apiblaze 0.21.52 → 0.21.54

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.52";
+    version = "0.21.54";
   }
 });
 
@@ -5310,6 +5310,7 @@ __export(directory_exports, {
   isApiError: () => isApiError,
   isReady: () => isReady,
   parsePlatforms: () => parsePlatforms,
+  parsePolicy: () => parsePolicy,
   printReport: () => printReport
 });
 function attestationId(flag) {
@@ -5330,6 +5331,7 @@ function directoryBodyFromFlags(f) {
   if (f.allowedOrigin?.length) m.allowed_origins = f.allowedOrigin.map((o) => o.trim()).filter(Boolean);
   const out = {};
   if (Object.keys(m).length) out.directory_metadata = m;
+  if (f.openaiChallenge?.trim()) out.openai_challenge_token = f.openaiChallenge.trim();
   if (f.attest?.length) {
     const a = {};
     for (const raw of f.attest) {
@@ -5341,6 +5343,22 @@ function directoryBodyFromFlags(f) {
   }
   return out;
 }
+function parsePolicy(policy, platform) {
+  if (platform && (policy === void 0 || policy === true)) return parsePlatforms(platform) ?? ["claude"];
+  if (policy === void 0 || policy === false || policy === true) return ["claude"];
+  const raw = (Array.isArray(policy) ? policy : [policy]).flatMap((s) => String(s).split(",")).map((s) => s.trim().toLowerCase()).filter(Boolean);
+  if (!raw.length) return ["claude"];
+  const out = /* @__PURE__ */ new Set();
+  for (const p of raw) {
+    if (p === "all" || p === "both") {
+      PLATFORMS.forEach((x) => out.add(x));
+      continue;
+    }
+    if (!PLATFORMS.includes(p)) throw new Error(`Unknown policy "${p}". Use claude, chatgpt or all.`);
+    out.add(p);
+  }
+  return PLATFORMS.filter((p) => out.has(p));
+}
 function parsePlatforms(raw) {
   if (!raw) return void 0;
   const out = raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
@@ -5401,11 +5419,18 @@ var init_directory = __esm({
     init_types();
     PLATFORMS = ["claude", "chatgpt"];
     ATTESTATIONS = [
-      { id: "own_backend", flags: ["own-backend", "own_backend"], label: "You own or control the backend this server calls" },
-      { id: "no_financial_transactions", flags: ["no-financial", "no-financial-transactions", "no_financial_transactions"], label: "No money, crypto or financial transactions through the tools" },
-      { id: "no_digital_goods_sales", flags: ["no-digital-goods", "no-digital-goods-sales", "no_digital_goods_sales"], label: "No sale of digital goods, subscriptions or credits; no upgrade/checkout flows (ChatGPT)" },
-      { id: "no_genai_media_primary", flags: ["no-genai-media", "no-genai-media-primary", "no_genai_media_primary"], label: "AI image/video/audio generation is not the primary function (Claude)" },
-      { id: "content_13_no_ads", flags: ["content-13-no-ads", "content-13", "content_13_no_ads"], label: "Content suitable for 13+ and no advertising (ChatGPT)" }
+      // Claude's Compliance step: seven acknowledgments (submission page, 2026-10-16).
+      { id: "directory_guidelines", flags: ["guidelines", "directory-guidelines", "directory_guidelines"], label: "You have read and will follow the directory guidelines and policies", platforms: PLATFORMS },
+      { id: "own_backend", flags: ["own-backend", "own_backend"], label: "You own or control the backend this server calls (first-party API)", platforms: PLATFORMS },
+      { id: "no_financial_transactions", flags: ["no-financial", "no-financial-transactions", "no_financial_transactions"], label: "No money, crypto or financial transactions through the tools", platforms: PLATFORMS },
+      { id: "no_genai_media_primary", flags: ["no-genai-media", "no-genai-media-primary", "no_genai_media_primary"], label: "AI image/video/audio generation is not the primary function (Claude)", platforms: ["claude"] },
+      { id: "no_prompt_injection", flags: ["no-prompt-injection", "no_prompt_injection"], label: "Tool descriptions describe the tools; nothing instructs the model, nothing is hidden or encoded", platforms: PLATFORMS },
+      { id: "no_conversation_data", flags: ["no-conversation-data", "no_conversation_data"], label: "The tools take only what they need; no conversation history, memory, chat summaries or user files", platforms: PLATFORMS },
+      { id: "public_documentation", flags: ["public-docs", "public-documentation", "public_documentation"], label: "Public documentation is live by the publish date (Claude)", platforms: ["claude"] },
+      // ChatGPT's guidelines add these three.
+      { id: "no_digital_goods_sales", flags: ["no-digital-goods", "no-digital-goods-sales", "no_digital_goods_sales"], label: "No sale of digital goods, subscriptions or credits; no upgrade/checkout flows (ChatGPT)", platforms: ["chatgpt"] },
+      { id: "content_13_no_ads", flags: ["content-13-no-ads", "content-13", "content_13_no_ads"], label: "Content suitable for 13+ and no advertising (ChatGPT)", platforms: ["chatgpt"] },
+      { id: "no_restricted_data", flags: ["no-restricted-data", "no_restricted_data"], label: "No card data, health records, government ids or credentials are collected (ChatGPT)", platforms: ["chatgpt"] }
     ];
     reportPath = (proj2) => `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/directory-report`;
   }
@@ -5602,6 +5627,26 @@ var init_iam = __esm({
 });
 
 // src/commands/create.ts
+var create_exports = {};
+__export(create_exports, {
+  PROVIDERS: () => PROVIDERS,
+  agentPrompts: () => agentPrompts,
+  buildTryItCurl: () => buildTryItCurl,
+  describeFamilies: () => describeFamilies,
+  directoryCreateFields: () => directoryCreateFields,
+  fail: () => fail4,
+  finishSetup: () => finishSetup,
+  firstPlainPath: () => firstPlainPath,
+  loadOpenapiSource: () => loadOpenapiSource,
+  normalizeName: () => normalizeName2,
+  parseOauthFlag: () => parseOauthFlag,
+  pickFamilies: () => pickFamilies,
+  planSetup: () => planSetup,
+  rememberForApichat: () => rememberForApichat,
+  resolveAuth: () => resolveAuth,
+  runCreate: () => runCreate,
+  tenantFromPortal: () => tenantFromPortal
+});
 function normalizeName2(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
@@ -6424,7 +6469,8 @@ Create an ${B.thing}
     ownerUserId: creds?.apiblazeUserId
   });
   await applyCreateToggles(name, opts);
-  const directory = await directoryAfterCreate(name, version2, opts);
+  opts.onCreated?.({ name, version: version2, tenant: tenant2, teamId });
+  const directory = opts.skipDirectoryReport ? null : await directoryAfterCreate(name, version2, opts);
   if (opts.json) {
     process.stdout.write(JSON.stringify({
       project_id: result.project_id,
@@ -7091,190 +7137,603 @@ var init_agent = __esm({
   }
 });
 
-// src/server/core.ts
-async function safeErr(res) {
-  try {
-    const b = await res.json();
-    if (typeof b.error === "string") return b.error;
-    if (b.error?.message) return b.error.message;
-    if (b.detail || b.title) return [b.title, b.detail].filter(Boolean).join(". ").replace(/\.\. /, ". ");
-    return `apiblaze ${res.status}`;
-  } catch {
-    return `apiblaze ${res.status}`;
-  }
-}
-function createPlaneCore(cfg) {
-  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
-  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
-  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
-  const tenantCache = /* @__PURE__ */ new Map();
-  const endUserCache = /* @__PURE__ */ new Map();
-  function planeFetch(base2, method, path17, user, opts = {}) {
-    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
-    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
-    let body;
-    if (opts.body !== void 0) {
-      headers["Content-Type"] = "application/json";
-      body = JSON.stringify(opts.body);
+// src/lib/agent-chat.ts
+async function runAgentChatRepl(opts) {
+  const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
+  console.log("\n" + import_chalk26.default.cyan.bold(title));
+  if (subtitle) console.log(import_chalk26.default.dim(subtitle));
+  const messages = [];
+  const ctx = { proposal: null, lastData: null, log: (s) => console.log(s) };
+  const cmdByName = new Map(commands.map((c) => [c.name, c]));
+  const footer = () => {
+    const parts = [
+      import_chalk26.default.dim("type to chat/refine"),
+      ...commands.map((c) => import_chalk26.default.dim(`/${c.name} ${c.describe}`)),
+      import_chalk26.default.dim("/show"),
+      import_chalk26.default.dim("/exit when done"),
+      import_chalk26.default.dim("/drop discard changes")
+    ];
+    return "  " + import_chalk26.default.dim("[ ") + parts.join(import_chalk26.default.dim(" \xB7 ")) + import_chalk26.default.dim(" ]");
+  };
+  async function turn(content) {
+    messages.push({ role: "user", content });
+    process.stdout.write(import_chalk26.default.dim("  \u2026thinking\n"));
+    const { status: status2, data } = await agentCall(endpoint, "POST", { messages, ...buildBody(messages) });
+    if (status2 === 402 || status2 === 503 || parseProblem(data)) {
+      await reportRefusal(status2, data, { cli: B.cli });
+      console.log("");
+      messages.pop();
+      return;
+    }
+    if (status2 >= 400 || !data) {
+      console.log(import_chalk26.default.red(`  Error (${status2}): ${(data && data.error) ?? "request failed"}
+`));
+      messages.pop();
+      return;
+    }
+    ctx.lastData = data;
+    const reply = data.reply ?? data.message ?? "(no reply)";
+    messages.push({ role: "assistant", content: reply });
+    console.log("\n" + import_chalk26.default.cyan("agent \u203A ") + reply + "\n");
+    if (data.proposal) {
+      ctx.proposal = data.proposal;
+      const summary = summarizeProposal?.(data);
+      if (summary) console.log(import_chalk26.default.yellow("  " + summary));
+      const applies = commands.filter((c) => c.needsProposal);
+      const primary = applies[applies.length - 1];
+      if (primary) {
+        console.log(import_chalk26.default.bold.green("  \u279C Next: type ") + import_chalk26.default.bold.cyan(`/${primary.name}`) + import_chalk26.default.bold.green(" to apply this, then ") + import_chalk26.default.bold.cyan("/exit") + import_chalk26.default.bold.green(" to leave."));
+        const rest = applies.slice(0, -1).map((c) => `/${c.name} = ${c.describe}`).join(" \xB7 ");
+        console.log(import_chalk26.default.dim(`    (or keep chatting to refine${rest ? ` \xB7 ${rest}` : ""} \xB7 /show = inspect)`));
+      }
+      console.log();
+    }
+    const line = formatBilling(data.billing);
+    if (line) {
+      const llm2 = data.llm;
+      console.log(import_chalk26.default.dim(`  ${line}${llm2?.model ? ` \xB7 ${llm2.model}` : ""}`));
     }
-    return fetch(`${base2}${path17}?${params.toString()}`, { method, headers, body, cache: "no-store" });
-  }
-  async function resolveTenant2(user) {
-    const cached = tenantCache.get(user.tenant);
-    if (cached) return cached;
-    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
-    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
-    const { tenant: tenant2 } = await res.json();
-    tenantCache.set(user.tenant, tenant2);
-    return tenant2;
   }
-  async function ensureEndUser(user, tenant2) {
-    const cacheKey = `${tenant2}:${user.userId}`;
-    const cached = endUserCache.get(cacheKey);
-    if (cached) return cached;
-    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
-      body: { tenant: tenant2, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
-    });
-    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
-    const { abz_sub } = await res.json();
-    endUserCache.set(cacheKey, abz_sub);
-    return abz_sub;
+  const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
+  const ask3 = (q) => new Promise((res) => rl.question(q, res));
+  await turn(seedPrompt);
+  for (; ; ) {
+    console.log(footer());
+    const line = (await ask3(import_chalk26.default.green("you \u203A "))).trim();
+    if (!line) continue;
+    const lower = line.toLowerCase();
+    if (line === "/exit" || line === "/quit" || lower === "exit" || lower === "quit" || lower === "q") {
+      console.log(import_chalk26.default.dim("  Bye \u2014 anything you enabled or published stays in place.\n"));
+      break;
+    }
+    if (line === "/drop") {
+      console.log(import_chalk26.default.dim("  Dropped the pending proposal \u2014 rules you already enabled/published are untouched.\n"));
+      break;
+    }
+    if (line === "/show") {
+      if (!ctx.proposal) console.log(import_chalk26.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
+      else console.log("\n" + JSON.stringify(ctx.proposal, null, 2) + "\n");
+      continue;
+    }
+    if (line.startsWith("/")) {
+      const cmd = cmdByName.get(line.slice(1));
+      if (!cmd) {
+        console.log(import_chalk26.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
+`));
+        continue;
+      }
+      if (cmd.needsProposal && !ctx.proposal) {
+        console.log(import_chalk26.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
+        continue;
+      }
+      await cmd.run(ctx);
+      continue;
+    }
+    await turn(line);
   }
-  return { planeFetch, resolveTenant: resolveTenant2, ensureEndUser, apikeysBase, iamBase };
+  rl.close();
 }
-var PlaneError;
-var init_core = __esm({
-  "src/server/core.ts"() {
+var import_readline, import_chalk26;
+var init_agent_chat = __esm({
+  "src/lib/agent-chat.ts"() {
     "use strict";
-    PlaneError = class extends Error {
-      constructor(status2, detail) {
-        super(detail);
-        this.status = status2;
-        this.detail = detail;
-      }
-    };
+    import_readline = __toESM(require("readline"));
+    import_chalk26 = __toESM(require("chalk"));
+    init_problem();
+    init_brand();
+    init_api();
+    init_admin();
   }
 });
 
-// src/demo-app/files.ts
-var DEMO_FILES;
-var init_files = __esm({
-  "src/demo-app/files.ts"() {
-    "use strict";
-    DEMO_FILES = {
-      "README.md": "# Nino's Pizza: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Your API is live on the internet.** The backend runs on your laptop; APIblaze gives it a public\n   URL and an MCP address for AI assistants. A live ticker shows each request reaching your laptop.\n2. **An AI assistant uses it.** Ask it to book a table and watch the request arrive.\n3. **Included, no code:** only the owner can change a booking, each customer (Nino Pizza,\n   Gino Pizza) is separate, rate limits, sign-in, and drop-in widgets for API keys and roles.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | Its endpoints. APIblaze builds the AI tools and the ownership rules from it. |\n| `app.js` | The website's server. Calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\n`npx apiblaze@latest demo` also adds `lib/apiblaze-server.js` and `public/apiblaze-widgets.js`, the same\nhelpers you get from `npm i apiblaze`. Stop the demo with `npx apiblaze@latest demo stop`.\n",
-      "openapi.yaml": `openapi: 3.0.3
-info:
-  title: ResiResi API
-  version: 1.0.0
-  description: Table bookings at restaurants (each restaurant is a tenant, like Nino Pizza and Gino Pizza). APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.
-paths:
-  /reservations:
-    get:
-      operationId: listReservations
-      summary: List my bookings
-      description: The signed-in person's own bookings at this restaurant, and nobody else's. Use it for "my bookings" or "the one I just made", and call it again whenever asked, since bookings change.
-      responses:
-        '200':
-          description: The caller's bookings
-          content:
-            application/json:
-              schema:
-                type: array
-                items: { $ref: '#/components/schemas/Reservation' }
-    post:
-      operationId: createReservation
-      summary: Book a table
-      description: Only the time is needed; the day is today unless a date is sent. For tomorrow or any other day, work out the date and send it. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: { $ref: '#/components/schemas/NewReservation' }
-      responses:
-        '201':
-          description: Booked
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/Reservation' }
-  /reservations/{id}:
-    parameters:
-      - { name: id, in: path, required: true, schema: { type: string } }
-    get:
-      operationId: getReservation
-      summary: Get one booking
-      description: Only the person who booked it (or the restaurant's admin) can see it. Anyone else is refused.
-      responses:
-        '200':
-          description: The booking
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/Reservation' }
-    patch:
-      operationId: updateReservation
-      summary: Change a booking
-      description: Move a booking to another day, table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema: { $ref: '#/components/schemas/ReservationChange' }
-      responses:
-        '200':
-          description: Changed
-          content:
-            application/json:
-              schema: { $ref: '#/components/schemas/Reservation' }
-        '409': { description: That table is already booked that day at that time }
-    delete:
-      operationId: cancelReservation
-      summary: Cancel a booking
-      description: Only the person who booked it (or the restaurant's admin) can cancel it.
-      responses:
-        '204': { description: Cancelled }
-components:
-  schemas:
-    NewReservation:
-      type: object
-      required: [time]
-      properties:
-        name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }
-        table: { type: integer, example: 4, description: 'Optional: the restaurant picks a free table. Do not ask for it.' }
-        date: { type: string, format: date, example: '2026-10-09', description: 'Day of the booking, YYYY-MM-DD. Optional: today if not given.' }
-        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }
-        guests: { type: integer, example: 2, description: 'How many people. Optional, 2 if not given.' }
-    ReservationChange:
-      type: object
-      properties:
-        table: { type: integer, example: 2, description: 'Move to this table.' }
-        date: { type: string, format: date, example: '2026-10-10', description: 'New day, YYYY-MM-DD' }
-        time: { type: string, example: '20:00', description: 'New time, 24h HH:MM' }
-        guests: { type: integer, example: 4, description: 'New number of people' }
-    Reservation:
-      allOf:
-        - $ref: '#/components/schemas/NewReservation'
-        - type: object
-          properties:
-            id: { type: string, example: r1 }
-`,
-      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The people the demo provisioned up front, per pizzeria: { tenant: { handle: stable id } }.\n// Through APIblaze every call already names the stable id (x-abz-user-id); a call straight\n// to this port still says \"ana\", and must mean the same person.\nconst USER_IDS = (() => { try { return JSON.parse(process.env.DEMO_USER_IDS || '{}'); } catch { return {}; } })();\nconst idOf = (tenant, handle) => (USER_IDS[tenant] || {})[handle] || handle;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const who = idOf(tenant, req.headers['x-abz-user-id'] || '');\n  // Shown in the ticker and the terminal: the name the caller gave (APIblaze forwards it as\n  // x-end-user-id next to the stable id), never the opaque id.\n  const shown = req.headers['x-end-user-id'] || req.headers['x-abz-user-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who: shown, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
-      "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
-      "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
-      "public/index.html": `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>ResiResi demo</title>
-<style>
-  :root {
-    --bg: #faf7f2; --card: #fff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9; --soft: #f3eee6;
-    --accent: #e4572e; --accent-ink: #fff; --good: #15803d; --good-bg: #ecfdf3; --bad: #c2410c; --bad-bg: #fff1e8;
-    --blaze: #4f46e5; --blaze-bg: #eef2ff; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
-  }
-  @media (prefers-color-scheme: dark) {
-    :root { --bg: #161412; --card: #1f1c1a; --ink: #f3efe9; --muted: #a39b92; --line: #34302c; --soft: #26221f;
-      --good: #4ade80; --good-bg: #10241a; --bad: #fb923c; --bad-bg: #2b1a10; --blaze: #a5b4fc; --blaze-bg: #1e1b4b; }
+// src/commands/mcp.ts
+var mcp_exports = {};
+__export(mcp_exports, {
+  PROMPT_NAME_RE: () => PROMPT_NAME_RE,
+  derivedBehavior: () => derivedBehavior,
+  effectiveBehavior: () => effectiveBehavior,
+  loadCatalogue: () => loadCatalogue,
+  normalizePrompt: () => normalizePrompt,
+  renderOps: () => renderOps,
+  runMcp: () => runMcp,
+  runMcpOps: () => runMcpOps,
+  runMcpPrompts: () => runMcpPrompts,
+  runMcpUi: () => runMcpUi,
+  saveCatalogue: () => saveCatalogue,
+  uiResourceUri: () => uiResourceUri,
+  withOverride: () => withOverride,
+  withPrompt: () => withPrompt,
+  withoutOverride: () => withoutOverride,
+  withoutPrompt: () => withoutPrompt
+});
+async function runMcp(projectArg, apiVersionArg, opts) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const projects = await getProjects(creds.teamId ?? "");
+  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
+  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
+  const projectId = match.projectId;
+  const apiVersion = apiVersionArg || match.apiVersion;
+  const environment = opts.environment || "prod";
+  const mcpHost2 = match.tenant ? `${projectId}-${match.tenant}` : projectId;
+  async function publish(ctx) {
+    const spec2 = ctx.proposal;
+    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec: spec2 });
+    if (pub.status >= 400) {
+      ctx.log(import_chalk27.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+`));
+      return;
+    }
+    ctx.log(import_chalk27.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost2}.mcp.apiblaze.com/${apiVersion}/${environment}.
+`));
+  }
+  await runAgentChatRepl({
+    title: `MCP builder \u2014 ${projectId} ${apiVersion} (${environment})`,
+    subtitle: "discuss which routes to expose as tools, then make the catalogue official.",
+    endpoint: `/projects/${projectId}/${apiVersion}/mcp/chat`,
+    buildBody: () => ({ environment, included_sample_ids: [] }),
+    seedPrompt: "Look at this API's routes and recommend which should become MCP tools, with good names and descriptions. Don't finalize yet \u2014 explain first.",
+    summarizeProposal: (data) => {
+      const spec2 = data.proposal;
+      const tools = Array.isArray(spec2.tools) ? spec2.tools : [];
+      const names = tools.slice(0, 12).map((t) => t.name ?? "(unnamed)").join(", ");
+      return `Catalogue ready: ${tools.length} tool(s)${names ? ` \u2014 ${names}${tools.length > 12 ? ", \u2026" : ""}` : ""}.`;
+    },
+    commands: [
+      { name: "publish", describe: `to ${mcpHost2}.mcp.apiblaze.com`, needsProposal: true, run: publish }
+    ]
+  });
+}
+function derivedBehavior(method) {
+  const m = (method ?? "").toUpperCase();
+  const destructive = m === "DELETE";
+  return {
+    readOnly: m === "GET" || m === "HEAD" || m === "OPTIONS",
+    destructive,
+    idempotent: m === "PUT" || m === "DELETE",
+    confirm: destructive,
+    alwaysAsync: false
+  };
+}
+function effectiveBehavior(method, o) {
+  const d = derivedBehavior(method);
+  const readOnly = o?.readOnly ?? d.readOnly;
+  const destructive = readOnly ? false : o?.destructive ?? d.destructive;
+  return {
+    readOnly,
+    destructive,
+    idempotent: o?.idempotent ?? d.idempotent,
+    confirm: o?.confirm ?? destructive,
+    alwaysAsync: o?.alwaysAsync ?? false
+  };
+}
+function uiResourceUri(projectId, toolName) {
+  return `ui://${projectId}/${toolName}`;
+}
+function normalizePrompt(name, raw) {
+  if (!PROMPT_NAME_RE.test(name)) throw new Error(`Prompt name "${name}" must match ${PROMPT_NAME_RE} (lowercase letters, digits, _ and -).`);
+  const p = raw ?? {};
+  if (typeof p !== "object" || Array.isArray(p)) throw new Error("The prompt file must hold one JSON object.");
+  let messages = p.messages;
+  if (!Array.isArray(messages) && typeof p.text === "string") messages = [{ role: "user", text: p.text }];
+  if (!Array.isArray(messages) || messages.length === 0) throw new Error('The prompt needs "messages": [{ "role": "user", "text": "\u2026" }] (or a "text" shorthand).');
+  for (const m of messages) {
+    if (!m || m.role !== "user" && m.role !== "assistant" || typeof m.text !== "string" || !m.text) {
+      throw new Error('Each message needs role "user" | "assistant" and a non-empty "text".');
+    }
+  }
+  if (p.arguments !== void 0 && (!Array.isArray(p.arguments) || p.arguments.some((a) => !a || typeof a.name !== "string"))) {
+    throw new Error('"arguments" must be [{ "name": "\u2026", "description"?: "\u2026", "required"?: true }].');
+  }
+  return {
+    name,
+    ...typeof p.title === "string" ? { title: p.title } : {},
+    ...typeof p.description === "string" ? { description: p.description } : {},
+    ...Array.isArray(p.arguments) ? { arguments: p.arguments } : {},
+    messages
+  };
+}
+function withPrompt(cat, prompt) {
+  const prompts = [...cat.prompts ?? []];
+  const i = prompts.findIndex((p) => p.name === prompt.name);
+  if (i >= 0) prompts[i] = prompt;
+  else prompts.push(prompt);
+  return { ...cat, prompts };
+}
+function withoutPrompt(cat, name) {
+  const prompts = cat.prompts ?? [];
+  if (!prompts.some((p) => p.name === name)) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list\`.`);
+  return { ...cat, prompts: prompts.filter((p) => p.name !== name) };
+}
+function requireTool(cat, tool) {
+  if (!cat.tools.some((t) => t.name === tool)) {
+    const names = cat.tools.slice(0, 10).map((t) => t.name).join(", ");
+    throw new Error(`No tool named "${tool}" in the published catalogue${names ? ` (tools: ${names}${cat.tools.length > 10 ? ", \u2026" : ""})` : ""}.`);
+  }
+}
+function withOverride(cat, tool, flags) {
+  requireTool(cat, tool);
+  const patch = {};
+  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
+    if (typeof flags[k] === "boolean") patch[k] = flags[k];
+  }
+  if (typeof flags.title === "string") {
+    const t = flags.title.trim().slice(0, 120);
+    if (!t) throw new Error('--title needs some text (a short human label, e.g. "List pets").');
+    patch.title = t;
+  }
+  if (Object.keys(patch).length === 0) {
+    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+  }
+  return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
+}
+function withoutOverride(cat, tool) {
+  requireTool(cat, tool);
+  const overrides = { ...cat.overrides ?? {} };
+  delete overrides[tool];
+  return { ...cat, overrides };
+}
+function flagsLine(b) {
+  const f = [];
+  if (b.readOnly) f.push("read-only");
+  if (b.idempotent) f.push("idempotent");
+  if (b.destructive) f.push("destructive");
+  if (b.confirm) f.push("asks to confirm");
+  if (b.alwaysAsync) f.push("always async");
+  return f.length ? f.join(", ") : "\u2014";
+}
+function renderOps(cat) {
+  const rows = cat.tools.map((t) => {
+    const method = t["x-route"]?.method?.toUpperCase() ?? "";
+    const o = cat.overrides?.[t.name];
+    return { name: t.name, route: `${method} ${t["x-route"]?.path ?? ""}`.trim(), eff: flagsLine(effectiveBehavior(method, o)), custom: !!o && Object.keys(o).length > 0 };
+  });
+  const w = Math.min(40, Math.max(4, ...rows.map((r) => r.name.length)));
+  const rw = Math.min(40, Math.max(5, ...rows.map((r) => r.route.length)));
+  return rows.map((r) => `  ${r.name.padEnd(w)}  ${r.route.padEnd(rw)}  ${r.eff}${r.custom ? import_chalk27.default.yellow("  (override)") : ""}`);
+}
+async function resolveMcpTarget(projectArg, opts) {
+  const creds = loadCredentials();
+  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
+  const projects = await getProjects(creds.teamId ?? "");
+  const matches2 = projects.filter((p) => p.projectId === projectArg || p.projectName === projectArg);
+  const wanted = opts.apiversion ?? opts.version;
+  const match = (wanted ? matches2.find((p) => p.apiVersion === wanted) : matches2[0]) ?? null;
+  if (!match) throw new Error(`Project "${projectArg}"${wanted ? ` version ${wanted}` : ""} not found in your active team. Run \`${B.cli} projects\`.`);
+  return { projectId: match.projectId, apiVersion: wanted || match.apiVersion, environment: opts.environment || "prod" };
+}
+async function loadCatalogue(t) {
+  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec?environment=${encodeURIComponent(t.environment)}`, "GET");
+  if (r.status >= 400) throw new Error(`Could not read the MCP catalogue (${r.status}): ${r.data?.error ?? ""}`);
+  const spec2 = r.data?.spec;
+  if (!spec2 || !Array.isArray(spec2.tools)) {
+    throw new Error(`No MCP catalogue published for ${t.projectId} ${t.apiVersion} (${t.environment}). Try --environment, or build one with \`${B.cli} agent mcp ${t.projectId}\`.`);
+  }
+  return spec2;
+}
+async function saveCatalogue(t, spec2) {
+  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec`, "PUT", { environment: t.environment, spec: spec2 });
+  if (r.status >= 400) {
+    const d = r.data;
+    throw new Error(`Save failed (${r.status}): ${d?.error ?? ""}${d?.details ? ` \u2014 ${typeof d.details === "string" ? d.details : JSON.stringify(d.details)}` : ""}`);
+  }
+}
+async function runMcpPrompts(action2, project, name, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  const prompts = cat.prompts ?? [];
+  if (action2 === "list") {
+    if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, prompts }, null, 2));
+    if (!prompts.length) {
+      console.log(import_chalk27.default.dim(`
+  No prompts on ${t.projectId} (${t.environment}). Prompts are drafted by the MCP agent (\`${B.cli} agent mcp ${t.projectId}\`) or added with \`${B.cli} mcp prompts set\`.
+`));
+      return;
+    }
+    console.log("");
+    for (const p of prompts) {
+      const args = (p.arguments ?? []).map((a) => a.required ? a.name : `${a.name}?`).join(", ");
+      console.log(`  ${import_chalk27.default.bold(p.name)}${args ? import_chalk27.default.dim(`(${args})`) : ""}${p.title || p.description ? `  ${p.title ?? p.description}` : ""}`);
+    }
+    console.log("");
+    return;
+  }
+  if (!name) throw new Error(`Usage: ${B.cli} mcp prompts ${action2} <project> <name>`);
+  if (action2 === "show") {
+    const p = prompts.find((x) => x.name === name);
+    if (!p) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list ${project}\`.`);
+    if (opts.json) return void console.log(JSON.stringify(p, null, 2));
+    console.log(`
+  ${import_chalk27.default.bold(p.name)}${p.title ? ` \u2014 ${p.title}` : ""}`);
+    if (p.description) console.log(`  ${p.description}`);
+    for (const a of p.arguments ?? []) console.log(import_chalk27.default.dim(`    ${a.name}${a.required ? " (required)" : ""}${a.description ? `: ${a.description}` : ""}`));
+    for (const m of p.messages) console.log(`
+  [${m.role}] ${m.text}`);
+    console.log("");
+    return;
+  }
+  let next;
+  if (action2 === "set") {
+    if (!opts.file) throw new Error(`Usage: ${B.cli} mcp prompts set <project> <name> --file prompt.json`);
+    let raw;
+    try {
+      raw = JSON.parse(import_fs5.default.readFileSync(opts.file, "utf8"));
+    } catch (e) {
+      throw new Error(`Could not read ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    next = withPrompt(cat, normalizePrompt(name, raw));
+  } else {
+    next = withoutPrompt(cat, name);
+  }
+  await saveCatalogue(t, next);
+  if (opts.json) return void console.log(JSON.stringify({ saved: true, environment: t.environment, prompts: next.prompts }, null, 2));
+  console.log(import_chalk27.default.green(`  \u2713 ${action2 === "set" ? "Saved" : "Removed"} prompt "${name}" on ${t.projectId} (${t.environment}).`));
+}
+async function runMcpOps(action2, project, tool, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  if (action2 === "list") {
+    if (opts.json) {
+      const tools = cat.tools.map((x) => {
+        const method2 = x["x-route"]?.method?.toUpperCase();
+        return {
+          name: x.name,
+          method: method2,
+          path: x["x-route"]?.path,
+          default: derivedBehavior(method2),
+          override: cat.overrides?.[x.name] ?? null,
+          effective: effectiveBehavior(method2, cat.overrides?.[x.name])
+        };
+      });
+      return void console.log(JSON.stringify({ environment: t.environment, tools }, null, 2));
+    }
+    console.log(import_chalk27.default.dim(`
+  ${cat.tools.length} tool(s) on ${t.projectId} (${t.environment}). Defaults come from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm.
+`));
+    for (const l of renderOps(cat)) console.log(l);
+    console.log(import_chalk27.default.dim(`
+  Override: ${B.cli} mcp ops set ${project} <tool> --read-only | --destructive | --confirm | --no-confirm | --always-async   \xB7   Reset: ${B.cli} mcp ops reset ${project} <tool>
+`));
+    return;
+  }
+  if (!tool) throw new Error(`Usage: ${B.cli} mcp ops ${action2} <project> <tool>`);
+  const next = action2 === "set" ? withOverride(cat, tool, opts) : withoutOverride(cat, tool);
+  await saveCatalogue(t, next);
+  const method = cat.tools.find((x) => x.name === tool)?.["x-route"]?.method;
+  const eff = effectiveBehavior(method, next.overrides?.[tool]);
+  if (opts.json) return void console.log(JSON.stringify({ saved: true, tool, override: next.overrides?.[tool] ?? null, effective: eff }, null, 2));
+  console.log(import_chalk27.default.green(`  \u2713 ${tool}: ${flagsLine(eff)}${action2 === "reset" ? " (automatic default)" : ""}`));
+}
+async function runMcpUi(project, tool, opts) {
+  const t = await resolveMcpTarget(project, opts);
+  const cat = await loadCatalogue(t);
+  requireTool(cat, tool);
+  const uri = uiResourceUri(t.projectId, tool);
+  if (opts.json) return void console.log(JSON.stringify({ tool, uri, kind: "automatic" }, null, 2));
+  console.log(`
+  ${import_chalk27.default.bold(uri)}
+`);
+  console.log(import_chalk27.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
+  console.log(import_chalk27.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
+}
+var import_fs5, import_chalk27, PROMPT_NAME_RE;
+var init_mcp = __esm({
+  "src/commands/mcp.ts"() {
+    "use strict";
+    import_fs5 = __toESM(require("fs"));
+    import_chalk27 = __toESM(require("chalk"));
+    init_brand();
+    init_auth();
+    init_api();
+    init_agent_chat();
+    PROMPT_NAME_RE = /^[a-z0-9_-]{1,64}$/;
+  }
+});
+
+// src/server/core.ts
+async function safeErr(res) {
+  try {
+    const b = await res.json();
+    if (typeof b.error === "string") return b.error;
+    if (b.error?.message) return b.error.message;
+    if (b.detail || b.title) return [b.title, b.detail].filter(Boolean).join(". ").replace(/\.\. /, ". ");
+    return `apiblaze ${res.status}`;
+  } catch {
+    return `apiblaze ${res.status}`;
+  }
+}
+function createPlaneCore(cfg) {
+  if (!cfg.cpKey) throw new Error("apiblaze: cpKey is required (set APIBLAZE_CP_KEY). It is server-only \u2014 never expose it to the browser.");
+  const apikeysBase = (cfg.apikeysBase ?? "https://apikeys.apiblaze.com").replace(/\/$/, "");
+  const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
+  const tenantCache = /* @__PURE__ */ new Map();
+  const endUserCache = /* @__PURE__ */ new Map();
+  function planeFetch(base2, method, path17, user, opts = {}) {
+    const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
+    const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
+    let body;
+    if (opts.body !== void 0) {
+      headers["Content-Type"] = "application/json";
+      body = JSON.stringify(opts.body);
+    }
+    return fetch(`${base2}${path17}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+  }
+  async function resolveTenant2(user) {
+    const cached = tenantCache.get(user.tenant);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/tenants", user, { body: { ref: user.tenant } });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { tenant: tenant2 } = await res.json();
+    tenantCache.set(user.tenant, tenant2);
+    return tenant2;
+  }
+  async function ensureEndUser(user, tenant2) {
+    const cacheKey = `${tenant2}:${user.userId}`;
+    const cached = endUserCache.get(cacheKey);
+    if (cached) return cached;
+    const res = await planeFetch(apikeysBase, "POST", "/users", user, {
+      body: { tenant: tenant2, ref: user.userId, email: user.email ?? null, display_name: user.label ?? null }
+    });
+    if (!res.ok) throw new PlaneError(res.status, await safeErr(res));
+    const { abz_sub } = await res.json();
+    endUserCache.set(cacheKey, abz_sub);
+    return abz_sub;
+  }
+  return { planeFetch, resolveTenant: resolveTenant2, ensureEndUser, apikeysBase, iamBase };
+}
+var PlaneError;
+var init_core = __esm({
+  "src/server/core.ts"() {
+    "use strict";
+    PlaneError = class extends Error {
+      constructor(status2, detail) {
+        super(detail);
+        this.status = status2;
+        this.detail = detail;
+      }
+    };
+  }
+});
+
+// src/demo-app/files.ts
+var DEMO_FILES;
+var init_files = __esm({
+  "src/demo-app/files.ts"() {
+    "use strict";
+    DEMO_FILES = {
+      "README.md": "# Nino's Pizza: the APIblaze demo\n\nA tiny table-booking app for pizzerias, used by `npx apiblaze@latest demo` to show what APIblaze does.\n\n```\nnpx apiblaze@latest demo\n```\n\nThat one command writes this folder to `./apiblaze-demo`, puts APIblaze in front of the backend,\nstarts everything and opens the page. No login, no prompts, no dependencies.\n\n## What the page shows\n\n1. **Your API is live on the internet.** The backend runs on your laptop; APIblaze gives it a public\n   URL and an MCP address for AI assistants. A live ticker shows each request reaching your laptop.\n2. **An AI assistant uses it.** Ask it to book a table and watch the request arrive.\n3. **Included, no code:** only the owner can change a booking, each customer (Nino Pizza,\n   Gino Pizza) is separate, rate limits, sign-in, and drop-in widgets for API keys and roles.\n\n## The files\n\n| File | What it is |\n| --- | --- |\n| `backend.js` | The pizzeria's API. No login, no keys, no permission checks. |\n| `openapi.yaml` | Its endpoints. APIblaze builds the AI tools and the ownership rules from it. |\n| `app.js` | The website's server. Calls the API with one key and says who is acting. |\n| `public/index.html` | The page. |\n| `start.js` | Starts the backend (port 3001) and the website (port 3000). |\n\n`npx apiblaze@latest demo` also adds `lib/apiblaze-server.js` and `public/apiblaze-widgets.js`, the same\nhelpers you get from `npm i apiblaze`. Stop the demo with `npx apiblaze@latest demo stop`.\n",
+      "openapi.yaml": `openapi: 3.0.3
+info:
+  title: ResiResi API
+  version: 1.0.0
+  description: Table bookings at restaurants (each restaurant is a tenant, like Nino Pizza and Gino Pizza). APIblaze reads this file to build the MCP tools for AI assistants and to work out who may change what.
+paths:
+  /reservations:
+    get:
+      operationId: listReservations
+      summary: List my bookings
+      description: The signed-in person's own bookings at this restaurant, and nobody else's. Use it for "my bookings" or "the one I just made", and call it again whenever asked, since bookings change.
+      responses:
+        '200':
+          description: The caller's bookings
+          content:
+            application/json:
+              schema:
+                type: array
+                items: { $ref: '#/components/schemas/Reservation' }
+    post:
+      operationId: createReservation
+      summary: Book a table
+      description: Only the time is needed; the day is today unless a date is sent. For tomorrow or any other day, work out the date and send it. The restaurant picks a free table and books it in the signed-in person's name, so never ask for a table number or a name.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/NewReservation' }
+      responses:
+        '201':
+          description: Booked
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Reservation' }
+  /reservations/{id}:
+    parameters:
+      - { name: id, in: path, required: true, schema: { type: string } }
+    get:
+      operationId: getReservation
+      summary: Get one booking
+      description: Only the person who booked it (or the restaurant's admin) can see it. Anyone else is refused.
+      responses:
+        '200':
+          description: The booking
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Reservation' }
+    patch:
+      operationId: updateReservation
+      summary: Change a booking
+      description: Move a booking to another day, table or time, or change the number of guests. Only the person who booked it (or the restaurant's admin) can change it. Get the id from listReservations; never ask for it.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema: { $ref: '#/components/schemas/ReservationChange' }
+      responses:
+        '200':
+          description: Changed
+          content:
+            application/json:
+              schema: { $ref: '#/components/schemas/Reservation' }
+        '409': { description: That table is already booked that day at that time }
+    delete:
+      operationId: cancelReservation
+      summary: Cancel a booking
+      description: Only the person who booked it (or the restaurant's admin) can cancel it.
+      responses:
+        '204': { description: Cancelled }
+components:
+  schemas:
+    NewReservation:
+      type: object
+      required: [time]
+      properties:
+        name: { type: string, example: Ana, description: 'Optional: defaults to the signed-in person. Do not ask for it.' }
+        table: { type: integer, example: 4, description: 'Optional: the restaurant picks a free table. Do not ask for it.' }
+        date: { type: string, format: date, example: '2026-10-09', description: 'Day of the booking, YYYY-MM-DD. Optional: today if not given.' }
+        time: { type: string, example: '19:30', description: 'Time of the booking, 24h HH:MM' }
+        guests: { type: integer, example: 2, description: 'How many people. Optional, 2 if not given.' }
+    ReservationChange:
+      type: object
+      properties:
+        table: { type: integer, example: 2, description: 'Move to this table.' }
+        date: { type: string, format: date, example: '2026-10-10', description: 'New day, YYYY-MM-DD' }
+        time: { type: string, example: '20:00', description: 'New time, 24h HH:MM' }
+        guests: { type: integer, example: 4, description: 'New number of people' }
+    Reservation:
+      allOf:
+        - $ref: '#/components/schemas/NewReservation'
+        - type: object
+          properties:
+            id: { type: string, example: r1 }
+`,
+      "backend.js": "// ResiResi backend: restaurants (tenants, like Nino Pizza and Gino Pizza) let their customers\n// book, list and cancel tables. It runs on YOUR laptop.\n//\n// `npx apiblaze@latest dev` (which the demo runs for you) puts it on the internet\n// at a public URL and gives AI assistants an MCP address for it. Everything else\n// (API keys, sign-in, who may change what, rate limits) happens in APIblaze, in\n// front of this file. Look at what is NOT here: no login, no keys, no permission\n// checks, no AI code.\n//\n// What APIblaze tells this backend about each call, in two headers:\n//   x-abz-tenant-id  which customer (pizzeria) is calling\n//   x-abz-user-id    which person\n// and one shared secret it adds to every call it forwards (x-target-api-key), so a\n// caller who skips APIblaze and hits localhost:3001 directly is refused.\n//\n// Zero dependencies. Run it alone with `node backend.js` (port 3001).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst bookings = new Map();\nlet next = 1;\n// The people the demo provisioned up front, per pizzeria: { tenant: { handle: stable id } }.\n// Through APIblaze every call already names the stable id (x-abz-user-id); a call straight\n// to this port still says \"ana\", and must mean the same person.\nconst USER_IDS = (() => { try { return JSON.parse(process.env.DEMO_USER_IDS || '{}'); } catch { return {}; } })();\nconst idOf = (tenant, handle) => (USER_IDS[tenant] || {})[handle] || handle;\n// Bumps on every booking made or cancelled. The page asks the app (on this laptop, free)\n// whether it moved before re-listing through APIblaze, so an open, idle page spends nothing.\nlet changes = 0;\n// The last requests this laptop answered \u2014 the demo page shows them live.\nconst recent = [];\nfunction remember(entry) {\n  recent.unshift({ at: Date.now(), ...entry });\n  recent.length = Math.min(recent.length, 50);\n  // One line per request in the terminal (`npx apiblaze@latest demo logs` follows it).\n  const who = entry.who ? `${entry.who}${entry.tenant ? ` @ ${entry.tenant}` : ''}` : '-';\n  console.log(`${new Date().toISOString().slice(11, 19)}  ${entry.status}  ${entry.method.padEnd(6)} ${entry.path.padEnd(22)} ${who}`);\n}\n\n// The restaurant's day, YYYY-MM-DD, on this laptop's clock: a booking without a date is for today.\nfunction today() {\n  const d = new Date();\n  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;\n}\n// A real calendar day written YYYY-MM-DD (2026-02-30 is not one).\nfunction isDay(s) {\n  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(s)) return false;\n  const [y, m, d] = s.split('-').map(Number);\n  const t = new Date(Date.UTC(y, m - 1, d));\n  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;\n}\n\n// The restaurant picks the table: the lowest one still free that day at that time, at that restaurant.\nfunction freeTable(tenant, date, time) {\n  const taken = new Set([...bookings.values()].filter((r) => r.tenant === tenant && r.date === date && r.time === time).map((r) => r.table));\n  let t = 1;\n  while (taken.has(t)) t++;\n  return t;\n}\n\nfunction send(res, status, body) {\n  res.writeHead(status, { 'content-type': 'application/json' });\n  res.end(body === undefined ? '' : JSON.stringify(body));\n}\n\nfunction handle(req, res, body) {\n  const url = new URL(req.url, 'http://x');\n  if (url.pathname === '/openapi.yaml') {\n    res.writeHead(200, { 'content-type': 'text/yaml' });\n    return res.end(fs.readFileSync(path.join(__dirname, 'openapi.yaml')));\n  }\n  const tenant = req.headers['x-abz-tenant-id'] || '';\n  const who = idOf(tenant, req.headers['x-abz-user-id'] || '');\n  // Shown in the ticker and the terminal: the name the caller gave (APIblaze forwards it as\n  // x-end-user-id next to the stable id), never the opaque id.\n  const shown = req.headers['x-end-user-id'] || req.headers['x-abz-user-id'] || '';\n  const reply = (status, data) => { remember({ method: req.method, path: url.pathname, who: shown, tenant, status }); send(res, status, data); };\n  const secret = process.env.BACKEND_SECRET || '';\n  if (secret && req.headers['x-target-api-key'] !== secret) return reply(401, { error: 'missing or wrong backend secret (APIblaze adds it to every call it forwards)' });\n  if (!who) return reply(401, { error: 'say who is calling (x-abz-user-id)' });\n\n  const m = /^\\/reservations(?:\\/([^/]+))?$/.exec(url.pathname);\n  if (!m) return reply(404, { error: 'not found' });\n  const id = m[1];\n\n  if (!id && req.method === 'POST') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : today();\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = String(input.time || '19:30');\n    const row = {\n      id: `r${next++}`, name: String(input.name || who), table: Number(input.table) || freeTable(tenant, date, time),\n      date, time, guests: Number(input.guests) || 2, owner: who, tenant,\n    };\n    bookings.set(row.id, row); changes++;\n    return reply(201, row);\n  }\n  if (!id && req.method === 'GET') {\n    // Lists are the backend's job: each person sees their own bookings, at their own pizzeria.\n    return reply(200, [...bookings.values()].filter((r) => r.owner === who && r.tenant === tenant)\n      .sort((a, b) => `${a.date} ${a.time}`.localeCompare(`${b.date} ${b.time}`)));\n  }\n  const row = bookings.get(id);\n  if (!row) return reply(404, { error: 'no such booking' });\n  if (req.method === 'GET') return reply(200, row);\n  if (req.method === 'PATCH') {\n    let input = {};\n    try { input = JSON.parse(body || '{}'); } catch { return reply(400, { error: 'body must be JSON' }); }\n    const date = input.date ? String(input.date) : row.date;\n    if (!isDay(date)) return reply(400, { error: 'date must be a day, YYYY-MM-DD' });\n    const time = input.time ? String(input.time) : row.time;\n    const moved = date !== row.date || time !== row.time;\n    const table = input.table ? Number(input.table) : (moved ? freeTable(row.tenant, date, time) : row.table);\n    const clash = [...bookings.values()].find((r) => r.id !== row.id && r.tenant === row.tenant && r.date === date && r.time === time && r.table === table);\n    if (clash) return reply(409, { error: `table ${table} is already booked on ${date} at ${time}` });\n    Object.assign(row, { date, time, table, ...(input.guests ? { guests: Number(input.guests) } : {}) }); changes++;\n    return reply(200, row);\n  }\n  if (req.method === 'DELETE') { bookings.delete(id); changes++; return reply(204); }\n  return reply(405, { error: 'method not allowed' });\n}\n\nfunction startBackend(port = Number(process.env.BACKEND_PORT) || 3001) {\n  const server = http.createServer((req, res) => {\n    let body = '';\n    req.on('data', (c) => { body += c; });\n    req.on('end', () => {\n      try { handle(req, res, body); } catch (e) { send(res, 500, { error: String((e && e.message) || e) }); }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startBackend, recent, changeCount: () => changes };\nif (require.main === module) startBackend().then(() => console.log('backend on http://localhost:3001'));\n",
+      "app.js": "// ResiResi website server: serves the page and makes its calls.\n//\n// PROTECTED (the default): every call goes to the PUBLIC API \u2014 through APIblaze \u2014 with the\n// pizzeria's server key (kept here, never in the browser) and X-End-User-Id naming the\n// person. APIblaze checks the key, applies the rules and forwards to the backend.\n//\n// DIRECT (the page's \"unprotected\" switch): the same calls go straight to the backend on\n// localhost, with the shared backend secret and whatever user the page claims. No APIblaze:\n// nobody checks who may do what. That is how most apps ship.\n//\n// The chat and the two admin widgets use apiblaze's own server helpers\n// (lib/apiblaze-server.js, copied in by `npx apiblaze@latest demo` \u2014 the same code as\n// `import \u2026 from 'apiblaze/server'`).\n\nconst http = require('http');\nconst fs = require('fs');\nconst path = require('path');\n\nconst env = (name, fallback = '') => process.env[name] || fallback;\nconst json = (res, status, body) => { res.writeHead(status, { 'content-type': 'application/json' }); res.end(JSON.stringify(body)); };\n\nlet lib = null;\ntry { lib = require('./lib/apiblaze-server.js'); } catch { /* run without the widgets */ }\n\n// The two pizzerias (tenants) and the people the demo lets you be. A real app takes\n// \"who is this\" from its own login.\nconst PIZZERIAS = {\n  nino: { label: 'Nino Pizza', tenant: () => env('APIBLAZE_TENANT', env('DEMO_NINO_TENANT')), key: () => env('APIBLAZE_SERVER_KEY'), admin: { userId: 'ana', label: 'Ana', email: 'ana@ninopizza.example' } },\n  gino: { label: 'Gino Pizza', tenant: () => env('APIBLAZE_GINO_TENANT', env('DEMO_GINO_TENANT')), key: () => env('APIBLAZE_GINO_KEY'), admin: { userId: 'gina', label: 'Gina', email: 'gina@ginopizza.example' } },\n};\n// Each pizzeria (tenant) has its own MCP address: https://{proxy}-{tenant}.mcp.\u2026\nconst portalFor = (tenant) => (env('APIBLAZE_PORTAL_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_PORTAL_URL').replace(`${env('APIBLAZE_TENANT')}.portal`, `${tenant}.portal`) : '');\nconst mcpFor = (tenant) => (env('APIBLAZE_MCP_URL') && env('APIBLAZE_TENANT') && tenant ? env('APIBLAZE_MCP_URL').replace(`-${env('APIBLAZE_TENANT')}.`, `-${tenant}.`) : '');\nconst CUSTOMERS = { ana: 'Ana', ben: 'Ben' };\nconst pizzeriaOf = (id) => PIZZERIAS[id] || PIZZERIAS.nino;\nfunction queryOf(req) { return new URL(req.url, 'http://x').searchParams; }\n\nasync function call(op, { pizzeria = 'nino', as = 'ana', id, body, direct = false } = {}) {\n  const pz = pizzeriaOf(pizzeria);\n  const base = direct ? `http://127.0.0.1:${env('BACKEND_PORT', '3001')}` : env('APIBLAZE_URL').replace(/\\/$/, '');\n  const headers = { 'content-type': 'application/json' };\n  if (direct) {\n    // Straight to localhost: the backend trusts whatever these headers say.\n    headers['x-target-api-key'] = env('BACKEND_SECRET');\n    headers['x-abz-user-id'] = as;\n    headers['x-abz-tenant-id'] = pz.tenant();\n  } else {\n    headers['x-api-key'] = pz.key();\n    headers['x-end-user-id'] = as;\n  }\n  const req = op === 'book' ? { method: 'POST', url: `${base}/reservations`, body: JSON.stringify({ name: CUSTOMERS[as] || as, ...(body || {}) }) }\n    : op === 'cancel' ? { method: 'DELETE', url: `${base}/reservations/${encodeURIComponent(id || '')}` }\n      : { method: 'GET', url: `${base}/reservations` };\n  const r = await fetch(req.url, { method: req.method, headers, body: req.body });\n  const text = await r.text();\n  let data = null;\n  try { data = text ? JSON.parse(text) : null; } catch { data = text; }\n  return { status: r.status, body: data };\n}\n\n// Node http  <->  the web-standard handlers apiblaze/server exports.\nasync function viaHandler(handler, req, res, raw) {\n  const request = new Request(`http://localhost${req.url}`, {\n    method: req.method,\n    headers: { 'content-type': req.headers['content-type'] || 'application/json' },\n    body: ['GET', 'HEAD'].includes(req.method) ? undefined : raw,\n  });\n  const out = await handler(request);\n  const headers = {};\n  out.headers.forEach((v, k) => { headers[k] = v; });\n  res.writeHead(out.status, headers);\n  if (!out.body) return res.end();\n  const reader = out.body.getReader();\n  for (;;) { const { done, value } = await reader.read(); if (done) break; res.write(Buffer.from(value)); }\n  res.end();\n}\n\nfunction widgets() {\n  if (!lib) return {};\n  const out = { chat: {} };\n  for (const [id, pz] of Object.entries(PIZZERIAS)) {\n    if (!pz.tenant() || !pz.key()) continue;\n    // The assistant acts as the signed-in customer, at that customer's pizzeria.\n    out.chat[id] = lib.createApiblazeChat({\n      project: `${env('APIBLAZE_NAME')}-${pz.tenant()}`, apiKey: pz.key(),\n      host: 'tryabz.run', environment: 'dev', getUser: (req) => ({ userId: queryOf(req).get('as') || 'ana' }),\n    });\n  }\n  if (env('APIBLAZE_CP_KEY') && env('APIBLAZE_WIDGETS') === '1') {\n    // Admin widgets: the admin of the chosen pizzeria.\n    const admin = (req) => { const pz = pizzeriaOf(queryOf(req).get('pizzeria')); return { tenant: pz.tenant(), ...pz.admin }; };\n    out.keys = lib.createApiblazeKeys({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin, environment: 'dev' });\n    out.groups = lib.createApiblazeGroups({ cpKey: env('APIBLAZE_CP_KEY'), getUser: admin });\n  }\n  return out;\n}\n\n/** One of the two websites: `direct` = straight to the backend (unprotected), else through APIblaze. */\nfunction startApp(port = Number(env('APP_PORT', '3000')), { direct = false } = {}) {\n  const w = direct ? {} : widgets();\n  const pub = path.join(__dirname, 'public');\n  const server = http.createServer((req, res) => {\n    let raw = '';\n    req.on('data', (c) => { raw += c; });\n    req.on('end', async () => {\n      try {\n        const url = new URL(req.url, 'http://x');\n        const p = url.pathname;\n        if (req.method === 'GET' && (p === '/' || p === '/index.html')) {\n          res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });\n          return res.end(fs.readFileSync(path.join(pub, 'index.html')));\n        }\n        for (const asset of ['apiblaze-widgets.js', 'apiblaze-logo.svg']) {\n          if (req.method === 'GET' && p === `/${asset}` && fs.existsSync(path.join(pub, asset))) {\n            res.writeHead(200, { 'content-type': asset.endsWith('.svg') ? 'image/svg+xml' : 'text/javascript; charset=utf-8' });\n            return res.end(fs.readFileSync(path.join(pub, asset)));\n          }\n        }\n        if (p === '/api/config') {\n          return json(res, 200, {\n            direct, apiUrl: env('APIBLAZE_URL'), portalUrl: env('APIBLAZE_PORTAL_URL'),\n            backendPort: env('BACKEND_PORT', '3001'),\n            protectedUrl: env('APIBLAZE_URL') ? `http://localhost:${env('APP_PORT', '3000')}` : '',\n            directUrl: `http://localhost:${env('DIRECT_PORT', '3002')}`,\n            logsCommand: `npx apiblaze@latest logs ${env('APIBLAZE_NAME')} --tenant ${env('APIBLAZE_TENANT')}`,\n            pizzerias: Object.entries(PIZZERIAS).filter(([, pz]) => pz.tenant()).map(([id, pz]) => ({ id, label: pz.label, admin: pz.admin.label, mcpUrl: mcpFor(pz.tenant()), portalUrl: portalFor(pz.tenant()) })),\n            widgets: { chat: Object.keys(w.chat || {}), keys: !!w.keys, groups: !!w.groups },\n          });\n        }\n        if (p === '/api/changes') {\n          // Local and free: has any booking changed since the page last listed? The page\n          // re-lists through APIblaze only when it has (the backend runs in this process).\n          let n = 0;\n          try { n = require('./backend').changeCount(); } catch { /* backend runs elsewhere */ }\n          return json(res, 200, { n });\n        }\n        if (p === '/api/apiblaze/chat') {\n          const h = (w.chat || {})[url.searchParams.get('pizzeria') || 'nino'];\n          if (h) return viaHandler(h.handler, req, res, raw);\n        }\n        if (p === '/api/apiblaze/keys' && w.keys) return viaHandler(w.keys.handler, req, res, raw);\n        if (p === '/api/apiblaze/groups' && w.groups) return viaHandler(w.groups.handler, req, res, raw);\n        if (req.method === 'POST' && p === '/api/act') {\n          const b = JSON.parse(raw || '{}');\n          return json(res, 200, await call(String(b.op || 'list'), { pizzeria: b.pizzeria, as: String(b.as || 'ana'), id: b.id, body: b.body, direct }));\n        }\n        json(res, 404, { error: 'not found' });\n      } catch (e) {\n        json(res, 502, { error: `Could not reach the API: ${String((e && e.message) || e)}` });\n      }\n    });\n  });\n  return new Promise((resolve, reject) => {\n    server.once('error', reject);\n    server.listen(port, '127.0.0.1', () => resolve(server));\n  });\n}\n\nmodule.exports = { startApp };\n",
+      "start.js": "// Starts ResiResi on this laptop: the backend (3001), the unprotected front-end straight to it\n// (3002) and, once APIblaze is set up, the protected website through APIblaze (3000).\n// No APIblaze involved here \u2014 the tunnel is `npx apiblaze@latest demo start|stop|restart`.\n//\n//   node start.js        run in the foreground (Ctrl-C stops)\n//   npm run start        run in the background\n//   npm run stop         stop the background one\n//   npm run restart      stop, then start again\n\nconst fs = require('fs');\nconst path = require('path');\nconst { spawn } = require('child_process');\n\nconst PID = path.join(__dirname, '.demo', 'app.pid');\n\nfunction loadEnv(file = path.join(__dirname, '.env.local')) {\n  if (!fs.existsSync(file)) return;\n  for (const line of fs.readFileSync(file, 'utf8').split('\\n')) {\n    const m = /^\\s*([A-Z0-9_]+)\\s*=\\s*(.*)\\s*$/.exec(line);\n    if (m && !process.env[m[1]]) process.env[m[1]] = m[2].replace(/^\"(.*)\"$/, '$1');\n  }\n}\n\nasync function start() {\n  loadEnv();\n  const { startBackend } = require('./backend');\n  const { startApp } = require('./app');\n  const backendPort = Number(process.env.BACKEND_PORT) || 3001;\n  const appPort = Number(process.env.APP_PORT) || 3000;\n  const directPort = Number(process.env.DIRECT_PORT) || 3002;\n  await startBackend(backendPort);\n  // The unprotected front-end: straight to the backend, no APIblaze.\n  await startApp(directPort, { direct: true });\n  // The protected website: through APIblaze (once the demo has written its keys).\n  if (process.env.APIBLAZE_URL) await startApp(appPort);\n  return { backendPort, appPort, directPort };\n}\n\nconst alive = (pid) => { try { process.kill(pid, 0); return true; } catch { return false; } };\nfunction runningPid() {\n  try { const pid = Number(fs.readFileSync(PID, 'utf8')); return pid && alive(pid) ? pid : null; } catch { return null; }\n}\nasync function stop() {\n  const pid = runningPid();\n  if (!pid) { console.log('ResiResi is not running.'); return; }\n  process.kill(pid, 'SIGTERM');\n  for (let i = 0; i < 30 && alive(pid); i++) await new Promise((r) => setTimeout(r, 100));\n  try { fs.unlinkSync(PID); } catch { /* gone */ }\n  console.log('Stopped ResiResi (backend and websites).');\n}\nfunction background() {\n  if (runningPid()) { console.log('ResiResi is already running.'); return; }\n  fs.mkdirSync(path.dirname(PID), { recursive: true });\n  const log = fs.openSync(path.join(__dirname, '.demo', 'app.log'), 'a');\n  const child = spawn(process.execPath, [__filename], { cwd: __dirname, detached: true, stdio: ['ignore', log, log] });\n  child.unref();\n  fs.writeFileSync(PID, String(child.pid));\n  loadEnv();\n  console.log(`Started ResiResi: backend localhost:${process.env.BACKEND_PORT || 3001}, unprotected front-end http://localhost:${process.env.DIRECT_PORT || 3002}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${process.env.APP_PORT || 3000}` : ''}.`);\n}\n\nmodule.exports = { start, loadEnv };\nif (require.main === module) {\n  const arg = process.argv[2];\n  if (arg === '--stop') stop();\n  else if (arg === '--background') background();\n  else if (arg === '--restart') stop().then(() => setTimeout(background, 300));\n  else {\n    start().then(({ appPort, backendPort, directPort }) => console.log(`ResiResi running: backend localhost:${backendPort}, unprotected front-end http://localhost:${directPort}${process.env.APIBLAZE_URL ? `, protected website http://localhost:${appPort}` : ''}. Ctrl-C stops.`))\n      .catch((e) => { console.error(`Could not start: ${e.message}`); process.exit(1); });\n  }\n}\n",
+      "public/index.html": `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>ResiResi demo</title>
+<style>
+  :root {
+    --bg: #faf7f2; --card: #fff; --ink: #1d1b19; --muted: #6b6560; --line: #e8e2d9; --soft: #f3eee6;
+    --accent: #e4572e; --accent-ink: #fff; --good: #15803d; --good-bg: #ecfdf3; --bad: #c2410c; --bad-bg: #fff1e8;
+    --blaze: #4f46e5; --blaze-bg: #eef2ff; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root { --bg: #161412; --card: #1f1c1a; --ink: #f3efe9; --muted: #a39b92; --line: #34302c; --soft: #26221f;
+      --good: #4ade80; --good-bg: #10241a; --bad: #fb923c; --bad-bg: #2b1a10; --blaze: #a5b4fc; --blaze-bg: #1e1b4b; }
   }
   * { box-sizing: border-box; }
   [hidden] { display: none !important; }
@@ -7587,24 +8046,24 @@ ready.then((c) => {
 
 // src/lib/log-view.ts
 function statusColor(status2) {
-  if (status2 < 300) return import_chalk27.default.green;
-  if (status2 < 400) return import_chalk27.default.blue;
-  if (status2 < 500) return import_chalk27.default.yellow;
-  return import_chalk27.default.red;
+  if (status2 < 300) return import_chalk29.default.green;
+  if (status2 < 400) return import_chalk29.default.blue;
+  if (status2 < 500) return import_chalk29.default.yellow;
+  return import_chalk29.default.red;
 }
 function methodColor(method) {
   switch ((method || "").toUpperCase()) {
     case "GET":
-      return import_chalk27.default.green;
+      return import_chalk29.default.green;
     case "POST":
-      return import_chalk27.default.blue;
+      return import_chalk29.default.blue;
     case "PUT":
     case "PATCH":
-      return import_chalk27.default.yellow;
+      return import_chalk29.default.yellow;
     case "DELETE":
-      return import_chalk27.default.red;
+      return import_chalk29.default.red;
     default:
-      return import_chalk27.default.white;
+      return import_chalk29.default.white;
   }
 }
 function clock(ts2) {
@@ -7615,12 +8074,12 @@ function routeCell(route) {
   return (r.length > ROUTE_W ? `\u2026${r.slice(-(ROUTE_W - 1))}` : r).padEnd(ROUTE_W);
 }
 function formatRow(r) {
-  const time = import_chalk27.default.dim(clock(r.ts));
+  const time = import_chalk29.default.dim(clock(r.ts));
   const method = methodColor(r.method)(String(r.method || "\u2014").padEnd(6));
   const route = routeCell(String(r.route || "\u2014"));
   const status2 = statusColor(r.status)(String(r.status ?? "\u2014").padStart(3));
-  const ms2 = import_chalk27.default.dim(`${r.duration_ms}ms`.padStart(8));
-  const step = r.error_step ? import_chalk27.default.dim(` ${r.error_step}`) : "";
+  const ms2 = import_chalk29.default.dim(`${r.duration_ms}ms`.padStart(8));
+  const step = r.error_step ? import_chalk29.default.dim(` ${r.error_step}`) : "";
   return `${time}  ${method} ${route} ${status2} ${ms2}${step}`;
 }
 function printRow(r, json) {
@@ -7674,13 +8133,13 @@ async function runTailSession(opts) {
     if (!held.length && !heldRowsDropped && !heldNotesDropped) return;
     const rows = held.filter((h) => h.kind === "row").length;
     const total = rows + heldRowsDropped;
-    if (total) console.log(import_chalk27.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
+    if (total) console.log(import_chalk29.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
     for (const h of held) {
       if (h.kind === "row") printRow(h.row, opts.json);
       else console.error(h.msg);
     }
     if (heldRowsDropped || heldNotesDropped) {
-      console.log(import_chalk27.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
+      console.log(import_chalk29.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
     }
     held.length = 0;
     heldRowsDropped = 0;
@@ -7694,7 +8153,7 @@ async function runTailSession(opts) {
       activeSocket?.close();
     } catch {
     }
-    if (!opts.json) console.log(import_chalk27.default.dim("\nStopped."));
+    if (!opts.json) console.log(import_chalk29.default.dim("\nStopped."));
     process.exit(0);
   }
   function onKeypress(_s, key) {
@@ -7707,7 +8166,7 @@ async function runTailSession(opts) {
   function bindKeys() {
     if (!interactive2 || keysBound || paused) return;
     keysBound = true;
-    readline.emitKeypressEvents(process.stdin);
+    readline2.emitKeypressEvents(process.stdin);
     process.stdin.setRawMode(true);
     process.stdin.on("keypress", onKeypress);
     process.stdin.resume();
@@ -7722,17 +8181,17 @@ async function runTailSession(opts) {
   async function openInspector() {
     if (paused) return;
     if (recent.length === 0) {
-      console.log(import_chalk27.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
+      console.log(import_chalk29.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
       return;
     }
     paused = true;
     unbindKeys();
     try {
       const { default: inquirer3 } = await import("inquirer");
-      console.log(import_chalk27.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
+      console.log(import_chalk29.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
       for (; ; ) {
         const choices = recent.slice(-TAIL_INSPECT_CHOICES).reverse().map((r) => ({ name: formatRow(r), value: r.request_id }));
-        choices.push({ name: import_chalk27.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
+        choices.push({ name: import_chalk29.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
         const { picked } = await inquirer3.prompt([{
           type: "list",
           name: "picked",
@@ -7743,12 +8202,12 @@ async function runTailSession(opts) {
         if (picked === "__resume__") break;
         const row = recent.find((r) => r.request_id === picked);
         if (row) printDetail(row, opts.detail);
-        else console.log(import_chalk27.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
+        else console.log(import_chalk29.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
       }
     } finally {
       paused = false;
       flushHeld();
-      console.log(import_chalk27.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
+      console.log(import_chalk29.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
       bindKeys();
     }
   }
@@ -7758,12 +8217,12 @@ async function runTailSession(opts) {
     if (reconnects >= MAX_RECONNECTS) {
       paused = false;
       flushHeld();
-      console.error(import_chalk27.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
+      console.error(import_chalk29.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
       process.exit(1);
     }
     const delay = Math.min(1e3 * 2 ** reconnects, 15e3);
     reconnects++;
-    diag(import_chalk27.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
+    diag(import_chalk29.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
     setTimeout(() => {
       if (!closed) void connect();
     }, delay);
@@ -7774,7 +8233,7 @@ async function runTailSession(opts) {
       url = await opts.mintTicket();
     } catch (err) {
       if (!everConnected) {
-        console.error(import_chalk27.default.red(`Could not start tail: ${err.message}`));
+        console.error(import_chalk29.default.red(`Could not start tail: ${err.message}`));
         process.exit(1);
       }
       lastFailure = `ticket mint failed: ${err.message}`;
@@ -7787,7 +8246,7 @@ async function runTailSession(opts) {
     } catch (err) {
       lastFailure = `bad tail URL: ${err.message}`;
       if (!everConnected) {
-        console.error(import_chalk27.default.red(`Could not start tail: ${lastFailure}`));
+        console.error(import_chalk29.default.red(`Could not start tail: ${lastFailure}`));
         process.exit(1);
       }
       scheduleReconnect();
@@ -7802,9 +8261,9 @@ async function runTailSession(opts) {
       lastInbound = Date.now();
       lastFailure = "";
       if (isReconnect) {
-        diag(import_chalk27.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
+        diag(import_chalk29.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
       } else {
-        diag(import_chalk27.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
+        diag(import_chalk29.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
       }
       bindKeys();
       pingTimer = setInterval(() => {
@@ -7831,7 +8290,7 @@ async function runTailSession(opts) {
         return;
       }
       if (frame?.type === "ceiling") {
-        diag(import_chalk27.default.yellow(
+        diag(import_chalk29.default.yellow(
           `\u26A0 volume ceiling \u2014 ${Number(frame.dropped_this_hour) || 0} rows dropped this hour; errors keep streaming.`
         ));
         return;
@@ -7907,10 +8366,10 @@ async function fetchPage(fetchWindow3, params, notices) {
       return { rows, nextCursor: res.next_cursor ?? void 0 };
     }
     if (hop >= MAX_EMPTY_HOPS) {
-      console.error(import_chalk27.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
+      console.error(import_chalk29.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
       return { rows: [], nextCursor: res.next_cursor, fuseTripped: true };
     }
-    if (hop === 0) console.error(import_chalk27.default.dim("searching older history\u2026"));
+    if (hop === 0) console.error(import_chalk29.default.dim("searching older history\u2026"));
     cursor = res.next_cursor;
   }
 }
@@ -7948,18 +8407,18 @@ async function runPlainList(opts, notices) {
     }
   }
   if (rows.length === 0) {
-    console.log(import_chalk27.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+    console.log(import_chalk29.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
     return;
   }
   const now = Date.now();
   for (const d of groupIntoDays(rows)) {
-    console.log(import_chalk27.default.bold(dayLabel(d.dayMs, now)));
+    console.log(import_chalk29.default.bold(dayLabel(d.dayMs, now)));
     for (const r of d.rows) console.log(`  ${formatRow(r)}`);
     console.log("");
   }
   const errs = rows.filter((r) => r.status >= 400).length;
   const tail = fuseTripped ? " \xB7 stopped early (long empty span) \u2014 older requests may still exist" : more ? " \xB7 showing the most recent \u2014 `--json` streams the rest" : "";
-  console.log(import_chalk27.default.dim(
+  console.log(import_chalk29.default.dim(
     `${rows.length} request${rows.length === 1 ? "" : "s"} \xB7 ${errs} error${errs === 1 ? "" : "s"}${tail}`
   ));
 }
@@ -7978,7 +8437,7 @@ async function runHistoryBrowser(opts) {
       for (const r of page.rows) console.log(JSON.stringify(r));
       any = any || page.rows.length > 0;
       if (page.fuseTripped || !page.nextCursor) {
-        if (!any && !page.fuseTripped) console.error(import_chalk27.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+        if (!any && !page.fuseTripped) console.error(import_chalk29.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
         return;
       }
       cursor2 = page.nextCursor;
@@ -7999,7 +8458,7 @@ async function runHistoryBrowser(opts) {
     scanRows = first.rows;
     scanCursor = first.nextCursor;
     if (scanRows.length === 0) {
-      console.log(import_chalk27.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+      console.log(import_chalk29.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
       return;
     }
   }
@@ -8010,10 +8469,10 @@ async function runHistoryBrowser(opts) {
     const now2 = Date.now();
     const oldestKey = days[days.length - 1]?.key;
     const choices = days.map((d) => ({
-      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk27.default.red(`  ${d.errors} errors`) : ""}`,
+      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk29.default.red(`  ${d.errors} errors`) : ""}`,
       value: d.key
     }));
-    if (scanCursor) choices.push({ name: import_chalk27.default.dim("\u2026 older days"), value: "__older__" });
+    if (scanCursor) choices.push({ name: import_chalk29.default.dim("\u2026 older days"), value: "__older__" });
     const { chosenDay } = await inquirer3.prompt([{
       type: "list",
       name: "chosenDay",
@@ -8033,7 +8492,7 @@ async function runHistoryBrowser(opts) {
         scanCursor = void 0;
       } else {
         scanCursor = more.nextCursor;
-        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk27.default.dim("That was everything \u2014 no older requests."));
+        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk29.default.dim("That was everything \u2014 no older requests."));
       }
       continue;
     }
@@ -8055,11 +8514,11 @@ async function runHistoryBrowser(opts) {
       cursor
     }, notices);
     if (page.rows.length === 0 && pageRows.length === 0) {
-      console.log(import_chalk27.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
+      console.log(import_chalk29.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
       return;
     }
     if (page.rows.length === 0) {
-      console.log(import_chalk27.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
+      console.log(import_chalk29.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
       moreCursor = void 0;
     } else {
       pageRows = page.rows;
@@ -8070,8 +8529,8 @@ async function runHistoryBrowser(opts) {
       name: formatRow(r),
       value: r.request_id
     }));
-    if (moreCursor) choices.push({ name: import_chalk27.default.dim("\u2026 load more"), value: "__more__" });
-    choices.push({ name: import_chalk27.default.dim("quit"), value: "__quit__" });
+    if (moreCursor) choices.push({ name: import_chalk29.default.dim("\u2026 load more"), value: "__more__" });
+    choices.push({ name: import_chalk29.default.dim("quit"), value: "__quit__" });
     for (; ; ) {
       const { picked } = await inquirer3.prompt([{
         type: "list",
@@ -8106,19 +8565,19 @@ function wrapCells(items, width) {
 ${PANE_INDENT}`);
 }
 function renderHeaders(h) {
-  if (!h) return import_chalk27.default.dim("\u2014");
+  if (!h) return import_chalk29.default.dim("\u2014");
   const width = process.stdout.columns || 100;
   if (h.values) {
     const e = Object.entries(h.values);
-    if (!e.length) return import_chalk27.default.dim("none");
+    if (!e.length) return import_chalk29.default.dim("none");
     const rank = (k) => {
       const i = HEADER_PRIORITY.indexOf(k.toLowerCase());
       return i === -1 ? NOISE_HEADER.test(k) ? 999 : 500 : i;
     };
-    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk27.default.dim(k + ":")} ${v}`).join(`
+    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk29.default.dim(k + ":")} ${v}`).join(`
 ${PANE_INDENT}`);
   }
-  if (!h.names?.length) return import_chalk27.default.dim("none");
+  if (!h.names?.length) return import_chalk29.default.dim("none");
   const names = [...h.names];
   const noise = names.filter((n) => NOISE_HEADER.test(n));
   const shown = names.filter((n) => !NOISE_HEADER.test(n)).sort((a, b) => {
@@ -8126,78 +8585,78 @@ ${PANE_INDENT}`);
     const ib = HEADER_PRIORITY.indexOf(b.toLowerCase());
     return (ia === -1 ? 500 : ia) - (ib === -1 ? 500 : ib) || a.localeCompare(b);
   });
-  const body = shown.length ? wrapCells(shown, width) : import_chalk27.default.dim("(all forwarding headers)");
+  const body = shown.length ? wrapCells(shown, width) : import_chalk29.default.dim("(all forwarding headers)");
   const tail = noise.length ? `
-${PANE_INDENT}${import_chalk27.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
-  return `${body}${tail}  ${import_chalk27.default.dim("(names only)")}`;
+${PANE_INDENT}${import_chalk29.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
+  return `${body}${tail}  ${import_chalk29.default.dim("(names only)")}`;
 }
 function renderBody(b) {
-  if (!b) return import_chalk27.default.dim("\u2014");
+  if (!b) return import_chalk29.default.dim("\u2014");
   const meta = [b.content_type, b.size != null ? `${b.size}B` : null, b.truncated ? "truncated" : null].filter(Boolean).join(" \xB7 ");
-  if (b.not_captured) return import_chalk27.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
+  if (b.not_captured) return import_chalk29.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
   const isShape = b.value === void 0 && b.shape !== void 0;
   const content = b.value !== void 0 ? b.value : b.shape;
   if (content === null || content === void 0 || content === "" || content === "empty") {
-    return import_chalk27.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
+    return import_chalk29.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
   }
   const text = typeof content === "string" ? content : JSON.stringify(content, null, 2);
-  const head = isShape ? import_chalk27.default.dim("shape only (values not captured)\n      ") : "";
+  const head = isShape ? import_chalk29.default.dim("shape only (values not captured)\n      ") : "";
   return head + text.split("\n").join("\n      ");
 }
 function pane(title, tone, view, empty) {
   console.log(`  ${tone(title)}`);
   if (empty !== void 0) {
-    console.log(`    ${import_chalk27.default.dim(empty)}`);
+    console.log(`    ${import_chalk29.default.dim(empty)}`);
     return;
   }
   const v = view ?? {};
-  if (v.url) console.log(`    ${import_chalk27.default.dim("target")}   ${v.url}`);
+  if (v.url) console.log(`    ${import_chalk29.default.dim("target")}   ${v.url}`);
   if (v.status != null) {
-    console.log(`    ${import_chalk27.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk27.default.dim(" " + v.status_text) : ""}`);
+    console.log(`    ${import_chalk29.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk29.default.dim(" " + v.status_text) : ""}`);
   }
-  if (v.raw_path) console.log(`    ${import_chalk27.default.dim("path")}     ${v.raw_path}`);
+  if (v.raw_path) console.log(`    ${import_chalk29.default.dim("path")}     ${v.raw_path}`);
   if (v.query && Object.keys(v.query).length) {
-    console.log(`    ${import_chalk27.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
+    console.log(`    ${import_chalk29.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
   }
-  if (v.jwt !== void 0) console.log(`    ${import_chalk27.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
-  console.log(`    ${import_chalk27.default.dim("headers")}  ${renderHeaders(v.headers)}`);
-  console.log(`    ${import_chalk27.default.dim("body")}     ${renderBody(v.body)}`);
+  if (v.jwt !== void 0) console.log(`    ${import_chalk29.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
+  console.log(`    ${import_chalk29.default.dim("headers")}  ${renderHeaders(v.headers)}`);
+  console.log(`    ${import_chalk29.default.dim("body")}     ${renderBody(v.body)}`);
 }
 function printDetail(r, mode = "producer") {
   const v = r.views;
   console.log("");
-  console.log(import_chalk27.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk27.default.dim(`  ${r.duration_ms}ms`));
+  console.log(import_chalk29.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk29.default.dim(`  ${r.duration_ms}ms`));
   const cost = typeof r.cost_cents === "number" && r.cost_cents > 0 ? ` \xB7 ${r.cost_cents}\xA2` : "";
-  console.log(import_chalk27.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
+  console.log(import_chalk29.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
   console.log("");
   if (!v) {
-    console.log(import_chalk27.default.dim("  No view detail captured for this request.\n"));
+    console.log(import_chalk29.default.dim("  No view detail captured for this request.\n"));
     return;
   }
-  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk27.default.cyan, v.request);
+  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk29.default.cyan, v.request);
   if (mode === "producer") {
     pane(
       "Request (after) \u2014 APIblaze \u2192 upstream",
-      import_chalk27.default.cyan,
+      import_chalk29.default.cyan,
       v.forwarded_request,
       v.forwarded_request ? void 0 : "Request did not reach an upstream."
     );
     pane(
       "Response (before) \u2014 upstream \u2192 APIblaze",
-      import_chalk27.default.magenta,
+      import_chalk29.default.magenta,
       v.upstream_response,
       v.upstream_response ? void 0 : "No upstream response."
     );
   }
-  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk27.default.magenta, v.response);
+  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk29.default.magenta, v.response);
   console.log("");
 }
-var import_chalk27, readline, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
+var import_chalk29, readline2, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
 var init_log_view = __esm({
   "src/lib/log-view.ts"() {
     "use strict";
-    import_chalk27 = __toESM(require("chalk"));
-    readline = __toESM(require("readline"));
+    import_chalk29 = __toESM(require("chalk"));
+    readline2 = __toESM(require("readline"));
     ROUTE_W = 34;
     WindowNotices = class {
       constructor() {
@@ -8208,15 +8667,15 @@ var init_log_view = __esm({
       note(res) {
         if (res.history_unavailable && !this.saidUnavailable) {
           this.saidUnavailable = true;
-          console.error(import_chalk27.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
+          console.error(import_chalk29.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
         }
         if ((res.history_markers?.length ?? 0) > 0 && !this.saidGap) {
           this.saidGap = true;
-          console.error(import_chalk27.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
+          console.error(import_chalk29.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
         }
         if ((res.dropped_this_hour ?? 0) > 0 && !this.saidDropped) {
           this.saidDropped = true;
-          console.error(import_chalk27.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
+          console.error(import_chalk29.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
         }
       }
     };
@@ -8303,7 +8762,7 @@ async function resolve(projectArg, versionArg, opts) {
   return { projectId, projectName: match.projectName, version: version2, tenant: tenant2 };
 }
 function otherPlaneHint() {
-  if (loadConsumer()) console.log(import_chalk28.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
+  if (loadConsumer()) console.log(import_chalk30.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
 }
 function fetchWindow(projectId, version2, tenant2) {
   return (params) => {
@@ -8322,8 +8781,8 @@ function fetchWindow(projectId, version2, tenant2) {
 async function runLogsTail(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk28.default.bold("API Producer logs") + import_chalk28.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk28.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk30.default.bold("API Producer logs") + import_chalk30.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk30.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
   }
   await runTailSession({
@@ -8344,8 +8803,8 @@ async function runLogsTail(projectArg, versionArg, opts) {
 async function runLogsList(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant: tenant2 } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk28.default.bold("API Producer logs") + import_chalk28.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk28.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk30.default.bold("API Producer logs") + import_chalk30.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant2}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk30.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
     console.log("");
   }
@@ -8357,11 +8816,11 @@ async function runLogsList(projectArg, versionArg, opts) {
     detail: "producer"
   });
 }
-var import_chalk28, activeCaller, viaCaller;
+var import_chalk30, activeCaller, viaCaller;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_chalk28 = __toESM(require("chalk"));
+    import_chalk30 = __toESM(require("chalk"));
     init_caller();
     init_auth();
     init_consumer_auth();
@@ -8433,15 +8892,15 @@ async function freePort(from, avoid = []) {
 }
 function readRegistry() {
   try {
-    return JSON.parse(import_fs7.default.readFileSync(registryFile(), "utf8"));
+    return JSON.parse(import_fs8.default.readFileSync(registryFile(), "utf8"));
   } catch {
     return [];
   }
 }
 function writeRegistry(rows) {
   try {
-    import_fs7.default.mkdirSync(import_path6.default.dirname(registryFile()), { recursive: true });
-    import_fs7.default.writeFileSync(registryFile(), JSON.stringify(rows));
+    import_fs8.default.mkdirSync(import_path6.default.dirname(registryFile()), { recursive: true });
+    import_fs8.default.writeFileSync(registryFile(), JSON.stringify(rows));
   } catch {
   }
 }
@@ -8485,7 +8944,7 @@ async function stopTunnels() {
   return stopped;
 }
 function appCtl(dir, arg) {
-  if (!import_fs7.default.existsSync(import_path6.default.join(dir, "start.js"))) return false;
+  if (!import_fs8.default.existsSync(import_path6.default.join(dir, "start.js"))) return false;
   const r = (0, import_child_process5.spawnSync)(process.execPath, [import_path6.default.join(dir, "start.js"), arg], { cwd: dir, stdio: "ignore", timeout: 15e3 });
   return r.status === 0;
 }
@@ -8526,47 +8985,47 @@ async function stopDemos() {
   return n + left.length;
 }
 function writeApp(dir) {
-  import_fs7.default.mkdirSync(dir, { recursive: true });
-  for (const entry of import_fs7.default.readdirSync(dir)) import_fs7.default.rmSync(import_path6.default.join(dir, entry), { recursive: true, force: true });
+  import_fs8.default.mkdirSync(dir, { recursive: true });
+  for (const entry of import_fs8.default.readdirSync(dir)) import_fs8.default.rmSync(import_path6.default.join(dir, entry), { recursive: true, force: true });
   for (const [rel, text] of Object.entries(DEMO_FILES)) {
     const f = import_path6.default.join(dir, rel);
-    import_fs7.default.mkdirSync(import_path6.default.dirname(f), { recursive: true });
-    import_fs7.default.writeFileSync(f, text);
+    import_fs8.default.mkdirSync(import_path6.default.dirname(f), { recursive: true });
+    import_fs8.default.writeFileSync(f, text);
   }
-  import_fs7.default.writeFileSync(import_path6.default.join(dir, "package.json"), JSON.stringify({
+  import_fs8.default.writeFileSync(import_path6.default.join(dir, "package.json"), JSON.stringify({
     name: "nino-pizza-demo",
     private: true,
     scripts: { start: "node start.js --background", stop: "node start.js --stop", restart: "node start.js --restart", dev: "node start.js" }
   }, null, 2) + "\n");
-  import_fs7.default.writeFileSync(import_path6.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
+  import_fs8.default.writeFileSync(import_path6.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
   for (const [from, to] of [[import_path6.default.join(__dirname, "server", "index.js"), import_path6.default.join(dir, "lib", "apiblaze-server.js")], [import_path6.default.join(__dirname, "browser", "widgets.js"), import_path6.default.join(dir, "public", "apiblaze-widgets.js")]]) {
-    if (!import_fs7.default.existsSync(from)) continue;
-    import_fs7.default.mkdirSync(import_path6.default.dirname(to), { recursive: true });
-    import_fs7.default.copyFileSync(from, to);
+    if (!import_fs8.default.existsSync(from)) continue;
+    import_fs8.default.mkdirSync(import_path6.default.dirname(to), { recursive: true });
+    import_fs8.default.copyFileSync(from, to);
   }
 }
 function saveState(dir, s) {
   const d = import_path6.default.join(dir, STATE_DIR);
-  import_fs7.default.mkdirSync(d, { recursive: true });
-  import_fs7.default.writeFileSync(import_path6.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
+  import_fs8.default.mkdirSync(d, { recursive: true });
+  import_fs8.default.writeFileSync(import_path6.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
 }
 function loadState(dir) {
   try {
-    return JSON.parse(import_fs7.default.readFileSync(import_path6.default.join(dir, STATE_DIR, "state.json"), "utf8"));
+    return JSON.parse(import_fs8.default.readFileSync(import_path6.default.join(dir, STATE_DIR, "state.json"), "utf8"));
   } catch {
     return null;
   }
 }
 function writeEnv(dir, v) {
   const lines = Object.entries(v).map(([k, val]) => `${k}=${val}`);
-  import_fs7.default.writeFileSync(import_path6.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
+  import_fs8.default.writeFileSync(import_path6.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
 ${lines.join("\n")}
 `, { mode: 384 });
 }
 function readEnvFile(file2) {
   const out = {};
   try {
-    for (const line of import_fs7.default.readFileSync(file2, "utf8").split("\n")) {
+    for (const line of import_fs8.default.readFileSync(file2, "utf8").split("\n")) {
       const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
       if (m) out[m[1]] = m[2];
     }
@@ -8576,14 +9035,14 @@ function readEnvFile(file2) {
 }
 function demoDir() {
   const here = process.cwd();
-  if (import_fs7.default.existsSync(import_path6.default.join(here, STATE_DIR, "state.json"))) return here;
+  if (import_fs8.default.existsSync(import_path6.default.join(here, STATE_DIR, "state.json"))) return here;
   return import_path6.default.resolve(here, DIR_NAME);
 }
 function adoptWorkspace(cpKey, teamId, claimCode) {
   const prev = loadAnonCred();
   if (prev?.cp_key && prev.team_id && prev.team_id !== teamId) {
     try {
-      import_fs7.default.writeFileSync(import_path6.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
+      import_fs8.default.writeFileSync(import_path6.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
     } catch {
     }
   }
@@ -8642,12 +9101,12 @@ async function waitThrough(apiUrl, serverKey) {
 async function confirmStep(opts, question) {
   if (opts.yes || !interactive()) return true;
   console.log();
-  return ask(`${import_chalk29.default.bold("?")} ${question} ${import_chalk29.default.dim("(Y/n)")} `);
+  return ask(`${import_chalk31.default.bold("?")} ${question} ${import_chalk31.default.dim("(Y/n)")} `);
 }
 async function busy(text, fn, minMs = 0) {
   if (!process.stdout.isTTY) return fn();
   const t = Date.now();
-  const spinner = (0, import_ora11.default)({ text: import_chalk29.default.dim(text), indent: 3, discardStdin: false }).start();
+  const spinner = (0, import_ora11.default)({ text: import_chalk31.default.dim(text), indent: 3, discardStdin: false }).start();
   try {
     const out = await fn();
     const left = minMs - (Date.now() - t);
@@ -8680,7 +9139,7 @@ async function offerBrowserAndLogs(dir, opts) {
   console.log();
   if (await ask(`  Open ${url} in your browser? (Y/n) `)) openBrowser3(url);
   if (await ask(`  Show the requests reaching ${B.product} here, live? (Y/n) `)) {
-    console.log(import_chalk29.default.dim(`  $ ${logsCommand(env)}`));
+    console.log(import_chalk31.default.dim(`  $ ${logsCommand(env)}`));
     const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
     await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
   }
@@ -8717,7 +9176,7 @@ async function runDemo(opts = {}) {
     const e = err instanceof DemoError ? err : new DemoError(`The demo could not start (${err.message}).`, `Run again: ${LATEST} demo`);
     countRun({ event: `demo-failed-${e.why}` });
     await stopDemos().catch(() => 0);
-    console.log(`${import_chalk29.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk31.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
@@ -8728,11 +9187,11 @@ function titleCard(lines) {
     const left = Math.floor((inner - t.length) / 2);
     return " ".repeat(left) + t + " ".repeat(inner - t.length - left);
   };
-  const edge = import_chalk29.default.magenta;
+  const edge = import_chalk31.default.magenta;
   console.log();
   console.log(`  ${edge(`\u256D${"\u2500".repeat(inner)}\u256E`)}`);
   console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
-  lines.forEach((l, i) => console.log(`  ${edge("\u2502")}${i === 0 ? import_chalk29.default.bold(center(l)) : import_chalk29.default.dim(center(l))}${edge("\u2502")}`));
+  lines.forEach((l, i) => console.log(`  ${edge("\u2502")}${i === 0 ? import_chalk31.default.bold(center(l)) : import_chalk31.default.dim(center(l))}${edge("\u2502")}`));
   console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
   console.log(`  ${edge(`\u2570${"\u2500".repeat(inner)}\u256F`)}`);
 }
@@ -8752,25 +9211,25 @@ function printTable(rows) {
     if (line) out.push(line);
     return out;
   };
-  const head = (l, r) => console.log(`   ${import_chalk29.default.dim(l.padEnd(leftW))}  ${import_chalk29.default.dim(r)}`);
+  const head = (l, r) => console.log(`   ${import_chalk31.default.dim(l.padEnd(leftW))}  ${import_chalk31.default.dim(r)}`);
   head(`What ${B.product} set up`, "The command that does this");
   head("\u2500".repeat(leftW), "\u2500".repeat(Math.min(rightW, 60)));
   for (const r of rows) {
-    const left = `${import_chalk29.default.green("\u2713")} ${import_chalk29.default.bold(r.label.padEnd(17))} ${r.what}`;
+    const left = `${import_chalk31.default.green("\u2713")} ${import_chalk31.default.bold(r.label.padEnd(17))} ${r.what}`;
     const leftPlain = `\u2713 ${r.label.padEnd(17)} ${r.what}`;
     const right = r.cmds.length ? r.cmds.flatMap(wrap2) : ["\u2014"];
-    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk29.default.cyan(right[0])}`);
-    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk29.default.cyan(extra)}`);
+    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk31.default.cyan(right[0])}`);
+    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk31.default.cyan(extra)}`);
   }
 }
 async function startDemo(opts) {
   const t0 = Date.now();
   const here = process.cwd();
-  const dir = import_fs7.default.existsSync(import_path6.default.join(here, STATE_DIR, "state.json")) ? here : import_path6.default.resolve(here, DIR_NAME);
+  const dir = import_fs8.default.existsSync(import_path6.default.join(here, STATE_DIR, "state.json")) ? here : import_path6.default.resolve(here, DIR_NAME);
   const rel = import_path6.default.relative(here, dir) || ".";
   const cdDir = rel === "." ? "" : `cd ${rel} && `;
-  const shell = (c, note = "") => console.log(`   ${import_chalk29.default.dim("$")} ${import_chalk29.default.cyan(c)}${note ? `   ${import_chalk29.default.dim(note)}` : ""}`);
-  const ok = (text, note = "") => console.log(`   ${import_chalk29.default.green("\u2713")} ${text}${note ? `   ${import_chalk29.default.dim(note)}` : ""}`);
+  const shell = (c, note = "") => console.log(`   ${import_chalk31.default.dim("$")} ${import_chalk31.default.cyan(c)}${note ? `   ${import_chalk31.default.dim(note)}` : ""}`);
+  const ok = (text, note = "") => console.log(`   ${import_chalk31.default.green("\u2713")} ${text}${note ? `   ${import_chalk31.default.dim(note)}` : ""}`);
   const stopHere = (step, lines) => {
     console.log();
     for (const l of lines) console.log(`  ${l}`);
@@ -8788,7 +9247,7 @@ async function startDemo(opts) {
   const openapi = DEMO_FILES["openapi.yaml"];
   try {
     const specPath = import_path6.default.join(dir, "openapi.yaml");
-    import_fs7.default.writeFileSync(specPath, import_fs7.default.readFileSync(specPath, "utf8").replace(/^paths:/m, `servers:
+    import_fs8.default.writeFileSync(specPath, import_fs8.default.readFileSync(specPath, "utf8").replace(/^paths:/m, `servers:
   - url: http://localhost:${backendPort2}
 paths:`));
   } catch {
@@ -8796,14 +9255,14 @@ paths:`));
   const L = (c) => `${LATEST} ${c}`;
   writeEnv(dir, { BACKEND_SECRET: backendSecret, DEMO_NINO_TENANT: ninoTenant, APP_PORT: appPort, BACKEND_PORT: backendPort2, DIRECT_PORT: directPort });
   console.log();
-  console.log(import_chalk29.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk29.default.dim(`   (no ${B.product} yet)`));
+  console.log(import_chalk31.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk31.default.dim(`   (no ${B.product} yet)`));
   console.log(`   Written to ${rel}. Its routes, from openapi.yaml:`);
-  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk29.default.dim(r.summary)}`);
-  console.log(import_chalk29.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
+  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk31.default.dim(r.summary)}`);
+  console.log(import_chalk31.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
   if (!await confirmStep(opts, `Ok to serve the backend on localhost:${backendPort2}?`)) {
     return stopHere("backend", [
       `Stopped before starting anything. ResiResi is written to ${rel}.`,
-      `Start it any time: ${cdDir}npm run start  ${import_chalk29.default.dim("\xB7")}  or run the whole demo again: ${LATEST} demo`
+      `Start it any time: ${cdDir}npm run start  ${import_chalk31.default.dim("\xB7")}  or run the whole demo again: ${LATEST} demo`
     ]);
   }
   shell(`${cdDir}npm run start`, "npm run stop \xB7 npm run restart");
@@ -8811,23 +9270,23 @@ paths:`));
   registerDemo(dir);
   const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort2, directPort]), 1800);
   if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path6.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`, "app-not-up");
-  ok(`${import_chalk29.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
-  ok(`${import_chalk29.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk29.default.bold(`http://localhost:${directPort}`)}`);
+  ok(`${import_chalk31.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
+  ok(`${import_chalk31.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk31.default.bold(`http://localhost:${directPort}`)}`);
   console.log("   Book a table directly, the way the unprotected front-end does:");
-  console.log(import_chalk29.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
-  console.log(import_chalk29.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path6.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
-  console.log(import_chalk29.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
+  console.log(import_chalk31.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
+  console.log(import_chalk31.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path6.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
+  console.log(import_chalk31.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
   const tomorrow = new Date(Date.now() + 864e5);
   const day = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, "0")}-${String(tomorrow.getDate()).padStart(2, "0")}`;
-  console.log(import_chalk29.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
+  console.log(import_chalk31.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
   if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
     return stopHere("proxy", [
-      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk29.default.dim(`(${cdDir}npm run stop stops it)`)}`,
+      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk31.default.dim(`(${cdDir}npm run stop stops it)`)}`,
       `Run the whole demo again any time: ${LATEST} demo`
     ]);
   }
   console.log();
-  console.log(import_chalk29.default.bold(`2. ${B.product}, in front of it`));
+  console.log(import_chalk31.default.bold(`2. ${B.product}, in front of it`));
   const tCreate = Date.now();
   const setup = await busy(`Creating the proxy, its tenants, admins, rules and limits\u2026`, async () => {
     const r = await createProxy2(name, backendPort2, openapi, ninoTenant);
@@ -8933,13 +9392,13 @@ paths:`));
     ]);
   }
   console.log();
-  console.log(import_chalk29.default.bold("3. Live on the internet"));
+  console.log(import_chalk31.default.bold("3. Live on the internet"));
   shell(`${LATEST} dev --port ${backendPort2} --project ${project} --auto`, "the tunnel, in the background");
   await busy(`Opening the tunnel to localhost:${backendPort2} and checking it with a real call\u2026`, async () => {
     await spawnTunnel(dir, state);
     await waitThrough(apiUrl, serverKey);
   }, 1200);
-  ok(`${import_chalk29.default.bold("Tunnel")}: the public address reaches localhost:${backendPort2} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
+  ok(`${import_chalk31.default.bold("Tunnel")}: the public address reaches localhost:${backendPort2} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
   printAddresses(dir);
   if (!await confirmStep(opts, "Ok to launch the protected website, which will use the proxy to reach the backend?")) {
     return stopHere("website", [
@@ -8948,7 +9407,7 @@ paths:`));
     ]);
   }
   console.log();
-  console.log(import_chalk29.default.bold(`4. The protected website, through ${B.product}`));
+  console.log(import_chalk31.default.bold(`4. The protected website, through ${B.product}`));
   shell(`${cdDir}npm run restart`, "picks up the keys in .env.local");
   const siteUp = await busy("Starting the protected website\u2026", async () => {
     appCtl(dir, "--stop");
@@ -8956,22 +9415,22 @@ paths:`));
     return waitPorts([appPort, directPort, backendPort2]);
   }, 1500);
   if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path6.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`, "site-not-up");
-  ok(`${import_chalk29.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk29.default.bold(`http://localhost:${appPort}`)}`);
-  ok(`${import_chalk29.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
+  ok(`${import_chalk31.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk31.default.bold(`http://localhost:${appPort}`)}`);
+  ok(`${import_chalk31.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
   console.log();
-  console.log(import_chalk29.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path6.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
+  console.log(import_chalk31.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path6.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
   await offerBrowserAndLogs(dir, opts);
   return "demo-ready";
 }
 function printAddresses(dir) {
   const env = readEnvFile(import_path6.default.join(dir, ".env.local"));
-  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk29.default.dim(note)}` : ""}`);
+  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk31.default.dim(note)}` : ""}`);
   row("Public API", env.APIBLAZE_URL ?? "", `${B.product} tunnel \u2192 localhost:${env.BACKEND_PORT}`);
   row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor (Nino Pizza)");
   if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
 }
 async function spawnTunnel(dir, state) {
-  const log4 = import_fs7.default.openSync(import_path6.default.join(dir, STATE_DIR, "tunnel.log"), "a");
+  const log4 = import_fs8.default.openSync(import_path6.default.join(dir, STATE_DIR, "tunnel.log"), "a");
   const child = (0, import_child_process5.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
   child.unref();
   saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
@@ -8984,7 +9443,7 @@ async function runDemoStart(opts = {}) {
   const state = loadState(dir);
   const env = readEnvFile(import_path6.default.join(dir, ".env.local"));
   if (!state || !env.APIBLAZE_SERVER_KEY) {
-    console.log(`${import_chalk29.default.red("\u2717")} There is no demo here to start.`);
+    console.log(`${import_chalk31.default.red("\u2717")} There is no demo here to start.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
@@ -8994,31 +9453,31 @@ async function runDemoStart(opts = {}) {
   } catch (err) {
     const e = err instanceof DemoError ? err : new DemoError(`The tunnel could not start (${err.message}).`, `Start over: ${LATEST} demo`);
     countRun({ event: `demo-restart-failed-${e.why}` });
-    console.log(`${import_chalk29.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk31.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
   countRun({ event: "demo-restarted" });
-  console.log(`${import_chalk29.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk29.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
+  console.log(`${import_chalk31.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk31.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
   printAddresses(dir);
   const appUp = await fetch(`http://127.0.0.1:${env.APP_PORT}/api/config`).then(() => true).catch(() => false);
-  if (!appUp) console.log(import_chalk29.default.yellow(`   ResiResi is not running: cd ${import_path6.default.relative(process.cwd(), dir) || "."} && npm run start`));
+  if (!appUp) console.log(import_chalk31.default.yellow(`   ResiResi is not running: cd ${import_path6.default.relative(process.cwd(), dir) || "."} && npm run start`));
   await offerBrowserAndLogs(dir, opts);
 }
 async function runDemoLogs() {
   const env = readEnvFile(import_path6.default.join(demoDir(), ".env.local"));
   if (!env.APIBLAZE_NAME) {
-    console.log(`${import_chalk29.default.red("\u2717")} There is no demo here.`);
+    console.log(`${import_chalk31.default.red("\u2717")} There is no demo here.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
-  console.log(import_chalk29.default.dim(`$ ${logsCommand(env)}`));
+  console.log(import_chalk31.default.dim(`$ ${logsCommand(env)}`));
   const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
   await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
 }
 async function runDemoStop() {
   const n = await stopTunnels();
-  console.log(n ? `${import_chalk29.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
+  console.log(n ? `${import_chalk31.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
 }
 async function serveTunnel(dir) {
   const state = loadState(dir);
@@ -9076,16 +9535,16 @@ async function serveTunnel(dir) {
   await new Promise(() => {
   });
 }
-var import_fs7, import_path6, import_net2, import_child_process5, import_crypto, import_chalk29, import_ora11, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
+var import_fs8, import_path6, import_net2, import_child_process5, import_crypto, import_chalk31, import_ora11, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
-    import_fs7 = __toESM(require("fs"));
+    import_fs8 = __toESM(require("fs"));
     import_path6 = __toESM(require("path"));
     import_net2 = __toESM(require("net"));
     import_child_process5 = require("child_process");
     import_crypto = __toESM(require("crypto"));
-    import_chalk29 = __toESM(require("chalk"));
+    import_chalk31 = __toESM(require("chalk"));
     import_ora11 = __toESM(require("ora"));
     init_api();
     init_tunnel_client();
@@ -10145,7 +10604,7 @@ async function runCheck(project, opts) {
   }
   const name = project;
   if (!name) throw new Error(`Which ${B.thingShort}? ${B.cli} check --directory-ready <project>`);
-  const platforms = parsePlatforms(opts.platform);
+  const platforms = parsePolicy(opts.policy, opts.platform);
   const stage = opts.stage === "create" ? "create" : opts.stage === "ready" || !opts.stage ? "ready" : void 0;
   if (!stage) throw new Error("--stage must be create or ready");
   const caller = requireCaller();
@@ -10169,13 +10628,149 @@ Not ready: ${lines.length} blocker${lines.length === 1 ? "" : "s"} (${r.rendered
 }
 
 // src/commands/connector.ts
-var import_fs5 = __toESM(require("fs"));
+var import_fs6 = __toESM(require("fs"));
 var import_path4 = __toESM(require("path"));
-var import_chalk26 = __toESM(require("chalk"));
+var import_chalk28 = __toESM(require("chalk"));
 var import_ora10 = __toESM(require("ora"));
 init_caller();
 init_directory();
 init_brand();
+
+// src/lib/listing-defaults.ts
+var import_yaml5 = __toESM(require("yaml"));
+var RESERVED_SUFFIX = /\s*\b(api|rest api|mcp|plugin|connector|app|server|service)\b\s*$/i;
+function serverNameFromTitle(title) {
+  let n = (title ?? "").replace(/\s+/g, " ").trim();
+  if (!n) return void 0;
+  for (let i = 0; i < 3; i++) {
+    const next = n.replace(RESERVED_SUFFIX, "").trim();
+    if (next === n || next.length < 2) break;
+    n = next;
+  }
+  if (n.length > 40) {
+    const cut = n.slice(0, 40);
+    n = (cut.includes(" ") ? cut.slice(0, cut.lastIndexOf(" ")) : cut).trim();
+  }
+  return n.length >= 2 ? n : void 0;
+}
+function taglineFrom(description, fallback) {
+  const d = (description ?? "").replace(/\s+/g, " ").trim();
+  const first = d.split(/(?<=[.!?])\s+/)[0] ?? "";
+  const t = first.length > 120 ? `${first.slice(0, 117).trim()}\u2026` : first;
+  if (t.length >= 10) return t;
+  return fallback ? `${fallback} for AI assistants` : void 0;
+}
+function descriptionFrom(description) {
+  const d = (description ?? "").trim();
+  if (!d) return void 0;
+  const firstPara = d.split(/\n\s*\n/)[0]?.replace(/\s+/g, " ").trim() ?? "";
+  const text = firstPara.length >= 40 ? firstPara : d.replace(/\s+/g, " ").trim();
+  return text.length > 600 ? `${text.slice(0, 597).trim()}\u2026` : text;
+}
+var VERB_MAP = [
+  [/^(list|get all|fetch all|retrieve all|search)\b\s*(.*)$/i, (r) => `List my ${r || "items"}`],
+  [/^(get|fetch|retrieve|show|read)\b\s*(.*)$/i, (r) => `Show me the ${r || "details"}`],
+  [/^(create|add|make|book|register|new)\b\s*(.*)$/i, (r) => `Create a ${r || "new entry"}`],
+  [/^(update|edit|change|modify|patch)\b\s*(.*)$/i, (r) => `Update the ${r || "entry"}`],
+  [/^(delete|remove|cancel)\b\s*(.*)$/i, (r) => `Cancel the ${r || "entry"}`]
+];
+function cleanRest(rest) {
+  return rest.replace(/\s*\(.*?\)\s*/g, " ").replace(/\bby id or slug\b/i, "").replace(/\bby id\b/i, "").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function promptFromSummary(summary, opId) {
+  const s = (summary ?? "").trim() || (opId ?? "").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").trim();
+  if (!s) return void 0;
+  for (const [re, make] of VERB_MAP) {
+    const m = s.match(re);
+    if (m) {
+      const rest = cleanRest(m[2] ?? "");
+      const out = make(rest).replace(/\s+/g, " ").trim();
+      return out.endsWith(".") ? out : `${out}.`;
+    }
+  }
+  const t = cleanRest(s);
+  return t ? `${t.charAt(0).toUpperCase()}${t.slice(1)}.` : void 0;
+}
+var SKIP_PATH = /(health|ping|status|openapi|swagger|docs|spec|whoami|version)/i;
+function promptsFromOps(ops, want = 3) {
+  const usable = ops.filter((o) => !SKIP_PATH.test(o.path) && !SKIP_PATH.test(o.operationId ?? ""));
+  const rank = (o) => {
+    const s = (o.summary ?? o.operationId ?? "").toLowerCase();
+    if (o.method === "get" && /^(list|search|get all)/.test(s)) return 0;
+    if (o.method === "post" && /^(create|add|book|make|register)/.test(s)) return 1;
+    if (o.method === "get") return 2;
+    if (o.method === "patch" || o.method === "put") return 3;
+    return 4;
+  };
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const o of [...usable].sort((a, b) => rank(a) - rank(b))) {
+    const p = promptFromSummary(o.summary, o.operationId);
+    if (!p || seen.has(p.toLowerCase())) continue;
+    seen.add(p.toLowerCase());
+    out.push(p);
+    if (out.length >= want) break;
+  }
+  return out;
+}
+function apexOf(host) {
+  if (!host) return void 0;
+  const h = host.toLowerCase().replace(/\.$/, "");
+  if (/^(\d+\.){3}\d+$/.test(h) || h === "localhost") return void 0;
+  const parts = h.split(".");
+  return parts.length >= 2 ? parts.slice(-2).join(".") : void 0;
+}
+function hostOf(url) {
+  try {
+    return url ? new URL(url).hostname : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function listingDefaultsFromSpec(specText, source) {
+  let doc = {};
+  try {
+    doc = import_yaml5.default.parse(specText) ?? {};
+  } catch {
+    try {
+      doc = JSON.parse(specText);
+    } catch {
+      doc = {};
+    }
+  }
+  const info = doc?.info ?? {};
+  const servers = Array.isArray(doc?.servers) ? doc.servers : [];
+  const ops = [];
+  for (const [p, item] of Object.entries(doc?.paths ?? {})) {
+    for (const m of ["get", "post", "put", "patch", "delete"]) {
+      const o = item?.[m];
+      if (o && typeof o === "object") ops.push({ method: m, path: p, summary: o.summary, operationId: o.operationId, description: o.description });
+    }
+  }
+  const serverName = serverNameFromTitle(info.title);
+  const apexDomain = apexOf(hostOf(servers[0]?.url)) ?? apexOf(hostOf(source));
+  const contact = info.contact ?? {};
+  const support = typeof contact.email === "string" && contact.email.includes("@") ? contact.email : typeof contact.url === "string" && /^https:\/\//i.test(contact.url) ? contact.url : apexDomain ? `support@${apexDomain}` : void 0;
+  const docsUrl = typeof doc?.externalDocs?.url === "string" && /^https:\/\//i.test(doc.externalDocs.url) ? doc.externalDocs.url : void 0;
+  const logo = info["x-logo"]?.url;
+  const iconUrl = typeof logo === "string" && /^https:\/\//i.test(logo) ? logo : void 0;
+  return {
+    serverName,
+    tagline: taglineFrom(info.description, serverName),
+    description: descriptionFrom(info.description),
+    support,
+    docsUrl,
+    iconUrl,
+    vulnContact: apexDomain ? `security@${apexDomain}` : void 0,
+    prompts: promptsFromOps(ops),
+    apexDomain
+  };
+}
+function suggestedMcpHost(apexDomain) {
+  return apexDomain ? `mcp.${apexDomain}` : void 0;
+}
+
+// src/commands/connector.ts
 var PORTALS = {
   claude: "https://claude.com/docs/connectors/building/submission",
   chatgpt: "https://developers.openai.com/apps-sdk/deploy/submission"
@@ -10185,55 +10780,368 @@ async function patchProject(caller, proj2, body, summary) {
   await producer(caller, { method: "PATCH", path: projectPath(proj2), body, summary });
 }
 var PROMPT_FOR_RULE = {
-  PRIVACY_URL_HTTPS_200: { key: "privacyUrl", message: "Privacy policy URL (https):" },
+  PRIVACY_URL_HTTPS_200: { key: "privacyUrl", message: "Privacy policy URL (https, must answer 200):" },
   SUPPORT_CONTACT: { key: "support", message: "Support contact (email or URL):" },
   DOCS_URL: { key: "docsUrl", message: "Documentation URL (https):" },
   EXAMPLE_PROMPTS_3: { key: "prompt", message: "Example prompt (3 needed; one per line, empty line to finish):", multi: true },
-  SERVER_NAME_RULES: { key: "serverName", message: 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix):' },
-  ICON_SET: { key: "iconUrl", message: "Icon URL (https, square):" },
-  VULN_CONTACT: { key: "vulnContact", message: "Security contact (email or URL; optional):" }
+  SERVER_NAME_RULES: { key: "serverName", message: 'Listing name (no "MCP"/"Plugin" suffix):' },
+  TAGLINE_SET: { key: "tagline", message: "One-line tagline:" },
+  DESCRIPTION_SET: { key: "description", message: "Description (what people can do with it):" },
+  ICON_SET: { key: "iconUrl", message: "Icon URL (https, square PNG):" },
+  VULN_CONTACT: { key: "vulnContact", message: "Security contact (email or URL):" },
+  LISTING_NAME_LEN_CHATGPT: { key: "serverName", message: "Listing name", limit: 30, portal: "ChatGPT" },
+  LISTING_NAME_LEN_CLAUDE: { key: "serverName", message: "Listing name", limit: 100, portal: "Claude" },
+  TAGLINE_LEN_CHATGPT: { key: "tagline", message: "One-line tagline", limit: 30, portal: "ChatGPT" },
+  TAGLINE_LEN_CLAUDE: { key: "tagline", message: "One-line tagline", limit: 200, portal: "Claude" },
+  DESCRIPTION_LEN_CLAUDE: { key: "description", message: "Description", limit: 2e3, portal: "Claude" },
+  DESCRIPTION_LEN_CHATGPT: { key: "description", message: "Description", limit: 4e3, portal: "ChatGPT" },
+  PROMPT_LEN_CHATGPT: { key: "prompt", message: "Example prompt", multi: true, limit: 128, portal: "ChatGPT" },
+  // ChatGPT only: the portal issues this token (Plugins → Connect MCP server); we serve it verbatim.
+  OPENAI_DOMAIN_CHALLENGE: { key: "openaiChallenge", message: "OpenAI domain challenge token, from platform.openai.com/plugins \u2192 Connect MCP server (Enter to skip for now):" }
 };
-async function promptForMissing(r, interactive2) {
+var DEFAULT_FOR_KEY = {
+  support: "support",
+  docsUrl: "docsUrl",
+  serverName: "serverName",
+  iconUrl: "iconUrl",
+  vulnContact: "vulnContact",
+  privacyUrl: "privacyUrl"
+};
+function looksLikeSpecArgument(arg) {
+  const a = arg.trim();
+  if (/^https?:\/\//i.test(a)) return true;
+  if (/[\\/]/.test(a) || /\.(ya?ml|json)$/i.test(a)) {
+    try {
+      return import_fs6.default.existsSync(a) && import_fs6.default.statSync(a).isFile();
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+function currentListingValue(r, key) {
+  const meta = r.target?.metadata ?? {};
+  const field = {
+    serverName: "serverName",
+    tagline: "tagline",
+    description: "description",
+    prompt: "examplePrompts",
+    privacyUrl: "privacyUrl",
+    support: "supportContact",
+    docsUrl: "docsUrl",
+    iconUrl: "iconUrl",
+    vulnContact: "vulnContact"
+  };
+  const v = field[key] ? meta[field[key]] : void 0;
+  if (Array.isArray(v)) return v.filter((x) => typeof x === "string");
+  return typeof v === "string" && v.trim() ? v : void 0;
+}
+function shortenTo(text, limit) {
+  const t = text.replace(/\s+/g, " ").trim();
+  if (t.length <= limit) return t;
+  const cut = t.slice(0, limit);
+  const atSentence = Math.max(cut.lastIndexOf(". "), cut.lastIndexOf("! "), cut.lastIndexOf("? "));
+  if (atSentence >= Math.floor(limit * 0.5)) return cut.slice(0, atSentence + 1).trim();
+  const atWord = cut.lastIndexOf(" ");
+  const base2 = atWord >= Math.floor(limit * 0.4) ? cut.slice(0, atWord) : cut;
+  return base2.replace(/[\s,;:(\-–—]+$/g, "").trim();
+}
+async function promptForMissing(r, interactive2, defaults = { prompts: [] }, platforms = PLATFORMS) {
   const out = {};
-  if (!interactive2) return out;
   const failing = r.report.results.filter((x) => !x.pass && !x.unverified);
-  const { default: inquirer3 } = await import("inquirer");
+  const asks = /* @__PURE__ */ new Map();
   for (const x of failing) {
     const p = PROMPT_FOR_RULE[x.id];
     if (!p) continue;
-    if (p.multi) {
+    const cur = asks.get(p.key);
+    if (!cur) {
+      asks.set(p.key, { ...p });
+      continue;
+    }
+    if (p.limit && (!cur.limit || p.limit < cur.limit)) {
+      cur.limit = p.limit;
+      cur.portal = p.portal;
+    }
+    if (!p.limit && cur.limit) cur.message = p.message;
+  }
+  const limitNote = (a) => a.limit ? ` (${a.portal} allows ${a.limit} characters; the proposed cut is pre-filled \u2014 edit or Enter)` : "";
+  const withinLimit = (a) => (v) => {
+    const n = (v ?? "").trim().length;
+    return !a.limit || n <= a.limit ? true : `${n} characters; ${a.portal} allows ${a.limit}.`;
+  };
+  if (!interactive2) {
+    for (const a of asks.values()) {
+      const current = currentListingValue(r, a.key);
+      if (a.multi) {
+        const base2 = Array.isArray(current) && current.length >= 3 ? current : defaults.prompts;
+        if (base2.length >= 3) out.prompt = base2.map((p) => a.limit ? shortenTo(p, a.limit) : p);
+        continue;
+      }
+      const dk = DEFAULT_FOR_KEY[a.key];
+      const dv = typeof current === "string" ? current : dk ? defaults[dk] : void 0;
+      if (typeof dv === "string" && dv) out[a.key] = a.limit ? shortenTo(dv, a.limit) : dv;
+    }
+    return out;
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  for (const a of asks.values()) {
+    const current = currentListingValue(r, a.key);
+    if (a.multi) {
+      const have = Array.isArray(current) ? current : [];
       const lines = [];
       for (let i = 0; i < 6; i++) {
-        const { line } = await inquirer3.prompt([{ type: "input", name: "line", message: i === 0 ? p.message : `Example prompt ${i + 1} (empty to finish):` }]);
-        if (!line?.trim()) break;
+        const raw = have[i] ?? defaults.prompts[i];
+        const def2 = raw && a.limit ? shortenTo(raw, a.limit) : raw;
+        const { line } = await inquirer3.prompt([{
+          type: "input",
+          name: "line",
+          message: (i === 0 ? `${a.message}${a.limit ? ` (3 needed, each \u2264 ${a.limit} characters for ${a.portal}; one per line, empty line to finish)` : ""}:` : `Example prompt ${i + 1}${i >= 3 ? " (optional, empty to finish)" : ""}:`).replace("::", ":"),
+          ...def2 ? { default: def2 } : {},
+          validate: withinLimit(a)
+        }]);
+        if (!line?.trim()) {
+          if (i >= 3) break;
+          continue;
+        }
         lines.push(line.trim());
       }
       if (lines.length) out.prompt = lines;
       continue;
     }
-    const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: p.message }]);
-    if (value?.trim()) out[p.key] = value.trim();
+    const dk = DEFAULT_FOR_KEY[a.key];
+    const base2 = typeof current === "string" ? current : dk ? defaults[dk] : void 0;
+    const def = typeof base2 === "string" && base2 ? a.limit ? shortenTo(base2, a.limit) : base2 : void 0;
+    const { value } = await inquirer3.prompt([{
+      type: "input",
+      name: "value",
+      message: `${a.message}${limitNote(a)}${a.message.endsWith(":") ? "" : ":"}`,
+      ...def ? { default: def } : {},
+      // The privacy page is a hard portal requirement (https + 200): check it here, before the
+      // report has to come back red for a typo.
+      validate: a.key === "privacyUrl" ? validatePrivacyUrl : withinLimit(a)
+    }]);
+    if (value?.trim()) out[a.key] = value.trim();
   }
   const missingAttest = failing.filter((x) => x.id.startsWith("ATTEST_"));
   if (missingAttest.length) {
-    const choices = ATTESTATIONS.filter((a) => missingAttest.some((x) => x.message?.toLowerCase().includes(a.label.toLowerCase().slice(0, 20)) || true)).map((a) => ({ name: a.label, value: a.id }));
-    const { picked } = await inquirer3.prompt([{ type: "checkbox", name: "picked", message: "Attest (only what is true \u2014 each is recorded with your name and the time):", choices }]);
+    const choices = ATTESTATIONS.filter((a) => a.platforms.some((p) => platforms.includes(p))).map((a) => ({ name: a.label, value: a.id, checked: true }));
+    const { picked } = await inquirer3.prompt([{ type: "checkbox", name: "picked", message: "These are true of your server (space unticks one; each is recorded with your name and the time):", choices }]);
     if (picked?.length) out.attest = picked;
   }
   return out;
 }
-async function runConnector(project, opts) {
+async function promptListingBasics(r, interactive2, defaults, given, platforms = PLATFORMS) {
+  const meta = r.target?.metadata ?? {};
+  const gpt = platforms.includes("chatgpt");
+  const lim = { serverName: gpt ? 30 : 100, tagline: gpt ? 30 : 200, description: platforms.includes("claude") ? 2e3 : 4e3 };
+  const cutTo = (v, n) => v ? shortenTo(v, n) : v;
+  const all = [
+    { key: "serverName", current: meta.serverName, def: cutTo(defaults.serverName, lim.serverName), message: `Listing name (\u2264 ${lim.serverName} chars, no "MCP"/"Plugin" suffix):` },
+    { key: "tagline", current: meta.tagline, def: cutTo(defaults.tagline, lim.tagline), message: `One-line tagline (\u2264 ${lim.tagline} chars):` },
+    { key: "description", current: meta.description, def: cutTo(defaults.description, lim.description), message: `Description (what people can do with it, \u2264 ${lim.description} chars):` }
+  ];
+  const want = all.filter((w) => !given[w.key] && !(w.current ?? "").trim() && w.def);
+  const out = {};
+  if (!want.length) return out;
+  if (!interactive2) {
+    for (const w of want) out[w.key] = w.def;
+    return out;
+  }
+  const { default: inquirer3 } = await import("inquirer");
+  for (const w of want) {
+    const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: w.message, default: w.def }]);
+    if (value?.trim()) out[w.key] = value.trim();
+  }
+  return out;
+}
+async function createFromSpec(spec2, opts, say) {
+  const { runCreate: runCreate2 } = await Promise.resolve().then(() => (init_create(), create_exports));
+  let created = null;
+  say(import_chalk28.default.bold(`Creating a directory-ready ${B.thingShort} from ${spec2}\u2026`));
+  await runCreate2({
+    openapi: spec2,
+    directoryReady: true,
+    ...opts.name ? { name: opts.name } : { auto: true },
+    yes: true,
+    json: !!opts.json,
+    team: opts.team,
+    ...opts.apiversion ? { apiversion: opts.apiversion } : {},
+    skipDirectoryReport: true,
+    onCreated: (c) => {
+      created = { name: c.name, version: c.version, tenant: c.tenant };
+    },
+    // Listing flags given on the command line ride along on the create.
+    privacyUrl: opts.privacyUrl,
+    support: opts.support,
+    docsUrl: opts.docsUrl,
+    prompt: opts.prompt,
+    serverName: opts.serverName,
+    tagline: opts.tagline,
+    description: opts.description,
+    iconUrl: opts.iconUrl,
+    vulnContact: opts.vulnContact,
+    attest: opts.attest,
+    allowedOrigin: opts.allowedOrigin
+  });
+  if (!created) throw new Error(`The create did not report a ${B.thingShort} name; run ${B.cli} connector <project> once it exists.`);
+  return created;
+}
+async function specTextFor(source) {
+  try {
+    if (/^https?:\/\//i.test(source)) {
+      const res = await fetch(source, { signal: AbortSignal.timeout(8e3) });
+      return res.ok ? await res.text() : null;
+    }
+    return import_fs6.default.readFileSync(source, "utf-8");
+  } catch {
+    return null;
+  }
+}
+async function projectSpecText(caller, proj2) {
+  try {
+    const o = await producer(caller, { method: "GET", path: `${projectPath(proj2)}/openapi`, summary: "Read the OpenAPI spec" });
+    const spec2 = o?.spec ?? o?.openapi ?? o?.content ?? o?.openapi_spec ?? null;
+    if (typeof spec2 === "string") return spec2;
+    return spec2 && typeof spec2 === "object" ? JSON.stringify(spec2) : null;
+  } catch {
+    return null;
+  }
+}
+var DOMAIN_RULE = "DOMAIN_CUSTOM_REQUIRED";
+async function ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, say) {
+  const domainRule = r.report.results.find((x) => x.id === DOMAIN_RULE);
+  if (!domainRule || domainRule.pass) return { active: true };
+  const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/domains`;
+  const list = await producer(caller, { method: "GET", path: `${base2}?api_version=${encodeURIComponent(proj2.apiVersion)}`, summary: "List custom domains" }).catch(() => null);
+  const rows = Array.isArray(list) ? list : list?.domains ?? [];
+  let row = rows.find((d) => (d.kind ?? "api") === "mcp" && (!opts.domain || d.hostname === opts.domain.toLowerCase()));
+  if (!row) {
+    let hostname2 = opts.domain?.trim().toLowerCase();
+    if (!hostname2) {
+      const suggested = suggestedMcpHost(defaults.apexDomain);
+      if (!interactive2) {
+        if (!suggested) throw new Error(`A custom MCP hostname is required for the directories. Pass --domain mcp.<your domain>.`);
+        hostname2 = suggested;
+      } else {
+        const { default: inquirer3 } = await import("inquirer");
+        const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: "Hostname for the MCP server (on a domain you control):", ...suggested ? { default: suggested } : {} }]);
+        hostname2 = value?.trim().toLowerCase();
+      }
+    }
+    if (!hostname2) throw new Error("A custom MCP hostname is required for the directories (--domain mcp.<your domain>).");
+    const sp2 = opts.json ? null : (0, import_ora10.default)(`Registering ${hostname2}\u2026`).start();
+    row = await producer(caller, { method: "POST", path: base2, body: { hostname: hostname2, api_version: proj2.apiVersion, kind: "mcp" }, summary: `Add custom MCP domain ${hostname2}` });
+    sp2?.succeed(`Registered ${row.hostname ?? hostname2} as the MCP server's domain.`);
+  }
+  const hostname = row.hostname ?? opts.domain ?? "";
+  if (row.status === "active") return { active: true, hostname };
+  say("");
+  say(import_chalk28.default.bold("  Add this DNS record at your DNS provider (one record; nothing else to add):"));
+  say(`  ${import_chalk28.default.cyan("CNAME")}  ${row.cnameRecord?.name ?? hostname}  \u2192  ${row.cnameRecord?.value ?? "proxy.abz.run"}`);
+  if (row.dcv) say(`  ${import_chalk28.default.cyan("TXT")}    ${row.dcv.name}  =  ${row.dcv.value}`);
+  say("");
+  const minutes = opts.wait === void 0 ? 15 : Number(opts.wait);
+  if (!(minutes > 0) || !row.id) return { active: false, hostname };
+  const sp = opts.json ? null : (0, import_ora10.default)(`Waiting for ${hostname} to activate (Cloudflare validates it once the CNAME resolves; up to ${minutes} min, Ctrl-C to stop and re-run later)\u2026`).start();
+  const until = Date.now() + minutes * 6e4;
+  let status2 = row.status ?? "pending";
+  while (Date.now() < until) {
+    await new Promise((res) => setTimeout(res, 15e3));
+    const s = await producer(caller, { method: "GET", path: `${base2}/${encodeURIComponent(row.id)}/status`, summary: "Check custom-domain status" }).catch(() => null);
+    status2 = s?.status ?? status2;
+    if (sp) sp.text = `Waiting for ${hostname} to activate\u2026 (${status2}, ${Math.max(0, Math.round((until - Date.now()) / 6e4))} min left)`;
+    if (status2 === "active") {
+      sp?.succeed(`${hostname} is active.`);
+      return { active: true, hostname };
+    }
+    if (status2 === "suspended" || status2 === "missing") break;
+  }
+  sp?.fail(`${hostname} is not active yet (${status2}).`);
+  return { active: false, hostname };
+}
+function generatePassword(bytes = () => crypto.getRandomValues(new Uint8Array(20))) {
+  const alphabet = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+  return Array.from(bytes(), (b) => alphabet[b % alphabet.length]).join("");
+}
+async function ensureReviewerAccount(caller, teamId, proj2, opts = {}) {
+  if (!proj2.tenant) throw new Error(`${proj2.projectName} has no tenant yet; attach one first (${B.cli} tenant attach ${proj2.projectName} --tenant <slug>).`);
+  const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(proj2.tenant)}`;
+  const username = (opts.username ?? `reviewer-${proj2.projectId}`).trim().toLowerCase();
+  const password = opts.password ?? generatePassword();
+  const { enabled, clientId } = await producer(caller, { method: "GET", path: `${base2}/password-accounts`, summary: "Check password sign-in" }).then((o) => ({ enabled: !!o?.enabled, clientId: o?.clientId ?? o?.client_id })).catch(() => ({ enabled: false, clientId: void 0 }));
+  if (!enabled && clientId) {
+    await producer(caller, { method: "POST", path: `${base2}/app-clients/${encodeURIComponent(clientId)}/providers`, body: { type: "password" }, summary: "Enable username & password sign-in" });
+  }
+  let finalUser = username;
+  try {
+    const created = await producer(caller, {
+      method: "POST",
+      path: `${base2}/password-accounts`,
+      body: { username, password, purpose: "reviewer", displayName: "Directory reviewer" },
+      summary: `Create reviewer account ${username}`
+    });
+    finalUser = created.account?.username ?? username;
+  } catch (e) {
+    if (!isApiError(e, 409)) throw e;
+    await producer(caller, { method: "POST", path: `${base2}/password-accounts/${encodeURIComponent(username)}/rotate`, body: { password }, summary: `Rotate reviewer account ${username}` });
+  }
+  await producer(caller, {
+    method: "PATCH",
+    path: projectPath(proj2),
+    body: { directory_test_account: { username: finalUser, password, tenant: proj2.tenant, ...clientId ? { app_client_id: clientId } : {} } },
+    summary: "Store the reviewer account for the packet"
+  });
+  return { username: finalUser, password, tenant: proj2.tenant };
+}
+function printReviewer(acct, proj2) {
+  console.log(import_chalk28.default.green(`Reviewer account ${import_chalk28.default.bold(acct.username)} on tenant ${acct.tenant} \u2014 stored (encrypted) for the submission packet.`));
+  console.log();
+  console.log(import_chalk28.default.bold("  Password (shown once):"));
+  console.log(`  ${import_chalk28.default.cyan(acct.username)}  ${import_chalk28.default.bgWhite.black(` ${acct.password} `)}`);
+  console.log();
+  console.log(import_chalk28.default.dim(`  Seed realistic data through the proxy (billed per turn): ${B.cli} agent --seed-for ${proj2.projectName}`));
+}
+async function runConnectorReviewer(project, opts) {
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const platforms = parsePlatforms(opts.platform);
+  const acct = await ensureReviewerAccount(caller, teamId, proj2, { username: opts.username, password: opts.password });
+  const seedLine = `${B.cli} agent --seed-for ${proj2.projectName}`;
+  if (opts.json) {
+    process.stdout.write(JSON.stringify({ username: acct.username, password: acct.password, tenant: acct.tenant, project: proj2.projectId, stored: true, seed: seedLine }) + "\n");
+  } else {
+    printReviewer(acct, proj2);
+  }
+  if (opts.seed) {
+    const { runAgent: runAgent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
+    await runAgent2({ team: opts.team, first: seedMessage(proj2) });
+  }
+}
+function seedMessage(proj2) {
+  return `Seed realistic sample data through the proxy "${proj2.projectName}" so a directory reviewer signing in as the reviewer account on tenant ${proj2.tenant ?? ""} sees a populated account: create a handful of records with each write tool, then list them back. Never mention or use credentials.`;
+}
+async function runConnector(target2, opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const platforms = parsePolicy(opts.policy, opts.platform);
   const json = !!opts.json;
   const interactive2 = !!process.stdin.isTTY && !json && !opts.yes;
   const say = (s) => {
     if (!json) console.log(s);
   };
+  let specSource = null;
+  let projectName = target2;
+  let version2 = opts.apiversion;
+  if (looksLikeSpecArgument(target2)) {
+    specSource = target2.trim();
+    const created = await createFromSpec(specSource, opts, say);
+    projectName = created.name;
+    version2 = created.version;
+    say(import_chalk28.default.green(`  ${B.thing} ${import_chalk28.default.bold(created.name)} created.`));
+  }
+  const proj2 = await resolveProjectVia(caller, teamId, projectName, version2);
   const flagBody = directoryBodyFromFlags(opts);
-  const onlyAttest = !!opts.attest?.length && !flagBody.directory_metadata && !opts.full;
+  const onlyAttest = !!opts.attest?.length && !flagBody.directory_metadata && !opts.full && !specSource;
   if (onlyAttest) {
     await patchProject(caller, proj2, { directory_attestations: flagBody.directory_attestations }, `Attest ${Object.keys(flagBody.directory_attestations).join(", ")}`);
     const r2 = await fetchDirectoryReport(caller, proj2, { platforms, probe: false });
@@ -10241,14 +11149,22 @@ async function runConnector(project, opts) {
       process.stdout.write(JSON.stringify({ attested: Object.keys(flagBody.directory_attestations), headline: r2.rendered.headline }) + "\n");
       return;
     }
-    say(import_chalk26.default.green(`Attested: ${Object.keys(flagBody.directory_attestations).join(", ")}.`) + import_chalk26.default.dim(`  ${r2.rendered.headline}`));
+    say(import_chalk28.default.green(`Attested: ${Object.keys(flagBody.directory_attestations).join(", ")}.`) + import_chalk28.default.dim(`  ${r2.rendered.headline}`));
     return;
   }
+  let defaults = { prompts: [] };
+  const specText = specSource ? await specTextFor(specSource) : await projectSpecText(caller, proj2);
+  if (specText) defaults = listingDefaultsFromSpec(specText, specSource ?? void 0);
+  if (defaults.apexDomain && (!defaults.privacyUrl || !defaults.iconUrl)) {
+    const found = await probeConventionalUrls(defaults.apexDomain);
+    defaults.privacyUrl ??= found.privacyUrl;
+    defaults.iconUrl ??= found.iconUrl;
+  }
   const sp = json ? null : (0, import_ora10.default)(`Turning directory-ready mode on for ${proj2.projectName}\u2026`).start();
   await patchProject(caller, proj2, { directory_ready: true, ...flagBody }, "Enable directory-ready mode");
   sp?.succeed(`Directory-ready mode is on for ${proj2.projectName} v${proj2.apiVersion}.`);
   let r = await fetchDirectoryReport(caller, proj2, { platforms });
-  say(import_chalk26.default.dim(`  ${r.rendered.headline}`));
+  say(import_chalk28.default.dim(`  ${r.rendered.headline}`));
   const fixes = await producer(caller, {
     method: "POST",
     path: `${projectPath(proj2)}/directory-fixes`,
@@ -10258,19 +11174,40 @@ async function runConnector(project, opts) {
     if (isApiError(e, 404)) return { applied: [], skipped: [{ fix: "all", reason: "server has no auto-fixes yet" }] };
     throw e;
   });
-  for (const f of fixes.applied ?? []) say(import_chalk26.default.green(`  \u2713 fixed: ${f}`));
-  for (const s of fixes.skipped ?? []) say(import_chalk26.default.dim(`  \u2013 ${s.fix}: ${s.reason}`));
+  for (const f of fixes.applied ?? []) say(import_chalk28.default.green(`  \u2713 fixed: ${f}`));
+  for (const s of fixes.skipped ?? []) say(import_chalk28.default.dim(`  \u2013 ${s.fix}: ${s.reason}`));
   if (fixes.applied?.length) r = await fetchDirectoryReport(caller, proj2, { platforms });
-  if (!isReady(r, platforms)) {
-    const asked = await promptForMissing(r, interactive2);
+  const domainWasBlocking = r.report.results.some((x) => x.id === DOMAIN_RULE && !x.pass);
+  const domain2 = await ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, say);
+  if (domainWasBlocking && domain2.active) r = await fetchDirectoryReport(caller, proj2, { platforms });
+  if (r.report.results.some((x) => x.id === TOOL_DESC_RULE && !x.pass)) {
+    const changed = await fixToolDescriptions(proj2, r.report.project.environment, interactive2, say);
+    if (changed) r = await fetchDirectoryReport(caller, proj2, { platforms });
+  }
+  const basics = await promptListingBasics(r, interactive2, defaults, opts, platforms);
+  if (!isReady(r, platforms) || Object.keys(basics).length) {
+    const asked = { ...basics, ...isReady(r, platforms) ? {} : await promptForMissing(r, interactive2, defaults, platforms) };
     const body = directoryBodyFromFlags(asked);
-    if (body.directory_metadata || body.directory_attestations) {
+    if (body.directory_metadata || body.directory_attestations || body.openai_challenge_token) {
       await patchProject(caller, proj2, { ...body }, "Save listing details");
       r = await fetchDirectoryReport(caller, proj2, { platforms });
     }
   }
-  if (!isReady(r, platforms)) {
+  let reviewer = null;
+  if (r.report.results.some((x) => x.id === "TEST_ACCOUNT_SET" && !x.pass)) {
+    reviewer = await ensureReviewerAccount(caller, teamId, proj2);
+    if (!json) {
+      console.log();
+      printReviewer(reviewer, proj2);
+    }
+    r = await fetchDirectoryReport(caller, proj2, { platforms });
+  }
+  if (!readyExceptSnapshot(r, platforms)) {
     printReport(r, json);
+    if (!domain2.active && domain2.hostname && !json) {
+      console.error(import_chalk28.default.yellow(`
+  ${domain2.hostname} is not active yet. Once the CNAME is in place, run again: ${B.cli} connector ${proj2.projectName}`));
+    }
     exitNotReady(r, platforms, json);
   }
   r = await fetchDirectoryReport(caller, proj2, { platforms, refreshSnapshot: true, publishedUrl: r.report.project.publishedUrl ?? null });
@@ -10278,78 +11215,141 @@ async function runConnector(project, opts) {
   const dir = opts.out ?? process.cwd();
   const mdPath = import_path4.default.join(dir, `connector-packet-${proj2.projectId}.md`);
   const jsonPath = import_path4.default.join(dir, `connector-packet-${proj2.projectId}.json`);
-  import_fs5.default.writeFileSync(mdPath, packet.markdown, { mode: 384 });
-  import_fs5.default.writeFileSync(jsonPath, JSON.stringify(packet.json, null, 2) + "\n", { mode: 384 });
+  import_fs6.default.writeFileSync(mdPath, packet.markdown, { mode: 384 });
+  import_fs6.default.writeFileSync(jsonPath, JSON.stringify(packet.json, null, 2) + "\n", { mode: 384 });
   if (json) {
-    process.stdout.write(JSON.stringify({ ready: true, headline: r.rendered.headline, report: r.report, packet: { markdown: mdPath, json: jsonPath }, portals: PORTALS }) + "\n");
+    process.stdout.write(JSON.stringify({ ready: true, project: proj2.projectId, headline: r.rendered.headline, report: r.report, packet: { markdown: mdPath, json: jsonPath }, portals: PORTALS, ...reviewer ? { reviewer } : {} }) + "\n");
     return;
   }
   printReport(r, false);
   console.log();
-  console.log(import_chalk26.default.green.bold(`  ${r.rendered.headline}`));
-  console.log(`  Submission packet: ${import_chalk26.default.cyan(mdPath)} and ${import_chalk26.default.cyan(jsonPath)}`);
-  console.log(import_chalk26.default.dim("  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
-  console.log(`  Submit it yourself: Claude ${import_chalk26.default.underline(PORTALS.claude)} \xB7 ChatGPT ${import_chalk26.default.underline(PORTALS.chatgpt)}`);
-  console.log(import_chalk26.default.dim(`  ${r.report.disclaimer}`));
+  console.log(import_chalk28.default.green.bold(`  ${r.rendered.headline}`));
+  console.log(`  Submission packet: ${import_chalk28.default.cyan(mdPath)} and ${import_chalk28.default.cyan(jsonPath)}`);
+  console.log(import_chalk28.default.dim("  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
+  printSubmitSteps(r, mdPath);
+  console.log(import_chalk28.default.dim(`  ${r.report.disclaimer}`));
+}
+var SNAPSHOT_RULE = "LISTING_SNAPSHOT_MATCH";
+var TOOL_DESC_RULE = "TOOL_DESC_NONEMPTY_SPECIFIC";
+var UTILITY_PATH = /(health|ping|status|openapi|swagger|docs|spec|whoami|version)/i;
+var SPECIFIC_MIN = 12;
+function isUtilityTool(t) {
+  const p = t["x-route"]?.path ?? "";
+  return UTILITY_PATH.test(p) || UTILITY_PATH.test(t.name);
+}
+function needsDescription(t) {
+  const d = (t.description ?? "").trim();
+  if (!d || d.length < SPECIFIC_MIN) return true;
+  const m = (t["x-route"]?.method ?? "get").toUpperCase();
+  const p = t["x-route"]?.path ?? "";
+  return new RegExp(`^(${m}\\s+${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${t.name})\\.?$`, "i").test(d);
+}
+function derivedDescription(t) {
+  const m = (t["x-route"]?.method ?? "get").toUpperCase();
+  const p = t["x-route"]?.path ?? "";
+  const summary = (t.summary ?? "").replace(/\s*\(.*?\)\s*/g, " ").replace(/\s+/g, " ").trim() || t.name.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").replace(/^./, (c) => c.toUpperCase());
+  const segments = p.split("/").filter(Boolean);
+  const plural = segments.filter((s) => !s.startsWith("{")).pop()?.replace(/[-_]/g, " ") ?? "result";
+  const one = segments[segments.length - 1]?.startsWith("{");
+  const noun = one ? plural.replace(/s$/, "") : plural;
+  const returns = m === "GET" ? `Returns the ${noun} as JSON.` : m === "POST" ? `Creates it and returns the new ${noun.replace(/s$/, "")} as JSON.` : m === "DELETE" ? `Removes it and returns the result.` : `Applies the change and returns the updated ${noun.replace(/s$/, "")} as JSON.`;
+  return `${summary.replace(/\.$/, "")}. ${m} ${p}. ${returns}`;
+}
+async function fixToolDescriptions(proj2, environment, interactive2, say) {
+  const { loadCatalogue: loadCatalogue2, saveCatalogue: saveCatalogue2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+  const t = { projectId: proj2.projectId, apiVersion: proj2.apiVersion, environment: environment || "dev" };
+  let cat;
+  try {
+    cat = await loadCatalogue2(t);
+  } catch {
+    return false;
+  }
+  const tools = cat.tools;
+  const kept = tools.filter((x) => !isUtilityTool(x));
+  const dropped = tools.filter(isUtilityTool).map((x) => x.name);
+  const todo = kept.filter(needsDescription);
+  if (!dropped.length && !todo.length) return false;
+  if (dropped.length) say(import_chalk28.default.green(`  \u2713 hidden from the MCP (utility endpoints, not tools): ${dropped.join(", ")}`));
+  if (todo.length) {
+    say(import_chalk28.default.dim(`  ${todo.length} tool${todo.length === 1 ? "" : "s"} need a description (what it does and returns):`));
+    const inquirer3 = interactive2 ? (await import("inquirer")).default : null;
+    for (const x of todo) {
+      const def = derivedDescription(x);
+      let text = def;
+      if (inquirer3) {
+        const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: `${x.name}:`, default: def }]);
+        text = value?.trim() || def;
+      }
+      x.description = text;
+      say(import_chalk28.default.green(`  \u2713 ${x.name}: ${text}`));
+    }
+  }
+  cat.tools = kept;
+  await saveCatalogue2(t, cat);
+  return true;
 }
-function generatePassword(bytes = () => crypto.getRandomValues(new Uint8Array(20))) {
-  const alphabet = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789";
-  return Array.from(bytes(), (b) => alphabet[b % alphabet.length]).join("");
+function readyExceptSnapshot(r, platforms) {
+  if (isReady(r, platforms)) return true;
+  const want = platforms ?? r.report.platformsRequested ?? ["claude", "chatgpt"];
+  const blocking = r.report.results.filter((x) => !x.pass && x.severity === "block" && x.platforms.some((p) => want.includes(p)));
+  return blocking.length > 0 && blocking.every((x) => x.id === SNAPSHOT_RULE && /no listing snapshot/i.test(x.message ?? ""));
 }
-async function runConnectorReviewer(project, opts) {
-  const caller = requireCaller();
-  const { teamId } = await resolveActingTeam(caller, opts.team);
-  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  if (!proj2.tenant) throw new Error(`${proj2.projectName} has no tenant yet; attach one first (${B.cli} tenant attach ${proj2.projectName} --tenant <slug>).`);
-  const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(proj2.tenant)}`;
-  const username = (opts.username ?? `reviewer-${proj2.projectId}`).trim().toLowerCase();
-  const password = opts.password ?? generatePassword();
-  const { enabled, clientId } = await producer(caller, { method: "GET", path: `${base2}/password-accounts`, summary: "Check password sign-in" }).then((o) => ({ enabled: !!o?.enabled, clientId: o?.clientId ?? o?.client_id })).catch(() => ({ enabled: false, clientId: void 0 }));
-  if (!enabled && clientId) {
-    await producer(caller, { method: "POST", path: `${base2}/app-clients/${encodeURIComponent(clientId)}/providers`, body: { type: "password" }, summary: "Enable username & password sign-in" });
+async function probeConventionalUrls(apexDomain, fetchFn = headStatus) {
+  if (!apexDomain) return {};
+  const out = {};
+  const hosts = [`https://${apexDomain}`, `https://www.${apexDomain}`];
+  const privacyPaths = ["/privacy", "/privacy-policy", "/legal/privacy", "/privacy.html"];
+  const iconPaths = ["/icon-512.png", "/icon.png", "/apple-touch-icon.png", "/logo.png", "/android-chrome-512x512.png"];
+  outer: for (const h of hosts) for (const p of privacyPaths) {
+    if (await fetchFn(`${h}${p}`) === 200) {
+      out.privacyUrl = `${h}${p}`;
+      break outer;
+    }
   }
-  const created = await producer(caller, {
-    method: "POST",
-    path: `${base2}/password-accounts`,
-    body: { username, password, purpose: "reviewer", displayName: "Directory reviewer" },
-    summary: `Create reviewer account ${username}`
-  });
-  const finalUser = created.account?.username ?? username;
-  await producer(caller, {
-    method: "PATCH",
-    path: projectPath(proj2),
-    body: { directory_test_account: { username: finalUser, password, tenant: proj2.tenant, ...clientId ? { app_client_id: clientId } : {} } },
-    summary: "Store the reviewer account for the packet"
-  });
-  const seedLine = `${B.cli} agent --seed-for ${proj2.projectName}`;
-  if (opts.json) {
-    process.stdout.write(JSON.stringify({ username: finalUser, password, tenant: proj2.tenant, project: proj2.projectId, stored: true, seed: seedLine }) + "\n");
-  } else {
-    console.log(import_chalk26.default.green(`Reviewer account ${import_chalk26.default.bold(finalUser)} on tenant ${proj2.tenant} \u2014 stored (encrypted) for the submission packet.`));
-    console.log();
-    console.log(import_chalk26.default.bold("  Password (shown once):"));
-    console.log(`  ${import_chalk26.default.cyan(finalUser)}  ${import_chalk26.default.bgWhite.black(` ${password} `)}`);
-    console.log();
-    console.log(import_chalk26.default.dim(`  Seed realistic data through the proxy (billed per turn): ${seedLine}`));
+  outer2: for (const h of hosts) for (const p of iconPaths) {
+    if (await fetchFn(`${h}${p}`) === 200) {
+      out.iconUrl = `${h}${p}`;
+      break outer2;
+    }
   }
-  if (opts.seed) {
-    const { runAgent: runAgent2 } = await Promise.resolve().then(() => (init_agent(), agent_exports));
-    await runAgent2({ team: opts.team, first: seedMessage(proj2) });
+  return out;
+}
+async function validatePrivacyUrl(input, fetchFn = headStatus) {
+  const u = (input ?? "").trim();
+  if (!u) return "A public privacy policy URL is required by both directories.";
+  if (!/^https:\/\//i.test(u)) return "The privacy URL must start with https://";
+  const status2 = await fetchFn(u);
+  if (status2 === 200) return true;
+  return status2 === 0 ? `${u} did not answer (timeout or DNS). Publish the page, then enter its URL.` : `${u} answered ${status2}; it must answer 200.`;
+}
+async function headStatus(u) {
+  try {
+    const res = await fetch(u, { method: "GET", redirect: "follow", signal: AbortSignal.timeout(5e3) });
+    return res.status;
+  } catch {
+    return 0;
   }
 }
-function seedMessage(proj2) {
-  return `Seed realistic sample data through the proxy "${proj2.projectName}" so a directory reviewer signing in as the reviewer account on tenant ${proj2.tenant ?? ""} sees a populated account: create a handful of records with each write tool, then list them back. Never mention or use credentials.`;
+function printSubmitSteps(r, mdPath) {
+  const url = r.report.project.publishedUrl ?? "(the MCP URL in the packet)";
+  console.log();
+  console.log(import_chalk28.default.bold("  Submit (you do this part; the packet has every value to paste):"));
+  console.log(`  1. Test it yourself first: add ${import_chalk28.default.cyan(url)} as a custom connector in Claude (Settings \u2192 Connectors) and in ChatGPT (Developer mode), sign in with the reviewer account, run a tool.`);
+  console.log(`  2. Claude: ${import_chalk28.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, the reviewer credentials and the test steps from ${import_chalk28.default.cyan(import_path4.default.basename(mdPath))}.`);
+  console.log(`  3. ChatGPT: ${import_chalk28.default.underline(PORTALS.chatgpt)} \u2192 the same packet, plus the 5 + 3 test cases it lists.`);
+  console.log(`  4. Keep the reviewer account alive; a nightly re-check emails you if the listing drifts.`);
+  console.log();
 }
 
 // src/commands/skill.ts
-var import_fs8 = __toESM(require("fs"));
+var import_fs9 = __toESM(require("fs"));
 var import_os2 = __toESM(require("os"));
 var import_path7 = __toESM(require("path"));
-var import_chalk30 = __toESM(require("chalk"));
+var import_chalk32 = __toESM(require("chalk"));
 init_brand();
 
 // src/lib/detect-backend.ts
-var import_fs6 = __toESM(require("fs"));
+var import_fs7 = __toESM(require("fs"));
 var import_path5 = __toESM(require("path"));
 var import_net = __toESM(require("net"));
 var NODE_SERVERS = [
@@ -10381,9 +11381,9 @@ var COMMON_PORTS = [3e3, 3001, 4e3, 5e3, 8e3, 8080, 8787];
 var SPEC_PATHS = ["/openapi.json", "/openapi.yaml", "/docs/openapi.json", "/swagger.json", "/api/openapi.json"];
 function readText(file2, max = 256 * 1024) {
   try {
-    const st = import_fs6.default.statSync(file2);
+    const st = import_fs7.default.statSync(file2);
     if (!st.isFile() || st.size > max) return null;
-    return import_fs6.default.readFileSync(file2, "utf8");
+    return import_fs7.default.readFileSync(file2, "utf8");
   } catch {
     return null;
   }
@@ -10579,7 +11579,7 @@ async function liveSpec(port) {
 async function detectBackend(dir, opts = {}) {
   const out = {};
   try {
-    if (import_fs6.default.existsSync(import_path5.default.join(dir, ".demo", "state.json"))) out.isDemo = true;
+    if (import_fs7.default.existsSync(import_path5.default.join(dir, ".demo", "state.json"))) out.isDemo = true;
     fromNode(dir, out);
     if (!out.framework) fromPython(dir, out);
     if (!out.framework) fromOthers(dir, out);
@@ -10687,7 +11687,7 @@ function staleSkillCopies(cwd = process.cwd(), home = import_os2.default.homedir
   for (const dir of /* @__PURE__ */ new Set([cwd, home])) {
     const f = import_path7.default.join(dir, SKILL_RELATIVE_PATH);
     try {
-      if (import_fs8.default.readFileSync(f, "utf8") !== current) out.push(f);
+      if (import_fs9.default.readFileSync(f, "utf8") !== current) out.push(f);
     } catch {
     }
   }
@@ -11007,11 +12007,13 @@ the header are not owned by ana@example.com's key.
 
 ## Listing it in the Claude or ChatGPT directory
 
-\`npx ${cli} connector <name>\` \u2014 directory-ready in one command: it checks what the directories
-require (your own domain for the MCP URL, OAuth sign-in, tool names and descriptions, a
-privacy page, a reviewer account), applies the safe fixes, asks for what is missing, and
-writes the submission packet when every check passes. \`npx ${cli} check --directory-ready <name>\`
-is the report alone. Passing the checks means the MCP meets the requirements APIblaze can
+\`npx ${cli} create --policy --target https://yourdomain.com/openapi.yaml --domain mcp.yourdomain.com\` \u2014 directory-ready
+in one command, to the letter of the Claude directory's policies (\`--policy chatgpt\` or \`--policy all\` for OpenAI's too;
+\`npx ${cli} connector <name> --policy \u2026\` runs the same flow on an existing ${B.thingShort}): it creates the ${B.thingShort} from the spec, checks what the
+directories require, applies the safe fixes, registers the MCP hostname and waits for its ONE CNAME
+(\u2192 proxy.abz.run), hides utility endpoints and fills thin tool descriptions, asks for the rest with
+every answer pre-filled from the spec and cut to the portal's limits (Enter accepts), creates the reviewer account, and writes the
+submission packet when every check passes. \`npx ${cli} check --directory-ready <name>\` is the report alone. Passing the checks means the MCP meets the requirements APIblaze can
 verify; listing decisions are made by Anthropic and OpenAI, and you submit the packet yourself.
 
 ## No shell? The control-plane MCP
@@ -11119,21 +12121,21 @@ async function runForPerson(found) {
   const P = B.product;
   const run2 = `npx ${B.cli}@latest`;
   console.log();
-  console.log(`  ${import_chalk30.default.bold(pitchText().split(". ")[0] + ".")}`);
+  console.log(`  ${import_chalk32.default.bold(pitchText().split(". ")[0] + ".")}`);
   console.log(`  ${pitchText().split(". ").slice(1).join(". ")}`);
   console.log();
-  console.log(import_chalk30.default.dim(`  With an AI assistant? Tell it: "Tell me what ${B.cli} can do for me using ${run2} skills"`));
+  console.log(import_chalk32.default.dim(`  With an AI assistant? Tell it: "Tell me what ${B.cli} can do for me using ${run2} skills"`));
   console.log();
   const report = folderReport(found, { forPerson: true });
   for (const l of report.lines) console.log(`  ${l.replace(/`/g, "")}`);
   const port = backendPort(found);
   if (report.ownApi && found.listening) {
     const args = ["dev", "--port", String(found.listening), ...found.specFile ? ["--openapi", found.specFile] : []];
-    if (!await ask2(`  ${import_chalk30.default.bold("?")} Put your API on port ${found.listening} behind ${P} now? ${import_chalk30.default.dim("(Y/n)")} `)) {
-      console.log(`  Any time: ${import_chalk30.default.cyan(`${run2} ${args.join(" ")}`)}`);
+    if (!await ask2(`  ${import_chalk32.default.bold("?")} Put your API on port ${found.listening} behind ${P} now? ${import_chalk32.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk32.default.cyan(`${run2} ${args.join(" ")}`)}`);
       return;
     }
-    console.log(import_chalk30.default.dim(`  $ ${run2} ${args.join(" ")}`));
+    console.log(import_chalk32.default.dim(`  $ ${run2} ${args.join(" ")}`));
     const { spawnSync: spawnSync4 } = await import("child_process");
     const r = spawnSync4(process.execPath, [process.argv[1], ...args], { stdio: "inherit" });
     process.exitCode = r.status ?? 0;
@@ -11142,18 +12144,18 @@ async function runForPerson(found) {
   if (report.ownApi) {
     const args = ["dev", "--port", String(port ?? 3e3), ...found.specFile ? ["--openapi", found.specFile] : []];
     const startHint = found.start ? `, once you start it (${found.start})` : ", once it runs";
-    if (!await ask2(`  ${import_chalk30.default.bold("?")} Put it behind ${P} now? It reaches your app on port ${port ?? 3e3}${startHint}. ${import_chalk30.default.dim("(Y/n)")} `)) {
-      console.log(`  Any time: ${import_chalk30.default.cyan(`${run2} ${args.join(" ")}`)}`);
+    if (!await ask2(`  ${import_chalk32.default.bold("?")} Put it behind ${P} now? It reaches your app on port ${port ?? 3e3}${startHint}. ${import_chalk32.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk32.default.cyan(`${run2} ${args.join(" ")}`)}`);
       return;
     }
-    console.log(import_chalk30.default.dim(`  $ ${run2} ${args.join(" ")}`));
+    console.log(import_chalk32.default.dim(`  $ ${run2} ${args.join(" ")}`));
     const { spawnSync: spawnSync4 } = await import("child_process");
     const r = spawnSync4(process.execPath, [process.argv[1], ...args], { stdio: "inherit" });
     process.exitCode = r.status ?? 0;
     return;
   }
-  if (!await ask2(`  ${import_chalk30.default.bold("?")} Create a demo app to try out ${P}? ${import_chalk30.default.dim("(Y/n)")} `)) {
-    console.log(`  Your own app, when it runs: ${import_chalk30.default.cyan(`${run2} dev --port <port>`)}`);
+  if (!await ask2(`  ${import_chalk32.default.bold("?")} Create a demo app to try out ${P}? ${import_chalk32.default.dim("(Y/n)")} `)) {
+    console.log(`  Your own app, when it runs: ${import_chalk32.default.cyan(`${run2} dev --port <port>`)}`);
     return;
   }
   const { runDemo: runDemo2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
@@ -11186,29 +12188,29 @@ async function runSkill(opts = {}) {
 function installSkill(opts) {
   const md = skillMarkdown();
   const target2 = import_path7.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
-  if (import_fs8.default.existsSync(target2) && !opts.force) {
-    console.error(import_chalk30.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
+  if (import_fs9.default.existsSync(target2) && !opts.force) {
+    console.error(import_chalk32.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
     process.exit(1);
   }
-  import_fs8.default.mkdirSync(import_path7.default.dirname(target2), { recursive: true });
-  import_fs8.default.writeFileSync(target2, md, "utf8");
-  console.log(`${import_chalk30.default.green("\u2713")} Installed the ${import_chalk30.default.bold(SKILL_NAME)} skill: ${import_chalk30.default.bold(target2)}`);
-  console.log(import_chalk30.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
+  import_fs9.default.mkdirSync(import_path7.default.dirname(target2), { recursive: true });
+  import_fs9.default.writeFileSync(target2, md, "utf8");
+  console.log(`${import_chalk32.default.green("\u2713")} Installed the ${import_chalk32.default.bold(SKILL_NAME)} skill: ${import_chalk32.default.bold(target2)}`);
+  console.log(import_chalk32.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
 }
 
 // src/commands/integration.ts
-var import_chalk31 = __toESM(require("chalk"));
+var import_chalk33 = __toESM(require("chalk"));
 var import_ora12 = __toESM(require("ora"));
 init_caller();
 init_api();
 init_brand();
 function file(f, indent2 = "     ") {
-  console.log(`   ${import_chalk31.default.cyan(f.file)}`);
+  console.log(`   ${import_chalk33.default.cyan(f.file)}`);
   for (const line of f.code.split("\n")) console.log(`${indent2}${line}`);
   console.log();
 }
 function bullets(lines, indent2 = "   ") {
-  for (const l of lines) console.log(`${indent2}${import_chalk31.default.dim("\u2022")} ${l}`);
+  for (const l of lines) console.log(`${indent2}${import_chalk33.default.dim("\u2022")} ${l}`);
 }
 async function runIntegration(name, opts = {}) {
   const stackRaw = (opts.stack ?? "nextjs").trim().toLowerCase();
@@ -11233,44 +12235,44 @@ async function runIntegration(name, opts = {}) {
     return;
   }
   console.log();
-  console.log(import_chalk31.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
-  console.log(import_chalk31.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
+  console.log(import_chalk33.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
+  console.log(import_chalk33.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
   console.log();
-  console.log(`  ${import_chalk31.default.dim("Proxy:  ")} ${import_chalk31.default.bold(kit.urls.proxy)}`);
-  console.log(`  ${import_chalk31.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk31.default.dim(" \xB7 "))}`);
-  console.log(`  ${import_chalk31.default.dim("Portal: ")} ${kit.urls.portal}`);
-  console.log(`  ${import_chalk31.default.dim("Spec:   ")} ${kit.urls.openapi}`);
+  console.log(`  ${import_chalk33.default.dim("Proxy:  ")} ${import_chalk33.default.bold(kit.urls.proxy)}`);
+  console.log(`  ${import_chalk33.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk33.default.dim(" \xB7 "))}`);
+  console.log(`  ${import_chalk33.default.dim("Portal: ")} ${kit.urls.portal}`);
+  console.log(`  ${import_chalk33.default.dim("Spec:   ")} ${kit.urls.openapi}`);
   const w = kit["1_frontend_widgets"];
   console.log();
-  console.log(import_chalk31.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
-  console.log(import_chalk31.default.dim(`   ${w.note}`));
+  console.log(import_chalk33.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
+  console.log(import_chalk33.default.dim(`   ${w.note}`));
   console.log();
   file(w.frontend);
   for (const r of w.server_routes) file(r);
   const c = kit["2_frontend_server_call_through"];
-  console.log(import_chalk31.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
+  console.log(import_chalk33.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
   console.log();
   file(c);
   const t = kit["3_backend_trust_contract"];
-  console.log(import_chalk31.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
-  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk31.default.cyan(h)} \u2014 ${why}`);
+  console.log(import_chalk33.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
+  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk33.default.cyan(h)} \u2014 ${why}`);
   console.log();
-  console.log(`   ${import_chalk31.default.dim("How to verify:")}`);
+  console.log(`   ${import_chalk33.default.dim("How to verify:")}`);
   bullets(t.how_to_verify);
   console.log();
-  console.log(`   ${import_chalk31.default.dim("Never:")}`);
+  console.log(`   ${import_chalk33.default.dim("Never:")}`);
   bullets(t.what_not_to_do);
   console.log();
-  console.log(import_chalk31.default.bold("4. Env vars (server only)"));
-  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk31.default.cyan(k)}  ${import_chalk31.default.dim("=")}  ${v}`);
+  console.log(import_chalk33.default.bold("4. Env vars (server only)"));
+  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk33.default.cyan(k)}  ${import_chalk33.default.dim("=")}  ${v}`);
   const o = kit["5_what_stays_open"];
   console.log();
-  console.log(import_chalk31.default.bold("5. What stays open"));
-  console.log(`   ${import_chalk31.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk31.default.dim("nothing")}`);
-  console.log(`   ${import_chalk31.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk31.default.dim("nothing")}`);
-  console.log(import_chalk31.default.dim(`   ${o.note}`));
+  console.log(import_chalk33.default.bold("5. What stays open"));
+  console.log(`   ${import_chalk33.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk33.default.dim("nothing")}`);
+  console.log(`   ${import_chalk33.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk33.default.dim("nothing")}`);
+  console.log(import_chalk33.default.dim(`   ${o.note}`));
   console.log();
-  console.log(import_chalk31.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
+  console.log(import_chalk33.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
   console.log();
 }
 
@@ -11278,14 +12280,14 @@ async function runIntegration(name, opts = {}) {
 init_claim();
 
 // src/commands/logout.ts
-var import_chalk32 = __toESM(require("chalk"));
+var import_chalk34 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 async function runLogout(opts = {}) {
   const creds = loadCredentials();
   const consumer2 = loadConsumer();
   if (!creds && !consumer2) {
-    console.log(import_chalk32.default.yellow("You were not logged in."));
+    console.log(import_chalk34.default.yellow("You were not logged in."));
     return;
   }
   let target2;
@@ -11312,96 +12314,96 @@ async function runLogout(opts = {}) {
   }
   if (target2 === "producer" || target2 === "all") {
     clearCredentials();
-    console.log(import_chalk32.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
+    console.log(import_chalk34.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
   }
   if (target2 === "consumer" || target2 === "all") {
     clearConsumer();
-    console.log(import_chalk32.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
+    console.log(import_chalk34.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
   }
 }
 
 // src/commands/flush.ts
-var import_chalk33 = __toESM(require("chalk"));
-var fs16 = __toESM(require("fs"));
+var import_chalk35 = __toESM(require("chalk"));
+var fs17 = __toESM(require("fs"));
 var path14 = __toESM(require("path"));
 init_auth();
 init_external_mcp();
 async function runFlush(opts) {
   const { stopDemos: stopDemos2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
   const demos = await stopDemos2().catch(() => 0);
-  if (demos) console.log(import_chalk33.default.dim(`  Stopped ${demos} running demo(s).`));
+  if (demos) console.log(import_chalk35.default.dim(`  Stopped ${demos} running demo(s).`));
   const dir = getApiblazeDir();
-  const entries2 = fs16.existsSync(dir) ? fs16.readdirSync(dir) : [];
+  const entries2 = fs17.existsSync(dir) ? fs17.readdirSync(dir) : [];
   if (!entries2.length) {
-    console.log(import_chalk33.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
+    console.log(import_chalk35.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
   }
-  console.log(import_chalk33.default.yellow("This removes ALL local apiblaze state from this machine:"));
-  console.log(import_chalk33.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
-  console.log(import_chalk33.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
-  console.log(import_chalk33.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
-  console.log(import_chalk33.default.dim(`  (${entries2.length} item(s) in ${dir})`));
+  console.log(import_chalk35.default.yellow("This removes ALL local apiblaze state from this machine:"));
+  console.log(import_chalk35.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
+  console.log(import_chalk35.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
+  console.log(import_chalk35.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
+  console.log(import_chalk35.default.dim(`  (${entries2.length} item(s) in ${dir})`));
   const footprint = apiblazeMcpFootprint();
   const mdFiles = ["claude", "codex"].map((k) => ({ k, file: agentInstructionFile(k) })).filter(({ file: file2 }) => {
     try {
-      return fs16.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
+      return fs17.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
     } catch {
       return false;
     }
   });
   if (footprint.claude.length || footprint.codex.length) {
-    console.log(import_chalk33.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
+    console.log(import_chalk35.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
   }
   if (mdFiles.length) {
-    console.log(import_chalk33.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path14.basename(m.file)).join(" and ")} (here)`));
+    console.log(import_chalk35.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path14.basename(m.file)).join(" and ")} (here)`));
   }
-  console.log(import_chalk33.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
+  console.log(import_chalk35.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
   if (!opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
     const { ok } = await inquirer3.prompt([
       { type: "confirm", name: "ok", message: "Delete all local state?", default: false }
     ]);
     if (!ok) {
-      console.log(import_chalk33.default.dim("Cancelled \u2014 nothing removed."));
+      console.log(import_chalk35.default.dim("Cancelled \u2014 nothing removed."));
       return;
     }
   }
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs16.rmSync(path14.join(dir, e), { recursive: true, force: true });
+      fs17.rmSync(path14.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
-      console.log(import_chalk33.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
+      console.log(import_chalk35.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
     }
   }
   for (const name of footprint.claude) {
-    console.log(removeClaudeServer(name) ? `  ${import_chalk33.default.dim("\u2022")} removed MCP ${import_chalk33.default.bold(name)} from Claude CLI` : import_chalk33.default.yellow(`  \u2717 could not remove MCP ${name} from Claude CLI`));
+    console.log(removeClaudeServer(name) ? `  ${import_chalk35.default.dim("\u2022")} removed MCP ${import_chalk35.default.bold(name)} from Claude CLI` : import_chalk35.default.yellow(`  \u2717 could not remove MCP ${name} from Claude CLI`));
   }
   for (const name of footprint.codex) {
-    console.log(removeCodexServer(name) ? `  ${import_chalk33.default.dim("\u2022")} removed MCP ${import_chalk33.default.bold(name)} from Codex` : import_chalk33.default.yellow(`  \u2717 could not remove MCP ${name} from Codex`));
+    console.log(removeCodexServer(name) ? `  ${import_chalk35.default.dim("\u2022")} removed MCP ${import_chalk35.default.bold(name)} from Codex` : import_chalk35.default.yellow(`  \u2717 could not remove MCP ${name} from Codex`));
   }
   for (const { k, file: file2 } of mdFiles) {
     let text = "";
     try {
-      text = fs16.readFileSync(file2, "utf-8");
+      text = fs17.readFileSync(file2, "utf-8");
     } catch {
       continue;
     }
     const names = [...text.matchAll(/<!-- apiblaze:mcp:([^\s>]+) -->/g)].map((m) => m[1]);
     let cleared = 0;
     for (const n of new Set(names)) if (removeAgentInstruction(k, n)) cleared++;
-    if (cleared) console.log(`  ${import_chalk33.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk33.default.bold(path14.basename(file2))}`);
+    if (cleared) console.log(`  ${import_chalk35.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk35.default.bold(path14.basename(file2))}`);
   }
-  console.log(`${import_chalk33.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
-  console.log(import_chalk33.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
+  console.log(`${import_chalk35.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
+  console.log(import_chalk35.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
 }
 
 // src/index.ts
 init_demo();
 
 // src/commands/whoami.ts
-var import_chalk34 = __toESM(require("chalk"));
+var import_chalk36 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 init_anon_cred();
@@ -11425,54 +12427,54 @@ async function runWhoami(opts = {}) {
     }, null, 2));
     return;
   }
-  console.log(import_chalk34.default.bold("API Producer"));
+  console.log(import_chalk36.default.bold("API Producer"));
   if (!creds) {
-    console.log(import_chalk34.default.dim("  Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk36.default.dim("  Not logged in. Run `apiblaze login`."));
   } else {
     const who = creds.githubHandle ?? creds.email ?? creds.apiblazeUserId ?? "unknown";
-    console.log(`  ${import_chalk34.default.cyan("Signed in as")} ${import_chalk34.default.bold(who)}`);
+    console.log(`  ${import_chalk36.default.cyan("Signed in as")} ${import_chalk36.default.bold(who)}`);
     if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
-    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk34.default.bold(creds.teamName ?? creds.teamId)}`);
-    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk34.default.bold(creds.activeTenant)}  ${import_chalk34.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
-    if (Date.now() >= creds.expiresAt) console.log(import_chalk34.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
+    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk36.default.bold(creds.teamName ?? creds.teamId)}`);
+    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk36.default.bold(creds.activeTenant)}  ${import_chalk36.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
+    if (Date.now() >= creds.expiresAt) console.log(import_chalk36.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
   }
   if (anon) {
     const masked = `${anon.cp_key.slice(0, 11)}\u2026${anon.cp_key.slice(-4)}`;
-    console.log(import_chalk34.default.bold("\nAnonymous workspace") + import_chalk34.default.dim("  (created without an account \u2014 unclaimed)"));
-    console.log(`  Team:    ${import_chalk34.default.bold(anon.team_id)}`);
-    console.log(`  CP key:  ${import_chalk34.default.bold(masked)}  ${import_chalk34.default.dim("controls the proxies you created anonymously")}`);
+    console.log(import_chalk36.default.bold("\nAnonymous workspace") + import_chalk36.default.dim("  (created without an account \u2014 unclaimed)"));
+    console.log(`  Team:    ${import_chalk36.default.bold(anon.team_id)}`);
+    console.log(`  CP key:  ${import_chalk36.default.bold(masked)}  ${import_chalk36.default.dim("controls the proxies you created anonymously")}`);
     console.log(
-      import_chalk34.default.dim(`  Keep it: ${import_chalk34.default.cyan("apiblaze login")} then ${import_chalk34.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk34.default.dim(`  \xB7  from another machine: ${import_chalk34.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
+      import_chalk36.default.dim(`  Keep it: ${import_chalk36.default.cyan("apiblaze login")} then ${import_chalk36.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk36.default.dim(`  \xB7  from another machine: ${import_chalk36.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
     );
-    if (creds) console.log(import_chalk34.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
+    if (creds) console.log(import_chalk36.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
   }
-  console.log(import_chalk34.default.bold("\nAPI Consumer"));
+  console.log(import_chalk36.default.bold("\nAPI Consumer"));
   if (!consumer2) {
-    console.log(import_chalk34.default.dim("  Not logged in. Run `apiblaze consumer login`."));
+    console.log(import_chalk36.default.dim("  Not logged in. Run `apiblaze consumer login`."));
   } else {
-    console.log(`  ${import_chalk34.default.cyan("Signed in as")} ${import_chalk34.default.bold(consumer2.email ?? consumer2.tenant)}`);
-    console.log(`  Tenant:  ${import_chalk34.default.bold(consumer2.tenant)}`);
-    if (Date.now() >= consumer2.expiresAt) console.log(import_chalk34.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
+    console.log(`  ${import_chalk36.default.cyan("Signed in as")} ${import_chalk36.default.bold(consumer2.email ?? consumer2.tenant)}`);
+    console.log(`  Tenant:  ${import_chalk36.default.bold(consumer2.tenant)}`);
+    if (Date.now() >= consumer2.expiresAt) console.log(import_chalk36.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
   }
 }
 
 // src/commands/team.ts
-var import_chalk35 = __toESM(require("chalk"));
+var import_chalk37 = __toESM(require("chalk"));
 var import_ora13 = __toESM(require("ora"));
 init_auth();
 init_api();
 init_admin();
 function fail5(message, hint) {
-  console.error(import_chalk35.default.red(`Error: ${message}`));
-  if (hint) console.error(import_chalk35.default.dim(hint));
+  console.error(import_chalk37.default.red(`Error: ${message}`));
+  if (hint) console.error(import_chalk37.default.dim(hint));
   process.exit(1);
 }
 function activate(creds, team) {
   const next = { ...creds, teamId: team.teamId, teamName: team.name };
   if (creds.teamId !== team.teamId) delete next.activeTenant;
   saveCredentials(next);
-  console.log(import_chalk35.default.green(`
-\u2714 Active team: ${import_chalk35.default.bold(team.name)}`));
+  console.log(import_chalk37.default.green(`
+\u2714 Active team: ${import_chalk37.default.bold(team.name)}`));
 }
 async function promptName(message) {
   const { default: inquirer3 } = await import("inquirer");
@@ -11480,7 +12482,7 @@ async function promptName(message) {
     const { name } = await inquirer3.prompt([{ type: "input", name: "name", message }]);
     const trimmed = (name ?? "").trim();
     if (trimmed.length >= 2) return trimmed;
-    console.log(import_chalk35.default.yellow("  Team name must be at least 2 characters.\n"));
+    console.log(import_chalk37.default.yellow("  Team name must be at least 2 characters.\n"));
   }
 }
 async function createAndActivate(creds, name) {
@@ -11502,7 +12504,7 @@ async function createAndActivate(creds, name) {
   }
   spinner.stop();
   if (!created?.team_id) fail5("The server created no team id.");
-  console.log(`${import_chalk35.default.green("\u2714")} Team created: ${import_chalk35.default.bold(created.name ?? name)} ${import_chalk35.default.dim(`(${created.team_id})`)}`);
+  console.log(`${import_chalk37.default.green("\u2714")} Team created: ${import_chalk37.default.bold(created.name ?? name)} ${import_chalk37.default.dim(`(${created.team_id})`)}`);
   activate(creds, { teamId: created.team_id, name: created.name ?? name });
 }
 async function runTeam(arg, opts = {}) {
@@ -11559,11 +12561,11 @@ async function runTeam(arg, opts = {}) {
     default: creds.teamId,
     choices: [
       ...teams.map((t) => ({
-        name: t.teamId === creds.teamId ? `${t.name} ${import_chalk35.default.dim("(current)")}` : t.name,
+        name: t.teamId === creds.teamId ? `${t.name} ${import_chalk37.default.dim("(current)")}` : t.name,
         value: t.teamId
       })),
       new inquirer3.Separator(),
-      { name: import_chalk35.default.green("\uFF0B Create a new team"), value: CREATE }
+      { name: import_chalk37.default.green("\uFF0B Create a new team"), value: CREATE }
     ]
   }]);
   if (picked === CREATE) {
@@ -11578,7 +12580,7 @@ async function runTeam(arg, opts = {}) {
 init_allow_oauth_registration();
 
 // src/commands/docs.ts
-var import_chalk36 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 init_apichat();
 var CONTROL_PLANE_TARGET = "https://api.mcp.apiblaze.com/openapi.json";
 function opTenantForTeam3(teamId) {
@@ -11589,168 +12591,66 @@ async function runDocsWeb() {
   const { openRegistrationAuthorization: openRegistrationAuthorization2 } = await Promise.resolve().then(() => (init_allow_oauth_registration(), allow_oauth_registration_exports));
   const creds = loadCredentials2();
   if (!creds?.teamId) {
-    console.error(import_chalk36.default.red("Error: Connecting a web chatbot needs an account."));
-    console.error(import_chalk36.default.dim("Run `apiblaze login` first (free)."));
+    console.error(import_chalk38.default.red("Error: Connecting a web chatbot needs an account."));
+    console.error(import_chalk38.default.dim("Run `apiblaze login` first (free)."));
     process.exit(1);
   }
   const tenant2 = opTenantForTeam3(creds.teamId);
   const url = `https://externalauth-${tenant2}.mcp.apiblaze.com/1.0.0/prod`;
-  console.log(import_chalk36.default.bold("\n  Your personal APIblaze MCP URL \u2014 paste it into claude.ai or ChatGPT:\n"));
-  console.log("    " + import_chalk36.default.bgCyan.black.bold(` ${url} `));
-  console.log(import_chalk36.default.dim(`
+  console.log(import_chalk38.default.bold("\n  Your personal APIblaze MCP URL \u2014 paste it into claude.ai or ChatGPT:\n"));
+  console.log("    " + import_chalk38.default.bgCyan.black.bold(` ${url} `));
+  console.log(import_chalk38.default.dim(`
   It is scoped to your team (${creds.teamName ?? creds.teamId}) \u2014 nobody else's account is reachable through it.`));
   const ok = await openRegistrationAuthorization2(creds.teamId, tenant2, 900);
-  console.log(ok ? `
-  ${import_chalk36.default.green("\u2714")} Connection pre-authorized (single use, 15 min) \u2014 connect now and it won't ask you to approve the app.` : import_chalk36.default.yellow("\n  Could not pre-authorize the connection. If the sign-in says the app needs verifying, run:\n    apiblaze allowoauthregistration --apiblaze"));
-  console.log(import_chalk36.default.dim("\n  Re-run this command any time to authorize another client."));
-}
-async function runDocs(opts) {
-  console.log("");
-  console.log(import_chalk36.default.bgYellow.black.bold("  This is not a docs search \u2014 the chatbot can CHANGE your account.  "));
-  console.log(import_chalk36.default.yellow(`  It connects ${import_chalk36.default.bold("Claude Code")} or ${import_chalk36.default.bold("Codex")} to the real APIblaze API, acting as you:`));
-  console.log(import_chalk36.default.yellow("  it can create proxies, add logins, invite teammates and point domains for real."));
-  console.log(import_chalk36.default.yellow("  Destructive actions (deleting proxies, teams or products) are deliberately not exposed."));
-  console.log(import_chalk36.default.dim('  Read-only questions ("what proxies do I have?") are of course fine.'));
-  console.log("");
-  if (!opts.yes && !opts.prompt && process.stdin.isTTY) {
-    const { default: inquirer3 } = await import("inquirer");
-    const { ok } = await inquirer3.prompt([{
-      type: "confirm",
-      name: "ok",
-      default: true,
-      message: "Continue, knowing the chatbot can act on your account?"
-    }]);
-    if (!ok) {
-      console.log(import_chalk36.default.dim("\n  Nothing connected. The written docs are at https://www.apiblaze.com/docs"));
-      return;
-    }
-  }
-  if (opts.web) {
-    await runDocsWeb();
-    return;
-  }
-  const forwarded = {
-    target: CONTROL_PLANE_TARGET,
-    prompt: opts.prompt,
-    installMcp: opts.installMcp,
-    removeMcp: opts.removeMcp,
-    verbose: opts.verbose,
-    // `--remove-mcp` needs the project name; the control-plane proxy is `externalauth`.
-    ...opts.removeMcp ? { project: "externalauth" } : {}
-  };
-  await runApichat(forwarded);
-}
-
-// src/commands/authz.ts
-var import_chalk39 = __toESM(require("chalk"));
-init_auth();
-init_api();
-
-// src/lib/agent-chat.ts
-var import_readline = __toESM(require("readline"));
-var import_chalk37 = __toESM(require("chalk"));
-init_problem();
-init_brand();
-init_api();
-init_admin();
-async function runAgentChatRepl(opts) {
-  const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
-  console.log("\n" + import_chalk37.default.cyan.bold(title));
-  if (subtitle) console.log(import_chalk37.default.dim(subtitle));
-  const messages = [];
-  const ctx = { proposal: null, lastData: null, log: (s) => console.log(s) };
-  const cmdByName = new Map(commands.map((c) => [c.name, c]));
-  const footer = () => {
-    const parts = [
-      import_chalk37.default.dim("type to chat/refine"),
-      ...commands.map((c) => import_chalk37.default.dim(`/${c.name} ${c.describe}`)),
-      import_chalk37.default.dim("/show"),
-      import_chalk37.default.dim("/exit when done"),
-      import_chalk37.default.dim("/drop discard changes")
-    ];
-    return "  " + import_chalk37.default.dim("[ ") + parts.join(import_chalk37.default.dim(" \xB7 ")) + import_chalk37.default.dim(" ]");
-  };
-  async function turn(content) {
-    messages.push({ role: "user", content });
-    process.stdout.write(import_chalk37.default.dim("  \u2026thinking\n"));
-    const { status: status2, data } = await agentCall(endpoint, "POST", { messages, ...buildBody(messages) });
-    if (status2 === 402 || status2 === 503 || parseProblem(data)) {
-      await reportRefusal(status2, data, { cli: B.cli });
-      console.log("");
-      messages.pop();
-      return;
-    }
-    if (status2 >= 400 || !data) {
-      console.log(import_chalk37.default.red(`  Error (${status2}): ${(data && data.error) ?? "request failed"}
-`));
-      messages.pop();
-      return;
-    }
-    ctx.lastData = data;
-    const reply = data.reply ?? data.message ?? "(no reply)";
-    messages.push({ role: "assistant", content: reply });
-    console.log("\n" + import_chalk37.default.cyan("agent \u203A ") + reply + "\n");
-    if (data.proposal) {
-      ctx.proposal = data.proposal;
-      const summary = summarizeProposal?.(data);
-      if (summary) console.log(import_chalk37.default.yellow("  " + summary));
-      const applies = commands.filter((c) => c.needsProposal);
-      const primary = applies[applies.length - 1];
-      if (primary) {
-        console.log(import_chalk37.default.bold.green("  \u279C Next: type ") + import_chalk37.default.bold.cyan(`/${primary.name}`) + import_chalk37.default.bold.green(" to apply this, then ") + import_chalk37.default.bold.cyan("/exit") + import_chalk37.default.bold.green(" to leave."));
-        const rest = applies.slice(0, -1).map((c) => `/${c.name} = ${c.describe}`).join(" \xB7 ");
-        console.log(import_chalk37.default.dim(`    (or keep chatting to refine${rest ? ` \xB7 ${rest}` : ""} \xB7 /show = inspect)`));
-      }
-      console.log();
-    }
-    const line = formatBilling(data.billing);
-    if (line) {
-      const llm2 = data.llm;
-      console.log(import_chalk37.default.dim(`  ${line}${llm2?.model ? ` \xB7 ${llm2.model}` : ""}`));
+  console.log(ok ? `
+  ${import_chalk38.default.green("\u2714")} Connection pre-authorized (single use, 15 min) \u2014 connect now and it won't ask you to approve the app.` : import_chalk38.default.yellow("\n  Could not pre-authorize the connection. If the sign-in says the app needs verifying, run:\n    apiblaze allowoauthregistration --apiblaze"));
+  console.log(import_chalk38.default.dim("\n  Re-run this command any time to authorize another client."));
+}
+async function runDocs(opts) {
+  console.log("");
+  console.log(import_chalk38.default.bgYellow.black.bold("  This is not a docs search \u2014 the chatbot can CHANGE your account.  "));
+  console.log(import_chalk38.default.yellow(`  It connects ${import_chalk38.default.bold("Claude Code")} or ${import_chalk38.default.bold("Codex")} to the real APIblaze API, acting as you:`));
+  console.log(import_chalk38.default.yellow("  it can create proxies, add logins, invite teammates and point domains for real."));
+  console.log(import_chalk38.default.yellow("  Destructive actions (deleting proxies, teams or products) are deliberately not exposed."));
+  console.log(import_chalk38.default.dim('  Read-only questions ("what proxies do I have?") are of course fine.'));
+  console.log("");
+  if (!opts.yes && !opts.prompt && process.stdin.isTTY) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { ok } = await inquirer3.prompt([{
+      type: "confirm",
+      name: "ok",
+      default: true,
+      message: "Continue, knowing the chatbot can act on your account?"
+    }]);
+    if (!ok) {
+      console.log(import_chalk38.default.dim("\n  Nothing connected. The written docs are at https://www.apiblaze.com/docs"));
+      return;
     }
   }
-  const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
-  const ask3 = (q) => new Promise((res) => rl.question(q, res));
-  await turn(seedPrompt);
-  for (; ; ) {
-    console.log(footer());
-    const line = (await ask3(import_chalk37.default.green("you \u203A "))).trim();
-    if (!line) continue;
-    const lower = line.toLowerCase();
-    if (line === "/exit" || line === "/quit" || lower === "exit" || lower === "quit" || lower === "q") {
-      console.log(import_chalk37.default.dim("  Bye \u2014 anything you enabled or published stays in place.\n"));
-      break;
-    }
-    if (line === "/drop") {
-      console.log(import_chalk37.default.dim("  Dropped the pending proposal \u2014 rules you already enabled/published are untouched.\n"));
-      break;
-    }
-    if (line === "/show") {
-      if (!ctx.proposal) console.log(import_chalk37.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
-      else console.log("\n" + JSON.stringify(ctx.proposal, null, 2) + "\n");
-      continue;
-    }
-    if (line.startsWith("/")) {
-      const cmd = cmdByName.get(line.slice(1));
-      if (!cmd) {
-        console.log(import_chalk37.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
-`));
-        continue;
-      }
-      if (cmd.needsProposal && !ctx.proposal) {
-        console.log(import_chalk37.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
-        continue;
-      }
-      await cmd.run(ctx);
-      continue;
-    }
-    await turn(line);
+  if (opts.web) {
+    await runDocsWeb();
+    return;
   }
-  rl.close();
+  const forwarded = {
+    target: CONTROL_PLANE_TARGET,
+    prompt: opts.prompt,
+    installMcp: opts.installMcp,
+    removeMcp: opts.removeMcp,
+    verbose: opts.verbose,
+    // `--remove-mcp` needs the project name; the control-plane proxy is `externalauth`.
+    ...opts.removeMcp ? { project: "externalauth" } : {}
+  };
+  await runApichat(forwarded);
 }
 
+// src/commands/authz.ts
+var import_chalk40 = __toESM(require("chalk"));
+init_auth();
+init_api();
+init_agent_chat();
+
 // src/lib/authz-apply.ts
-var import_chalk38 = __toESM(require("chalk"));
+var import_chalk39 = __toESM(require("chalk"));
 init_api();
 async function gatherSampleIds(projectId, apiVersion, cap2 = 50) {
   try {
@@ -11775,10 +12675,10 @@ async function gatherSampleIds(projectId, apiVersion, cap2 = 50) {
 }
 function maybeWarnNoTraffic(total, projectArg) {
   if (total >= 3) return;
-  console.log(import_chalk38.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
-  console.log(import_chalk38.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
-  console.log(import_chalk38.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
-  console.log(import_chalk38.default.dim(`    curl a few endpoints, or `) + import_chalk38.default.cyan("npx apiblaze dev") + import_chalk38.default.dim(` \u2014 then re-run.
+  console.log(import_chalk39.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
+  console.log(import_chalk39.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
+  console.log(import_chalk39.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
+  console.log(import_chalk39.default.dim(`    curl a few endpoints, or `) + import_chalk39.default.cyan("npx apiblaze dev") + import_chalk39.default.dim(` \u2014 then re-run.
 `));
 }
 async function applyProposal(opts) {
@@ -11787,12 +12687,12 @@ async function applyProposal(opts) {
   {
     const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant2)}`, "POST", proposal.model);
     if (m.status === 404) {
-      log4(import_chalk38.default.red(`  Project ${projectId} ${apiVersion} not found on the authorization service \u2014 check \`apiblaze projects\`.
+      log4(import_chalk39.default.red(`  Project ${projectId} ${apiVersion} not found on the authorization service \u2014 check \`apiblaze projects\`.
 `));
       return { ok: 0, fail: 0, enabled: false, aborted: true };
     }
     if (m.status >= 400) {
-      log4(import_chalk38.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
+      log4(import_chalk39.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
 `));
       return { ok: 0, fail: 0, enabled: false, aborted: true };
     }
@@ -11824,17 +12724,17 @@ async function applyProposal(opts) {
     }
   }
   if (fail7 > 0) {
-    log4(import_chalk38.default.red(`  ${fail7} of ${proposal.routes.length} route rule(s) could not be saved:`));
-    for (const f of failed) log4(import_chalk38.default.red(`    ${f}`));
+    log4(import_chalk39.default.red(`  ${fail7} of ${proposal.routes.length} route rule(s) could not be saved:`));
+    for (const f of failed) log4(import_chalk39.default.red(`    ${f}`));
     if (enable) {
-      log4(import_chalk38.default.red("  Enforcement NOT turned on \u2014 a route without a saved rule is left open by the gateway. Fix the rule(s) above and re-run with --enforce.\n"));
+      log4(import_chalk39.default.red("  Enforcement NOT turned on \u2014 a route without a saved rule is left open by the gateway. Fix the rule(s) above and re-run with --enforce.\n"));
     }
     return { ok, fail: fail7, enabled: false, aborted: true, failed };
   }
   if (enable) {
     const e = await agentCall(`/projects/${projectId}/${apiVersion}`, "PATCH", { authorization: { enforce_authorization: true }, tenant: tenant2 });
     if (e.status >= 400) {
-      log4(import_chalk38.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
+      log4(import_chalk39.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
 `));
       return { ok, fail: fail7, enabled: false, failed };
     }
@@ -11859,19 +12759,19 @@ async function runAuthz(projectArg, apiVersionArg) {
     const proposal = ctx.proposal;
     const r = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable, log: ctx.log });
     if (r.aborted) {
-      ctx.log(import_chalk39.default.red(enable ? `  Enforcement NOT on \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /enable again.
+      ctx.log(import_chalk40.default.red(enable ? `  Enforcement NOT on \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /enable again.
 ` : `  Not published \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /publish again.
 `));
       return;
     }
     if (enable && r.enabled) {
-      ctx.log(import_chalk39.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on.`));
-      ctx.log(import_chalk39.default.dim("  Route config takes up to ~90 s to reach every edge. Undo any time: ") + import_chalk39.default.cyan(`apiblaze config ${projectArg} authorization.enforce_authorization false`));
-      ctx.log(import_chalk39.default.dim("  Done here? Type /exit to leave the chat (your rule stays on).\n"));
+      ctx.log(import_chalk40.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on.`));
+      ctx.log(import_chalk40.default.dim("  Route config takes up to ~90 s to reach every edge. Undo any time: ") + import_chalk40.default.cyan(`apiblaze config ${projectArg} authorization.enforce_authorization false`));
+      ctx.log(import_chalk40.default.dim("  Done here? Type /exit to leave the chat (your rule stays on).\n"));
     } else if (enable) {
-      ctx.log(import_chalk39.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above).\n"));
+      ctx.log(import_chalk40.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above).\n"));
     } else {
-      ctx.log(import_chalk39.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s). Review, then /enable.
+      ctx.log(import_chalk40.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s). Review, then /enable.
 `));
     }
   }
@@ -11898,7 +12798,7 @@ async function runAuthz(projectArg, apiVersionArg) {
 }
 
 // src/commands/rule.ts
-var import_chalk40 = __toESM(require("chalk"));
+var import_chalk41 = __toESM(require("chalk"));
 var import_ora14 = __toESM(require("ora"));
 init_auth();
 init_api();
@@ -11938,12 +12838,12 @@ async function runRule(projectArg, ruleText, opts) {
   const proposal = data?.proposal;
   if (!proposal || !Array.isArray(proposal.routes) || proposal.routes.length === 0) {
     spinner.fail("The agent couldn\u2019t turn that into a rule in one shot.");
-    if (data?.reply) console.log(import_chalk40.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
-    console.log(import_chalk40.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk40.default.cyan(`${B.cli} agent authz ${projectArg}`));
+    if (data?.reply) console.log(import_chalk41.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
+    console.log(import_chalk41.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk41.default.cyan(`${B.cli} agent authz ${projectArg}`));
     return;
   }
   spinner.succeed(`Rule designed \u2014 ${proposal.routes.length} route(s) affected.`);
-  if (data?.reply) console.log(import_chalk40.default.dim("  " + String(data.reply).slice(0, 240)));
+  if (data?.reply) console.log(import_chalk41.default.dim("  " + String(data.reply).slice(0, 240)));
   await shadowThenEnforce(ctx, proposal, opts.enforce ? "yes" : "no", `${B.cli} rule ${projectArg} "${rule}" --enforce`);
 }
 async function proposeFromSpecBranch(ctx, opts) {
@@ -11958,417 +12858,143 @@ async function proposeFromSpecBranch(ctx, opts) {
   const families = first.data?.families ?? [];
   const protectable = families.filter((f) => !f.skipped_reason);
   if (!protectable.length) {
-    spinner.stop();
-    console.log(import_chalk40.default.dim(`  Nothing to lock: the spec has no resource with a POST collection plus item routes${families.length ? ` (${families.length} candidate(s) not protectable)` : ""}.`));
-    console.log(import_chalk40.default.dim("  Describe the rule instead: ") + import_chalk40.default.cyan(`${B.cli} rule ${projectArg} "users see only their own rows"`));
-    return;
-  }
-  spinner.stop();
-  const chosen = interactive2 ? await pickFamilies(families) : protectable.map((f) => f.key);
-  if (!chosen.length) {
-    console.log(import_chalk40.default.dim("  Nothing selected \u2014 no rules written."));
-    return;
-  }
-  let data = first.data;
-  if (chosen.length !== protectable.length) {
-    const second = await agentCall(`/projects/${projectId}/${apiVersion}/authz/propose`, "POST", { families: chosen });
-    if (second.status >= 400) {
-      console.log(import_chalk40.default.red(`  Could not build the rules for that selection (${second.status}): ${second.data?.error ?? ""}`));
-      return;
-    }
-    data = second.data;
-  }
-  const proposal = data?.proposal;
-  if (!proposal || !Array.isArray(proposal.routes) || !proposal.routes.length) {
-    console.log(import_chalk40.default.red("  The authorization service returned no routes for that selection."));
-    return;
-  }
-  const sim = data?.simulation;
-  if (sim?.blocked_without_backfill) {
-    console.log(import_chalk40.default.yellow(`  \u26A0 ${sim.blocked_without_backfill} request(s) that succeed today would be denied once enforced \u2014`));
-    console.log(import_chalk40.default.yellow("    rows created before the rules have no recorded owner. Backfill them or accept it."));
-  }
-  console.log(import_chalk40.default.green(`  \u2713 ${chosen.map((k) => k.replace(/^\//, "")).join(" + ")} \u2014 ${proposal.routes.length} route rule(s).`));
-  let enforce = opts.enforce ? "yes" : interactive2 ? "ask" : "no";
-  await shadowThenEnforce(ctx, proposal, enforce, `${B.cli} rule ${projectArg} --enforce`);
-}
-async function shadowThenEnforce(ctx, proposal, enforce, enforceCmd) {
-  const { projectId, apiVersion, tenant: tenant2, projectArg } = ctx;
-  const pub = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: false });
-  if (pub.aborted) {
-    console.log(import_chalk40.default.red(`  Nothing saved${pub.ok ? ` beyond ${pub.ok} route(s)` : ""} \u2014 fix the error above and re-run.`));
-    return;
-  }
-  console.log(import_chalk40.default.green(`  \u2713 Saved in shadow mode \u2014 model + ${pub.ok} route(s). Nothing is blocked yet.`));
-  if (enforce === "ask") {
-    const { default: inquirer3 } = await import("inquirer");
-    const { on } = await inquirer3.prompt([{ type: "confirm", name: "on", message: "Turn enforcement on now?", default: true }]);
-    enforce = on ? "yes" : "no";
-  }
-  if (enforce !== "yes") {
-    console.log(import_chalk40.default.dim("  Review it (shadow logs), then enforce: ") + import_chalk40.default.cyan(enforceCmd));
-    return;
-  }
-  const enf = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: true });
-  if (enf.aborted) {
-    console.log(import_chalk40.default.red(`  Enforcement NOT on \u2014 ${enf.fail} route rule(s) failed (listed above). Rules stay in shadow mode.`));
-    return;
-  }
-  if (!enf.enabled) {
-    console.log(import_chalk40.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above)."));
-    return;
-  }
-  console.log(import_chalk40.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on.`));
-  console.log(import_chalk40.default.dim("  Route config takes up to ~90 s to reach every edge."));
-  console.log(import_chalk40.default.dim("  Testing a locked route? Use the sign-in door, or send X-End-User-Id / a key minted with --for \u2014"));
-  console.log(import_chalk40.default.dim("  a bare key has no person to check."));
-  console.log(import_chalk40.default.dim(`  Undo: `) + import_chalk40.default.cyan(`${B.cli} config ${projectArg} authorization.enforce_authorization false`));
-}
-
-// src/commands/openapi.ts
-var import_chalk41 = __toESM(require("chalk"));
-init_auth();
-init_api();
-async function runOpenapi(projectArg, apiVersionArg) {
-  const creds = loadCredentials();
-  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
-  const projects = await getProjects(creds.teamId ?? "");
-  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
-  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
-  const projectId = match.projectId;
-  const apiVersion = apiVersionArg || match.apiVersion;
-  console.log(import_chalk41.default.dim("Gathering captured traffic samples\u2026"));
-  const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
-  if (routesRes.status >= 400) {
-    console.log(import_chalk41.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
-    return;
-  }
-  const routes = routesRes.data?.routes ?? (Array.isArray(routesRes.data) ? routesRes.data : []);
-  const hashes = routes.map((r) => r.route_hash).filter((h) => !!h);
-  const ids = /* @__PURE__ */ new Set();
-  for (const h of hashes) {
-    const s = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes/${encodeURIComponent(h)}/samples`, "GET");
-    const arr = s.data?.samples ?? [];
-    for (const x of arr) if (x.sample_id) ids.add(x.sample_id);
-  }
-  const sampleIds = [...ids];
-  if (sampleIds.length === 0) {
-    console.log(import_chalk41.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
-    return;
-  }
-  async function publish(ctx) {
-    const patch = ctx.proposal.patch;
-    if (!Array.isArray(patch) || patch.length === 0) {
-      ctx.log(import_chalk41.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
-      return;
-    }
-    const specSource = ctx.lastData?.spec_source ?? "unknown";
-    const endpoint = specSource === "github" ? "open-pr" : "publish-openapi";
-    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/samples/${endpoint}`, "POST", { patch, sample_ids_used: sampleIds });
-    if (pub.status >= 400) {
-      ctx.log(import_chalk41.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
-`));
-      return;
-    }
-    const prUrl = pub.data?.pr_url;
-    ctx.log(import_chalk41.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
-` : "  \u2713 Published updated OpenAPI spec.\n"));
-  }
-  await runAgentChatRepl({
-    title: `API-docs assistant \u2014 ${projectId} ${apiVersion}`,
-    subtitle: `${sampleIds.length} captured sample(s) \xB7 discuss what to document, then make it official.`,
-    endpoint: `/projects/${projectId}/${apiVersion}/openapi/chat`,
-    buildBody: () => ({ included_sample_ids: sampleIds }),
-    seedPrompt: "Compare the captured samples against the current spec and tell me what's missing or wrong. List the changes you'd make \u2014 don't produce a patch yet.",
-    summarizeProposal: (data) => {
-      const patch = data.proposal.patch;
-      const n = Array.isArray(patch) ? patch.length : 0;
-      return n === 0 ? "The spec already covers the observed traffic \u2014 nothing to publish." : `Patch ready: ${n} additive change(s) to the OpenAPI spec.`;
-    },
-    commands: [
-      { name: "publish", describe: "publish / open PR", needsProposal: true, run: publish }
-    ]
-  });
-}
-
-// src/commands/mcp.ts
-var import_fs9 = __toESM(require("fs"));
-var import_chalk42 = __toESM(require("chalk"));
-init_brand();
-init_auth();
-init_api();
-async function runMcp(projectArg, apiVersionArg, opts) {
-  const creds = loadCredentials();
-  if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
-  const projects = await getProjects(creds.teamId ?? "");
-  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
-  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
-  const projectId = match.projectId;
-  const apiVersion = apiVersionArg || match.apiVersion;
-  const environment = opts.environment || "prod";
-  const mcpHost2 = match.tenant ? `${projectId}-${match.tenant}` : projectId;
-  async function publish(ctx) {
-    const spec2 = ctx.proposal;
-    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec: spec2 });
-    if (pub.status >= 400) {
-      ctx.log(import_chalk42.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
-`));
-      return;
-    }
-    ctx.log(import_chalk42.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost2}.mcp.apiblaze.com/${apiVersion}/${environment}.
-`));
-  }
-  await runAgentChatRepl({
-    title: `MCP builder \u2014 ${projectId} ${apiVersion} (${environment})`,
-    subtitle: "discuss which routes to expose as tools, then make the catalogue official.",
-    endpoint: `/projects/${projectId}/${apiVersion}/mcp/chat`,
-    buildBody: () => ({ environment, included_sample_ids: [] }),
-    seedPrompt: "Look at this API's routes and recommend which should become MCP tools, with good names and descriptions. Don't finalize yet \u2014 explain first.",
-    summarizeProposal: (data) => {
-      const spec2 = data.proposal;
-      const tools = Array.isArray(spec2.tools) ? spec2.tools : [];
-      const names = tools.slice(0, 12).map((t) => t.name ?? "(unnamed)").join(", ");
-      return `Catalogue ready: ${tools.length} tool(s)${names ? ` \u2014 ${names}${tools.length > 12 ? ", \u2026" : ""}` : ""}.`;
-    },
-    commands: [
-      { name: "publish", describe: `to ${mcpHost2}.mcp.apiblaze.com`, needsProposal: true, run: publish }
-    ]
-  });
-}
-var PROMPT_NAME_RE = /^[a-z0-9_-]{1,64}$/;
-function derivedBehavior(method) {
-  const m = (method ?? "").toUpperCase();
-  const destructive = m === "DELETE";
-  return {
-    readOnly: m === "GET" || m === "HEAD" || m === "OPTIONS",
-    destructive,
-    idempotent: m === "PUT" || m === "DELETE",
-    confirm: destructive,
-    alwaysAsync: false
-  };
-}
-function effectiveBehavior(method, o) {
-  const d = derivedBehavior(method);
-  const readOnly = o?.readOnly ?? d.readOnly;
-  const destructive = readOnly ? false : o?.destructive ?? d.destructive;
-  return {
-    readOnly,
-    destructive,
-    idempotent: o?.idempotent ?? d.idempotent,
-    confirm: o?.confirm ?? destructive,
-    alwaysAsync: o?.alwaysAsync ?? false
-  };
-}
-function uiResourceUri(projectId, toolName) {
-  return `ui://${projectId}/${toolName}`;
-}
-function normalizePrompt(name, raw) {
-  if (!PROMPT_NAME_RE.test(name)) throw new Error(`Prompt name "${name}" must match ${PROMPT_NAME_RE} (lowercase letters, digits, _ and -).`);
-  const p = raw ?? {};
-  if (typeof p !== "object" || Array.isArray(p)) throw new Error("The prompt file must hold one JSON object.");
-  let messages = p.messages;
-  if (!Array.isArray(messages) && typeof p.text === "string") messages = [{ role: "user", text: p.text }];
-  if (!Array.isArray(messages) || messages.length === 0) throw new Error('The prompt needs "messages": [{ "role": "user", "text": "\u2026" }] (or a "text" shorthand).');
-  for (const m of messages) {
-    if (!m || m.role !== "user" && m.role !== "assistant" || typeof m.text !== "string" || !m.text) {
-      throw new Error('Each message needs role "user" | "assistant" and a non-empty "text".');
+    spinner.stop();
+    console.log(import_chalk41.default.dim(`  Nothing to lock: the spec has no resource with a POST collection plus item routes${families.length ? ` (${families.length} candidate(s) not protectable)` : ""}.`));
+    console.log(import_chalk41.default.dim("  Describe the rule instead: ") + import_chalk41.default.cyan(`${B.cli} rule ${projectArg} "users see only their own rows"`));
+    return;
+  }
+  spinner.stop();
+  const chosen = interactive2 ? await pickFamilies(families) : protectable.map((f) => f.key);
+  if (!chosen.length) {
+    console.log(import_chalk41.default.dim("  Nothing selected \u2014 no rules written."));
+    return;
+  }
+  let data = first.data;
+  if (chosen.length !== protectable.length) {
+    const second = await agentCall(`/projects/${projectId}/${apiVersion}/authz/propose`, "POST", { families: chosen });
+    if (second.status >= 400) {
+      console.log(import_chalk41.default.red(`  Could not build the rules for that selection (${second.status}): ${second.data?.error ?? ""}`));
+      return;
     }
+    data = second.data;
   }
-  if (p.arguments !== void 0 && (!Array.isArray(p.arguments) || p.arguments.some((a) => !a || typeof a.name !== "string"))) {
-    throw new Error('"arguments" must be [{ "name": "\u2026", "description"?: "\u2026", "required"?: true }].');
+  const proposal = data?.proposal;
+  if (!proposal || !Array.isArray(proposal.routes) || !proposal.routes.length) {
+    console.log(import_chalk41.default.red("  The authorization service returned no routes for that selection."));
+    return;
   }
-  return {
-    name,
-    ...typeof p.title === "string" ? { title: p.title } : {},
-    ...typeof p.description === "string" ? { description: p.description } : {},
-    ...Array.isArray(p.arguments) ? { arguments: p.arguments } : {},
-    messages
-  };
-}
-function withPrompt(cat, prompt) {
-  const prompts = [...cat.prompts ?? []];
-  const i = prompts.findIndex((p) => p.name === prompt.name);
-  if (i >= 0) prompts[i] = prompt;
-  else prompts.push(prompt);
-  return { ...cat, prompts };
-}
-function withoutPrompt(cat, name) {
-  const prompts = cat.prompts ?? [];
-  if (!prompts.some((p) => p.name === name)) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list\`.`);
-  return { ...cat, prompts: prompts.filter((p) => p.name !== name) };
-}
-function requireTool(cat, tool) {
-  if (!cat.tools.some((t) => t.name === tool)) {
-    const names = cat.tools.slice(0, 10).map((t) => t.name).join(", ");
-    throw new Error(`No tool named "${tool}" in the published catalogue${names ? ` (tools: ${names}${cat.tools.length > 10 ? ", \u2026" : ""})` : ""}.`);
+  const sim = data?.simulation;
+  if (sim?.blocked_without_backfill) {
+    console.log(import_chalk41.default.yellow(`  \u26A0 ${sim.blocked_without_backfill} request(s) that succeed today would be denied once enforced \u2014`));
+    console.log(import_chalk41.default.yellow("    rows created before the rules have no recorded owner. Backfill them or accept it."));
   }
+  console.log(import_chalk41.default.green(`  \u2713 ${chosen.map((k) => k.replace(/^\//, "")).join(" + ")} \u2014 ${proposal.routes.length} route rule(s).`));
+  let enforce = opts.enforce ? "yes" : interactive2 ? "ask" : "no";
+  await shadowThenEnforce(ctx, proposal, enforce, `${B.cli} rule ${projectArg} --enforce`);
 }
-function withOverride(cat, tool, flags) {
-  requireTool(cat, tool);
-  const patch = {};
-  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
-    if (typeof flags[k] === "boolean") patch[k] = flags[k];
+async function shadowThenEnforce(ctx, proposal, enforce, enforceCmd) {
+  const { projectId, apiVersion, tenant: tenant2, projectArg } = ctx;
+  const pub = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: false });
+  if (pub.aborted) {
+    console.log(import_chalk41.default.red(`  Nothing saved${pub.ok ? ` beyond ${pub.ok} route(s)` : ""} \u2014 fix the error above and re-run.`));
+    return;
   }
-  if (typeof flags.title === "string") {
-    const t = flags.title.trim().slice(0, 120);
-    if (!t) throw new Error('--title needs some text (a short human label, e.g. "List pets").');
-    patch.title = t;
+  console.log(import_chalk41.default.green(`  \u2713 Saved in shadow mode \u2014 model + ${pub.ok} route(s). Nothing is blocked yet.`));
+  if (enforce === "ask") {
+    const { default: inquirer3 } = await import("inquirer");
+    const { on } = await inquirer3.prompt([{ type: "confirm", name: "on", message: "Turn enforcement on now?", default: true }]);
+    enforce = on ? "yes" : "no";
   }
-  if (Object.keys(patch).length === 0) {
-    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+  if (enforce !== "yes") {
+    console.log(import_chalk41.default.dim("  Review it (shadow logs), then enforce: ") + import_chalk41.default.cyan(enforceCmd));
+    return;
   }
-  return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
-}
-function withoutOverride(cat, tool) {
-  requireTool(cat, tool);
-  const overrides = { ...cat.overrides ?? {} };
-  delete overrides[tool];
-  return { ...cat, overrides };
-}
-function flagsLine(b) {
-  const f = [];
-  if (b.readOnly) f.push("read-only");
-  if (b.idempotent) f.push("idempotent");
-  if (b.destructive) f.push("destructive");
-  if (b.confirm) f.push("asks to confirm");
-  if (b.alwaysAsync) f.push("always async");
-  return f.length ? f.join(", ") : "\u2014";
-}
-function renderOps(cat) {
-  const rows = cat.tools.map((t) => {
-    const method = t["x-route"]?.method?.toUpperCase() ?? "";
-    const o = cat.overrides?.[t.name];
-    return { name: t.name, route: `${method} ${t["x-route"]?.path ?? ""}`.trim(), eff: flagsLine(effectiveBehavior(method, o)), custom: !!o && Object.keys(o).length > 0 };
-  });
-  const w = Math.min(40, Math.max(4, ...rows.map((r) => r.name.length)));
-  const rw = Math.min(40, Math.max(5, ...rows.map((r) => r.route.length)));
-  return rows.map((r) => `  ${r.name.padEnd(w)}  ${r.route.padEnd(rw)}  ${r.eff}${r.custom ? import_chalk42.default.yellow("  (override)") : ""}`);
+  const enf = await applyProposal({ projectId, apiVersion, tenant: tenant2, proposal, enable: true });
+  if (enf.aborted) {
+    console.log(import_chalk41.default.red(`  Enforcement NOT on \u2014 ${enf.fail} route rule(s) failed (listed above). Rules stay in shadow mode.`));
+    return;
+  }
+  if (!enf.enabled) {
+    console.log(import_chalk41.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above)."));
+    return;
+  }
+  console.log(import_chalk41.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on.`));
+  console.log(import_chalk41.default.dim("  Route config takes up to ~90 s to reach every edge."));
+  console.log(import_chalk41.default.dim("  Testing a locked route? Use the sign-in door, or send X-End-User-Id / a key minted with --for \u2014"));
+  console.log(import_chalk41.default.dim("  a bare key has no person to check."));
+  console.log(import_chalk41.default.dim(`  Undo: `) + import_chalk41.default.cyan(`${B.cli} config ${projectArg} authorization.enforce_authorization false`));
 }
-async function resolveMcpTarget(projectArg, opts) {
+
+// src/commands/openapi.ts
+var import_chalk42 = __toESM(require("chalk"));
+init_auth();
+init_api();
+init_agent_chat();
+async function runOpenapi(projectArg, apiVersionArg) {
   const creds = loadCredentials();
   if (!creds) throw new Error("Not authenticated. Run `apiblaze login` first.");
   const projects = await getProjects(creds.teamId ?? "");
-  const matches2 = projects.filter((p) => p.projectId === projectArg || p.projectName === projectArg);
-  const wanted = opts.apiversion ?? opts.version;
-  const match = (wanted ? matches2.find((p) => p.apiVersion === wanted) : matches2[0]) ?? null;
-  if (!match) throw new Error(`Project "${projectArg}"${wanted ? ` version ${wanted}` : ""} not found in your active team. Run \`${B.cli} projects\`.`);
-  return { projectId: match.projectId, apiVersion: wanted || match.apiVersion, environment: opts.environment || "prod" };
-}
-async function loadCatalogue(t) {
-  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec?environment=${encodeURIComponent(t.environment)}`, "GET");
-  if (r.status >= 400) throw new Error(`Could not read the MCP catalogue (${r.status}): ${r.data?.error ?? ""}`);
-  const spec2 = r.data?.spec;
-  if (!spec2 || !Array.isArray(spec2.tools)) {
-    throw new Error(`No MCP catalogue published for ${t.projectId} ${t.apiVersion} (${t.environment}). Try --environment, or build one with \`${B.cli} agent mcp ${t.projectId}\`.`);
-  }
-  return spec2;
-}
-async function saveCatalogue(t, spec2) {
-  const r = await agentCall(`/projects/${t.projectId}/${t.apiVersion}/mcp/spec`, "PUT", { environment: t.environment, spec: spec2 });
-  if (r.status >= 400) {
-    const d = r.data;
-    throw new Error(`Save failed (${r.status}): ${d?.error ?? ""}${d?.details ? ` \u2014 ${typeof d.details === "string" ? d.details : JSON.stringify(d.details)}` : ""}`);
-  }
-}
-async function runMcpPrompts(action2, project, name, opts) {
-  const t = await resolveMcpTarget(project, opts);
-  const cat = await loadCatalogue(t);
-  const prompts = cat.prompts ?? [];
-  if (action2 === "list") {
-    if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, prompts }, null, 2));
-    if (!prompts.length) {
-      console.log(import_chalk42.default.dim(`
-  No prompts on ${t.projectId} (${t.environment}). Prompts are drafted by the MCP agent (\`${B.cli} agent mcp ${t.projectId}\`) or added with \`${B.cli} mcp prompts set\`.
-`));
-      return;
-    }
-    console.log("");
-    for (const p of prompts) {
-      const args = (p.arguments ?? []).map((a) => a.required ? a.name : `${a.name}?`).join(", ");
-      console.log(`  ${import_chalk42.default.bold(p.name)}${args ? import_chalk42.default.dim(`(${args})`) : ""}${p.title || p.description ? `  ${p.title ?? p.description}` : ""}`);
-    }
-    console.log("");
+  const match = projects.find((p) => p.projectId === projectArg || p.projectName === projectArg);
+  if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
+  const projectId = match.projectId;
+  const apiVersion = apiVersionArg || match.apiVersion;
+  console.log(import_chalk42.default.dim("Gathering captured traffic samples\u2026"));
+  const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
+  if (routesRes.status >= 400) {
+    console.log(import_chalk42.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
     return;
   }
-  if (!name) throw new Error(`Usage: ${B.cli} mcp prompts ${action2} <project> <name>`);
-  if (action2 === "show") {
-    const p = prompts.find((x) => x.name === name);
-    if (!p) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list ${project}\`.`);
-    if (opts.json) return void console.log(JSON.stringify(p, null, 2));
-    console.log(`
-  ${import_chalk42.default.bold(p.name)}${p.title ? ` \u2014 ${p.title}` : ""}`);
-    if (p.description) console.log(`  ${p.description}`);
-    for (const a of p.arguments ?? []) console.log(import_chalk42.default.dim(`    ${a.name}${a.required ? " (required)" : ""}${a.description ? `: ${a.description}` : ""}`));
-    for (const m of p.messages) console.log(`
-  [${m.role}] ${m.text}`);
-    console.log("");
-    return;
+  const routes = routesRes.data?.routes ?? (Array.isArray(routesRes.data) ? routesRes.data : []);
+  const hashes = routes.map((r) => r.route_hash).filter((h) => !!h);
+  const ids = /* @__PURE__ */ new Set();
+  for (const h of hashes) {
+    const s = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes/${encodeURIComponent(h)}/samples`, "GET");
+    const arr = s.data?.samples ?? [];
+    for (const x of arr) if (x.sample_id) ids.add(x.sample_id);
   }
-  let next;
-  if (action2 === "set") {
-    if (!opts.file) throw new Error(`Usage: ${B.cli} mcp prompts set <project> <name> --file prompt.json`);
-    let raw;
-    try {
-      raw = JSON.parse(import_fs9.default.readFileSync(opts.file, "utf8"));
-    } catch (e) {
-      throw new Error(`Could not read ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    next = withPrompt(cat, normalizePrompt(name, raw));
-  } else {
-    next = withoutPrompt(cat, name);
+  const sampleIds = [...ids];
+  if (sampleIds.length === 0) {
+    console.log(import_chalk42.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
+    return;
   }
-  await saveCatalogue(t, next);
-  if (opts.json) return void console.log(JSON.stringify({ saved: true, environment: t.environment, prompts: next.prompts }, null, 2));
-  console.log(import_chalk42.default.green(`  \u2713 ${action2 === "set" ? "Saved" : "Removed"} prompt "${name}" on ${t.projectId} (${t.environment}).`));
-}
-async function runMcpOps(action2, project, tool, opts) {
-  const t = await resolveMcpTarget(project, opts);
-  const cat = await loadCatalogue(t);
-  if (action2 === "list") {
-    if (opts.json) {
-      const tools = cat.tools.map((x) => {
-        const method2 = x["x-route"]?.method?.toUpperCase();
-        return {
-          name: x.name,
-          method: method2,
-          path: x["x-route"]?.path,
-          default: derivedBehavior(method2),
-          override: cat.overrides?.[x.name] ?? null,
-          effective: effectiveBehavior(method2, cat.overrides?.[x.name])
-        };
-      });
-      return void console.log(JSON.stringify({ environment: t.environment, tools }, null, 2));
+  async function publish(ctx) {
+    const patch = ctx.proposal.patch;
+    if (!Array.isArray(patch) || patch.length === 0) {
+      ctx.log(import_chalk42.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
+      return;
     }
-    console.log(import_chalk42.default.dim(`
-  ${cat.tools.length} tool(s) on ${t.projectId} (${t.environment}). Defaults come from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm.
-`));
-    for (const l of renderOps(cat)) console.log(l);
-    console.log(import_chalk42.default.dim(`
-  Override: ${B.cli} mcp ops set ${project} <tool> --read-only | --destructive | --confirm | --no-confirm | --always-async   \xB7   Reset: ${B.cli} mcp ops reset ${project} <tool>
+    const specSource = ctx.lastData?.spec_source ?? "unknown";
+    const endpoint = specSource === "github" ? "open-pr" : "publish-openapi";
+    const pub = await agentCall(`/projects/${projectId}/${apiVersion}/samples/${endpoint}`, "POST", { patch, sample_ids_used: sampleIds });
+    if (pub.status >= 400) {
+      ctx.log(import_chalk42.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
-    return;
+      return;
+    }
+    const prUrl = pub.data?.pr_url;
+    ctx.log(import_chalk42.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
+` : "  \u2713 Published updated OpenAPI spec.\n"));
   }
-  if (!tool) throw new Error(`Usage: ${B.cli} mcp ops ${action2} <project> <tool>`);
-  const next = action2 === "set" ? withOverride(cat, tool, opts) : withoutOverride(cat, tool);
-  await saveCatalogue(t, next);
-  const method = cat.tools.find((x) => x.name === tool)?.["x-route"]?.method;
-  const eff = effectiveBehavior(method, next.overrides?.[tool]);
-  if (opts.json) return void console.log(JSON.stringify({ saved: true, tool, override: next.overrides?.[tool] ?? null, effective: eff }, null, 2));
-  console.log(import_chalk42.default.green(`  \u2713 ${tool}: ${flagsLine(eff)}${action2 === "reset" ? " (automatic default)" : ""}`));
-}
-async function runMcpUi(project, tool, opts) {
-  const t = await resolveMcpTarget(project, opts);
-  const cat = await loadCatalogue(t);
-  requireTool(cat, tool);
-  const uri = uiResourceUri(t.projectId, tool);
-  if (opts.json) return void console.log(JSON.stringify({ tool, uri, kind: "automatic" }, null, 2));
-  console.log(`
-  ${import_chalk42.default.bold(uri)}
-`);
-  console.log(import_chalk42.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
-  console.log(import_chalk42.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
+  await runAgentChatRepl({
+    title: `API-docs assistant \u2014 ${projectId} ${apiVersion}`,
+    subtitle: `${sampleIds.length} captured sample(s) \xB7 discuss what to document, then make it official.`,
+    endpoint: `/projects/${projectId}/${apiVersion}/openapi/chat`,
+    buildBody: () => ({ included_sample_ids: sampleIds }),
+    seedPrompt: "Compare the captured samples against the current spec and tell me what's missing or wrong. List the changes you'd make \u2014 don't produce a patch yet.",
+    summarizeProposal: (data) => {
+      const patch = data.proposal.patch;
+      const n = Array.isArray(patch) ? patch.length : 0;
+      return n === 0 ? "The spec already covers the observed traffic \u2014 nothing to publish." : `Patch ready: ${n} additive change(s) to the OpenAPI spec.`;
+    },
+    commands: [
+      { name: "publish", describe: "publish / open PR", needsProposal: true, run: publish }
+    ]
+  });
 }
 
+// src/index.ts
+init_mcp();
+
 // src/commands/delete.ts
 var import_chalk44 = __toESM(require("chalk"));
 var import_ora15 = __toESM(require("ora"));
@@ -15770,6 +16396,7 @@ async function runSpecDeleteRule(project, opts) {
 
 // src/commands/config-browse.ts
 init_agent();
+init_mcp();
 var limitsQuota = (cfg, patch) => ({
   quota: { limit: cfg.limits?.quota?.limit ?? 3e3, period: cfg.limits?.quota?.period ?? "daily", ...patch }
 });
@@ -18502,7 +19129,7 @@ async function runOpTest(o = {}) {
       for (const g of guts) {
         let r;
         try {
-          r = await call2({ action: "gut", id: g.id }, timeoutS);
+          r = await call2({ action: "gut", id: g.id, ...o.commit ? { commit: true } : {} }, timeoutS);
         } catch (e) {
           r = { kind: "gut", id: g.id, label: g.label, ok: false, results: [], error: e instanceof Error ? e.message : String(e), duration_ms: 0 };
         }
@@ -18958,7 +19585,7 @@ var OP_COMMANDS = [
   { cmd: "op ceiling deny", blurb: "refuse a maximum-rate request; the producer is told why", extra: '<id> --note "why" (required) --json' },
   { cmd: "op incident status", blurb: "the degraded-mode switch: allow | deny | extend, who set it and why" },
   { cmd: "op incident allow|deny|extend", blurb: "dashboard-only \u2014 prints the page (reason required)" },
-  { cmd: "op test", blurb: "run the operator test suite against production (sandbox team only): contract specs + gut checks", extra: "--json --only <ids> --group <g> --skip-guts --guts-only --fail-fast" },
+  { cmd: "op test", blurb: "run the operator test suite against production (sandbox team only): contract specs + gut checks", extra: "--json --only <ids> --group <g> --skip-guts --guts-only --fail-fast --commit" },
   { cmd: "op test --perf", blurb: "performance gate: fixed-rate load on a sandbox proxy, client + gateway latency vs thresholds (alias: op perf)", extra: "--rps 100 --seconds 60 --json --max-p50 --max-p95 --max-error-rate --max-gateway-p50 --max-gateway-p95 --url --key" },
   { cmd: "op test --consumer", blurb: "the data plane as a consumer: the stored `consumer login` token opens exactly its own proxy (401 without, 401 tampered)", extra: "--path /get --json" },
   { cmd: "op residue", blurb: "external-store residue report (Neon/OpenFGA) \u2014 dry run, deletes nothing" },
@@ -19069,6 +19696,7 @@ async function runOp(sub, opts = {}, view, arg) {
         skipGuts: !!opts.skipGuts,
         gutsOnly: !!opts.gutsOnly,
         failFast: !!opts.failFast,
+        commit: !!opts.commit,
         timeout: typeof opts.timeout === "string" ? Number(opts.timeout) : void 0
       });
       if (!opts.only && !opts.group && !opts.gutsOnly && !opts.skipAnon) {
@@ -19466,8 +20094,15 @@ program.command("login").description(`Authenticate with ${B.product}`).option("-
     process.exit(1);
   }
 });
-program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): own-backend \xB7 no-financial \xB7 no-digital-goods \xB7 no-genai-media \xB7 content-13-no-ads", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).action(async (opts) => {
+program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.)`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--policy [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Same as \`${B.cli} connector <spec> --policy \u2026\`.`).option("--domain <host>", "With --policy: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --policy: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
   try {
+    if (opts.policy !== void 0 && opts.policy !== false) {
+      const spec2 = opts.target ?? opts.openapi ?? opts.openapispec;
+      if (!spec2) throw new Error(`--policy needs the OpenAPI document: ${B.cli} create --policy --target https://yourdomain.com/openapi.yaml --domain mcp.yourdomain.com`);
+      const { auth: _auth, target: _target, openapi: _openapi, openapispec: _spec, directoryReady: _dr, ...rest } = opts;
+      await runConnector(spec2, { ...rest, full: true });
+      return;
+    }
     await runCreate({ ...opts, openapi: opts.openapi ?? opts.openapispec });
   } catch (err) {
     await printError(err);
@@ -19477,9 +20112,9 @@ program.command("create").description(`Put an app that is already DEPLOYED behin
 function collect(value, previous) {
   return [...previous ?? [], value];
 }
-program.command("check").description(`Readiness report for the Claude and ChatGPT directories (--directory-ready): what passes, every blocker with its fix, and the ${B.thingShort}'s published URL. Exit 1 while a blocker remains.`).argument("[project]", `The ${B.thingShort} (project name)`).option("--directory-ready", "The directory readiness checks (the only mode today)").option("--platform <list>", "claude \xB7 chatgpt \xB7 claude,chatgpt (default both)").option("--stage <stage>", "create (relaxed: docs URL is a warning) \xB7 ready (the submission gate, default)").option("--refresh-snapshot", "Re-take the listing snapshot (after you edited the listing in the portals)").option("--no-probe", "Skip the live probes from this machine (report what the server can see)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Print the raw report JSON (report, rendered text, target)").action(action((project, opts) => runCheck(project, { ...opts, noProbe: opts.probe === false })));
-var connector = program.command("connector").description(`Directory-ready in one command: checks the ${B.thingShort}, applies the safe fixes, asks for what is missing, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project]", `The ${B.thingShort} (project name)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): own-backend \xB7 no-financial \xB7 no-digital-goods \xB7 no-genai-media \xB7 content-13-no-ads. Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--full", "Run the full flow even when only --attest was given").option("--platform <list>", "claude \xB7 chatgpt \xB7 claude,chatgpt (default both)").option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
-  if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector reviewer <project>`);
+program.command("check").description(`Readiness report for the Claude and ChatGPT directories (--directory-ready): what passes, every blocker with its fix, and the ${B.thingShort}'s published URL. Exit 1 while a blocker remains.`).argument("[project]", `The ${B.thingShort} (project name)`).option("--directory-ready", "The directory readiness checks (the only mode today)").option("--policy <directory>", "Which directory's policies to check against: claude \xB7 chatgpt \xB7 all (default claude; repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--platform <list>", "Older spelling of --policy").hideHelp()).option("--stage <stage>", "create (relaxed: docs URL is a warning) \xB7 ready (the submission gate, default)").option("--refresh-snapshot", "Re-take the listing snapshot (after you edited the listing in the portals)").option("--no-probe", "Skip the live probes from this machine (report what the server can see)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Print the raw report JSON (report, rendered text, target)").action(action((project, opts) => runCheck(project, { ...opts, noProbe: opts.probe === false })));
+var connector = program.command("connector").description(`Directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--full", "Run the full flow even when only --attest was given").option("--policy <directory>", "Which directory's policies this run must satisfy: claude \xB7 chatgpt \xB7 all (default claude; repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--platform <list>", "Older spelling of --policy").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+  if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector https://\u2026/openapi.yaml  \xB7  ${B.cli} connector reviewer <project>`);
   await runConnector(project, opts);
 }));
 connector.command("reviewer").description("Create the reviewer test account (username + password sign-in on the tenant, no MFA), store it encrypted for the packet, show it once").argument("<project>", `The ${B.thingShort} (project name)`).option("--username <name>", "Account name (default reviewer-<project>)").option("--password <pw>", "Use this password instead of a generated one").option("--seed", "Then open the agent chat with a first message that seeds realistic data through the proxy (billed per turn)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON (the password appears there exactly once)").action(action((project, opts) => runConnectorReviewer(project, opts)));
@@ -19676,7 +20311,7 @@ apikeys.command("list").description("List control-plane API keys in your team").
 apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant: a backend key (default), a client key (--client) or a person-bound key (--for)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--backend", `Backend key (default). ${HOLDER_HELP.backend}`).option("--client", `Client key. ${HOLDER_HELP.client} Needs --tenant.`).option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. The Users & Groups widget's admin lane accepts only such a key, one per admin. Needs --tenant.").option("--admin", "With --for: a key that acts as that tenant admin on the IAM API (users & groups) \u2014 adds manage-access; env defaults to prod").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev, prod with --admin)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
 apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts, cmd) => runKeyRevoke(keyId, { ...cmd.parent?.opts(), ...opts })));
 program.addCommand(apikeys);
-var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "latency | mark | wallet | money | ledger | incident | residue | sweep | test | anon | perf | cli-policy (omit for the menu)").argument("[view]", "for `latency`: slow | llm | compare | grades | distance \xB7 for `wallet`: list | inspect | freeze \u2026 \xB7 for `money`: exposure \xB7 for `ledger`: show | lag | quarantine | cut | backfill \xB7 for `incident`: status | allow | deny | extend \xB7 for `mark`: the change name, quoted").argument("[arg]", "for `wallet inspect` / `ledger show|cut`: the wallet id (or a team id)").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").option("--hours <n>", "Look-back window in hours (default 1)").option("--team <id>", "Filter to one team").option("--only <ids>", "for `test`: comma-separated spec/gut ids or prefixes").option("--group <name>", "for `test`: only specs whose group matches").option("--skip-guts", "for `test`: contract specs only").option("--guts-only", "for `test`: server-side gut checks only").option("--fail-fast", "for `test`: stop at the first failure").option("--skip-anon", "for `test`: skip the first-run journey (`op anon`) that runs after the suite").option("--timeout <s>", "for `test`: seconds to wait per check (default 150)").option("--perf", "for `test`: run the performance gate instead of the suite (fixed-rate load on a sandbox proxy)").option("--consumer", "for `test`: probe the data plane with the stored `consumer login` token instead of the suite").option("--path <p>", "for `test --consumer`: request path on the proxy (default /get)").option("--proxy <name@version>", "for `test --consumer`: the OAuth-door proxy to knock on (default: the sandbox proxy for a sandbox-tenant session)").option("--rps <n>", "for `test --perf`: requests per second (default 100, max 300); for `ceiling approve`: the maximum rate to grant (default: what was asked)").option("--seconds <n>", "for `test --perf`: how long to send for (default 60, max 300)").option("--url <url>", "for `test --perf`: load this fixture URL instead of provisioning one (with --key; nothing is torn down)").option("--max-p50 <ms>", "for `test --perf`: client p50 threshold (default 250)").option("--max-p95 <ms>", "for `test --perf`: client p95 threshold (default 800)").option("--max-error-rate <pct>", "for `test --perf`: error-rate threshold in percent (default 0.5)").option("--max-gateway-p50 <ms>", "for `test --perf`: apiblaze-overhead p50 threshold (default 60)").option("--max-gateway-p95 <ms>", "for `test --perf`: apiblaze-overhead p95 threshold (default 250)").option("--project <name>", "Filter to one proxy").option("--api-version <v>", "Filter to one API version").option("--tenant <name>", "Filter to one tenant").option("--route <path>", "Filter to one route").option("--environment <env>", "Filter to one environment").option("--status-class <c>", "Filter to a status class (2xx/4xx/5xx)").option("--min-ms <n>", "For `latency slow`: minimum duration (default 1000)").option("--min <version>", "for `cli-policy`: minimum CLI version (x.y.z; 0.0.0 = none)").option("--reject-unversioned", "for `cli-policy`: also refuse CLIs that send no version (released before 2026-09-27)").option("--allow-unversioned", "for `cli-policy`: stop refusing unversioned CLIs").option("--message <text>", "for `cli-policy`: message shown with the upgrade instruction").option("--reason <text>", "for `cli-policy`: why the policy changes (required for a change; recorded with it); for `ledger cut|backfill`: written to operator_audit").option("--force", "for `cli-policy`: allow a minimum above the latest published npm version (locks out every CLI until it ships)").option("--days <n>", "For `latency grades`: how many days back (default 7)").option("--threshold-ms <n>", "For `latency distance`: network ms above which distance counts as a problem (default 50)").option("--excellent <ms>", "Grade threshold: under this is excellent (default 250)").option("--okay <ms>", "Grade threshold: under this is okay (default 500)").option("--bad <ms>", "Grade threshold: under this is bad, at/over is terrible (default 1000)").option("--key <key>", "for `test --perf --url`: the fixture's API key").option("--since <date>", "for `ledger show`: start of the window; for `ledger backfill`: wallets active since (ISO date or epoch ms)").option("--kind <k>", "for `ledger show`: one entry kind only (or `flow`)").option("--limit <n>", "for `money exposure` / `ledger show|quarantine|backfill`: row / wallet cap").option("--ba <wallet>", "for `ledger quarantine`: one wallet only").option("--status <s>", "for `ceiling list`: pending (default) | decided | all").option("--note <text>", "for `ceiling approve` / `ceiling deny`: the note the producer reads (required to deny)").action(action((sub, view, arg, opts) => runOp(sub, opts, view, arg))).addHelpText("after", () => `
+var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "latency | mark | wallet | money | ledger | incident | residue | sweep | test | anon | perf | cli-policy (omit for the menu)").argument("[view]", "for `latency`: slow | llm | compare | grades | distance \xB7 for `wallet`: list | inspect | freeze \u2026 \xB7 for `money`: exposure \xB7 for `ledger`: show | lag | quarantine | cut | backfill \xB7 for `incident`: status | allow | deny | extend \xB7 for `mark`: the change name, quoted").argument("[arg]", "for `wallet inspect` / `ledger show|cut`: the wallet id (or a team id)").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").option("--hours <n>", "Look-back window in hours (default 1)").option("--team <id>", "Filter to one team").option("--only <ids>", "for `test`: comma-separated spec/gut ids or prefixes").option("--group <name>", "for `test`: only specs whose group matches").option("--skip-guts", "for `test`: contract specs only").option("--guts-only", "for `test`: server-side gut checks only").option("--fail-fast", "for `test`: stop at the first failure").option("--commit", "for `test --only openapi-drift --guts-only`: accept the current producer OpenAPI as the new drift baseline").option("--skip-anon", "for `test`: skip the first-run journey (`op anon`) that runs after the suite").option("--timeout <s>", "for `test`: seconds to wait per check (default 150)").option("--perf", "for `test`: run the performance gate instead of the suite (fixed-rate load on a sandbox proxy)").option("--consumer", "for `test`: probe the data plane with the stored `consumer login` token instead of the suite").option("--path <p>", "for `test --consumer`: request path on the proxy (default /get)").option("--proxy <name@version>", "for `test --consumer`: the OAuth-door proxy to knock on (default: the sandbox proxy for a sandbox-tenant session)").option("--rps <n>", "for `test --perf`: requests per second (default 100, max 300); for `ceiling approve`: the maximum rate to grant (default: what was asked)").option("--seconds <n>", "for `test --perf`: how long to send for (default 60, max 300)").option("--url <url>", "for `test --perf`: load this fixture URL instead of provisioning one (with --key; nothing is torn down)").option("--max-p50 <ms>", "for `test --perf`: client p50 threshold (default 250)").option("--max-p95 <ms>", "for `test --perf`: client p95 threshold (default 800)").option("--max-error-rate <pct>", "for `test --perf`: error-rate threshold in percent (default 0.5)").option("--max-gateway-p50 <ms>", "for `test --perf`: apiblaze-overhead p50 threshold (default 60)").option("--max-gateway-p95 <ms>", "for `test --perf`: apiblaze-overhead p95 threshold (default 250)").option("--project <name>", "Filter to one proxy").option("--api-version <v>", "Filter to one API version").option("--tenant <name>", "Filter to one tenant").option("--route <path>", "Filter to one route").option("--environment <env>", "Filter to one environment").option("--status-class <c>", "Filter to a status class (2xx/4xx/5xx)").option("--min-ms <n>", "For `latency slow`: minimum duration (default 1000)").option("--min <version>", "for `cli-policy`: minimum CLI version (x.y.z; 0.0.0 = none)").option("--reject-unversioned", "for `cli-policy`: also refuse CLIs that send no version (released before 2026-09-27)").option("--allow-unversioned", "for `cli-policy`: stop refusing unversioned CLIs").option("--message <text>", "for `cli-policy`: message shown with the upgrade instruction").option("--reason <text>", "for `cli-policy`: why the policy changes (required for a change; recorded with it); for `ledger cut|backfill`: written to operator_audit").option("--force", "for `cli-policy`: allow a minimum above the latest published npm version (locks out every CLI until it ships)").option("--days <n>", "For `latency grades`: how many days back (default 7)").option("--threshold-ms <n>", "For `latency distance`: network ms above which distance counts as a problem (default 50)").option("--excellent <ms>", "Grade threshold: under this is excellent (default 250)").option("--okay <ms>", "Grade threshold: under this is okay (default 500)").option("--bad <ms>", "Grade threshold: under this is bad, at/over is terrible (default 1000)").option("--key <key>", "for `test --perf --url`: the fixture's API key").option("--since <date>", "for `ledger show`: start of the window; for `ledger backfill`: wallets active since (ISO date or epoch ms)").option("--kind <k>", "for `ledger show`: one entry kind only (or `flow`)").option("--limit <n>", "for `money exposure` / `ledger show|quarantine|backfill`: row / wallet cap").option("--ba <wallet>", "for `ledger quarantine`: one wallet only").option("--status <s>", "for `ceiling list`: pending (default) | decided | all").option("--note <text>", "for `ceiling approve` / `ceiling deny`: the note the producer reads (required to deny)").action(action((sub, view, arg, opts) => runOp(sub, opts, view, arg))).addHelpText("after", () => `
 ${renderOpCommands()}
 `);
 program.addCommand(op, { hidden: true });