apiblaze 0.21.68 → 0.21.70

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.68";
+    version = "0.21.70";
   }
 });
 
@@ -445,8 +445,8 @@ function dualAuth(opts = {}) {
 function bothDoorsBody(opts = {}) {
   return { auth_type: "api_key", requests_auth: dualAuth(opts), login: GITHUB_LOGIN };
 }
-async function apiFetch(path19, options = {}, auth) {
-  const url = `${DASHBOARD_BASE2}${path19}`;
+async function apiFetch(path20, options = {}, auth) {
+  const url = `${DASHBOARD_BASE2}${path20}`;
   const res = await fetch(url, {
     ...options,
     headers: {
@@ -472,12 +472,12 @@ async function apiFetch(path19, options = {}, auth) {
   }
   return res.json();
 }
-async function agentCall(path19, method, body) {
+async function agentCall(path20, method, body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE2}/api/cli/agents`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ path: path19, method, body })
+    body: JSON.stringify({ path: path20, method, body })
   });
   let data = null;
   try {
@@ -962,11 +962,11 @@ function decodeJwt(token) {
     return null;
   }
 }
-function maskPath(path19) {
-  const q = path19.indexOf("?");
-  if (q < 0) return path19;
-  const base2 = path19.slice(0, q);
-  const query = path19.slice(q + 1);
+function maskPath(path20) {
+  const q = path20.indexOf("?");
+  if (q < 0) return path20;
+  const base2 = path20.slice(0, q);
+  const query = path20.slice(q + 1);
   const masked = query.split("&").map((pair) => {
     const eq = pair.indexOf("=");
     if (eq < 0) return pair;
@@ -1263,8 +1263,8 @@ function pageQuery(cursor, limit = PAGE_LIMIT) {
   if (cursor) qs.set("cursor", cursor);
   return qs.toString();
 }
-function withPage(path19, cursor, limit = PAGE_LIMIT) {
-  return `${path19}${path19.includes("?") ? "&" : "?"}${pageQuery(cursor, limit)}`;
+function withPage(path20, cursor, limit = PAGE_LIMIT) {
+  return `${path20}${path20.includes("?") ? "&" : "?"}${pageQuery(cursor, limit)}`;
 }
 var PAGE_LIMIT, MAX_HOPS;
 var init_paging = __esm({
@@ -2002,12 +2002,12 @@ var init_env_local = __esm({
 });
 
 // src/lib/preapproval.ts
-async function iamCall(tenant2, path19, method = "GET", body) {
+async function iamCall(tenant2, path20, method = "GET", body) {
   const token = getAccessToken();
   const res = await fetch(`${DASHBOARD_BASE5}/api/cli/iam`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-    body: JSON.stringify({ tenant: tenant2, path: path19, method, body })
+    body: JSON.stringify({ tenant: tenant2, path: path20, method, body })
   });
   const data = await res.json().catch(() => ({}));
   if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -3456,13 +3456,13 @@ async function ensureConsumerLogin(teamId, tenant2, version2) {
   console.log(`  ${import_chalk15.default.green("\u2714")} Signed in as${creds.email ? ` ${import_chalk15.default.bold(creds.email)}` : " a consumer"} on ${tenant2}.`);
   return creds;
 }
-async function cpPost(anon, path19, body, summary) {
+async function cpPost(anon, path20, body, summary) {
   if (anon) {
     const cred = loadAnonCred();
     if (!cred) throw new Error("Anonymous workspace credential missing.");
-    return cpFetch(cred.cp_key, path19, { method: "POST", body: JSON.stringify(body) });
+    return cpFetch(cred.cp_key, path20, { method: "POST", body: JSON.stringify(body) });
   }
-  return admin({ method: "POST", path: path19, body, summary });
+  return admin({ method: "POST", path: path20, body, summary });
 }
 async function provision(spec2, target2, opts) {
   const loggedIn = !!loadCredentials();
@@ -5165,12 +5165,148 @@ var init_key = __esm({
   }
 });
 
+// src/lib/zip.ts
+function crc32(buf) {
+  let c = 4294967295;
+  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
+}
+function zipStore(entries2) {
+  const parts = [];
+  const central = [];
+  let offset = 0;
+  const dosTime = 0, dosDate = 1 << 5 | 1;
+  for (const e of entries2) {
+    const name = new TextEncoder().encode(e.path.replace(/^\.\//, ""));
+    const crc = crc32(e.data);
+    const local = new Uint8Array(30 + name.length);
+    const lv = new DataView(local.buffer);
+    lv.setUint32(0, 67324752, true);
+    lv.setUint16(4, 20, true);
+    lv.setUint16(6, 2048, true);
+    lv.setUint16(8, 0, true);
+    lv.setUint16(10, dosTime, true);
+    lv.setUint16(12, dosDate, true);
+    lv.setUint32(14, crc, true);
+    lv.setUint32(18, e.data.length, true);
+    lv.setUint32(22, e.data.length, true);
+    lv.setUint16(26, name.length, true);
+    lv.setUint16(28, 0, true);
+    local.set(name, 30);
+    parts.push(local, e.data);
+    const cd = new Uint8Array(46 + name.length);
+    const cv = new DataView(cd.buffer);
+    cv.setUint32(0, 33639248, true);
+    cv.setUint16(4, 20, true);
+    cv.setUint16(6, 20, true);
+    cv.setUint16(8, 2048, true);
+    cv.setUint16(10, 0, true);
+    cv.setUint16(12, dosTime, true);
+    cv.setUint16(14, dosDate, true);
+    cv.setUint32(16, crc, true);
+    cv.setUint32(20, e.data.length, true);
+    cv.setUint32(24, e.data.length, true);
+    cv.setUint16(28, name.length, true);
+    cv.setUint16(30, 0, true);
+    cv.setUint16(32, 0, true);
+    cv.setUint16(34, 0, true);
+    cv.setUint16(36, 0, true);
+    cv.setUint32(38, 0, true);
+    cv.setUint32(42, offset, true);
+    cd.set(name, 46);
+    central.push(cd);
+    offset += local.length + e.data.length;
+  }
+  const cdSize = central.reduce((n, c) => n + c.length, 0);
+  const end = new Uint8Array(22);
+  const ev = new DataView(end.buffer);
+  ev.setUint32(0, 101010256, true);
+  ev.setUint16(4, 0, true);
+  ev.setUint16(6, 0, true);
+  ev.setUint16(8, entries2.length, true);
+  ev.setUint16(10, entries2.length, true);
+  ev.setUint32(12, cdSize, true);
+  ev.setUint32(16, offset, true);
+  ev.setUint16(20, 0, true);
+  const total = offset + cdSize + end.length;
+  const out = new Uint8Array(total);
+  let p = 0;
+  for (const part of [...parts, ...central, end]) {
+    out.set(part, p);
+    p += part.length;
+  }
+  return out;
+}
+function imageInfo(buf) {
+  const dv = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+  if (buf.length >= 24 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return { format: "png", width: dv.getUint32(16), height: dv.getUint32(20) };
+  if (buf.length >= 4 && buf[0] === 255 && buf[1] === 216) {
+    let i = 2;
+    while (i + 9 < buf.length) {
+      if (buf[i] !== 255) {
+        i++;
+        continue;
+      }
+      const marker2 = buf[i + 1];
+      if (marker2 === 216 || marker2 === 1 || marker2 >= 208 && marker2 <= 215) {
+        i += 2;
+        continue;
+      }
+      const len = dv.getUint16(i + 2);
+      if (marker2 >= 192 && marker2 <= 207 && marker2 !== 196 && marker2 !== 200 && marker2 !== 204) return { format: "jpeg", height: dv.getUint16(i + 5), width: dv.getUint16(i + 7) };
+      i += 2 + len;
+    }
+    return { format: "jpeg", width: null, height: null };
+  }
+  if (buf.length >= 30 && buf[0] === 82 && buf[1] === 73 && buf[2] === 70 && buf[3] === 70 && buf[8] === 87 && buf[9] === 69 && buf[10] === 66 && buf[11] === 80) {
+    const chunk = String.fromCharCode(buf[12], buf[13], buf[14], buf[15]);
+    if (chunk === "VP8X") return { format: "webp", width: 1 + (buf[24] | buf[25] << 8 | buf[26] << 16), height: 1 + (buf[27] | buf[28] << 8 | buf[29] << 16) };
+    if (chunk === "VP8 ") return { format: "webp", width: dv.getUint16(26, true) & 16383, height: dv.getUint16(28, true) & 16383 };
+    if (chunk === "VP8L") {
+      const b = dv.getUint32(21, true);
+      return { format: "webp", width: (b & 16383) + 1, height: (b >> 14 & 16383) + 1 };
+    }
+    return { format: "webp", width: null, height: null };
+  }
+  const head = new TextDecoder().decode(buf.subarray(0, 512)).trim();
+  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*<svg[\s>]/i.test(head)) return { format: "svg", width: null, height: null };
+  return { format: "unknown", width: null, height: null };
+}
+function logoProblem(buf) {
+  if (buf.length > 5 * 1024 * 1024) return `the icon is ${(buf.length / 1048576).toFixed(1)} MiB; OpenAI allows 5`;
+  const info = imageInfo(buf);
+  if (info.format === "unknown") return "the icon is not a PNG, JPEG, WebP or SVG";
+  if (info.width != null && info.height != null) {
+    if (info.width !== info.height) return `the icon is ${info.width}\xD7${info.height}; OpenAI wants a square`;
+    if (info.width < 48) return `the icon is ${info.width} px; OpenAI wants at least 48`;
+    if (info.width > 4096) return `the icon is ${info.width} px; OpenAI allows at most 4096`;
+  }
+  return null;
+}
+var CRC_TABLE, LOGO_EXT;
+var init_zip = __esm({
+  "src/lib/zip.ts"() {
+    "use strict";
+    CRC_TABLE = (() => {
+      const t = new Uint32Array(256);
+      for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+        t[n] = c >>> 0;
+      }
+      return t;
+    })();
+    LOGO_EXT = { png: "png", jpeg: "jpg", webp: "webp", svg: "svg", unknown: "bin" };
+  }
+});
+
 // src/lib/directory-probes.ts
 var directory_probes_exports = {};
 __export(directory_probes_exports, {
   PROBE_TIMEOUT_MS: () => PROBE_TIMEOUT_MS,
   asMetadataUrl: () => asMetadataUrl,
-  probeDirectoryTarget: () => probeDirectoryTarget
+  probeDirectoryTarget: () => probeDirectoryTarget,
+  probeUserinfo: () => probeUserinfo
 });
 async function probe(url, init, deps) {
   const f2 = deps.fetch ?? fetch;
@@ -5238,7 +5374,9 @@ async function probeDirectoryTarget(target2, deps = {}) {
       }
     })() ? redirected : null,
     sseServed: sse.status == null ? null : sse.status === 200,
-    ipv4Reachable: post.status == null && get.status == null ? ipv4 ? null : false : ipv4
+    ipv4Reachable: post.status == null && get.status == null ? ipv4 ? null : false : ipv4,
+    // WP1: a 200 `initialize` says whether the host advertises the MCP Apps UI extension (sign-in hosts answer 401: not probed).
+    uiExtension: post.status === 200 && obj(post.json).result && typeof obj(post.json).result === "object" ? !!obj(obj(post.json).result).capabilities?.extensions?.["io.modelcontextprotocol/ui"] : null
   };
   const prmUrl = `${origin.origin}/.well-known/oauth-protected-resource${origin.pathname.replace(/\/$/, "")}`;
   const prm = await probe(prmUrl, { method: "GET" }, deps);
@@ -5286,6 +5424,45 @@ async function probeDirectoryTarget(target2, deps = {}) {
     const name = (target2.serverName ?? "").trim();
     out.metadata = { ...out.metadata ?? {}, docsStatus: p.status, docsContainsName: p.status === 200 && name ? body.toLowerCase().includes(name.toLowerCase()) : null };
   }
+  for (const [url, key] of [[target2.websiteUrl, "websiteStatus"], [target2.supportUrl, "supportStatus"], [target2.termsUrl, "termsStatus"]]) {
+    if (!url || !/^https?:\/\//i.test(url)) continue;
+    let p = await probe(url, { method: "GET", headers: { accept: "text/html, */*;q=0.5" } }, deps);
+    if (p.status != null && p.status >= 300 && p.status < 400 && p.location) p = await probe(absolute(p.location, url) ?? p.location, { method: "GET", headers: { accept: "text/html, */*;q=0.5" } }, deps);
+    out.metadata = { ...out.metadata ?? {}, [key]: p.status };
+  }
+  if (target2.iconUrl && /^https:\/\//i.test(target2.iconUrl)) {
+    const f2 = deps.fetch ?? fetch;
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
+    try {
+      const res = await f2(target2.iconUrl, { redirect: "follow", signal: ctl.signal, headers: { "user-agent": "apiblaze-cli directory-check", accept: "image/*" } });
+      const buf = new Uint8Array(await res.arrayBuffer());
+      const info = res.status === 200 ? imageInfo(buf) : null;
+      out.metadata = { ...out.metadata ?? {}, iconStatus: res.status, iconWidth: info?.width ?? null, iconHeight: info?.height ?? null, iconFormat: info?.format ?? null };
+    } catch {
+      out.metadata = { ...out.metadata ?? {}, iconStatus: null, iconWidth: null, iconHeight: null, iconFormat: null };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  if (target2.screenshots?.length) {
+    const f2 = deps.fetch ?? fetch;
+    const shots = await Promise.all(target2.screenshots.slice(0, 5).map(async (url) => {
+      const ctl = new AbortController();
+      const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
+      try {
+        const res = await f2(url, { redirect: "follow", signal: ctl.signal, headers: { "user-agent": "apiblaze-cli directory-check", accept: "image/*" } });
+        const buf = new Uint8Array(await res.arrayBuffer());
+        const info = res.status === 200 ? imageInfo(buf) : null;
+        return { url, status: res.status, width: info?.width ?? null, height: info?.height ?? null, format: info?.format ?? null };
+      } catch {
+        return { url, status: null, width: null, height: null, format: null };
+      } finally {
+        clearTimeout(timer);
+      }
+    }));
+    out.metadata = { ...out.metadata ?? {}, screenshots: shots };
+  }
   const ch = await probe(`${origin.origin}/.well-known/openai-apps-challenge`, { method: "GET" }, deps);
   out.openaiChallenge = { servedStatus: ch.status, servedMatches: null };
   if (ch.status === 200 && typeof ch.json === "string") out.openaiChallenge.servedBody = ch.json.trim().slice(0, 128);
@@ -5294,17 +5471,25 @@ async function probeDirectoryTarget(target2, deps = {}) {
 function asMetadataUrl(issuer) {
   try {
     const u = new URL(issuer);
-    const path19 = u.pathname.replace(/\/$/, "");
-    return `${u.origin}/.well-known/oauth-authorization-server${path19}`;
+    const path20 = u.pathname.replace(/\/$/, "");
+    return `${u.origin}/.well-known/oauth-authorization-server${path20}`;
   } catch {
     return `${issuer.replace(/\/$/, "")}/.well-known/oauth-authorization-server`;
   }
 }
+async function probeUserinfo(as, bearer, deps = {}) {
+  const ep = typeof as?.userinfo_endpoint === "string" ? as.userinfo_endpoint : null;
+  if (!ep || !bearer) return { userinfoStatus: null, userinfoEmailVerified: null };
+  const p = await probe(ep, { method: "GET", headers: { authorization: `Bearer ${bearer}` } }, deps);
+  const body = obj(p.json);
+  return { userinfoStatus: p.status, userinfoEmailVerified: p.status === 200 ? body.email_verified === true : null };
+}
 var import_promises, PROBE_TIMEOUT_MS, strArr, obj;
 var init_directory_probes = __esm({
   "src/lib/directory-probes.ts"() {
     "use strict";
     import_promises = __toESM(require("dns/promises"));
+    init_zip();
     PROBE_TIMEOUT_MS = 5e3;
     strArr = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : null;
     obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -5318,6 +5503,7 @@ __export(directory_exports, {
   AUTH_MODES: () => AUTH_MODES,
   DATA_HANDLING_MODES: () => DATA_HANDLING_MODES,
   DESCRIPTION_MIN: () => DESCRIPTION_MIN,
+  OPENAI_CATEGORIES: () => OPENAI_CATEGORIES,
   PLATFORMS: () => PLATFORMS,
   attestationId: () => attestationId,
   blockerLines: () => blockerLines,
@@ -5325,12 +5511,14 @@ __export(directory_exports, {
   fetchDirectoryReport: () => fetchDirectoryReport,
   isApiError: () => isApiError,
   isReady: () => isReady,
+  listingOf: () => listingOf,
   parseAuthMode: () => parseAuthMode,
   parseCompliant: () => parseCompliant,
   parseDataHandling: () => parseDataHandling,
   parsePlatforms: () => parsePlatforms,
   parseYesNo: () => parseYesNo,
-  printReport: () => printReport
+  printReport: () => printReport,
+  writeJsonLine: () => writeJsonLine
 });
 function attestationId(flag) {
   const f2 = flag.trim().toLowerCase();
@@ -5358,7 +5546,7 @@ function parseYesNo(flag, v) {
 }
 function directoryBodyFromFlags(f2) {
   const m = {};
-  for (const [flag, v] of [["--privacy-url", f2.privacyUrl], ["--docs-url", f2.docsUrl], ["--icon-url", f2.iconUrl]]) {
+  for (const [flag, v] of [["--privacy-url", f2.privacyUrl], ["--docs-url", f2.docsUrl], ["--icon-url", f2.iconUrl], ["--website-url", f2.websiteUrl], ["--support-url", f2.supportUrl], ["--terms-url", f2.termsUrl], ["--demo-recording-url", f2.demoRecordingUrl]]) {
     if (v && !/^https:\/\//i.test(v.trim())) throw new Error(`${flag} must be an https URL (got ${v.trim()}).`);
   }
   if (f2.privacyUrl) m.privacy_url = f2.privacyUrl;
@@ -5372,8 +5560,39 @@ function directoryBodyFromFlags(f2) {
   if (f2.tagline) m.tagline = f2.tagline;
   if (f2.description) m.description = f2.description;
   if (f2.iconUrl) m.icon_url = f2.iconUrl;
+  if (f2.slug) m.slug = f2.slug.trim().toLowerCase();
+  if (f2.highRisk !== void 0) {
+    const list = (Array.isArray(f2.highRisk) ? f2.highRisk : String(f2.highRisk).split(",")).map((x) => x.trim().toLowerCase()).filter((x) => x && x !== "none");
+    const bad = list.filter((x) => !["legal", "healthcare", "insurance", "finance"].includes(x));
+    if (bad.length) throw new Error(`--high-risk: unknown "${bad.join(", ")}"; use none, or any of legal, healthcare, insurance, finance (comma-separated).`);
+    m.high_risk = list;
+  }
+  if (f2.mcpApp === true) m.mcp_app = true;
+  if (f2.mcpApp === false) m.mcp_app = null;
+  if (f2.screenshot?.length) {
+    m.screenshots = f2.screenshot.map((x) => {
+      const i = x.indexOf("=");
+      const url = (i > 0 ? x.slice(0, i) : x).trim();
+      const prompt = i > 0 ? x.slice(i + 1).trim() : "";
+      if (!/^https:\/\//i.test(url) || !prompt) throw new Error(`--screenshot wants https://\u2026png="<the prompt that produced it>", got "${x}"`);
+      return { url, prompt };
+    });
+  }
   if (f2.vulnContact) m.vuln_contact = f2.vulnContact;
   if (f2.allowedOrigin?.length) m.allowed_origins = f2.allowedOrigin.map((o) => o.trim()).filter(Boolean);
+  if (f2.websiteUrl) m.website_url = f2.websiteUrl.trim();
+  if (f2.supportUrl) m.support_url = f2.supportUrl.trim();
+  if (f2.termsUrl) m.terms_url = f2.termsUrl.trim();
+  if (f2.developerName) m.developer_name = f2.developerName.trim();
+  if (f2.category) {
+    const hit = OPENAI_CATEGORIES.find((c) => c.toLowerCase() === f2.category.trim().toLowerCase());
+    if (!hit) throw new Error(`Unknown --category "${f2.category}". OpenAI's list: ${OPENAI_CATEGORIES.join(", ")}.`);
+    m.category = hit;
+  }
+  if (f2.demoRecordingUrl) m.demo_recording_url = f2.demoRecordingUrl.trim();
+  if (f2.releaseNotes) m.release_notes = f2.releaseNotes.trim();
+  if (f2.shortDescription) m.short_description = f2.shortDescription.trim();
+  if (f2.countries) m.countries = f2.countries.map((c) => c.trim().toUpperCase()).filter(Boolean);
   const mode = parseAuthMode(f2.authMode);
   if (mode) m.auth_mode = mode;
   const dh = parseDataHandling(f2.dataHandling, f2.dataHandlingStatement);
@@ -5396,6 +5615,11 @@ function directoryBodyFromFlags(f2) {
   }
   return out;
 }
+function listingOf(r) {
+  const m = r?.target?.metadata ?? {};
+  const s = (k) => typeof m[k] === "string" ? m[k] : null;
+  return { privacyUrl: s("privacyUrl"), docsUrl: s("docsUrl"), serverName: s("serverName"), websiteUrl: s("websiteUrl"), supportUrl: s("supportUrl"), termsUrl: s("termsUrl") };
+}
 function parseCompliant(policy, platform) {
   if (platform && (policy === void 0 || policy === true)) return parsePlatforms(platform) ?? ["claude"];
   if (policy === void 0 || policy === false || policy === true) return ["claude"];
@@ -5431,11 +5655,12 @@ async function fetchDirectoryReport(caller, proj2, opts = {}) {
       first = await producer(caller, { method: "POST", path: reportPath(proj2), body: base2, summary: `Directory report for ${proj2.projectName}` });
     }
     const publishedUrl = opts.publishedUrl ?? first?.report?.project?.publishedUrl ?? null;
-    const meta = first?.target?.metadata;
+    const meta = first?.target?.metadata ?? opts.listing ?? void 0;
     const privacyUrl = opts.privacyUrl ?? meta?.privacyUrl ?? null;
-    if (publishedUrl) probes = await probeDirectoryTarget({ publishedUrl, privacyUrl, docsUrl: meta?.docsUrl ?? null, serverName: meta?.serverName ?? null });
+    if (publishedUrl) probes = await probeDirectoryTarget({ publishedUrl, privacyUrl, docsUrl: meta?.docsUrl ?? null, serverName: meta?.serverName ?? null, websiteUrl: meta?.websiteUrl ?? null, supportUrl: meta?.supportUrl ?? null, termsUrl: meta?.termsUrl ?? null, screenshots: meta?.mcpApp ? (meta.screenshots ?? []).map((x) => x.url) : null, iconUrl: meta?.iconUrl ?? null });
     else if (first && !opts.refreshSnapshot) return first;
   }
+  if (opts.extraProbes) probes = { ...probes ?? {}, ...opts.extraProbes, metadata: { ...probes?.metadata ?? {}, ...opts.extraProbes.metadata ?? {} } };
   return producer(caller, {
     method: "POST",
     path: reportPath(proj2),
@@ -5447,9 +5672,12 @@ function isReady(r, platforms) {
   const want = platforms ?? r.report.platformsRequested ?? [...PLATFORMS];
   return want.every((p) => r.report.platforms[p]?.ready === true);
 }
+function writeJsonLine(value) {
+  import_node_fs.default.writeSync(1, JSON.stringify(value) + "\n");
+}
 function printReport(r, json) {
   if (json) {
-    process.stdout.write(JSON.stringify(r) + "\n");
+    writeJsonLine(r);
     return;
   }
   console.log(r.rendered.text.replace(/<project>/g, r.report.project.id));
@@ -5463,10 +5691,11 @@ function blockerLines(r, platforms) {
 function isApiError(e, status2) {
   return e instanceof ApiError && (status2 === void 0 || e.status === status2);
 }
-var import_chalk17, PLATFORMS, ATTESTATIONS, AUTH_MODES, DATA_HANDLING_MODES, reportPath, DESCRIPTION_MIN;
+var import_node_fs, import_chalk17, PLATFORMS, ATTESTATIONS, OPENAI_CATEGORIES, AUTH_MODES, DATA_HANDLING_MODES, reportPath, DESCRIPTION_MIN;
 var init_directory = __esm({
   "src/lib/directory.ts"() {
     "use strict";
+    import_node_fs = __toESM(require("fs"));
     import_chalk17 = __toESM(require("chalk"));
     init_caller();
     init_directory_probes();
@@ -5484,8 +5713,11 @@ var init_directory = __esm({
       // ChatGPT's guidelines add these three.
       { id: "no_digital_goods_sales", flags: ["no-digital-goods", "no-digital-goods-sales", "no_digital_goods_sales"], label: "No sale of digital goods, subscriptions or credits; no upgrade/checkout flows (ChatGPT)", platforms: ["chatgpt"] },
       { id: "content_13_no_ads", flags: ["content-13-no-ads", "content-13", "content_13_no_ads"], label: "Content suitable for 13+ and no advertising (ChatGPT)", platforms: ["chatgpt"] },
+      // WP5 (Claude-lane review A11): both directories want the policy to say what is collected, used, shared and kept, and how to reach you.
+      { id: "privacy_policy_covers", flags: ["privacy-policy-covers", "privacy_policy_covers", "privacy-covers"], label: "The privacy policy covers data collection, use, sharing, retention and a contact, and says tool traffic passes through APIblaze as a processor", platforms: PLATFORMS },
       { id: "no_restricted_data", flags: ["no-restricted-data", "no_restricted_data"], label: "No card data, health records, government ids or credentials are collected (ChatGPT)", platforms: ["chatgpt"] }
     ];
+    OPENAI_CATEGORIES = ["Productivity", "Creativity", "Developer Tools", "Business & Operations", "Data & Analytics", "Communication", "Education & Research", "Security", "Finance", "Healthcare", "Travel", "Entertainment", "Other"];
     AUTH_MODES = ["signin", "open"];
     DATA_HANDLING_MODES = ["own", "proxied", "third-party"];
     reportPath = (proj2) => `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/directory-report`;
@@ -7490,6 +7722,58 @@ function mcpConfigDocument(url, bearer, runId2) {
   const headers = { ...bearer ? { Authorization: `Bearer ${bearer}` } : {}, ...runId2 ? { "apiblaze-directory-run": runId2 } : {} };
   return JSON.stringify({ mcpServers: { abz: { type: "http", url, ...Object.keys(headers).length ? { headers } : {} } } }, null, 2) + "\n";
 }
+function codexRecipe(o) {
+  const toml = (s) => JSON.stringify(s);
+  return [
+    "exec",
+    "--json",
+    "--ephemeral",
+    "--ignore-user-config",
+    "--skip-git-repo-check",
+    // Built-ins off, as for Claude Code: with web search or a browser on, Codex "looks at the site" itself
+    // instead of calling the tool (seen live 2026-11-04: "the site wouldn't load through my browsing tools").
+    "-c",
+    'web_search="disabled"',
+    "--disable",
+    "browser_use",
+    "--disable",
+    "browser_use_external",
+    "--disable",
+    "in_app_browser",
+    ...o.cwd ? ["-C", o.cwd] : [],
+    "-c",
+    `mcp_servers.abz.url=${toml(o.serverUrl)}`,
+    "-c",
+    `mcp_servers.abz.http_headers={"apiblaze-directory-run"=${toml(o.runId)}}`,
+    ...o.bearerEnvVar ? ["-c", `mcp_servers.abz.bearer_token_env_var=${toml(o.bearerEnvVar)}`] : [],
+    "-c",
+    "mcp_servers.abz.required=true",
+    "-c",
+    'mcp_servers.abz.default_tools_approval_mode="approve"',
+    "-c",
+    `mcp_servers.abz.enabled_tools=[${o.enabledTools.map(toml).join(",")}]`,
+    o.prompt
+  ];
+}
+function toolCallsInCodexOutput(stdout) {
+  const names = /* @__PURE__ */ new Set();
+  for (const line of stdout.split("\n")) {
+    const s = line.trim();
+    if (!s.startsWith("{")) continue;
+    let ev;
+    try {
+      ev = JSON.parse(s);
+    } catch {
+      continue;
+    }
+    const item = ev?.item ?? ev;
+    if (item && item.type === "mcp_tool_call" && typeof item.tool === "string" && (item.server === void 0 || item.server === "abz")) names.add(item.tool);
+  }
+  return [...names];
+}
+function readOnlyToolNames(tools) {
+  return tools.filter((t) => toolRole(t) === "read").map((t) => t.name);
+}
 function toolCallsInClaudeOutput(stdout) {
   const names = /* @__PURE__ */ new Set();
   for (const line of stdout.split("\n")) {
@@ -7524,11 +7808,14 @@ var init_exercise = __esm({
 var portal_drafts_exports = {};
 __export(portal_drafts_exports, {
   ANSWER_MIN: () => ANSWER_MIN,
+  defaultNegativePrompts: () => defaultNegativePrompts,
   describeResult: () => describeResult,
+  draftChatgptTestCases: () => draftChatgptTestCases,
   draftDescription: () => draftDescription,
   draftMissing: () => draftMissing,
   draftReviewerInstructions: () => draftReviewerInstructions,
-  draftUseCases: () => draftUseCases
+  draftUseCases: () => draftUseCases,
+  humanizeShape: () => humanizeShape
 });
 function describeResult(text) {
   const t = (text ?? "").trim();
@@ -7545,6 +7832,21 @@ function describeResult(text) {
   const head = t.replace(/\s+/g, " ").slice(0, 80);
   return `a text answer ("${head}${t.length > 80 ? "\u2026" : ""}")`;
 }
+function humanKey(k) {
+  const words = k.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase().trim();
+  if (/^(is|has) /.test(words)) return `whether it ${words}`;
+  if (/ (at|on)$/.test(words)) return `when it was ${words.replace(/ (at|on)$/, "")}`;
+  if (words === "id") return "an id";
+  if (words === "url") return "the URL";
+  return words;
+}
+function humanizeShape(shape) {
+  const m = /^a (?:JSON answer|list of (\d+) items?) with (.+?)(?: \(\+\d+ more\))?$/.exec(shape.trim());
+  if (!m) return shape.replace(/ \(\+\d+ more\)/, "");
+  const keys = m[2].split(",").map((x) => x.trim()).filter(Boolean).slice(0, 6).map(humanKey);
+  const list = keys.length > 1 ? `${keys.slice(0, -1).join(", ")} and ${keys[keys.length - 1]}` : keys[0] ?? "an answer";
+  return m[1] ? `a list of ${m[1]} item${m[1] === "1" ? "" : "s"}, each with ${list}` : `${list}`;
+}
 function argsText(args) {
   if (!args || !Object.keys(args).length) return "no arguments";
   return Object.entries(args).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(", ");
@@ -7570,7 +7872,7 @@ function draftUseCases(i) {
   for (const g of groups.values()) {
     const row = i.rows.find((r) => r.tool === g.tools[0].name && r.valid === "ok");
     const which = g.prompts.length === list.length && list.length > 1 ? "Each of these" : g.prompts.map(short).join(", ");
-    parts.push(`${which} make${g.prompts.length === 1 ? "s" : ""} Claude call ${g.tools.map(titleOf).join(" and ")}${row ? `, which returns ${shapeOf(row)}` : ""}.`);
+    parts.push(`${which} answer${g.prompts.length === 1 ? "s" : ""} with ${row ? humanizeShape(shapeOf(row)) : `what ${g.tools.map(titleOf).join(" and ")} gives`}.`);
   }
   const uncalled = i.tools.filter((t) => !Object.values(i.promptTools).some((ns) => ns.includes(t.name)));
   if (uncalled.length) parts.push(`Also available: ${uncalled.map((t) => `${titleOf(t)}${(t.description ?? "").trim() ? ` (${(t.description ?? "").trim().replace(/\.$/, "")})` : ""}`).join("; ")}.`);
@@ -7579,20 +7881,21 @@ function draftUseCases(i) {
 }
 function draftReviewerInstructions(i) {
   const lines = [];
-  lines.push(`Add ${i.publishedUrl} as a custom connector in Claude (Settings \u2192 Connectors \u2192 Add custom connector).`);
-  lines.push(i.open ? "No sign-in: the data is public and every tool is read-only. Connect and ask." : `Sign in with the reviewer account in this packet${i.reviewerUsername ? ` (username ${i.reviewerUsername}; the password is in the packet, never in this text)` : ""}.`);
+  const where = i.platforms?.length === 1 && i.platforms[0] === "chatgpt" ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : i.platforms?.includes("chatgpt") ? "Claude (Settings \u2192 Connectors \u2192 Add custom connector) or ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : "Claude (Settings \u2192 Connectors \u2192 Add custom connector)";
+  lines.push(`Add ${i.publishedUrl} as a custom connector in ${where}.`);
+  lines.push(i.open ? "No sign-in: the data is public and every tool is read-only. Connect and ask." : `Sign in with the username and password entered in the credential fields of this form${i.reviewerUsername ? ` (username ${i.reviewerUsername})` : ""}: the sign-in page shows a username & password form under the provider buttons; no email, SMS or MFA step.`);
   const seen = /* @__PURE__ */ new Set();
   for (const p of i.prompts) {
     const called = toolsCalledBy(i, p);
     if (!called.length) continue;
     const row = i.rows.find((r) => r.tool === called[0].name && r.valid === "ok");
     called.forEach((t) => seen.add(t.name));
-    lines.push(`Ask: "${p}" \u2014 Claude calls ${called.map(titleOf).join(" and ")}${row ? `; expect ${shapeOf(row)}` : ""}.`);
+    lines.push(`Ask: "${p}" \u2014 uses ${called.map(titleOf).join(" and ")}${row ? `; expect ${humanizeShape(shapeOf(row))}` : ""}.`);
   }
   for (const r of i.rows) {
     if (seen.has(r.tool) || r.valid !== "ok") continue;
     const t = i.tools.find((x) => x.name === r.tool) ?? { name: r.tool };
-    lines.push(`Ask Claude to ${titleOf(t).replace(/^./, (c) => c.toLowerCase())} (${argsText(r.args)}); expect ${shapeOf(r)}.`);
+    lines.push(`Ask it to ${titleOf(t).replace(/^./, (c) => c.toLowerCase())} (${argsText(r.args)}); expect ${humanizeShape(shapeOf(r))}.`);
   }
   const errs = i.rows.filter((r) => r.invalid === "error" && r.invalidText);
   for (const r of errs.slice(0, 2)) {
@@ -7617,7 +7920,7 @@ function draftDescription(i) {
   const working = i.prompts.filter((p) => (i.promptTools[p] ?? []).length);
   if (working.length) parts.push(`Ask it things like ${working.map((p) => `"${p}"`).join(", ")}.`);
   const ok = i.rows.find((r) => r.valid === "ok");
-  if (ok) parts.push(`What comes back is ${shapeOf(ok)}, which Claude reads and explains.`);
+  if (ok) parts.push(`Answers come back as ${humanizeShape(shapeOf(ok))}, explained in plain words.`);
   parts.push(readOnly(i) ? "Every tool only reads; nothing is created or changed." : "Writes change data in the signed-in account only.");
   return parts.join(" ");
 }
@@ -7629,6 +7932,40 @@ function draftMissing(i, current) {
   if (len(current.reviewer_instructions) < ANSWER_MIN.reviewer_instructions) out.push({ key: "reviewer_instructions", label: "Reviewer instructions", draft: draftReviewerInstructions(i), current: (current.reviewer_instructions ?? "").trim() });
   return out;
 }
+function draftChatgptTestCases(i) {
+  const view = i.codexPromptTools && Object.keys(i.codexPromptTools).length ? i.codexPromptTools : i.promptTools;
+  const positive2 = [];
+  for (const p of i.prompts) {
+    const called = (view[p] ?? []).filter((n) => i.tools.some((t) => t.name === n));
+    if (!called.length || positive2.length >= 5) continue;
+    const tool = i.tools.find((t) => t.name === called[0]) ?? { name: called[0] };
+    const row = i.rows.find((r) => r.tool === called[0] && r.valid === "ok");
+    positive2.push({
+      description: `${titleOf(tool)}: ${p.length > 60 ? `${p.slice(0, 57)}\u2026` : p}`,
+      prompt: p,
+      tools_triggered: called[0],
+      expected_behavior: row ? `The assistant calls ${titleOf(tool)} and answers from ${shapeOf(row)}.` : `The assistant calls ${titleOf(tool)} and answers from its result.`
+    });
+  }
+  const negative = (i.negativePrompts ?? []).slice(0, 3).map((n) => ({ description: n.description, prompt: n.prompt }));
+  return { positive: positive2, negative };
+}
+function defaultNegativePrompts(i) {
+  const name = (i.serverName ?? "it").trim();
+  const allRead = i.tools.every((t) => /^(get|head)$/i.test(t.method ?? "get"));
+  if (i.open) {
+    return [
+      { prompt: `Delete everything ${name} knows about me`, description: "There is no write tool and no account: the assistant says it cannot change or delete anything." },
+      { prompt: `Sign me in to my ${name} account`, description: "The connector takes no sign-in (public data): the assistant explains there is no account to sign in to." },
+      { prompt: "Book me a table for two tonight", description: "Off topic for this connector: no tool fits, so none is called." }
+    ];
+  }
+  return [
+    { prompt: "Show me every record in the whole system, for every customer", description: "Cross-account data: the rules only expose the signed-in account, so the assistant refuses or shows only the user's own." },
+    { prompt: "Pay for it with my card ending 4242", description: "No payment tool exists and card data must not be collected: the assistant refuses." },
+    { prompt: allRead ? "Change my account email to someone else's" : "Book me a flight to Rome", description: allRead ? "Every tool is read-only: nothing can be changed, so no tool is called." : "Off topic for this connector: no tool fits, so none is called." }
+  ];
+}
 var ANSWER_MIN, titleOf, shapeOf, readOnly;
 var init_portal_drafts = __esm({
   "src/lib/portal-drafts.ts"() {
@@ -7646,11 +7983,28 @@ __export(connector_exercise_exports, {
   DASHBOARD_BASE: () => DASHBOARD_BASE8,
   RUN_HEADER: () => RUN_HEADER,
   RUN_META_KEY: () => RUN_META_KEY,
+  clientsFor: () => clientsFor,
   createPromptTester: () => createPromptTester,
+  detectCodex: () => detectCodex,
+  looksEmpty: () => looksEmpty,
   reportLink: () => reportLink,
   runConnectorAnswers: () => runConnectorAnswers,
   runConnectorExercise: () => runConnectorExercise
 });
+function clientsFor(platforms) {
+  const p = platforms?.length ? platforms : ["claude", "chatgpt"];
+  const out = [];
+  if (p.includes("claude")) out.push("claude");
+  if (p.includes("chatgpt")) out.push("codex");
+  return out;
+}
+function detectCodex(spawn5 = import_child_process5.spawnSync) {
+  const v = spawn5("codex", ["--version"], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 });
+  if (v.error || v.status !== 0 || !/codex/i.test(String(v.stdout ?? ""))) return { installed: false, loggedIn: false };
+  const st = spawn5("codex", ["login", "status"], { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 15e3 });
+  const text = `${st.stdout ?? ""}${st.stderr ?? ""}`;
+  return { installed: true, loggedIn: st.status === 0 && !/not logged in/i.test(text) };
+}
 function reportLink(projectId, apiVersion = "1.0.0") {
   return `${DASHBOARD_BASE8}/directory/${encodeURIComponent(projectId)}/${encodeURIComponent(apiVersion)}`;
 }
@@ -7660,6 +8014,16 @@ async function confirm(message, interactive2) {
   const a = await inquirer3.prompt([{ type: "confirm", name: "go", message, default: false }]);
   return a.go;
 }
+function looksEmpty(json) {
+  if (json == null || json === "") return true;
+  if (Array.isArray(json)) return json.length === 0;
+  if (typeof json === "object") {
+    const vals = Object.values(json);
+    if (!vals.length) return true;
+    return vals.every((v) => Array.isArray(v) && v.length === 0 || v === 0 || v === null || v === false || typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).length === 0);
+  }
+  return false;
+}
 async function runConnectorExercise(project, opts = {}) {
   const caller = await requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
@@ -7691,17 +8055,22 @@ async function runConnectorExercise(project, opts = {}) {
   let asMeta = null;
   let configDir = null;
   let reviewerUsername = null;
+  let userinfo = null;
+  const seeded = {};
   try {
     if (!open) {
       const packet = await producer(caller, { method: "GET", path: `${projectPath(proj2)}/directory-packet?probe=0&force=1`, summary: "Reviewer account (for the login)" });
       const acct = packet.json?.test_account ?? null;
       if (!acct) throw new Error(`No reviewer account on ${proj2.projectName}: create it first (\`${B.cli} connector reviewer ${proj2.projectId}\`), or declare open mode for public read-only data.`);
       const login = await headlessPasswordLogin({ mcpUrl: publishedUrl, username: acct.username, password: acct.password }, deps);
-      if (!login.accessToken) throw new Error(`The reviewer could not sign in at ${login.failedAt}: ${login.detail}. Fix the sign-in and run again.`);
+      if (!login.accessToken) {
+        await producer(caller, { method: "PATCH", path: `${projectPath(proj2)}/directory-runs/${encodeURIComponent(runId2)}`, body: { notes: [{ kind: "failed", note: `reviewer sign-in failed at ${login.failedAt}: ${login.detail}` }], runner: "cli-direct", email: false }, summary: "Close the failed run" }).catch(() => null);
+        throw new Error(`The reviewer could not sign in at ${login.failedAt}: ${login.detail}. Fix the sign-in and run again.`);
+      }
       bearer = login.accessToken;
       asMeta = login.as;
       reviewerUsername = acct.username;
-      say(import_chalk26.default.dim(`  signed in as the reviewer (${acct.username}); the token is revoked at the end`));
+      say(import_chalk26.default.dim(`  signed in as the reviewer (${acct.username}); the token expires in 1 h`));
     } else {
       say(import_chalk26.default.dim("  open mode: no sign-in; this run's calls count as yours"));
     }
@@ -7709,6 +8078,7 @@ async function runConnectorExercise(project, opts = {}) {
     const headers = { [RUN_HEADER]: runId2 };
     const call3 = (name, args) => mcpCall(publishedUrl, "tools/call", { name, arguments: args, _meta: { [RUN_META_KEY]: runId2 } }, { bearer, headers, userAgent: ua }, deps);
     const created = {};
+    const emptyReads = [];
     const examples = { ...target2.metadata?.toolExamples ?? {} };
     const learned = {};
     const prompts = (target2.metadata?.examplePrompts ?? []).filter((p) => typeof p === "string");
@@ -7751,6 +8121,7 @@ async function runConnectorExercise(project, opts = {}) {
       row.validText = redactHead(v.text);
       row.args = args;
       if (v.outcome === "ok") row.resultShape = describeResult(v.text);
+      if (role === "read" && v.outcome === "ok" && looksEmpty(parseResultJson(v.text))) emptyReads.push(t);
       if (v.outcome === "ok" && role === "create") {
         const id = extractCreatedId(parseResultJson(v.text));
         if (id) {
@@ -7773,35 +8144,99 @@ async function runConnectorExercise(project, opts = {}) {
       await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { tool_examples: learned } }, summary: "Remember the working arguments" });
       say(import_chalk26.default.green(`  \u2713 remembered the working arguments for ${Object.keys(learned).join(", ")} (used on every run from now on)`));
     }
+    const creators = tools.filter((t) => toolRole(t) === "create");
+    if (!open && !opts.promptsOnly && opts.seed !== false && emptyReads.length && creators.length) {
+      const names = emptyReads.map((t) => t.name).join(", ");
+      let go = opts.seed === true;
+      if (!go && interactive2) go = await confirm(`${emptyReads.length} read${emptyReads.length > 1 ? "s" : ""} returned nothing for the reviewer (${names}). Create a few records the reviewer will see, through ${creators.map((c) => c.name).join(", ")}? They are kept, not deleted.`, interactive2);
+      if (!go) {
+        say(import_chalk26.default.dim(`  seed skipped${interactive2 ? "" : " (non-interactive: pass --seed to create records for the reviewer, --no-seed to silence this)"}: ${names} stay empty for the reviewer (REVIEWER_ACCOUNT_POPULATED)`));
+        notes.push({ kind: "seed", note: "skipped", tools: emptyReads.map((t) => t.name) });
+      } else {
+        for (const c of creators) {
+          const args = validArgs(c, {}, examples[c.name]);
+          const v = localOutcome(await call3(c.name, args));
+          if (v.outcome !== "ok") {
+            say(`  ${mark(v.outcome)} seed via ${c.name} ${JSON.stringify(args)}: ${import_chalk26.default.dim(redactHead(v.text, 100) || v.outcome)}`);
+            continue;
+          }
+          const id = extractCreatedId(parseResultJson(v.text));
+          const idText = id ? String(id.value).slice(0, 64) : "(no id in the answer)";
+          seeded[c.name] = [...seeded[c.name] ?? [], idText];
+          notes.push({ kind: "seed", tool: c.name, note: `seeded ${id ? `${id.name}=${idText}` : "a record"}` });
+          say(`  ${import_chalk26.default.green("\u2713")} seeded via ${c.name}: ${idText} ${import_chalk26.default.dim("(kept for the reviewer)")}`);
+        }
+        if (Object.keys(seeded).length) {
+          for (const t of emptyReads) {
+            const row = rows.find((x) => x.tool === t.name);
+            const args = validArgs(t, {}, examples[t.name]);
+            const v = localOutcome(await call3(t.name, args));
+            const nonEmpty = v.outcome === "ok" && !looksEmpty(parseResultJson(v.text));
+            if (v.outcome === "ok") {
+              row.valid = v.outcome;
+              row.validText = redactHead(v.text);
+              row.args = args;
+              row.resultShape = describeResult(v.text);
+            }
+            say(`  ${nonEmpty ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} ${t.name} after seeding: ${import_chalk26.default.dim(nonEmpty ? v.text.replace(/\s+/g, " ").slice(0, 80) : "still nothing (a different filter or tenant? mark it --empty-ok if that is correct)")}`);
+          }
+          await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { seeded } }, summary: "Remember what was seeded for the reviewer" }).catch((e) => say(import_chalk26.default.dim(`  (could not store the seeded ids: ${e.message})`)));
+        }
+      }
+    }
+    const clients = clientsFor(opts.platforms);
     const claudeInstalled = deps.claudeInstalled ?? detectExternalClis().some((c) => c.kind === "claude");
-    if (!opts.noClaude && claudeInstalled) {
-      const spawn5 = deps.spawn ?? import_child_process5.spawnSync;
-      configDir = import_fs5.default.mkdtempSync(import_path4.default.join(deps.tmpdir ?? import_os2.default.tmpdir(), "abz-exercise-"));
-      import_fs5.default.chmodSync(configDir, 448);
-      const cfgPath = import_path4.default.join(configDir, "mcp.json");
-      import_fs5.default.writeFileSync(cfgPath, mcpConfigDocument(publishedUrl, bearer, runId2), { mode: 384 });
-      const proven = new Map((opts.provenPromptNotes ?? []).map((n) => [n.prompt.trim(), n]));
-      const prompts2 = (opts.promptsOnly ?? target2.metadata?.examplePrompts ?? []).filter((p) => typeof p === "string" && p.trim()).slice(0, 3);
-      const firstRead = tools.find((t) => toolRole(t) === "read") ?? tools[0];
+    const codex = deps.codexInstalled !== void 0 ? { installed: deps.codexInstalled, loggedIn: deps.codexInstalled } : clients.includes("codex") ? detectCodex(deps.spawn ?? import_child_process5.spawnSync) : { installed: false, loggedIn: false };
+    const proven = opts.provenPromptNotes ?? [];
+    const provenFor = (client) => new Map(proven.filter((n) => n.kind === "prompt" && (n.client ?? "claude") === client).map((n) => [n.prompt.trim(), n]));
+    const passPrompts = (opts.promptsOnly ?? target2.metadata?.examplePrompts ?? []).filter((p) => typeof p === "string" && p.trim()).slice(0, 5);
+    const negatives = (target2.metadata?.portalAnswers?.chatgpt_test_cases?.negative ?? []).map((c) => c.prompt).filter((p) => typeof p === "string" && p.trim()).slice(0, 3);
+    const readOnly2 = readOnlyToolNames(tools);
+    const requiredCount = (t) => Object.values(t.inputProperties ?? {}).filter((p) => p.required).length;
+    const firstRead = [...tools].filter((t) => toolRole(t) === "read").sort((a, b) => requiredCount(a) - requiredCount(b))[0] ?? tools[0];
+    const spawn5 = deps.spawn ?? import_child_process5.spawnSync;
+    for (const client of clients) {
+      if (opts.noClaude && client === "claude") continue;
+      if (client === "claude" && !claudeInstalled) {
+        say(import_chalk26.default.dim("  Claude Code is not installed here: the Claude pass is skipped (TESTED_FROM_CLAUDE and EXAMPLE_PROMPTS_WORK stay open with their instruction)."));
+        continue;
+      }
+      if (client === "codex" && !(codex.installed && codex.loggedIn)) {
+        say(import_chalk26.default.dim(`  Codex CLI is ${codex.installed ? "not logged in" : "not installed"} here: the Codex pass is skipped (TESTED_FROM_OPENAI_CLIENT, EXAMPLE_PROMPTS_WORK_OPENAI and NEGATIVE_PROMPTS_HOLD stay open with their instruction).${codex.installed ? " Run `codex login` once." : " Install it: npm i -g @openai/codex, then `codex login`."}`));
+        continue;
+      }
+      const already = provenFor(client);
+      for (const p of passPrompts) {
+        const n = already.get(p.trim());
+        if (n) notes.push({ ...n });
+      }
+      if (opts.promptsOnly && client === "codex") for (const n of proven.filter((x) => x.kind === "negative" && x.client === "codex")) notes.push({ ...n });
       const runs = [
-        ...opts.promptsOnly ? [] : [{ prompt: `Use the ${firstRead.title ?? firstRead.name} tool once and summarise what it returned in one sentence.`, allowed: [`mcp__abz__${firstRead.name}`], kind: "tool" }],
-        ...prompts2.filter((p) => !proven.has(p.trim())).map((p) => ({ prompt: p, allowed: ["mcp__abz__*"], kind: "prompt" }))
+        ...opts.promptsOnly ? [] : [{ prompt: `Use the ${firstRead.title ?? firstRead.name} tool once and summarise what it returned in one sentence.`, kind: "tool" }],
+        ...passPrompts.filter((p) => !already.has(p.trim())).map((p) => ({ prompt: p, kind: "prompt" })),
+        ...client === "codex" && !opts.promptsOnly ? negatives.map((p) => ({ prompt: p, kind: "negative" })) : []
       ];
-      for (const p of prompts2) {
-        const n = proven.get(p.trim());
-        if (n) notes.push({ ...n });
+      const label3 = client === "claude" ? "Claude Code" : "Codex CLI";
+      if (already.size) say(import_chalk26.default.dim(`  ${already.size} prompt${already.size > 1 ? "s" : ""} already run through ${label3} as ${already.size > 1 ? "they were" : "it was"} typed`));
+      if (!runs.length) continue;
+      say(import_chalk26.default.dim(`  ${label3} pass: ${runs.length} one-shot${runs.length > 1 ? "s" : ""} (10\u201325 s each; read-only tools only)`));
+      let cfgPath = null;
+      if (client === "claude") {
+        configDir = configDir ?? import_fs5.default.mkdtempSync(import_path4.default.join(deps.tmpdir ?? import_os2.default.tmpdir(), "abz-exercise-"));
+        import_fs5.default.chmodSync(configDir, 448);
+        cfgPath = import_path4.default.join(configDir, "mcp.json");
+        import_fs5.default.writeFileSync(cfgPath, mcpConfigDocument(publishedUrl, bearer, runId2), { mode: 384 });
       }
-      if (proven.size) say(import_chalk26.default.dim(`  ${proven.size} prompt${proven.size > 1 ? "s" : ""} already run through Claude Code as ${proven.size > 1 ? "they were" : "it was"} typed`));
-      say(import_chalk26.default.dim(`  Claude Code pass: ${runs.length} one-shot${runs.length > 1 ? "s" : ""} (10\u201325 s each)`));
       for (const x of runs) {
-        const { calls, status: status2 } = claudeOneShot2(spawn5, cfgPath, x.prompt, x.allowed);
-        if (x.kind === "prompt") notes.push({ kind: "prompt", prompt: x.prompt, tool_called: calls.length > 0, tools: calls });
-        else notes.push({ kind: "claude-tool", tool: firstRead.name, tool_called: calls.length > 0 });
-        say(`  ${calls.length ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} claude: "${x.prompt.slice(0, 60)}" \u2192 ${calls.length ? `called ${calls.join(", ")}` : "no tool call"}${status2 !== 0 && status2 != null ? import_chalk26.default.dim(` (exit ${status2})`) : ""}`);
+        const allowed = x.kind === "tool" ? [firstRead.name] : readOnly2;
+        const { calls, status: status2 } = client === "claude" ? claudeOneShot2(spawn5, cfgPath, x.prompt, allowed.map((n) => `mcp__abz__${n}`)) : codexOneShot2(spawn5, { prompt: x.prompt, serverUrl: publishedUrl, runId: runId2, enabledTools: allowed, bearer, cwd: deps.tmpdir });
+        if (x.kind === "tool") notes.push({ kind: "claude-tool", client, tool: firstRead.name, tool_called: calls.length > 0 });
+        else notes.push({ kind: x.kind, prompt: x.prompt, tool_called: calls.length > 0, tools: calls, client });
+        const good = x.kind === "negative" ? calls.length === 0 : calls.length > 0;
+        say(`  ${good ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} ${client}: "${x.prompt.slice(0, 60)}" \u2192 ${calls.length ? `called ${calls.join(", ")}` : "no tool call"}${x.kind === "negative" ? calls.length ? import_chalk26.default.yellow(" (a negative prompt must hold)") : import_chalk26.default.dim(" (held)") : ""}${status2 !== 0 && status2 != null ? import_chalk26.default.dim(` (exit ${status2})`) : ""}`);
       }
-    } else if (!opts.noClaude) {
-      say(import_chalk26.default.dim("  Claude Code is not installed here: the Claude pass is skipped (TESTED_FROM_CLAUDE and EXAMPLE_PROMPTS_WORK stay open with their instruction)."));
     }
+    if (bearer && asMeta) userinfo = await probeUserinfo(asMeta, bearer, deps);
   } finally {
     if (configDir) {
       try {
@@ -7817,15 +8252,29 @@ async function runConnectorExercise(project, opts = {}) {
   const verdicts = r.report.verdicts ?? null;
   const closed = await producer(caller, { method: "PATCH", path: `${projectPath(proj2)}/directory-runs/${encodeURIComponent(runId2)}`, body: { verdicts, scores: verdicts?.groups ?? null, notes, runner: "cli-direct", ...opts.platforms?.length ? { platforms: opts.platforms } : {}, ...opts.noEmail ? { email: false } : {} }, summary: "Close the exercise run" });
   const promptTools = {};
-  for (const n of notes) if (n.kind === "prompt" && typeof n.prompt === "string") promptTools[n.prompt] = Array.isArray(n.tools) ? n.tools : [];
+  const codexPromptTools = {};
+  const failedByClient = {};
+  for (const n of notes) {
+    if (n.kind !== "prompt" || typeof n.prompt !== "string") continue;
+    const tools2 = Array.isArray(n.tools) ? n.tools : [];
+    const client = n.client ?? "claude";
+    if (client === "codex") codexPromptTools[n.prompt] = tools2;
+    if (!promptTools[n.prompt]?.length) promptTools[n.prompt] = tools2;
+    if (n.tool_called === false) failedByClient[n.prompt] = [...failedByClient[n.prompt] ?? [], client];
+  }
   const summary = {
-    failedPrompts: notes.filter((n) => n.kind === "prompt" && n.tool_called === false && typeof n.prompt === "string").map((n) => n.prompt),
+    failedPrompts: Object.keys(failedByClient),
+    failedByClient,
     rows,
     promptTools,
+    codexPromptTools,
     publishedUrl,
     open,
     reviewerUsername,
-    tools
+    tools,
+    userinfo,
+    seeded,
+    notes: notes.filter((n) => (n.kind === "prompt" || n.kind === "negative") && typeof n.prompt === "string")
   };
   if (json) {
     process.stdout.write(JSON.stringify({ project: proj2.projectId, run_id: runId2, link: reportLink(proj2.projectId, proj2.apiVersion), tools: rows, notes, headline: r.rendered.headline, verdicts, report: r.report }) + "\n");
@@ -7843,18 +8292,29 @@ function claudeOneShot2(spawn5, cfgPath, prompt, allowed) {
   const res = spawn5("claude", claudeRecipe({ prompt, mcpConfigPath: cfgPath, allowedTools: allowed }), { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 12e4, env: { ...process.env, CLAUDECODE: "" } });
   return { calls: toolCallsInClaudeOutput(String(res.stdout ?? "")), status: res.status };
 }
+function codexOneShot2(spawn5, o) {
+  const env = { ...process.env };
+  if (o.bearer) env.ABZ_BEARER = o.bearer;
+  const res = spawn5("codex", codexRecipe({ prompt: o.prompt, serverUrl: o.serverUrl, runId: o.runId, enabledTools: o.enabledTools, bearerEnvVar: o.bearer ? "ABZ_BEARER" : null, cwd: o.cwd ?? import_os2.default.tmpdir() }), { encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"], timeout: 18e4, env });
+  return { calls: toolCallsInCodexOutput(String(res.stdout ?? "")), status: res.status };
+}
 async function createPromptTester(caller, proj2, opts = {}) {
   const say = opts.say ?? ((s) => console.log(s));
   const deps = opts.deps ?? {};
+  const wanted = clientsFor(opts.platforms);
   const claudeInstalled = deps.claudeInstalled ?? detectExternalClis().some((c) => c.kind === "claude");
-  if (!claudeInstalled) {
-    say(import_chalk26.default.dim("  (Claude Code is not installed here: each prompt is run at the end, in the exercise)"));
+  const codex = deps.codexInstalled !== void 0 ? { installed: deps.codexInstalled, loggedIn: deps.codexInstalled } : wanted.includes("codex") ? detectCodex(deps.spawn ?? import_child_process5.spawnSync) : { installed: false, loggedIn: false };
+  const clients = wanted.filter((c) => c === "claude" ? claudeInstalled : codex.installed && codex.loggedIn);
+  if (!clients.length) {
+    say(import_chalk26.default.dim(`  (${wanted.includes("codex") && !wanted.includes("claude") ? `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}` : "Claude Code is not installed"} here: each prompt is run at the end, in the exercise)`));
     return null;
   }
+  for (const missing of wanted.filter((c) => !clients.includes(c))) say(import_chalk26.default.dim(`  (${missing === "claude" ? "Claude Code is not installed" : `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}`} here: that pass runs at the end, in the exercise, once it is)`));
   const r = await fetchDirectoryReport(caller, proj2, { probe: false });
   const target2 = r.target ?? {};
   const publishedUrl = r.report.project.publishedUrl;
   if (!publishedUrl || target2.project?.directoryReady === false) return null;
+  const readOnly2 = readOnlyToolNames(orderTools(target2.tools ?? []));
   const open = target2.project?.authMode === "open";
   let bearer = null;
   let asMeta = null;
@@ -7879,16 +8339,22 @@ async function createPromptTester(caller, proj2, opts = {}) {
   const configDir = import_fs5.default.mkdtempSync(import_path4.default.join(deps.tmpdir ?? import_os2.default.tmpdir(), "abz-prompt-"));
   import_fs5.default.chmodSync(configDir, 448);
   const cfgPath = import_path4.default.join(configDir, "mcp.json");
-  import_fs5.default.writeFileSync(cfgPath, mcpConfigDocument(publishedUrl, bearer, runId2), { mode: 384 });
+  if (clients.includes("claude")) import_fs5.default.writeFileSync(cfgPath, mcpConfigDocument(publishedUrl, bearer, runId2), { mode: 384 });
   const notes = [];
   return {
+    clients,
     async test(prompt) {
-      const { calls } = claudeOneShot2(spawn5, cfgPath, prompt, ["mcp__abz__*"]);
-      const note = { kind: "prompt", prompt, tool_called: calls.length > 0, tools: calls };
-      const at = notes.findIndex((n) => n.prompt === prompt);
-      if (at >= 0) notes[at] = note;
-      else notes.push(note);
-      return { called: calls.length > 0, tools: calls };
+      const byClient = {};
+      for (const client of clients) {
+        const { calls } = client === "claude" ? claudeOneShot2(spawn5, cfgPath, prompt, readOnly2.map((n) => `mcp__abz__${n}`)) : codexOneShot2(spawn5, { prompt, serverUrl: publishedUrl, runId: runId2, enabledTools: readOnly2, bearer, cwd: deps.tmpdir });
+        byClient[client] = { called: calls.length > 0, tools: calls };
+        const note = { kind: "prompt", prompt, tool_called: calls.length > 0, tools: calls, client };
+        const at = notes.findIndex((n) => n.prompt === prompt && n.client === client);
+        if (at >= 0) notes[at] = note;
+        else notes.push(note);
+      }
+      const all = Object.values(byClient);
+      return { called: all.every((x) => x.called), tools: [...new Set(all.flatMap((x) => x.tools))], byClient };
     },
     notes: () => [...notes],
     async close() {
@@ -7922,6 +8388,9 @@ async function runConnectorAnswers(project, opts = {}) {
   const sponsored = parseYesNo("--sponsored-content", opts.sponsoredContent);
   const access = opts.access ? opts.access.trim().toLowerCase() : void 0;
   if (access && !["read", "write", "both"].includes(access)) throw new Error("--access must be read, write or both.");
+  const platforms = opts.platforms?.length ? opts.platforms : ["claude", "chatgpt"];
+  const forClaude = platforms.includes("claude");
+  const forChatgpt = platforms.includes("chatgpt");
   const answers = {};
   for (const q of QUESTIONS) {
     const v = opts[q.key];
@@ -7933,6 +8402,9 @@ async function runConnectorAnswers(project, opts = {}) {
   if (dh) meta.data_handling = dh;
   if (health) meta.health_data = health;
   if (sponsored) meta.sponsored_content = sponsored;
+  const { directoryBodyFromFlags: directoryBodyFromFlags2 } = await Promise.resolve().then(() => (init_directory(), directory_exports));
+  Object.assign(meta, directoryBodyFromFlags2({ websiteUrl: opts.websiteUrl, supportUrl: opts.supportUrl, termsUrl: opts.termsUrl, developerName: opts.developerName, category: opts.chatgptCategory, demoRecordingUrl: opts.demoRecordingUrl, releaseNotes: opts.releaseNotes, shortDescription: opts.shortDescription, countries: opts.countries }).directory_metadata ?? {});
+  if (opts.negativePrompt?.length) answers.chatgpt_test_cases = { positive: [], negative: opts.negativePrompt.slice(0, 3).map((p) => ({ prompt: p.trim(), description: "The plugin must not act on this; the assistant refuses or says it cannot." })) };
   if (interactive2) {
     const current = await producer(caller, { method: "POST", path: `${projectPath(proj2)}/directory-report`, body: { probe: false }, summary: "Current answers" });
     const have = current.target?.metadata?.portalAnswers ?? {};
@@ -7961,18 +8433,19 @@ async function runConnectorAnswers(project, opts = {}) {
     for (const q of QUESTIONS) {
       if (answers[q.field] !== void 0) continue;
       if (opts.derived === false && (q.field === "use_cases" || q.field === "reviewer_instructions")) continue;
+      if (!forClaude && (q.field === "use_cases" || q.field === "reviewer_instructions" || q.field === "prerequisites" || q.field === "company_contact")) continue;
       const existing = typeof have[q.field] === "string" ? String(have[q.field]) : "";
       if (existing.length >= (q.min ?? 1)) continue;
       const a = await ask3([{ type: "input", name: "value", message: q.message, default: existing || void 0, validate: (v) => v.trim().length >= (q.min ?? 1) ? true : `${q.min ?? 1}+ characters` }]);
       answers[q.field] = a.value.trim();
       await saveNow({ directory_portal_answers: { [q.field]: a.value.trim() } });
     }
-    if (answers.access === void 0 && !have.access) {
+    if (forClaude && answers.access === void 0 && !have.access) {
       const a = await ask3([{ type: "list", name: "value", message: "What the tools do:", choices: ["read", "write", "both"] }]);
       answers.access = a.value;
       await saveNow({ directory_portal_answers: { access: a.value } });
     }
-    if (answers.categories === void 0 && !(Array.isArray(have.categories) && have.categories.length)) {
+    if (forClaude && answers.categories === void 0 && !(Array.isArray(have.categories) && have.categories.length)) {
       const a = await ask3([{ type: "input", name: "value", message: "Category suggestions (1\u20135, comma-separated; you pick the closest in the portal):", validate: (v) => v.trim() ? true : "one at least" }]);
       answers.categories = a.value.split(",").map((c) => c.trim()).filter(Boolean).slice(0, 5);
       await saveNow({ directory_portal_answers: { categories: answers.categories } });
@@ -7985,16 +8458,113 @@ async function runConnectorAnswers(project, opts = {}) {
       meta.data_handling = { mode: a.mode, ...a.statement?.trim() ? { statement: a.statement.trim() } : {} };
       await saveNow({ directory_metadata: { data_handling: meta.data_handling } });
     }
-    if (!meta.health_data && !current.target?.metadata?.healthData) {
+    if (forClaude && !meta.health_data && !current.target?.metadata?.healthData) {
       const a = await ask3([{ type: "confirm", name: "value", message: "Do the tools handle health data?", default: false }]);
       meta.health_data = a.value ? "yes" : "no";
       await saveNow({ directory_metadata: { health_data: meta.health_data } });
     }
-    if (!meta.sponsored_content && !current.target?.metadata?.sponsoredContent) {
+    if (forClaude && !meta.sponsored_content && !current.target?.metadata?.sponsoredContent) {
       const a = await ask3([{ type: "confirm", name: "value", message: "Do tool results carry sponsored content?", default: false }]);
       meta.sponsored_content = a.value ? "yes" : "no";
       await saveNow({ directory_metadata: { sponsored_content: meta.sponsored_content } });
     }
+    if (forChatgpt) {
+      const cm = current.target?.metadata ?? {};
+      const { default: inquirer4 } = await import("inquirer");
+      let headed2 = false;
+      const ask22 = async (qs) => {
+        if (!headed2) {
+          headed2 = true;
+          console.log(import_chalk26.default.bold("  What OpenAI's form asks (saved as you go):"));
+        }
+        return inquirer4.prompt(qs);
+      };
+      const apex = (() => {
+        try {
+          return new URL(String(cm.docsUrl ?? cm.privacyUrl ?? have.company_website ?? "")).origin;
+        } catch {
+          return "";
+        }
+      })();
+      const urlQ = async (key, label3, def) => {
+        if (cm[key === "website_url" ? "websiteUrl" : key === "support_url" ? "supportUrl" : "termsUrl"] || meta[key]) return;
+        const a = await ask22([{ type: "input", name: "value", message: `${label3} (https; OpenAI requires it):`, ...def ? { default: def } : {}, validate: (v) => /^https:\/\/\S+$/i.test(v.trim()) ? true : "an https URL" }]);
+        meta[key] = a.value.trim();
+        await saveNow({ directory_metadata: { [key]: a.value.trim() } });
+      };
+      await urlQ("website_url", "Website URL", typeof have.company_website === "string" ? have.company_website : apex || void 0);
+      await urlQ("support_url", "Support page URL", apex ? `${apex}/support` : void 0);
+      await urlQ("terms_url", "Terms of service URL", apex ? `${apex}/terms` : void 0);
+      if (!cm.developerName && !meta.developer_name) {
+        const a = await ask22([{ type: "input", name: "value", message: "Developer name (\u2264 80; the directory shows your verified identity instead):", ...have.company_name ? { default: String(have.company_name) } : {}, validate: (v) => v.trim().length >= 1 && v.trim().length <= 80 ? true : "1\u201380 characters" }]);
+        meta.developer_name = a.value.trim();
+        await saveNow({ directory_metadata: { developer_name: meta.developer_name } });
+      }
+      if (!cm.category && !meta.category) {
+        const a = await ask22([{ type: "list", name: "value", message: "Category (OpenAI's list):", choices: [...OPENAI_CATEGORIES] }]);
+        meta.category = a.value;
+        await saveNow({ directory_metadata: { category: a.value } });
+      }
+      if (!cm.shortDescription && !meta.short_description) {
+        const tag = typeof cm.tagline === "string" ? cm.tagline : "";
+        const a = await ask22([{ type: "input", name: "value", message: "ChatGPT subtitle (\u2264 30 characters; Claude keeps the long tagline):", ...tag ? { default: tag.slice(0, 30).replace(/\s+\S*$/, "") || tag.slice(0, 30) } : {}, validate: (v) => v.trim().length >= 1 && v.trim().length <= 30 ? true : `${v.trim().length}/30 characters` }]);
+        meta.short_description = a.value.trim();
+        await saveNow({ directory_metadata: { short_description: meta.short_description } });
+      }
+      if (!cm.demoRecordingUrl && !meta.demo_recording_url) {
+        const a = await ask22([{ type: "input", name: "value", message: "Demo recording URL (OpenAI requires a walkthrough of the test cases on desktop and mobile; Enter to leave it for later):", validate: (v) => !v.trim() || /^https:\/\/\S+$/i.test(v.trim()) ? true : "an https URL, or Enter" }]);
+        if (a.value.trim()) {
+          meta.demo_recording_url = a.value.trim();
+          await saveNow({ directory_metadata: { demo_recording_url: meta.demo_recording_url } });
+        }
+      }
+      if (!cm.releaseNotes && !meta.release_notes) {
+        const a = await ask22([{ type: "input", name: "value", message: "Release notes for this submission:", default: "Initial release." }]);
+        meta.release_notes = a.value.trim() || "Initial release.";
+        await saveNow({ directory_metadata: { release_notes: meta.release_notes } });
+      }
+      if (cm.countries == null && !meta.countries) {
+        const a = await ask22([{ type: "input", name: "value", message: "Countries (ISO codes, comma-separated; Enter = everywhere):", validate: (v) => v.split(",").map((x) => x.trim()).filter(Boolean).every((x) => /^[A-Za-z]{2}$/.test(x)) ? true : "two-letter codes, like US, FR" }]);
+        meta.countries = a.value.split(",").map((x) => x.trim().toUpperCase()).filter(Boolean);
+        await saveNow({ directory_metadata: { countries: meta.countries } });
+      }
+      const cases = have.chatgpt_test_cases ?? null;
+      if (answers.chatgpt_test_cases === void 0 && !((cases?.negative ?? []).length >= 3)) {
+        const { defaultNegativePrompts: defaultNegativePrompts2 } = await Promise.resolve().then(() => (init_portal_drafts(), portal_drafts_exports));
+        const open = current.target?.project?.authMode === "open";
+        const tools = current.target?.tools ?? [];
+        const defaults = defaultNegativePrompts2({ open, tools, serverName: typeof cm.serverName === "string" ? cm.serverName : null });
+        console.log(import_chalk26.default.dim("  Three prompts the plugin must NOT act on (OpenAI asks for them; the exercise checks that no tool is called):"));
+        const negative = [];
+        for (let i = 0; i < 3; i++) {
+          const a = await ask22([{ type: "input", name: "value", message: `Negative prompt ${i + 1}:`, default: defaults[i].prompt }]);
+          const prompt = a.value.trim() || defaults[i].prompt;
+          negative.push({ prompt, description: prompt === defaults[i].prompt ? defaults[i].description : "The plugin must not act on this; the assistant refuses or says it cannot." });
+        }
+        answers.chatgpt_test_cases = { positive: Array.isArray(cases?.positive) ? cases.positive : [], negative };
+        await saveNow({ directory_portal_answers: { chatgpt_test_cases: answers.chatgpt_test_cases } });
+      }
+      const prompts = Array.isArray(cm.examplePrompts) ? cm.examplePrompts.filter((p) => typeof p === "string" && p.trim()) : [];
+      if (prompts.length >= 3 && prompts.length < 5) {
+        console.log(import_chalk26.default.dim(`  OpenAI wants five positive cases; you have ${prompts.length} prompts. ${5 - prompts.length} more a reviewer can try:`));
+        const extra = [...prompts];
+        for (let i = prompts.length; i < 5; i++) {
+          const a = await ask22([{ type: "input", name: "value", message: `Prompt ${i + 1} (Enter to stop here):`, validate: (v) => v.trim().length <= 128 ? true : `${v.trim().length} characters; ChatGPT allows 128` }]);
+          const p = a.value.trim();
+          if (!p) break;
+          if (opts.testPrompt) {
+            console.log(import_chalk26.default.dim("  trying it\u2026"));
+            const res = await opts.testPrompt(p);
+            console.log(res.called ? import_chalk26.default.green(`  \u2713 called ${res.tools.join(", ")}`) : import_chalk26.default.yellow("  \u2013 no tool call; kept (the exercise will say so)"));
+          }
+          extra.push(p);
+        }
+        if (extra.length > prompts.length) {
+          meta.example_prompts = extra;
+          await saveNow({ directory_metadata: { example_prompts: extra } });
+        }
+      }
+    }
   }
   const body = {};
   if (Object.keys(answers).length) body.directory_portal_answers = answers;
@@ -8027,6 +8597,7 @@ var init_connector_exercise = __esm({
     init_directory();
     init_headless_login();
     init_exercise();
+    init_directory_probes();
     init_brand();
     init_portal_drafts();
     init_external_mcp();
@@ -8231,7 +8802,7 @@ async function askDocsQuestion(caller, proj2, state, interactive2, say, deps = {
   if (!v || /^n(o)?$/i.test(v)) {
     say(import_chalk27.default.dim("  using the generated page"));
     try {
-      await runConnectorDocs(proj2.projectName, { deps, yes: true });
+      await runConnectorDocs(proj2.projectId, { deps, yes: true, team: proj2.teamId });
     } catch (e) {
       say(import_chalk27.default.yellow(`  ${e instanceof Error ? e.message : String(e)}`));
       await producer(caller, { method: "PUT", path: `${projectPath2(proj2)}/directory-documents`, body: { use_generated_docs_url: true }, summary: "Point docs at the generated page" });
@@ -8264,6 +8835,65 @@ var init_connector_docs = __esm({
   }
 });
 
+// src/lib/plugin-package.ts
+var plugin_package_exports = {};
+__export(plugin_package_exports, {
+  writePluginPackage: () => writePluginPackage
+});
+async function writePluginPackage(dir, m, deps = {}) {
+  const f2 = deps.fetch ?? fetch;
+  const dirPath = import_path6.default.join(dir, m.package_name);
+  import_fs7.default.mkdirSync(import_path6.default.join(dirPath, "assets"), { recursive: true });
+  const problems = [];
+  const plugin = JSON.parse(JSON.stringify(m.plugin));
+  for (const k of FORBIDDEN) {
+    if (k in plugin) delete plugin[k];
+  }
+  let logoFile = "assets/logo.png";
+  if (m.logo_url) {
+    try {
+      const res = await f2(m.logo_url, { signal: AbortSignal.timeout(1e4) });
+      const buf = new Uint8Array(await res.arrayBuffer());
+      if (!res.ok) problems.push(`the icon at ${m.logo_url} answered ${res.status}`);
+      else {
+        const why = logoProblem(buf);
+        if (why) problems.push(why);
+        logoFile = `assets/logo.${LOGO_EXT[imageInfo(buf).format]}`;
+        import_fs7.default.writeFileSync(import_path6.default.join(dirPath, logoFile), buf, { mode: 420 });
+      }
+    } catch (e) {
+      problems.push(`the icon could not be downloaded: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  } else problems.push("no icon URL: OpenAI requires a logo (square, \u2265 48 px)");
+  if (m.icon_source === "default") problems.push("the icon is APIblaze's default logo; OpenAI lists only IP you own");
+  const iface = plugin.extensions?.["com.openai"]?.interface;
+  if (iface) iface.logo = `./${logoFile}`;
+  const pluginText = JSON.stringify(plugin, null, 2) + "\n";
+  const mcpText = JSON.stringify(m.mcp, null, 2) + "\n";
+  if (/"headers"\s*:/.test(mcpText)) problems.push("mcp.json carries server headers; OpenAI rejects a public submission with them");
+  import_fs7.default.writeFileSync(import_path6.default.join(dirPath, "plugin.json"), pluginText, { mode: 420 });
+  import_fs7.default.writeFileSync(import_path6.default.join(dirPath, "mcp.json"), mcpText, { mode: 420 });
+  const entries2 = [
+    { path: "plugin.json", data: new TextEncoder().encode(pluginText) },
+    { path: "mcp.json", data: new TextEncoder().encode(mcpText) }
+  ];
+  const logoPath = import_path6.default.join(dirPath, logoFile);
+  if (import_fs7.default.existsSync(logoPath)) entries2.push({ path: logoFile, data: new Uint8Array(import_fs7.default.readFileSync(logoPath)) });
+  const zipPath = import_path6.default.join(dir, `${m.package_name}.zip`);
+  import_fs7.default.writeFileSync(zipPath, zipStore(entries2), { mode: 420 });
+  return { dirPath, zipPath, seq: m.seq, problem: problems.length ? `OpenAI package: ${problems.join("; ")}.` : null };
+}
+var import_fs7, import_path6, FORBIDDEN;
+var init_plugin_package = __esm({
+  "src/lib/plugin-package.ts"() {
+    "use strict";
+    import_fs7 = __toESM(require("fs"));
+    import_path6 = __toESM(require("path"));
+    init_zip();
+    FORBIDDEN = ["test_credentials", "reviewer_instructions", "clientSecret", "client_secret", "screenshots", "apps", "hooks"];
+  }
+});
+
 // src/lib/agent-chat.ts
 async function runAgentChatRepl(opts) {
   const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
@@ -8501,7 +9131,7 @@ function requireTool(cat, tool) {
 function withOverride(cat, tool, flags) {
   requireTool(cat, tool);
   const patch = {};
-  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
+  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync", "openWorld"]) {
     if (typeof flags[k] === "boolean") patch[k] = flags[k];
   }
   if (typeof flags.title === "string") {
@@ -8510,7 +9140,7 @@ function withOverride(cat, tool, flags) {
     patch.title = t;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async, --open-world (or their --no-\u2026 forms).");
   }
   return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
 }
@@ -8604,7 +9234,7 @@ async function runMcpPrompts(action2, project, name, opts) {
     if (!opts.file) throw new Error(`Usage: ${B.cli} mcp prompts set <project> <name> --file prompt.json`);
     let raw;
     try {
-      raw = JSON.parse(import_fs7.default.readFileSync(opts.file, "utf8"));
+      raw = JSON.parse(import_fs8.default.readFileSync(opts.file, "utf8"));
     } catch (e) {
       throw new Error(`Could not read ${opts.file}: ${e instanceof Error ? e.message : String(e)}`);
     }
@@ -8663,11 +9293,11 @@ async function runMcpUi(project, tool, opts) {
   console.log(import_chalk29.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
   console.log(import_chalk29.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
 }
-var import_fs7, import_chalk29, PROMPT_NAME_RE;
+var import_fs8, import_chalk29, PROMPT_NAME_RE;
 var init_mcp = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
-    import_fs7 = __toESM(require("fs"));
+    import_fs8 = __toESM(require("fs"));
     import_chalk29 = __toESM(require("chalk"));
     init_brand();
     init_auth();
@@ -8695,7 +9325,7 @@ function createPlaneCore(cfg) {
   const iamBase = (cfg.iamBase ?? "https://iam.apiblaze.com").replace(/\/$/, "");
   const tenantCache = /* @__PURE__ */ new Map();
   const endUserCache = /* @__PURE__ */ new Map();
-  function planeFetch(base2, method, path19, user, opts = {}) {
+  function planeFetch(base2, method, path20, user, opts = {}) {
     const params = new URLSearchParams({ product: "apiblaze", ...opts.query ?? {} });
     const headers = { "X-API-Key": cfg.cpKey, "X-End-User-Id": user.userId };
     let body;
@@ -8703,7 +9333,7 @@ function createPlaneCore(cfg) {
       headers["Content-Type"] = "application/json";
       body = JSON.stringify(opts.body);
     }
-    return fetch(`${base2}${path19}?${params.toString()}`, { method, headers, body, cache: "no-store" });
+    return fetch(`${base2}${path20}?${params.toString()}`, { method, headers, body, cache: "no-store" });
   }
   async function resolveTenant2(user) {
     const cached = tenantCache.get(user.tenant);
@@ -10128,15 +10758,15 @@ async function freePort(from, avoid = []) {
 }
 function readRegistry() {
   try {
-    return JSON.parse(import_fs10.default.readFileSync(registryFile(), "utf8"));
+    return JSON.parse(import_fs11.default.readFileSync(registryFile(), "utf8"));
   } catch {
     return [];
   }
 }
 function writeRegistry(rows) {
   try {
-    import_fs10.default.mkdirSync(import_path8.default.dirname(registryFile()), { recursive: true });
-    import_fs10.default.writeFileSync(registryFile(), JSON.stringify(rows));
+    import_fs11.default.mkdirSync(import_path9.default.dirname(registryFile()), { recursive: true });
+    import_fs11.default.writeFileSync(registryFile(), JSON.stringify(rows));
   } catch {
   }
 }
@@ -10180,8 +10810,8 @@ async function stopTunnels() {
   return stopped;
 }
 function appCtl(dir, arg) {
-  if (!import_fs10.default.existsSync(import_path8.default.join(dir, "start.js"))) return false;
-  const r = (0, import_child_process7.spawnSync)(process.execPath, [import_path8.default.join(dir, "start.js"), arg], { cwd: dir, stdio: "ignore", timeout: 15e3 });
+  if (!import_fs11.default.existsSync(import_path9.default.join(dir, "start.js"))) return false;
+  const r = (0, import_child_process7.spawnSync)(process.execPath, [import_path9.default.join(dir, "start.js"), arg], { cwd: dir, stdio: "ignore", timeout: 15e3 });
   return r.status === 0;
 }
 function isDemoProcess(args) {
@@ -10221,47 +10851,47 @@ async function stopDemos() {
   return n + left.length;
 }
 function writeApp(dir) {
-  import_fs10.default.mkdirSync(dir, { recursive: true });
-  for (const entry of import_fs10.default.readdirSync(dir)) import_fs10.default.rmSync(import_path8.default.join(dir, entry), { recursive: true, force: true });
+  import_fs11.default.mkdirSync(dir, { recursive: true });
+  for (const entry of import_fs11.default.readdirSync(dir)) import_fs11.default.rmSync(import_path9.default.join(dir, entry), { recursive: true, force: true });
   for (const [rel, text] of Object.entries(DEMO_FILES)) {
-    const f2 = import_path8.default.join(dir, rel);
-    import_fs10.default.mkdirSync(import_path8.default.dirname(f2), { recursive: true });
-    import_fs10.default.writeFileSync(f2, text);
+    const f2 = import_path9.default.join(dir, rel);
+    import_fs11.default.mkdirSync(import_path9.default.dirname(f2), { recursive: true });
+    import_fs11.default.writeFileSync(f2, text);
   }
-  import_fs10.default.writeFileSync(import_path8.default.join(dir, "package.json"), JSON.stringify({
+  import_fs11.default.writeFileSync(import_path9.default.join(dir, "package.json"), JSON.stringify({
     name: "nino-pizza-demo",
     private: true,
     scripts: { start: "node start.js --background", stop: "node start.js --stop", restart: "node start.js --restart", dev: "node start.js" }
   }, null, 2) + "\n");
-  import_fs10.default.writeFileSync(import_path8.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
-  for (const [from, to] of [[import_path8.default.join(__dirname, "server", "index.js"), import_path8.default.join(dir, "lib", "apiblaze-server.js")], [import_path8.default.join(__dirname, "browser", "widgets.js"), import_path8.default.join(dir, "public", "apiblaze-widgets.js")]]) {
-    if (!import_fs10.default.existsSync(from)) continue;
-    import_fs10.default.mkdirSync(import_path8.default.dirname(to), { recursive: true });
-    import_fs10.default.copyFileSync(from, to);
+  import_fs11.default.writeFileSync(import_path9.default.join(dir, ".gitignore"), ".env.local\n.demo/\n");
+  for (const [from, to] of [[import_path9.default.join(__dirname, "server", "index.js"), import_path9.default.join(dir, "lib", "apiblaze-server.js")], [import_path9.default.join(__dirname, "browser", "widgets.js"), import_path9.default.join(dir, "public", "apiblaze-widgets.js")]]) {
+    if (!import_fs11.default.existsSync(from)) continue;
+    import_fs11.default.mkdirSync(import_path9.default.dirname(to), { recursive: true });
+    import_fs11.default.copyFileSync(from, to);
   }
 }
 function saveState(dir, s) {
-  const d = import_path8.default.join(dir, STATE_DIR);
-  import_fs10.default.mkdirSync(d, { recursive: true });
-  import_fs10.default.writeFileSync(import_path8.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
+  const d = import_path9.default.join(dir, STATE_DIR);
+  import_fs11.default.mkdirSync(d, { recursive: true });
+  import_fs11.default.writeFileSync(import_path9.default.join(d, "state.json"), JSON.stringify(s, null, 2), { mode: 384 });
 }
 function loadState(dir) {
   try {
-    return JSON.parse(import_fs10.default.readFileSync(import_path8.default.join(dir, STATE_DIR, "state.json"), "utf8"));
+    return JSON.parse(import_fs11.default.readFileSync(import_path9.default.join(dir, STATE_DIR, "state.json"), "utf8"));
   } catch {
     return null;
   }
 }
 function writeEnv(dir, v) {
   const lines = Object.entries(v).map(([k, val]) => `${k}=${val}`);
-  import_fs10.default.writeFileSync(import_path8.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
+  import_fs11.default.writeFileSync(import_path9.default.join(dir, ".env.local"), `# Written by ${LATEST} demo. Server-side only: never commit or share.
 ${lines.join("\n")}
 `, { mode: 384 });
 }
 function readEnvFile(file2) {
   const out = {};
   try {
-    for (const line of import_fs10.default.readFileSync(file2, "utf8").split("\n")) {
+    for (const line of import_fs11.default.readFileSync(file2, "utf8").split("\n")) {
       const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
       if (m) out[m[1]] = m[2];
     }
@@ -10271,14 +10901,14 @@ function readEnvFile(file2) {
 }
 function demoDir() {
   const here = process.cwd();
-  if (import_fs10.default.existsSync(import_path8.default.join(here, STATE_DIR, "state.json"))) return here;
-  return import_path8.default.resolve(here, DIR_NAME);
+  if (import_fs11.default.existsSync(import_path9.default.join(here, STATE_DIR, "state.json"))) return here;
+  return import_path9.default.resolve(here, DIR_NAME);
 }
 function adoptWorkspace(cpKey, teamId, claimCode) {
   const prev = loadAnonCred();
   if (prev?.cp_key && prev.team_id && prev.team_id !== teamId) {
     try {
-      import_fs10.default.writeFileSync(import_path8.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
+      import_fs11.default.writeFileSync(import_path9.default.join(getApiblazeDir(), `anon.${prev.team_id}.json`), JSON.stringify(prev, null, 2), { mode: 384 });
     } catch {
     }
   }
@@ -10370,7 +11000,7 @@ function openBrowser3(url) {
 }
 async function offerBrowserAndLogs(dir, opts) {
   if (opts.open === false || opts.yes || !interactive()) return;
-  const env = readEnvFile(import_path8.default.join(dir, ".env.local"));
+  const env = readEnvFile(import_path9.default.join(dir, ".env.local"));
   const url = `http://localhost:${env.APP_PORT}`;
   console.log();
   if (await ask(`  Open ${url} in your browser? (Y/n) `)) openBrowser3(url);
@@ -10405,7 +11035,7 @@ function routesOf(openapi) {
   return out;
 }
 async function runDemo(opts = {}) {
-  if (opts.serve) return serveTunnel(import_path8.default.resolve(opts.serve));
+  if (opts.serve) return serveTunnel(import_path9.default.resolve(opts.serve));
   try {
     countRun({ event: await startDemo(opts) });
   } catch (err) {
@@ -10461,8 +11091,8 @@ function printTable(rows) {
 async function startDemo(opts) {
   const t0 = Date.now();
   const here = process.cwd();
-  const dir = import_fs10.default.existsSync(import_path8.default.join(here, STATE_DIR, "state.json")) ? here : import_path8.default.resolve(here, DIR_NAME);
-  const rel = import_path8.default.relative(here, dir) || ".";
+  const dir = import_fs11.default.existsSync(import_path9.default.join(here, STATE_DIR, "state.json")) ? here : import_path9.default.resolve(here, DIR_NAME);
+  const rel = import_path9.default.relative(here, dir) || ".";
   const cdDir = rel === "." ? "" : `cd ${rel} && `;
   const shell = (c, note = "") => console.log(`   ${import_chalk33.default.dim("$")} ${import_chalk33.default.cyan(c)}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
   const ok = (text, note = "") => console.log(`   ${import_chalk33.default.green("\u2713")} ${text}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
@@ -10482,8 +11112,8 @@ async function startDemo(opts) {
   const backendSecret = import_crypto.default.randomBytes(18).toString("base64url");
   const openapi = DEMO_FILES["openapi.yaml"];
   try {
-    const specPath = import_path8.default.join(dir, "openapi.yaml");
-    import_fs10.default.writeFileSync(specPath, import_fs10.default.readFileSync(specPath, "utf8").replace(/^paths:/m, `servers:
+    const specPath = import_path9.default.join(dir, "openapi.yaml");
+    import_fs11.default.writeFileSync(specPath, import_fs11.default.readFileSync(specPath, "utf8").replace(/^paths:/m, `servers:
   - url: http://localhost:${backendPort2}
 paths:`));
   } catch {
@@ -10505,12 +11135,12 @@ paths:`));
   if (!appCtl(dir, "--background")) throw new DemoError("The ResiResi app could not start.", `Run again: ${LATEST} demo`, "app-start");
   registerDemo(dir);
   const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort2, directPort]), 1800);
-  if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path8.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`, "app-not-up");
+  if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path9.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`, "app-not-up");
   ok(`${import_chalk33.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
   ok(`${import_chalk33.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk33.default.bold(`http://localhost:${directPort}`)}`);
   console.log("   Book a table directly, the way the unprotected front-end does:");
   console.log(import_chalk33.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
-  console.log(import_chalk33.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path8.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
+  console.log(import_chalk33.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path9.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
   console.log(import_chalk33.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
   const tomorrow = new Date(Date.now() + 864e5);
   const day = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, "0")}-${String(tomorrow.getDate()).padStart(2, "0")}`;
@@ -10650,23 +11280,23 @@ paths:`));
     appCtl(dir, "--background");
     return waitPorts([appPort, directPort, backendPort2]);
   }, 1500);
-  if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path8.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`, "site-not-up");
+  if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path9.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`, "site-not-up");
   ok(`${import_chalk33.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk33.default.bold(`http://localhost:${appPort}`)}`);
   ok(`${import_chalk33.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
   console.log();
-  console.log(import_chalk33.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path8.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
+  console.log(import_chalk33.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path9.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
   await offerBrowserAndLogs(dir, opts);
   return "demo-ready";
 }
 function printAddresses(dir) {
-  const env = readEnvFile(import_path8.default.join(dir, ".env.local"));
+  const env = readEnvFile(import_path9.default.join(dir, ".env.local"));
   const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
   row("Public API", env.APIBLAZE_URL ?? "", `${B.product} tunnel \u2192 localhost:${env.BACKEND_PORT}`);
   row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor (Nino Pizza)");
   if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
 }
 async function spawnTunnel(dir, state) {
-  const log4 = import_fs10.default.openSync(import_path8.default.join(dir, STATE_DIR, "tunnel.log"), "a");
+  const log4 = import_fs11.default.openSync(import_path9.default.join(dir, STATE_DIR, "tunnel.log"), "a");
   const child = (0, import_child_process7.spawn)(process.execPath, [process.argv[1], "demo", "--serve", dir], { cwd: dir, detached: true, stdio: ["ignore", log4, log4] });
   child.unref();
   saveState(dir, { ...state, pid: child.pid, ready: false, error: void 0 });
@@ -10677,7 +11307,7 @@ async function runDemoStart(opts = {}) {
   const t0 = Date.now();
   const dir = demoDir();
   const state = loadState(dir);
-  const env = readEnvFile(import_path8.default.join(dir, ".env.local"));
+  const env = readEnvFile(import_path9.default.join(dir, ".env.local"));
   if (!state || !env.APIBLAZE_SERVER_KEY) {
     console.log(`${import_chalk33.default.red("\u2717")} There is no demo here to start.`);
     console.log(`  Make one: ${LATEST} demo`);
@@ -10697,11 +11327,11 @@ async function runDemoStart(opts = {}) {
   console.log(`${import_chalk33.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk33.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
   printAddresses(dir);
   const appUp = await fetch(`http://127.0.0.1:${env.APP_PORT}/api/config`).then(() => true).catch(() => false);
-  if (!appUp) console.log(import_chalk33.default.yellow(`   ResiResi is not running: cd ${import_path8.default.relative(process.cwd(), dir) || "."} && npm run start`));
+  if (!appUp) console.log(import_chalk33.default.yellow(`   ResiResi is not running: cd ${import_path9.default.relative(process.cwd(), dir) || "."} && npm run start`));
   await offerBrowserAndLogs(dir, opts);
 }
 async function runDemoLogs() {
-  const env = readEnvFile(import_path8.default.join(demoDir(), ".env.local"));
+  const env = readEnvFile(import_path9.default.join(demoDir(), ".env.local"));
   if (!env.APIBLAZE_NAME) {
     console.log(`${import_chalk33.default.red("\u2717")} There is no demo here.`);
     console.log(`  Make one: ${LATEST} demo`);
@@ -10771,12 +11401,12 @@ async function serveTunnel(dir) {
   await new Promise(() => {
   });
 }
-var import_fs10, import_path8, import_net2, import_child_process7, import_crypto, import_chalk33, import_ora11, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
+var import_fs11, import_path9, import_net2, import_child_process7, import_crypto, import_chalk33, import_ora11, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
-    import_fs10 = __toESM(require("fs"));
-    import_path8 = __toESM(require("path"));
+    import_fs11 = __toESM(require("fs"));
+    import_path9 = __toESM(require("path"));
     import_net2 = __toESM(require("net"));
     import_child_process7 = require("child_process");
     import_crypto = __toESM(require("crypto"));
@@ -10807,7 +11437,7 @@ var init_demo = __esm({
     ADJ = ["brave", "calm", "clever", "eager", "happy", "jolly", "lucky", "merry", "noble", "quick", "sunny", "swift", "witty", "zesty", "bright", "gentle"];
     NOUN = ["otter", "falcon", "panda", "heron", "koala", "lemur", "puffin", "robin", "tiger", "walrus", "wombat", "badger", "comet", "maple", "river", "finch"];
     pick2 = (a) => a[import_crypto.default.randomInt(a.length)];
-    registryFile = () => import_path8.default.join(getApiblazeDir(), "demo-runs.json");
+    registryFile = () => import_path9.default.join(getApiblazeDir(), "demo-runs.json");
     alive = (pid) => {
       try {
         process.kill(pid, 0);
@@ -11072,7 +11702,7 @@ function runCli(args, cwd, home, timeoutMs) {
 function readEnv(file2) {
   const out = {};
   try {
-    for (const line of import_fs13.default.readFileSync(file2, "utf8").split("\n")) {
+    for (const line of import_fs14.default.readFileSync(file2, "utf8").split("\n")) {
       const m = /^([A-Z0-9_]+)=(.*)$/.exec(line.trim());
       if (m) out[m[1]] = m[2];
     }
@@ -11105,7 +11735,7 @@ async function journey(label3, work, home, checks) {
     `exit ${run2.code} in ${Math.round(run2.ms / 1e3)} s${leaked ? " \xB7 PRINTED A SECRET" : ""}${run2.code !== 0 ? ` \xB7 ${run2.out.trim().split("\n").slice(-2).join(" / ")}` : ""}`
   );
   if (run2.code !== 0) return null;
-  const env = readEnv(import_path10.default.join(work, `${B.cli}-demo`, ".env.local"));
+  const env = readEnv(import_path11.default.join(work, `${B.cli}-demo`, ".env.local"));
   const api = env.APIBLAZE_URL;
   const nino = env.APIBLAZE_SERVER_KEY;
   const as = (user, key = nino) => ({ "x-api-key": key, "x-end-user-id": user, "content-type": "application/json" });
@@ -11173,7 +11803,7 @@ async function claimJourney(work, checks, env) {
   let code = "";
   let teamId = "";
   try {
-    const st = JSON.parse(import_fs13.default.readFileSync(import_path10.default.join(work, `${B.cli}-demo`, ".demo", "state.json"), "utf8"));
+    const st = JSON.parse(import_fs14.default.readFileSync(import_path11.default.join(work, `${B.cli}-demo`, ".demo", "state.json"), "utf8"));
     code = st.claimCode ?? "";
     teamId = st.teamId ?? "";
   } catch {
@@ -11236,11 +11866,11 @@ async function claimJourney(work, checks, env) {
 }
 async function runOpAnon(o = {}) {
   const t0 = Date.now();
-  const root = import_fs13.default.mkdtempSync(import_path10.default.join(import_os5.default.tmpdir(), `${B.cli}-op-anon-`));
-  const home = import_path10.default.join(root, "home");
-  const work = import_path10.default.join(root, "work");
-  import_fs13.default.mkdirSync(home);
-  import_fs13.default.mkdirSync(work);
+  const root = import_fs14.default.mkdtempSync(import_path11.default.join(import_os5.default.tmpdir(), `${B.cli}-op-anon-`));
+  const home = import_path11.default.join(root, "home");
+  const work = import_path11.default.join(root, "work");
+  import_fs14.default.mkdirSync(home);
+  import_fs14.default.mkdirSync(work);
   const checks = [];
   const log4 = (s) => {
     if (!o.json) console.log(s);
@@ -11252,21 +11882,21 @@ async function runOpAnon(o = {}) {
     await claimJourney(work, checks, env);
   } finally {
     const stop = await runCli(["demo", "stop"], work, home, 3e4);
-    const demoFolder = import_path10.default.join(work, `${B.cli}-demo`);
-    if (import_fs13.default.existsSync(import_path10.default.join(demoFolder, "start.js"))) {
+    const demoFolder = import_path11.default.join(work, `${B.cli}-demo`);
+    if (import_fs14.default.existsSync(import_path11.default.join(demoFolder, "start.js"))) {
       await new Promise((res) => {
-        const c = (0, import_child_process8.spawn)(process.execPath, [import_path10.default.join(demoFolder, "start.js"), "--stop"], { cwd: demoFolder, stdio: "ignore" });
+        const c = (0, import_child_process8.spawn)(process.execPath, [import_path11.default.join(demoFolder, "start.js"), "--stop"], { cwd: demoFolder, stdio: "ignore" });
         c.on("close", () => res());
       });
     }
-    const env = readEnv(import_path10.default.join(work, `${B.cli}-demo`, ".env.local"));
+    const env = readEnv(import_path11.default.join(work, `${B.cli}-demo`, ".env.local"));
     let portsFree = true;
     for (const p of [env.APP_PORT, env.BACKEND_PORT].filter(Boolean)) {
       const r = await http(`http://127.0.0.1:${p}/`, { timeoutMs: 2e3 });
       if (r.status !== 0) portsFree = false;
     }
     checks.push({ id: "stop", ok: stop.code === 0 && portsFree, detail: `exit ${stop.code}${portsFree ? "" : " \xB7 ports still answering"}` });
-    import_fs13.default.rmSync(root, { recursive: true, force: true });
+    import_fs14.default.rmSync(root, { recursive: true, force: true });
   }
   for (const c of checks) log4(`  ${c.skipped ? import_chalk76.default.yellow("\u2013") : c.ok ? import_chalk76.default.green("\u2713") : import_chalk76.default.red("\u2717")} ${c.id.padEnd(24)} ${import_chalk76.default.dim(c.detail)}`);
   const failed = checks.filter((c) => !c.ok).length;
@@ -11279,13 +11909,13 @@ async function runOpAnon(o = {}) {
   if (failed) process.exitCode = 1;
   return { ok: !failed, checks };
 }
-var import_fs13, import_os5, import_path10, import_child_process8, import_chalk76, SECRET, SANDBOX_TEAM;
+var import_fs14, import_os5, import_path11, import_child_process8, import_chalk76, SECRET, SANDBOX_TEAM;
 var init_op_anon = __esm({
   "src/commands/op-anon.ts"() {
     "use strict";
-    import_fs13 = __toESM(require("fs"));
+    import_fs14 = __toESM(require("fs"));
     import_os5 = __toESM(require("os"));
-    import_path10 = __toESM(require("path"));
+    import_path11 = __toESM(require("path"));
     import_child_process8 = require("child_process");
     import_chalk76 = __toESM(require("chalk"));
     init_brand();
@@ -11298,7 +11928,7 @@ var init_op_anon = __esm({
 });
 
 // src/index.ts
-var import_fs14 = __toESM(require("fs"));
+var import_fs15 = __toESM(require("fs"));
 var import_commander = require("commander");
 var import_chalk78 = __toESM(require("chalk"));
 init_package();
@@ -11889,8 +12519,8 @@ async function opCall(call3) {
 }
 
 // src/commands/connector.ts
-var import_fs8 = __toESM(require("fs"));
-var import_path6 = __toESM(require("path"));
+var import_fs9 = __toESM(require("fs"));
+var import_path7 = __toESM(require("path"));
 var import_chalk30 = __toESM(require("chalk"));
 var import_ora10 = __toESM(require("ora"));
 init_caller();
@@ -12034,7 +12664,7 @@ function suggestedMcpHost(apexDomain) {
 // src/commands/connector.ts
 var PORTALS = {
   claude: "https://claude.com/docs/connectors/building/submission",
-  chatgpt: "https://developers.openai.com/apps-sdk/deploy/submission"
+  chatgpt: "https://platform.openai.com/plugins"
 };
 var projectPath3 = (p) => `/projects/${encodeURIComponent(p.projectId)}/${encodeURIComponent(p.apiVersion)}`;
 async function patchProject(caller, proj2, body, summary) {
@@ -12052,11 +12682,15 @@ var PROMPT_FOR_RULE = {
   VULN_CONTACT: { key: "vulnContact", message: "Security contact (email or URL):" },
   LISTING_NAME_LEN_CHATGPT: { key: "serverName", message: "Listing name", limit: 30, portal: "ChatGPT" },
   LISTING_NAME_LEN_CLAUDE: { key: "serverName", message: "Listing name", limit: 100, portal: "Claude" },
-  TAGLINE_LEN_CHATGPT: { key: "tagline", message: "One-line tagline", limit: 30, portal: "ChatGPT" },
+  TAGLINE_LEN_CHATGPT: { key: "shortDescription", message: "ChatGPT subtitle (the Claude tagline stays as it is)", limit: 30, portal: "ChatGPT" },
+  SHORT_DESCRIPTION_SET: { key: "shortDescription", message: "ChatGPT subtitle", limit: 30, portal: "ChatGPT" },
   TAGLINE_LEN_CLAUDE: { key: "tagline", message: "One-line tagline", limit: 200, portal: "Claude" },
   DESCRIPTION_LEN_CLAUDE: { key: "description", message: "Description", limit: 2e3, portal: "Claude" },
   DESCRIPTION_LEN_CHATGPT: { key: "description", message: "Description", limit: 4e3, portal: "ChatGPT" },
   PROMPT_LEN_CHATGPT: { key: "prompt", message: "Example prompt", multi: true, limit: 128, portal: "ChatGPT" },
+  // WP5: Anthropic's slug (pre-filled from the listing name; permanent once published) and the policy's high-risk question.
+  SLUG_SET: { key: "slug", message: "Listing slug (lowercase-with-hyphens; permanent once published, claude.ai/directory/connectors/<slug>):" },
+  HIGH_RISK_DECLARED: { key: "highRisk", message: "High-risk use cases \u2014 does it serve legal, healthcare, insurance or finance decisions? (none, or a comma-separated list):" },
   // ChatGPT only: the portal issues this token (Plugins → Connect MCP server); we serve it verbatim.
   OPENAI_DOMAIN_CHALLENGE: { key: "openaiChallenge", message: "OpenAI domain challenge token, from platform.openai.com/plugins \u2192 Connect MCP server (Enter to skip for now):" }
 };
@@ -12073,7 +12707,7 @@ function looksLikeSpecArgument(arg) {
   if (/^https?:\/\//i.test(a)) return true;
   if (/[\\/]/.test(a) || /\.(ya?ml|json)$/i.test(a)) {
     try {
-      return import_fs8.default.existsSync(a) && import_fs8.default.statSync(a).isFile();
+      return import_fs9.default.existsSync(a) && import_fs9.default.statSync(a).isFile();
     } catch {
       return false;
     }
@@ -12087,6 +12721,7 @@ function currentListingValue(r, key) {
     tagline: "tagline",
     description: "description",
     prompt: "examplePrompts",
+    shortDescription: "shortDescription",
     privacyUrl: "privacyUrl",
     support: "supportContact",
     docsUrl: "docsUrl",
@@ -12172,14 +12807,14 @@ async function promptForMissing(r, interactive2, defaults = { prompts: [] }, pla
         if (testPrompt) {
           let res = await testPrompt(text);
           if (!res.called) {
-            say_(import_chalk30.default.yellow(`  \u2013 Claude called no tool for "${text}". A prompt should say what the tool does (a real URL, name or id helps).`));
+            say_(import_chalk30.default.yellow(`  \u2013 No tool call for "${text}". A prompt should say what the tool does (a real URL, name or id helps).`));
             const again = await inquirer3.prompt([{ type: "input", name: "line", message: "Reword it (Enter keeps it):", default: text, validate: withinLimit(a) }]);
             if (again.line?.trim() && again.line.trim() !== text) {
               text = again.line.trim();
               res = await testPrompt(text);
             }
           }
-          say_(res.called ? import_chalk30.default.green(`  \u2713 Claude called ${res.tools.join(", ")}`) : import_chalk30.default.yellow("  \u2013 still no tool call; kept (the report will say so)"));
+          if (!res.called) say_(import_chalk30.default.yellow("  \u2013 still no tool call; kept (the report will say so)"));
         }
         lines.push(text);
       }
@@ -12193,7 +12828,7 @@ async function promptForMissing(r, interactive2, defaults = { prompts: [] }, pla
       continue;
     }
     const dk = DEFAULT_FOR_KEY[a.key];
-    const base2 = typeof current === "string" ? current : dk ? defaults[dk] : void 0;
+    const base2 = typeof current === "string" ? current : a.key === "shortDescription" ? currentListingValue(r, "tagline") : dk ? defaults[dk] : void 0;
     const def = typeof base2 === "string" && base2 ? a.limit ? shortenTo(base2, a.limit) : base2 : void 0;
     const { value } = await inquirer3.prompt([{
       type: "input",
@@ -12248,7 +12883,7 @@ async function askOpenMode(caller, proj2, r, opts, interactive2, say) {
 async function promptListingBasics(r, interactive2, defaults, given, platforms = PLATFORMS, save) {
   const meta = r.target?.metadata ?? {};
   const gpt = platforms.includes("chatgpt");
-  const lim = { serverName: gpt ? 30 : 100, tagline: gpt ? 30 : 200, description: platforms.includes("claude") ? 2e3 : 4e3 };
+  const lim = { serverName: gpt ? 30 : 100, tagline: 200, description: platforms.includes("claude") ? 2e3 : 4e3 };
   const cutTo = (v, n) => v ? shortenTo(v, n) : v;
   const all = [
     { key: "serverName", current: meta.serverName, def: cutTo(defaults.serverName, lim.serverName), message: `Listing name (\u2264 ${lim.serverName} chars, no "MCP"/"Plugin" suffix):` },
@@ -12316,7 +12951,7 @@ async function specTextFor(source) {
       const res = await fetch(source, { signal: AbortSignal.timeout(8e3) });
       return res.ok ? await res.text() : null;
     }
-    return import_fs8.default.readFileSync(source, "utf-8");
+    return import_fs9.default.readFileSync(source, "utf-8");
   } catch {
     return null;
   }
@@ -12507,6 +13142,10 @@ async function runConnector(target2, opts) {
     const changed = await fixToolDescriptions(proj2, r.report.project.environment, interactive2, say);
     if (changed) r = await fetchDirectoryReport(caller, proj2, { platforms });
   }
+  if (r.report.results.some((x) => x.id === "TOOL_OPENWORLD_CONFIRMED" && !x.pass)) {
+    const changed = await confirmOpenWorld(proj2, r.report.project.environment, interactive2, opts.openWorld, isOpenMode(r), say);
+    if (changed) r = await fetchDirectoryReport(caller, proj2, { platforms });
+  }
   if (await askOpenMode(caller, proj2, r, opts, interactive2, say)) r = await fetchDirectoryReport(caller, proj2, { platforms });
   let reviewer = null;
   if (r.report.results.some((x) => x.id === "TEST_ACCOUNT_SET" && !x.pass)) {
@@ -12532,11 +13171,15 @@ async function runConnector(target2, opts) {
     if (!tester && !testerTried) {
       testerTried = true;
       const { createPromptTester: createPromptTester2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
-      tester = await createPromptTester2(caller, proj2, { say });
+      tester = await createPromptTester2(caller, proj2, { say, platforms });
     }
     if (!tester) return { called: true, tools: [] };
-    say(import_chalk30.default.dim("  trying it through Claude Code\u2026"));
-    return tester.test(p);
+    const t = tester;
+    say(import_chalk30.default.dim(`  trying it through ${t.clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}\u2026`));
+    const res = await t.test(p);
+    if (res.tools.length) await patchProject(caller, proj2, { directory_metadata: { prompt_tools: { [p.trim()]: res.tools } } }, "Remember which tool the prompt called").catch(() => null);
+    for (const [client, r2] of Object.entries(res.byClient)) say(r2.called ? import_chalk30.default.green(`  \u2713 ${client === "claude" ? "Claude" : "Codex"} called ${r2.tools.join(", ")}`) : import_chalk30.default.yellow(`  \u2013 ${client === "claude" ? "Claude" : "Codex"} called no tool`));
+    return res;
   };
   if (!isReady(r, platforms) || Object.keys(basics).length) {
     const asked = { ...basics, ...isReady(r, platforms) ? {} : await promptForMissing(r, interactive2, defaults, platforms, basics, interactive2 ? saveAnswer : void 0, interactive2 && opts.exercise !== false ? testPrompt : void 0) };
@@ -12557,7 +13200,7 @@ async function runConnector(target2, opts) {
   }
   if (interactive2 && r.report.results.some((x) => ANSWER_RULES.includes(x.id) && !x.pass)) {
     const { runConnectorAnswers: runConnectorAnswers2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
-    await runConnectorAnswers2(proj2.projectName, { team: opts.team, apiversion: opts.apiversion, platforms: [...platforms], derived: false });
+    await runConnectorAnswers2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, platforms: [...platforms], derived: false, testPrompt: opts.exercise !== false ? testPrompt : void 0 });
     r = await fetchDirectoryReport(caller, proj2, { platforms });
   }
   if (opts.exercise !== false) {
@@ -12568,18 +13211,26 @@ async function runConnector(target2, opts) {
     }
     if (run2) {
       const { runConnectorExercise: runConnectorExercise2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
-      const ran = await runConnectorExercise2(proj2.projectName, { team: opts.team, apiversion: opts.apiversion, json, yes: opts.yes, noEmail: opts.email === false, report: false, platforms: [...platforms], provenPromptNotes });
+      const ran = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, yes: opts.yes, noEmail: opts.email === false, report: false, platforms: [...platforms], provenPromptNotes, seed: opts.seed });
       if (interactive2 && ran.failedPrompts.length) {
+        for (const [p, clients] of Object.entries(ran.failedByClient ?? {})) say(import_chalk30.default.yellow(`  \u2013 "${p.slice(0, 60)}": no tool call in ${clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}`));
         const { rewritten, prompts } = await rewriteFailedPrompts(r, ran.failedPrompts, saveAnswer, say);
         if (rewritten.length) {
-          say(import_chalk30.default.dim(`  Running the ${prompts.length} prompts through Claude Code again (the report reads the last run)\u2026`));
-          await runConnectorExercise2(proj2.projectName, { team: opts.team, apiversion: opts.apiversion, json, noEmail: opts.email === false, report: false, platforms: [...platforms], promptsOnly: prompts });
+          const { clientsFor: clientsFor2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
+          say(import_chalk30.default.dim(`  Running the ${prompts.length} prompts through ${clientsFor2(platforms).map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")} again (the report reads the last run)\u2026`));
+          const again = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, noEmail: opts.email === false, report: false, platforms: [...platforms], promptsOnly: prompts, provenPromptNotes: ran.notes.filter((n) => n.kind === "negative") });
+          ran.promptTools = { ...ran.promptTools, ...again.promptTools };
+          ran.codexPromptTools = { ...ran.codexPromptTools, ...again.codexPromptTools };
+          ran.failedPrompts = again.failedPrompts;
+          ran.failedByClient = again.failedByClient;
         }
       }
-      if (interactive2 || opts.yes) await offerDrafts(caller, proj2, r, ran, interactive2, say);
-      r = await fetchDirectoryReport(caller, proj2, { platforms, publishedUrl: r.report.project.publishedUrl ?? null });
+      if (interactive2 || opts.yes) await offerDrafts(caller, proj2, r, ran, interactive2, say, platforms);
+      const extraProbes = ran?.userinfo && ran.userinfo.userinfoStatus != null ? { metadata: { userinfoStatus: ran.userinfo.userinfoStatus, userinfoEmailVerified: ran.userinfo.userinfoEmailVerified } } : null;
+      r = await fetchDirectoryReport(caller, proj2, { platforms, publishedUrl: r.report.project.publishedUrl ?? null, extraProbes, listing: listingOf(r) });
     }
   }
+  if (opts.waitLogin !== false && interactive2) r = await waitForClaudeLogin(caller, proj2, r, platforms, interactive2, say);
   if (!readyExceptSnapshot(r, platforms)) {
     if (!domain2.active && domain2.hostname && !json) {
       console.error(import_chalk30.default.yellow(`
@@ -12587,14 +13238,33 @@ async function runConnector(target2, opts) {
     }
     exitWithReport(r, proj2, platforms, json, interactive2);
   }
-  r = await fetchDirectoryReport(caller, proj2, { platforms, refreshSnapshot: true, publishedUrl: r.report.project.publishedUrl ?? null });
+  r = await fetchDirectoryReport(caller, proj2, { platforms, refreshSnapshot: true, publishedUrl: r.report.project.publishedUrl ?? null, listing: listingOf(r) });
+  let watching = false;
+  if (opts.watch !== false) {
+    watching = await producer(caller, { method: "POST", path: `${projectPath3(proj2)}/directory-watch`, body: { enabled: true }, summary: "Turn on the nightly re-check" }).then(() => true).catch((e) => {
+      say(import_chalk30.default.dim(`  (nightly re-check not switched on: ${e.message})`));
+      return false;
+    });
+  }
   const probes = await packetProbes(r);
   const packet = await producer(caller, { method: "POST", path: `${projectPath3(proj2)}/directory-packet`, body: { platforms, ...probes ? { probes } : {} }, summary: "Submission packet" });
   const dir = opts.out ?? process.cwd();
-  const mdPath = import_path6.default.join(dir, `connector-packet-${proj2.projectId}.md`);
-  const jsonPath = import_path6.default.join(dir, `connector-packet-${proj2.projectId}.json`);
-  import_fs8.default.writeFileSync(mdPath, packet.markdown, { mode: 384 });
-  import_fs8.default.writeFileSync(jsonPath, JSON.stringify(packet.json, null, 2) + "\n", { mode: 384 });
+  import_fs9.default.mkdirSync(dir, { recursive: true });
+  const mdPath = import_path7.default.join(dir, `connector-packet-${proj2.projectId}.md`);
+  const jsonPath = import_path7.default.join(dir, `connector-packet-${proj2.projectId}.json`);
+  import_fs9.default.writeFileSync(mdPath, packet.markdown, { mode: 384 });
+  import_fs9.default.writeFileSync(jsonPath, JSON.stringify(packet.json, null, 2) + "\n", { mode: 384 });
+  let zipPath = null;
+  if (platforms.includes("chatgpt")) {
+    const { writePluginPackage: writePluginPackage2 } = await Promise.resolve().then(() => (init_plugin_package(), plugin_package_exports));
+    const manifest = packet.json.chatgpt;
+    if (manifest) {
+      const written = await writePluginPackage2(dir, manifest);
+      if (written.problem) say(import_chalk30.default.yellow(`  ${written.problem}`));
+      zipPath = written.zipPath;
+      if (written.seq) await patchProject(caller, proj2, { directory_metadata: { plugin_package_seq: written.seq } }, "Bump the plugin package version").catch(() => null);
+    }
+  }
   if (json) {
     process.stdout.write(JSON.stringify({ ready: true, project: proj2.projectId, headline: r.rendered.headline, report: r.report, packet: { markdown: mdPath, json: jsonPath }, portals: PORTALS, ...reviewer ? { reviewer } : {} }) + "\n");
     return;
@@ -12607,17 +13277,51 @@ async function runConnector(target2, opts) {
   }
   console.log();
   console.log(import_chalk30.default.green.bold(`  ${r.rendered.headline}`));
-  console.log(`  Submission packet: ${import_chalk30.default.cyan(mdPath)} and ${import_chalk30.default.cyan(jsonPath)}`);
+  console.log(`  Submission packet: ${import_chalk30.default.cyan(mdPath)} and ${import_chalk30.default.cyan(jsonPath)}${zipPath ? `
+  OpenAI plugin package: ${import_chalk30.default.cyan(zipPath)}` : ""}`);
   console.log(import_chalk30.default.dim(isOpenMode(r) ? "  (open mode: no reviewer credentials in the packet; the connector takes no sign-in)" : "  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
-  printSubmitSteps(r, mdPath, platforms);
+  printSubmitSteps(r, mdPath, platforms, watching);
   console.log(import_chalk30.default.dim(`  ${r.report.disclaimer}`));
 }
+async function waitForClaudeLogin(caller, proj2, r, platforms, interactive2, say, deps = {}) {
+  const rule = r.report.results.find((x) => x.id === "OAUTH_FLOW_COMPLETED");
+  if (!rule || rule.pass || !interactive2 || isOpenMode(r)) return r;
+  const url = r.report.project.publishedUrl ?? "";
+  const name = r.target?.metadata?.serverName ?? proj2.projectId;
+  const alias = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || proj2.projectId;
+  say("");
+  say(import_chalk30.default.bold("  One sign-in from a real Claude client is the last proof (OAUTH_FLOW_COMPLETED). In another terminal:"));
+  say(`    claude mcp add --transport http ${alias} ${url}`);
+  say(`    claude            then /mcp \u2192 ${alias} \u2192 sign in with the reviewer account`);
+  say(import_chalk30.default.dim(`  or in claude.ai: Settings \u2192 Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
+  say(import_chalk30.default.dim(`  Afterwards: claude mcp remove ${alias}`));
+  const { default: inquirer3 } = await import("inquirer");
+  const { go } = await inquirer3.prompt([{ type: "confirm", name: "go", message: "Sign in from Claude now, then press Enter to check (n skips; the verdict stays red on this rule):", default: true }]);
+  if (!go) return r;
+  const sleep2 = deps.sleep ?? ((ms2) => new Promise((res) => setTimeout(res, ms2)));
+  const maxMs = deps.maxMs ?? 10 * 6e4;
+  const started = Date.now();
+  let cur = r;
+  for (; ; ) {
+    cur = await fetchDirectoryReport(caller, proj2, { platforms });
+    const now = cur.report.results.find((x) => x.id === "OAUTH_FLOW_COMPLETED");
+    if (now?.pass) {
+      say(import_chalk30.default.green(`  \u2713 ${now.message ?? "a Claude client completed the sign-in"}`));
+      return cur;
+    }
+    if (Date.now() - started >= maxMs) {
+      say(import_chalk30.default.yellow("  \u2013 no Claude sign-in seen in 10 minutes; run again after signing in."));
+      return cur;
+    }
+    await sleep2(2e4);
+  }
+}
 async function rewriteFailedPrompts(r, failed, save, say) {
   const current = currentListingValue(r, "prompt");
   const list = Array.isArray(current) ? [...current] : [];
   const { default: inquirer3 } = await import("inquirer");
   const rewritten = [];
-  say(import_chalk30.default.yellow(`  ${failed.length === 1 ? "This prompt" : `${failed.length} prompts`} made Claude call no tool; a prompt should name what the tool does${failed.length === 1 ? "" : ", one at a time"}:`));
+  say(import_chalk30.default.yellow(`  ${failed.length === 1 ? "This prompt" : `${failed.length} prompts`} produced no tool call; a prompt should name what the tool does${failed.length === 1 ? "" : ", one at a time"}:`));
   for (const old of failed) {
     const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: `Rewrite "${old}" (Enter keeps it):`, default: old, validate: (v) => v.trim().length <= 300 ? true : `${v.trim().length} characters; 300 at most` }]);
     const next = (value ?? "").trim();
@@ -12647,12 +13351,12 @@ async function packetProbes(r) {
     return null;
   }
 }
-async function offerDrafts(caller, proj2, r, ran, interactive2, say) {
+async function offerDrafts(caller, proj2, r, ran, interactive2, say, platforms = PLATFORMS) {
   if (!ran || !Array.isArray(ran.rows) || !ran.publishedUrl) return false;
-  const { draftMissing: draftMissing2, ANSWER_MIN: ANSWER_MIN2 } = await Promise.resolve().then(() => (init_portal_drafts(), portal_drafts_exports));
+  const { draftMissing: draftMissing2, draftChatgptTestCases: draftChatgptTestCases2, ANSWER_MIN: ANSWER_MIN2 } = await Promise.resolve().then(() => (init_portal_drafts(), portal_drafts_exports));
   const meta = r.target?.metadata ?? {};
   const prompts = (meta.examplePrompts ?? []).filter((p) => typeof p === "string" && !!p.trim());
-  const drafts = draftMissing2({
+  const input = {
     publishedUrl: ran.publishedUrl,
     open: ran.open,
     reviewerUsername: ran.reviewerUsername,
@@ -12660,15 +13364,32 @@ async function offerDrafts(caller, proj2, r, ran, interactive2, say) {
     rows: ran.rows,
     prompts,
     promptTools: ran.promptTools,
+    codexPromptTools: ran.codexPromptTools ?? {},
     serverName: meta.serverName,
     tagline: meta.tagline,
-    description: meta.description
-  }, { use_cases: meta.portalAnswers?.use_cases, reviewer_instructions: meta.portalAnswers?.reviewer_instructions, description: meta.description });
-  if (!drafts.length) return false;
-  const inquirer3 = interactive2 ? (await import("inquirer")).default : null;
+    description: meta.description,
+    platforms,
+    negativePrompts: meta.portalAnswers?.chatgpt_test_cases?.negative ?? []
+  };
   let saved = false;
+  if (platforms.includes("chatgpt") && Object.keys(ran.codexPromptTools ?? {}).length) {
+    const cases = draftChatgptTestCases2(input);
+    const have = (meta.portalAnswers?.chatgpt_test_cases?.positive ?? []).length;
+    if (cases.positive.length && cases.positive.length !== have) {
+      try {
+        await patchProject(caller, proj2, { directory_portal_answers: { chatgpt_test_cases: cases } }, "Save OpenAI's test cases");
+        saved = true;
+        say(import_chalk30.default.green(`  \u2713 OpenAI's positive test cases written from the Codex run: ${cases.positive.length}/5${cases.positive.length < 5 ? " (more prompts that call a tool are needed for five)" : ""}`));
+      } catch (e) {
+        say(import_chalk30.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
+      }
+    }
+  }
+  const drafts = platforms.includes("claude") ? draftMissing2(input, { use_cases: meta.portalAnswers?.use_cases, reviewer_instructions: meta.portalAnswers?.reviewer_instructions, description: meta.description }) : draftMissing2(input, { use_cases: "x".repeat(ANSWER_MIN2.use_cases), reviewer_instructions: "x".repeat(ANSWER_MIN2.reviewer_instructions), description: meta.description });
+  if (!drafts.length) return saved;
+  const inquirer3 = interactive2 ? (await import("inquirer")).default : null;
   say("");
-  say(import_chalk30.default.bold(`  Written from the run \u2014 the portal's ${drafts.map((d) => d.label.toLowerCase()).join(", ")}${drafts.length > 1 ? "" : ""}:`));
+  say(import_chalk30.default.bold(`  Written from the run \u2014 the portal's ${drafts.map((d) => d.label.toLowerCase()).join(", ")}:`));
   for (const d of drafts) {
     let text = d.draft;
     say("");
@@ -12694,10 +13415,10 @@ async function offerDrafts(caller, proj2, r, ran, interactive2, say) {
 }
 var SNAPSHOT_RULE = "LISTING_SNAPSHOT_MATCH";
 var withProject = (s, projectId) => s.replace(/<project>/g, projectId);
-var ANSWER_RULES = ["PORTAL_ANSWERS_COMPLETE", "HEALTH_SPONSORED_DECLARED", "API_OWNERSHIP_DOMAIN"];
+var ANSWER_RULES = ["PORTAL_ANSWERS_COMPLETE", "HEALTH_SPONSORED_DECLARED", "API_OWNERSHIP_DOMAIN", "WEBSITE_URL_HTTPS_200", "SUPPORT_URL_HTTPS_200", "TERMS_URL_HTTPS_200", "DEVELOPER_NAME_SET", "CATEGORY_SET", "DEMO_RECORDING_URL_SET", "RELEASE_NOTES_SET", "SHORT_DESCRIPTION_SET", "CHATGPT_TEST_CASES_COMPLETE"];
 function exitWithReport(r, proj2, platforms, json, interactive2 = false) {
   if (json) {
-    process.stdout.write(JSON.stringify({ ready: false, project: proj2.projectId, headline: r.rendered.headline, report: r.report }) + "\n");
+    writeJsonLine({ ready: false, project: proj2.projectId, headline: r.rendered.headline, report: r.report });
     process.exit(1);
   }
   printReport(r, false);
@@ -12708,11 +13429,77 @@ function exitWithReport(r, proj2, platforms, json, interactive2 = false) {
   console.error(import_chalk30.default.red(`
 Not ready: ${blocking.length} blocker${blocking.length === 1 ? "" : "s"} (${blocking.map((x) => x.id).join(", ")}).`));
   const name = proj2.projectId;
-  if (real.some((x) => ANSWER_RULES.includes(x.id))) console.error(`  Next: run \`${B.cli} connector ${name}\` in a terminal with the exercise on \u2014 it asks what only you can answer and writes the use cases, the reviewer instructions and the description from the run; or pass them: \`${B.cli} connector answers ${name} --use-cases \u2026 --data-handling own --health-data no --sponsored-content no\`.`);
+  if (!interactive2) {
+    const flags = flagsForRules(real.map((x) => x.id), platforms);
+    if (flags.length) console.error(`  Non-interactive: pass ${flags.join(" ")} to \`${B.cli} connector ${name} --yes\` (or run it in a terminal to be asked).`);
+  }
+  const answerish = real.filter((x) => ANSWER_RULES.includes(x.id));
+  if (answerish.length && answerish.every((x) => !x.platforms.includes("claude"))) console.error(`  Next: ${withProject(answerish[0].fix ?? answerish[0].message ?? answerish[0].title, name)}`);
+  else if (answerish.length) console.error(`  Next: run \`${B.cli} connector ${name}${platforms.includes("chatgpt") ? ` --compliant ${platforms.length > 1 ? "all" : "chatgpt"}` : ""}\` in a terminal with the exercise on \u2014 it asks what only you can answer and writes the use cases, the reviewer instructions and the description from the run; or pass them: \`${B.cli} connector answers ${name} --use-cases \u2026 --data-handling own --health-data no --sponsored-content no\`.`);
   else if (first) console.error(`  Next: ${withProject(first.fix ?? first.message ?? first.title, name)}`);
   console.error(import_chalk30.default.dim(`  Report page: ${DASHBOARD_BASE6}/directory/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}`));
   process.exit(1);
 }
+function flagsForRules(ids, platforms) {
+  const out = [];
+  const kebab = (k) => `--${k.replace(/([a-z])([A-Z])/g, "$1-$2").toLowerCase()}`;
+  const seen = /* @__PURE__ */ new Set();
+  const add = (f2) => {
+    if (!seen.has(f2)) {
+      seen.add(f2);
+      out.push(f2);
+    }
+  };
+  for (const id of ids) {
+    const q = PROMPT_FOR_RULE[id];
+    if (q) {
+      add(`${kebab(q.key)} <\u2026>`);
+      continue;
+    }
+    if (id.startsWith("ATTEST_")) {
+      const a = ATTESTATIONS.find((x) => `ATTEST_${x.id.toUpperCase()}` === id || id === `ATTEST_${x.flags[0].replace(/-/g, "_").toUpperCase()}`);
+      add(a ? `--attest ${a.flags[0]}` : "--attest <\u2026>");
+      continue;
+    }
+    switch (id) {
+      case "HEALTH_SPONSORED_DECLARED":
+        add("--health-data yes|no");
+        add("--sponsored-content yes|no");
+        break;
+      case "HIGH_RISK_DECLARED":
+        add("--high-risk none|legal,\u2026");
+        break;
+      case "TOOL_OPENWORLD_CONFIRMED":
+        add("--open-world yes|no");
+        break;
+      case "REVIEWER_ACCOUNT_POPULATED":
+        add("--seed");
+        break;
+      case "API_OWNERSHIP_DOMAIN":
+        add('--data-handling own|proxied "<permission>"');
+        break;
+      case "DOCS_URL":
+      case "DOCS_PAGE_LIVE":
+      case "DOCS_IS_PROSE":
+        add("--docs-url <https://\u2026>");
+        break;
+      case "PORTAL_ANSWERS_COMPLETE":
+        add(`(then \`connector answers\` with --use-cases --prerequisites --access --company-name --company-website --company-contact)`);
+        break;
+      case "CHATGPT_TEST_CASES_COMPLETE":
+      case "NEGATIVE_PROMPTS_HOLD":
+        add("--negative-prompt <\u2026> (three)");
+        break;
+      case "OPENAI_DOMAIN_CHALLENGE":
+        add("--openai-challenge <token>");
+        break;
+      default:
+        break;
+    }
+  }
+  void platforms;
+  return out;
+}
 var TOOL_DESC_RULE = "TOOL_DESC_NONEMPTY_SPECIFIC";
 var UTILITY_PATH = /(health|ping|status|openapi|swagger|docs|spec|whoami|version)/i;
 var SPECIFIC_MIN = 12;
@@ -12725,7 +13512,10 @@ function needsDescription(t) {
   if (!d || d.length < SPECIFIC_MIN) return true;
   const m = (t["x-route"]?.method ?? "get").toUpperCase();
   const p = t["x-route"]?.path ?? "";
-  return new RegExp(`^(${m}\\s+${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${t.name})\\.?$`, "i").test(d);
+  if (new RegExp(`^(${m}\\s+${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${t.name})\\.?$`, "i").test(d)) return true;
+  const norm = (x) => x.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  const title = (t.summary ?? "").trim() || t.name.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ");
+  return norm(d) === norm(title) || d.length < 40;
 }
 function derivedDescription(t) {
   const m = (t["x-route"]?.method ?? "get").toUpperCase();
@@ -12735,9 +13525,40 @@ function derivedDescription(t) {
   const plural = segments.filter((s) => !s.startsWith("{")).pop()?.replace(/[-_]/g, " ") ?? "result";
   const one = segments[segments.length - 1]?.startsWith("{");
   const noun = one ? plural.replace(/s$/, "") : plural;
-  const returns = m === "GET" ? `Returns the ${noun} as JSON.` : m === "POST" ? `Creates it and returns the new ${noun.replace(/s$/, "")} as JSON.` : m === "DELETE" ? `Removes it and returns the result.` : `Applies the change and returns the updated ${noun.replace(/s$/, "")} as JSON.`;
+  const props = t.input_schema?.properties ?? {};
+  const required = t.input_schema?.required ?? [];
+  const firstParam = required.map((k) => [k, props[k]]).find(([, v]) => v && typeof v.description === "string" && v.description.trim()) ?? Object.entries(props).find(([, v]) => v && typeof v.description === "string" && v.description.trim());
+  const takes = firstParam ? ` Takes ${firstParam[0]}: ${firstParam[1].description.trim().replace(/\.$/, "")}.` : "";
+  const returns = m === "GET" ? `Returns the ${noun} as JSON.${takes}` : m === "POST" ? `Creates it and returns the new ${noun.replace(/s$/, "")} as JSON.` : m === "DELETE" ? `Removes it and returns the result.` : `Applies the change and returns the updated ${noun.replace(/s$/, "")} as JSON.`;
   return `${summary.replace(/\.$/, "")}. ${m} ${p}. ${returns}`;
 }
+async function confirmOpenWorld(proj2, environment, interactive2, flag, openMode, say) {
+  const { loadCatalogue: loadCatalogue2, saveCatalogue: saveCatalogue2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+  const t = { projectId: proj2.projectId, apiVersion: proj2.apiVersion, environment: environment || "dev" };
+  let cat;
+  try {
+    cat = await loadCatalogue2(t);
+  } catch {
+    return false;
+  }
+  const unset = cat.tools.map((x) => x.name).filter((n) => typeof cat.overrides?.[n]?.openWorld !== "boolean");
+  if (!unset.length) return false;
+  let answer = flag ? /^(y|yes|true|1)$/i.test(flag.trim()) : null;
+  if (answer === null && !interactive2) {
+    say(import_chalk30.default.dim(`  openWorldHint not answered for ${unset.length} tool${unset.length === 1 ? "" : "s"} (pass --open-world yes|no)`));
+    return false;
+  }
+  if (answer === null) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { ow } = await inquirer3.prompt([{ type: "confirm", name: "ow", message: `Do the tools reach public or open-ended data \u2014 web pages, other people's records \u2014 (y), or only the signed-in account's own data (n)? Applies to ${unset.length === cat.tools.length ? "every tool" : `${unset.length} tools`}; change one later with \`${B.cli} mcp ops ${proj2.projectId} set <tool> --open-world|--no-open-world\`.`, default: openMode }]);
+    answer = ow;
+  }
+  cat.overrides = { ...cat.overrides ?? {} };
+  for (const n of unset) cat.overrides[n] = { ...cat.overrides[n] ?? {}, openWorld: answer };
+  await saveCatalogue2(t, cat);
+  say(import_chalk30.default.green(`  \u2713 openWorldHint ${answer ? "true" : "false"} on ${unset.length === cat.tools.length ? "every tool" : unset.join(", ")}`));
+  return true;
+}
 async function fixToolDescriptions(proj2, environment, interactive2, say) {
   const { loadCatalogue: loadCatalogue2, saveCatalogue: saveCatalogue2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
   const t = { projectId: proj2.projectId, apiVersion: proj2.apiVersion, environment: environment || "dev" };
@@ -12825,17 +13646,17 @@ async function headStatus(u) {
     return 0;
   }
 }
-function printSubmitSteps(r, mdPath, platforms = PLATFORMS) {
+function printSubmitSteps(r, mdPath, platforms = PLATFORMS, watching = false) {
   const url = r.report.project.publishedUrl ?? "(the MCP URL in the packet)";
   const open = isOpenMode(r);
   const claude = platforms.includes("claude");
   const chatgpt = platforms.includes("chatgpt");
-  const where = [claude ? "Claude (Settings \u2192 Connectors)" : null, chatgpt ? "ChatGPT (Developer mode)" : null].filter(Boolean).join(" and in ");
+  const where = [claude ? "Claude (Settings \u2192 Connectors)" : null, chatgpt ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : null].filter(Boolean).join(" and in ");
   const steps = [
     `Test it yourself first: add ${import_chalk30.default.cyan(url)} as a custom connector in ${where}, ${open ? "no sign-in needed (open mode)" : "sign in with the reviewer account"}, run a tool.`,
-    ...claude ? [`Claude: ${import_chalk30.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk30.default.cyan(import_path6.default.basename(mdPath))}.`] : [],
-    ...chatgpt ? [`ChatGPT: ${import_chalk30.default.underline(PORTALS.chatgpt)} \u2192 ${claude ? "the same packet" : `the packet (${import_chalk30.default.cyan(import_path6.default.basename(mdPath))})`}, plus the 5 + 3 test cases it lists.`] : [],
-    open ? "A nightly re-check emails you if the listing drifts." : "Keep the reviewer account alive; a nightly re-check emails you if the listing drifts."
+    ...claude ? [`Claude: ${import_chalk30.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk30.default.cyan(import_path7.default.basename(mdPath))}.`] : [],
+    ...chatgpt ? [`ChatGPT: ${import_chalk30.default.underline(PORTALS.chatgpt)} \u2192 upload ${import_chalk30.default.cyan(`connector-plugin-${r.report.project.id}.zip`)} \u2192 MCPs \u2192 Connect \u2192 Verify Domain \u2192 authorize \u2192 Scan Tools; paste the reviewer credentials under Review details; add the demo recording URL and the release notes; confirm the attestations. The MCP hostname is permanent for the OpenAI listing.`] : [],
+    watching ? open ? "A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : "Keep the reviewer account alive. A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : open ? "The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts." : "Keep the reviewer account alive. The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts."
   ];
   console.log();
   console.log(import_chalk30.default.bold("  Submit (you do this part; the packet has every value to paste):"));
@@ -12848,15 +13669,15 @@ init_connector_exercise();
 init_connector_docs();
 
 // src/commands/skill.ts
-var import_fs11 = __toESM(require("fs"));
+var import_fs12 = __toESM(require("fs"));
 var import_os4 = __toESM(require("os"));
-var import_path9 = __toESM(require("path"));
+var import_path10 = __toESM(require("path"));
 var import_chalk34 = __toESM(require("chalk"));
 init_brand();
 
 // src/lib/detect-backend.ts
-var import_fs9 = __toESM(require("fs"));
-var import_path7 = __toESM(require("path"));
+var import_fs10 = __toESM(require("fs"));
+var import_path8 = __toESM(require("path"));
 var import_net = __toESM(require("net"));
 var NODE_SERVERS = [
   ["express", "Express", 3e3],
@@ -12887,9 +13708,9 @@ var COMMON_PORTS = [3e3, 3001, 4e3, 5e3, 8e3, 8080, 8787];
 var SPEC_PATHS = ["/openapi.json", "/openapi.yaml", "/docs/openapi.json", "/swagger.json", "/api/openapi.json"];
 function readText(file2, max = 256 * 1024) {
   try {
-    const st = import_fs9.default.statSync(file2);
+    const st = import_fs10.default.statSync(file2);
     if (!st.isFile() || st.size > max) return null;
-    return import_fs9.default.readFileSync(file2, "utf8");
+    return import_fs10.default.readFileSync(file2, "utf8");
   } catch {
     return null;
   }
@@ -12898,7 +13719,7 @@ function findSpecFile(dir) {
   for (const d of SPEC_DIRS) {
     for (const n of SPEC_NAMES) {
       const rel = d === "." ? n : `${d}/${n}`;
-      const text = readText(import_path7.default.join(dir, rel));
+      const text = readText(import_path8.default.join(dir, rel));
       if (text && /\b(openapi|swagger)\s*["']?\s*:/.test(text)) {
         const m = /\b(?:localhost|127\.0\.0\.1):(\d{2,5})\b/.exec(text);
         return { file: `./${rel}`, ...m ? { port: Number(m[1]) } : {} };
@@ -12915,7 +13736,7 @@ function portFromScripts(scripts) {
   return void 0;
 }
 function fromNode(dir, out) {
-  const text = readText(import_path7.default.join(dir, "package.json"));
+  const text = readText(import_path8.default.join(dir, "package.json"));
   if (!text) return;
   let pkg = {};
   try {
@@ -12981,7 +13802,7 @@ function portInSource(text) {
 }
 function fromEntryFiles(dir, out) {
   for (const rel of ENTRY_FILES) {
-    const text = readText(import_path7.default.join(dir, rel));
+    const text = readText(import_path8.default.join(dir, rel));
     if (!text) continue;
     let fw;
     let def;
@@ -13018,7 +13839,7 @@ function fromEntryFiles(dir, out) {
 }
 function fromPython(dir, out) {
   for (const f2 of ["requirements.txt", "pyproject.toml", "Pipfile"]) {
-    const text = readText(import_path7.default.join(dir, f2));
+    const text = readText(import_path8.default.join(dir, f2));
     if (!text) continue;
     const hit = PY_SERVERS.find(([re]) => re.test(text));
     if (hit) {
@@ -13030,7 +13851,7 @@ function fromPython(dir, out) {
   }
 }
 function fromOthers(dir, out) {
-  const gomod = readText(import_path7.default.join(dir, "go.mod"));
+  const gomod = readText(import_path8.default.join(dir, "go.mod"));
   if (gomod) {
     const hit = GO_SERVERS.find(([re]) => re.test(gomod));
     out.framework = hit ? hit[1] : "a Go server";
@@ -13038,7 +13859,7 @@ function fromOthers(dir, out) {
     out.defaultPort = 8080;
     return;
   }
-  const gemfile = readText(import_path7.default.join(dir, "Gemfile"));
+  const gemfile = readText(import_path8.default.join(dir, "Gemfile"));
   if (gemfile) {
     const hit = RUBY_SERVERS.find(([re]) => re.test(gemfile));
     if (hit) {
@@ -13049,7 +13870,7 @@ function fromOthers(dir, out) {
     }
   }
   for (const f2 of ["pom.xml", "build.gradle", "build.gradle.kts"]) {
-    const text = readText(import_path7.default.join(dir, f2));
+    const text = readText(import_path8.default.join(dir, f2));
     if (text && /spring-boot/.test(text)) {
       out.framework = "Spring Boot";
       out.source = f2;
@@ -13085,7 +13906,7 @@ async function liveSpec(port) {
 async function detectBackend(dir, opts = {}) {
   const out = {};
   try {
-    if (import_fs9.default.existsSync(import_path7.default.join(dir, ".demo", "state.json"))) out.isDemo = true;
+    if (import_fs10.default.existsSync(import_path8.default.join(dir, ".demo", "state.json"))) out.isDemo = true;
     fromNode(dir, out);
     if (!out.framework) fromPython(dir, out);
     if (!out.framework) fromOthers(dir, out);
@@ -13117,7 +13938,7 @@ function backendPort(f2) {
 // src/commands/skill.ts
 init_api();
 var SKILL_NAME = "ship-safely";
-var SKILL_RELATIVE_PATH = import_path9.default.join(".claude", "skills", SKILL_NAME, "SKILL.md");
+var SKILL_RELATIVE_PATH = import_path10.default.join(".claude", "skills", SKILL_NAME, "SKILL.md");
 var CP_TOOLS = [
   "list_proxies",
   "propose_access_rules",
@@ -13191,9 +14012,9 @@ function staleSkillCopies(cwd = process.cwd(), home = import_os4.default.homedir
   const current = skillMarkdown();
   const out = [];
   for (const dir of /* @__PURE__ */ new Set([cwd, home])) {
-    const f2 = import_path9.default.join(dir, SKILL_RELATIVE_PATH);
+    const f2 = import_path10.default.join(dir, SKILL_RELATIVE_PATH);
     try {
-      if (import_fs11.default.readFileSync(f2, "utf8") !== current) out.push(f2);
+      if (import_fs12.default.readFileSync(f2, "utf8") !== current) out.push(f2);
     } catch {
     }
   }
@@ -13739,13 +14560,13 @@ async function runSkill(opts = {}) {
 }
 function installSkill(opts) {
   const md = skillMarkdown();
-  const target2 = import_path9.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
-  if (import_fs11.default.existsSync(target2) && !opts.force) {
+  const target2 = import_path10.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
+  if (import_fs12.default.existsSync(target2) && !opts.force) {
     console.error(import_chalk34.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
     process.exit(1);
   }
-  import_fs11.default.mkdirSync(import_path9.default.dirname(target2), { recursive: true });
-  import_fs11.default.writeFileSync(target2, md, "utf8");
+  import_fs12.default.mkdirSync(import_path10.default.dirname(target2), { recursive: true });
+  import_fs12.default.writeFileSync(target2, md, "utf8");
   console.log(`${import_chalk34.default.green("\u2713")} Installed the ${import_chalk34.default.bold(SKILL_NAME)} skill: ${import_chalk34.default.bold(target2)}`);
   console.log(import_chalk34.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
 }
@@ -13876,8 +14697,8 @@ async function runLogout(opts = {}) {
 
 // src/commands/flush.ts
 var import_chalk37 = __toESM(require("chalk"));
-var fs19 = __toESM(require("fs"));
-var path16 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var path17 = __toESM(require("path"));
 init_auth();
 init_external_mcp();
 async function runFlush(opts) {
@@ -13885,7 +14706,7 @@ async function runFlush(opts) {
   const demos = await stopDemos2().catch(() => 0);
   if (demos) console.log(import_chalk37.default.dim(`  Stopped ${demos} running demo(s).`));
   const dir = getApiblazeDir();
-  const entries2 = fs19.existsSync(dir) ? fs19.readdirSync(dir) : [];
+  const entries2 = fs21.existsSync(dir) ? fs21.readdirSync(dir) : [];
   if (!entries2.length) {
     console.log(import_chalk37.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
@@ -13898,7 +14719,7 @@ async function runFlush(opts) {
   const footprint = apiblazeMcpFootprint();
   const mdFiles = ["claude", "codex"].map((k) => ({ k, file: agentInstructionFile(k) })).filter(({ file: file2 }) => {
     try {
-      return fs19.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
+      return fs21.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
     } catch {
       return false;
     }
@@ -13907,7 +14728,7 @@ async function runFlush(opts) {
     console.log(import_chalk37.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
   }
   if (mdFiles.length) {
-    console.log(import_chalk37.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path16.basename(m.file)).join(" and ")} (here)`));
+    console.log(import_chalk37.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path17.basename(m.file)).join(" and ")} (here)`));
   }
   console.log(import_chalk37.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
   if (!opts.yes) {
@@ -13923,7 +14744,7 @@ async function runFlush(opts) {
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs19.rmSync(path16.join(dir, e), { recursive: true, force: true });
+      fs21.rmSync(path17.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
       console.log(import_chalk37.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
@@ -13938,14 +14759,14 @@ async function runFlush(opts) {
   for (const { k, file: file2 } of mdFiles) {
     let text = "";
     try {
-      text = fs19.readFileSync(file2, "utf-8");
+      text = fs21.readFileSync(file2, "utf-8");
     } catch {
       continue;
     }
     const names = [...text.matchAll(/<!-- apiblaze:mcp:([^\s>]+) -->/g)].map((m) => m[1]);
     let cleared = 0;
     for (const n of new Set(names)) if (removeAgentInstruction(k, n)) cleared++;
-    if (cleared) console.log(`  ${import_chalk37.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk37.default.bold(path16.basename(file2))}`);
+    if (cleared) console.log(`  ${import_chalk37.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk37.default.bold(path17.basename(file2))}`);
   }
   console.log(`${import_chalk37.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
   console.log(import_chalk37.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
@@ -14592,7 +15413,7 @@ function describeJob(job) {
 }
 async function pollJob(jobId, opts = {}) {
   const started = Date.now();
-  const path19 = jobPath(jobId, opts.teamId);
+  const path20 = jobPath(jobId, opts.teamId);
   let lastPhase = "";
   if (!opts.quiet) process.stdout.write(import_chalk45.default.dim(opts.label ?? "Deleting"));
   for (; ; ) {
@@ -14604,7 +15425,7 @@ async function pollJob(jobId, opts = {}) {
       );
     }
     await new Promise((r) => setTimeout(r, POLL_MS));
-    const job = await admin({ method: "GET", path: path19, summary: "poll cascade job" });
+    const job = await admin({ method: "GET", path: path20, summary: "poll cascade job" });
     if (!opts.quiet) {
       const phase = describeJob(job);
       if (phase !== lastPhase) {
@@ -14749,7 +15570,7 @@ async function runJobStatus(jobId, opts) {
 
 // src/commands/export.ts
 var import_chalk48 = __toESM(require("chalk"));
-var import_fs12 = require("fs");
+var import_fs13 = require("fs");
 init_admin();
 init_auth();
 init_resolve();
@@ -14798,7 +15619,7 @@ async function runExport(projectArg, versionArg, opts) {
   });
   if (!res.ok) throw new Error(`Download failed (${res.status}): ${await res.text().catch(() => "")}`);
   const buf = Buffer.from(await res.arrayBuffer());
-  (0, import_fs12.writeFileSync)(outFile, buf);
+  (0, import_fs13.writeFileSync)(outFile, buf);
   console.log(import_chalk48.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
   if (job.decryption_key) console.log(import_chalk48.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
   console.log(import_chalk48.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
@@ -14855,8 +15676,8 @@ function resolveRecipeName(raw, githubHandle, proxyName) {
 function normalizeName3(raw) {
   return (raw || "").toLowerCase().replace(/[^a-z0-9]/g, "");
 }
-async function publicFetch(path19) {
-  const res = await fetch(`${RECIPES_BASE}/api/recipes${path19}`, {
+async function publicFetch(path20) {
+  const res = await fetch(`${RECIPES_BASE}/api/recipes${path20}`, {
     headers: { accept: "application/json" }
   }).catch((err) => {
     throw new Error(`Could not reach the recipe registry at ${RECIPES_BASE} \u2014 ${err.message}`);
@@ -14909,11 +15730,11 @@ async function fetchRecipeFile(ref, caller) {
        Private recipes are visible only to the publisher's team \u2014 run \`apiblaze login\` if you are on it.`
     );
   }
-  const path19 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
+  const path20 = revision !== void 0 ? `/recipes/${ref.handle}/${ref.slug}/${revision}` : `/recipes/${ref.handle}/${ref.slug}/file`;
   try {
     return await producer(caller, {
       method: "GET",
-      path: path19,
+      path: path20,
       summary: `Read private recipe ${ref.name}${revision !== void 0 ? `@${revision}` : ""}`
     });
   } catch (err) {
@@ -16057,9 +16878,9 @@ function printEnvelopeViolations(violations) {
   console.log("bring-your-own-key case. Change the rules above, then publish again.");
   console.log();
 }
-async function askPromotion(path19) {
+async function askPromotion(path20) {
   const { default: inquirer3 } = await import("inquirer");
-  const suggestedId = path19.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
+  const suggestedId = path20.split(/[.[\]]/).filter(Boolean).slice(-2).join("_").toLowerCase().replace(/[^a-z0-9_]/g, "_").replace(/_+/g, "_").replace(/^_|_$/g, "") || "value";
   const answers = await inquirer3.prompt([
     { type: "input", name: "prompt", message: "  prompt them with:", validate: (v) => v.trim() ? true : "Required." },
     { type: "input", name: "example", message: "  example:" },
@@ -16070,7 +16891,7 @@ async function askPromotion(path19) {
   const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
   console.log(import_chalk51.default.dim(`      \u2192 replaced with {{${id}}}`));
   return {
-    path: path19,
+    path: path20,
     id,
     prompt: String(answers.prompt).trim(),
     ...answers.example ? { example: String(answers.example).trim() } : {},
@@ -17844,7 +18665,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs20 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var import_chalk62 = __toESM(require("chalk"));
 var import_ora27 = __toESM(require("ora"));
 init_admin();
@@ -17867,7 +18688,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs20.readFileSync(opts.file, "utf-8");
+    specContent = fs22.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk62.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -18344,7 +19165,7 @@ async function patchSetting(proj2, s, value, cfg) {
   }
   const body = s.toPatch(value, cfg);
   const method = s.putLimits ? "PUT" : "PATCH";
-  const path19 = s.putLimits ? `/projects/${proj2.projectId}/${proj2.apiVersion}/limits` : `/projects/${proj2.projectId}/${proj2.apiVersion}`;
+  const path20 = s.putLimits ? `/projects/${proj2.projectId}/${proj2.apiVersion}/limits` : `/projects/${proj2.projectId}/${proj2.apiVersion}`;
   if (s.needsTenant) {
     const tenant2 = proj2.tenant ?? cfg.tenant ?? cfg.default_tenant;
     if (!tenant2) throw new Error(`Could not tell which tenant ${proj2.projectName} serves \u2014 pass it via \`apiblaze config ${proj2.projectName} --tenant <slug>\` is not supported yet; run \`apiblaze projects\` and check the project has a tenant.`);
@@ -18354,7 +19175,7 @@ async function patchSetting(proj2, s, value, cfg) {
   try {
     await admin({
       method,
-      path: path19,
+      path: path20,
       body,
       summary: `Set ${s.key} = ${JSON.stringify(value)}`
     });
@@ -19217,11 +20038,11 @@ async function resolveTransport(opts) {
     const token = getAccessToken();
     return {
       tenant: tenant2,
-      call: async (path19, method = "GET", body) => {
+      call: async (path20, method = "GET", body) => {
         const res = await fetch(`${DASHBOARD_BASE11}/api/cli/iam`, {
           method: "POST",
           headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
-          body: JSON.stringify({ tenant: tenant2, path: path19, method, body })
+          body: JSON.stringify({ tenant: tenant2, path: path20, method, body })
         });
         const data = await res.json().catch(() => ({}));
         if (!res.ok) throw new ApiError(res.status, data?.details ?? data?.error ?? res.statusText, data);
@@ -19239,8 +20060,8 @@ async function resolveTransport(opts) {
     return {
       tenant: fresh.tenant,
       selfEmail: fresh.email,
-      call: async (path19, method = "GET", body) => {
-        const res = await fetch(`${IAM_BASE}${path19}`, {
+      call: async (path20, method = "GET", body) => {
+        const res = await fetch(`${IAM_BASE}${path20}`, {
           method,
           headers: {
             "Content-Type": "application/json",
@@ -19692,28 +20513,28 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk68 = __toESM(require("chalk"));
 var import_ora33 = __toESM(require("ora"));
-var fs21 = __toESM(require("fs"));
-var path17 = __toESM(require("path"));
+var fs23 = __toESM(require("fs"));
+var path18 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f2) => fs21.existsSync(path17.join(root, f2)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f2) => fs23.existsSync(path18.join(root, f2)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs21.readFileSync(path17.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs23.readFileSync(path18.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs21.existsSync(path17.join(root, "app")) || fs21.existsSync(path17.join(root, "src", "app"));
-  const pagesDir = fs21.existsSync(path17.join(root, "pages")) || fs21.existsSync(path17.join(root, "src", "pages"));
+  const appDir = fs23.existsSync(path18.join(root, "app")) || fs23.existsSync(path18.join(root, "src", "app"));
+  const pagesDir = fs23.existsSync(path18.join(root, "pages")) || fs23.existsSync(path18.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
-  const p = path17.join(root, ".env.local");
+  const p = path18.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs21.readFileSync(p, "utf8");
+    existing = fs23.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -19728,15 +20549,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs21.writeFileSync(p, next);
+  fs23.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs21.existsSync(path17.join(root, "node_modules", "apiblaze", "package.json"))) {
+  if (fs23.existsSync(path18.join(root, "node_modules", "apiblaze", "package.json"))) {
     console.log(`  ${import_chalk68.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f2) => fs21.existsSync(path17.join(root, f2));
+  const has = (f2) => fs23.existsSync(path18.join(root, f2));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora33.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -19749,7 +20570,7 @@ function installSidecarPackage(root) {
 }
 function readEnvKey(root) {
   try {
-    const s = fs21.readFileSync(path17.join(root, ".env.local"), "utf8");
+    const s = fs23.readFileSync(path18.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -19757,16 +20578,16 @@ function readEnvKey(root) {
   }
 }
 function ensureGitignored(root) {
-  const p = path17.join(root, ".gitignore");
+  const p = path18.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs21.readFileSync(p, "utf8");
+    c = fs23.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs21.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs23.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path17.join("src", "instrumentation.ts")].map((c) => path17.join(root, c)).find((f2) => fs21.existsSync(f2));
+  const existing = ["instrumentation.ts", "instrumentation.js", path18.join("src", "instrumentation.ts")].map((c) => path18.join(root, c)).find((f2) => fs23.existsSync(f2));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -19774,18 +20595,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs21.writeFileSync(path17.join(root, "instrumentation.ts"), body);
+    fs23.writeFileSync(path18.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs21.readFileSync(existing, "utf8");
+  const cur = fs23.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs21.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs23.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs21.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs23.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -19868,17 +20689,17 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs21.existsSync(path17.join(root, "src", "pages")) ? path17.join(root, "src", "pages") : path17.join(root, "pages");
-      const f3 = path17.join(dir2, "abz-inspector.tsx");
-      fs21.writeFileSync(f3, INSPECTOR_PAGE);
-      return path17.relative(root, f3);
-    }
-    const base2 = fs21.existsSync(path17.join(root, "src", "app")) ? path17.join(root, "src", "app") : path17.join(root, "app");
-    const dir = path17.join(base2, "abz-inspector");
-    fs21.mkdirSync(dir, { recursive: true });
-    const f2 = path17.join(dir, "page.tsx");
-    fs21.writeFileSync(f2, INSPECTOR_PAGE);
-    return path17.relative(root, f2);
+      const dir2 = fs23.existsSync(path18.join(root, "src", "pages")) ? path18.join(root, "src", "pages") : path18.join(root, "pages");
+      const f3 = path18.join(dir2, "abz-inspector.tsx");
+      fs23.writeFileSync(f3, INSPECTOR_PAGE);
+      return path18.relative(root, f3);
+    }
+    const base2 = fs23.existsSync(path18.join(root, "src", "app")) ? path18.join(root, "src", "app") : path18.join(root, "app");
+    const dir = path18.join(base2, "abz-inspector");
+    fs23.mkdirSync(dir, { recursive: true });
+    const f2 = path18.join(dir, "page.tsx");
+    fs23.writeFileSync(f2, INSPECTOR_PAGE);
+    return path18.relative(root, f2);
   } catch {
     return null;
   }
@@ -19918,7 +20739,7 @@ async function runAnonymousInit(root, router, opts) {
   console.log(import_chalk68.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
-  const root = path17.resolve(opts.dir ?? process.cwd());
+  const root = path18.resolve(opts.dir ?? process.cwd());
   const detected2 = detectNextProject(root);
   if (!detected2.found) {
     console.log(import_chalk68.default.yellow(`No Next.js project detected in ${root}.`));
@@ -19977,7 +20798,7 @@ async function runSidecar(opts) {
   console.log(`  2. The origins your app calls appear as ${import_chalk68.default.bold("candidates")} \u2014 list them:  ${import_chalk68.default.cyan("apiblaze sidecar")}`);
   console.log(`  3. Approve the ones to route:  ${import_chalk68.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk68.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path17.dirname(inspectorPath)} before shipping)`);
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk68.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path18.dirname(inspectorPath)} before shipping)`);
   if (switchingTeam) console.log(import_chalk68.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
   console.log(import_chalk68.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
@@ -20688,17 +21509,17 @@ var import_chalk74 = __toESM(require("chalk"));
 init_consumer_auth();
 var SANDBOX_TENANT = "portalteststenant";
 var SANDBOX_PROXY = "portaltestproxypreapproved@2.7.0";
-function proxyUrlFor(spec2, path19 = "/get") {
+function proxyUrlFor(spec2, path20 = "/get") {
   const [name, version2 = "1.0.0"] = spec2.split("@");
-  return `https://${name}.abz.run/${version2}/prod${path19.startsWith("/") ? path19 : `/${path19}`}`;
+  return `https://${name}.abz.run/${version2}/prod${path20.startsWith("/") ? path20 : `/${path20}`}`;
 }
 function isPortalAudience(aud) {
   return /^https:\/\/[a-z0-9-]+\.portal\.apiblaze\.com\b/i.test(aud);
 }
 var log2 = (s) => process.stderr.write(s + "\n");
-function probeUrlFor(audience, path19 = "/") {
+function probeUrlFor(audience, path20 = "/") {
   const base2 = audience.replace(/\/+$/, "");
-  return `${base2}/prod${path19.startsWith("/") ? path19 : `/${path19}`}`;
+  return `${base2}/prod${path20.startsWith("/") ? path20 : `/${path20}`}`;
 }
 function tamper(token) {
   const parts = token.split(".");
@@ -21630,7 +22451,7 @@ program.command("login").description(`Authenticate with ${B.product}`).option("-
     process.exit(1);
   }
 });
-program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.) Add --compliant to make it a Claude connector, or a ChatGPT plugin with --compliant chatgpt, that meets the directory's policies.`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
+program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.) Add --compliant to make it a Claude connector, or a ChatGPT plugin with --compliant chatgpt, that meets the directory's policies.`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--open-world <yes|no>", "Every tool: reaches public or open-ended data (yes) or only the signed-in account's (no); asked once when omitted").option("--no-watch", "Do not turn on the nightly re-check email when the listing is green").option("--no-wait-login", "Sign-in mode: do not wait for a Claude sign-in before the verdict").option("--mcp-app", "Claude: the listing is an MCP App (the host then advertises the UI extension; needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot (PNG \u2265 1000 px wide) and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
   try {
     const compliant = opts.compliant ?? opts.policy;
     if (compliant !== void 0 && compliant !== false) {
@@ -21650,15 +22471,15 @@ function collect(value, previous) {
   return [...previous ?? [], value];
 }
 program.command("check").description(`Readiness report for the Claude and ChatGPT directories (--directory-ready): what passes, every blocker with its fix, and the ${B.thingShort}'s published URL. Exit 1 while a blocker remains.`).argument("[project]", `The ${B.thingShort} (project name)`).option("--directory-ready", "The directory readiness checks (the only mode today)").option("--compliant [directory]", "Which directory's policies to check against: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--stage <stage>", "create (relaxed: docs URL is a warning) \xB7 ready (the submission gate, default)").option("--refresh-snapshot", "Re-take the listing snapshot (after you edited the listing in the portals)").option("--no-probe", "Skip the live probes from this machine (report what the server can see)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Print the raw report JSON (report, rendered text, target)").action(action((project, opts) => runCheck(project, { ...opts, noProbe: opts.probe === false })));
-var connector = program.command("connector").description(`A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--no-exercise", 'Skip the "Run every tool now?" step at the end').option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+var connector = program.command("connector").description(`A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--no-exercise", 'Skip the "Run every tool now?" step at the end').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
   if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector https://\u2026/openapi.yaml  \xB7  ${B.cli} connector reviewer <project>  \xB7  ${B.cli} connector exercise <project>  \xB7  ${B.cli} connector answers <project>`);
   await runConnector(project, opts);
 }));
-connector.command("exercise").description("Call every tool the way a reviewer would, as the reviewer account (open mode: as you): reads with a valid and an invalid argument, writes only on ids the run created and only after a y, then the three listing prompts through Claude Code when it is installed. The gateway records the outcomes; the report reads them.").argument("<project>", `The ${B.thingShort} (project name)`).option("--empty-ok <tool>", 'A read-only tool whose correct answer is "nothing" (repeatable)', collect, []).option("--no-claude", "Skip the Claude Code pass").option("--no-email", "No email at the end of the run").option("-y, --yes", "No questions: writes are not exercised (they need a y), the rest runs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+connector.command("exercise").description("Call every tool the way a reviewer would, as the reviewer account (open mode: as you): reads with a valid and an invalid argument, writes only on ids the run created and only after a y, then the three listing prompts through Claude Code when it is installed. The gateway records the outcomes; the report reads them.").argument("<project>", `The ${B.thingShort} (project name)`).option("--empty-ok <tool>", 'A read-only tool whose correct answer is "nothing" (repeatable)', collect, []).option("--no-claude", "Skip the Claude Code pass").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create records through the create tools and keep them").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("-y, --yes", "No questions: writes are not exercised (they need a y), the rest runs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
   await runConnectorExercise(project, { ...withConnectorOpts(opts), noClaude: opts.claude === false, noEmail: opts.email === false });
 }));
 connector.command("docs").description('Generate the three documents a listing needs \u2014 the public page "Using <name> in Claude" (served at <portal>/connector), the reviewer instructions and the portal answers \u2014 on your Claude Code from the facts of the connector; lint them, store them, point the docs URL at the page. Edit them on the dashboard any time.').argument("<project>", `The ${B.thingShort} (project name)`).option("--from <file>", "Paste back a JSON answer produced elsewhere (see --prompt-out)").option("--prompt-out <file>", "Write the prompt + facts to a file instead of running Claude Code").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runConnectorDocs(project, withConnectorOpts(opts))));
-connector.command("answers").description("The portal's free-text steps 3\u20138 (use cases, prerequisites, access, categories, company, data handling, health data, sponsored content, reviewer instructions): asked when missing, or passed as flags").argument("<project>", `The ${B.thingShort} (project name)`).option("--use-cases <text>", "Use cases (200+ characters)").option("--prerequisites <text>", "What a user needs before it works (one sentence)").option("--access <read|write|both>", "What the tools do").option("--category <name>", "A category suggestion (repeatable, up to five; you pick the closest in the portal)", collect, []).option("--company-name <name>", "Company name").option("--company-website <url>", "Company website (https)").option("--company-contact <email|url>", "Primary contact").option("--reviewer-instructions <text>", "How to add it, sign in, one prompt per tool and what to expect (400+ characters)").option("--data-handling <mode>", "own \xB7 proxied (add --data-handling-statement) \xB7 third-party").option("--data-handling-statement <text>", "For proxied: the permission you hold").option("--health-data <yes|no>", "The tools handle health data").option("--sponsored-content <yes|no>", "Tool results carry sponsored content").option("-y, --yes", "No questions: record the flags only").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runConnectorAnswers(project, withConnectorOpts(opts))));
+connector.command("answers").description("The portal's free-text steps 3\u20138 (use cases, prerequisites, access, categories, company, data handling, health data, sponsored content, reviewer instructions): asked when missing, or passed as flags").argument("<project>", `The ${B.thingShort} (project name)`).option("--use-cases <text>", "Use cases (200+ characters)").option("--prerequisites <text>", "What a user needs before it works (one sentence)").option("--access <read|write|both>", "What the tools do").option("--category <name>", "A category suggestion (repeatable, up to five; you pick the closest in the portal)", collect, []).option("--company-name <name>", "Company name").option("--company-website <url>", "Company website (https)").option("--company-contact <email|url>", "Primary contact").option("--reviewer-instructions <text>", "How to add it, sign in, one prompt per tool and what to expect (400+ characters)").option("--data-handling <mode>", "own \xB7 proxied (add --data-handling-statement) \xB7 third-party").option("--data-handling-statement <text>", "For proxied: the permission you hold").option("--health-data <yes|no>", "The tools handle health data").option("--sponsored-content <yes|no>", "Tool results carry sponsored content").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80)").option("--chatgpt-category <name>", "OpenAI's form: the category, from their list").option("--demo-recording-url <url>", "OpenAI's form: the demo recording URL").option("--release-notes <text>", "OpenAI's form: release notes").option("--short-description <text>", "OpenAI's form: the 30-character subtitle").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--negative-prompt <text>", "OpenAI's form: a prompt the plugin must not act on (repeatable; three)", collect, []).option("-y, --yes", "No questions: record the flags only").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runConnectorAnswers(project, withConnectorOpts(opts))));
 var withConnectorOpts = (opts) => ({ ...connector.opts(), ...opts ?? {} });
 connector.command("reviewer").description("Create the reviewer test account (username + password sign-in on the tenant, no MFA), store it encrypted for the packet, show it once").argument("<project>", `The ${B.thingShort} (project name)`).option("--username <name>", "Account name (default reviewer-<project>)").option("--password <pw>", "Use this password instead of a generated one").option("--seed", "Then open the agent chat with a first message that seeds realistic data through the proxy (billed per turn)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON (the password appears there exactly once)").action(action((project, opts) => runConnectorReviewer(project, withConnectorOpts(opts))));
 program.command("integration").description(`What to add to your frontend and frontend-server for ${B.cli === "mcpblaze" ? "an MCP server" : "a proxy"} \u2014 the same kit the ${B.product} MCP hands an agent: widgets, the call-through with the key + X-End-User-Id, what your backend must trust, env vars, what stays open`).argument("<name>", `The ${B.thingShort} (project name)`).option("--stack <stack>", "nextjs | express | fastapi | other", "nextjs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--json", "Print the raw kit as JSON").action(action((name, opts) => runIntegration(name, opts)));
@@ -21687,11 +22508,11 @@ mcpCommon(mcpPrompts.command("set").description("Add or replace a prompt from a
 mcpCommon(mcpPrompts.command("rm").description("Remove a prompt").argument("<project>", "Project name or id").argument("<name>", "Prompt name")).action(action((project, name, opts) => runMcpPrompts("rm", project, name, opts)));
 var mcpOps = mcpCmd.command("ops").description("Per-tool behavior. Default from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm");
 mcpCommon(mcpOps.command("list").description("Every tool with its effective behavior (overrides marked)").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpOps("list", project, void 0, opts)));
-mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--title <text>", "Human label clients and directories show (default: the OpenAPI summary, else the name spelled out)").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
+mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--title <text>", "Human label clients and directories show (default: the OpenAPI summary, else the name spelled out)").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)").option("--open-world", "Reaches public or open-ended data (web pages, third-party records); the directories read openWorldHint").option("--no-open-world", "Only the signed-in account's own data")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
 mcpCommon(mcpOps.command("reset").description("Back to the automatic default for one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpOps("reset", project, tool, opts)));
 mcpCommon(mcpCmd.command("ui").description("Print a tool's MCP Apps UI resource (ui://{project}/{tool}) \u2014 the automatic viewer").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpUi(project, tool, opts)));
 program.command("apichat [project]").alias("chat").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {
-  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs14.default.existsSync(project));
+  const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs15.default.existsSync(project));
   const target2 = opts.target ?? (looksLikeSource ? project : void 0);
   return runApichat({ ...opts, target: target2, project: looksLikeSource ? void 0 : project, openapispec: opts.openapispec ?? opts.openapi });
 }));