apiblaze 0.21.69 → 0.21.70

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.69";
+    version = "0.21.70";
   }
 });
 
@@ -5165,6 +5165,141 @@ var init_key = __esm({
   }
 });
 
+// src/lib/zip.ts
+function crc32(buf) {
+  let c = 4294967295;
+  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 255] ^ c >>> 8;
+  return (c ^ 4294967295) >>> 0;
+}
+function zipStore(entries2) {
+  const parts = [];
+  const central = [];
+  let offset = 0;
+  const dosTime = 0, dosDate = 1 << 5 | 1;
+  for (const e of entries2) {
+    const name = new TextEncoder().encode(e.path.replace(/^\.\//, ""));
+    const crc = crc32(e.data);
+    const local = new Uint8Array(30 + name.length);
+    const lv = new DataView(local.buffer);
+    lv.setUint32(0, 67324752, true);
+    lv.setUint16(4, 20, true);
+    lv.setUint16(6, 2048, true);
+    lv.setUint16(8, 0, true);
+    lv.setUint16(10, dosTime, true);
+    lv.setUint16(12, dosDate, true);
+    lv.setUint32(14, crc, true);
+    lv.setUint32(18, e.data.length, true);
+    lv.setUint32(22, e.data.length, true);
+    lv.setUint16(26, name.length, true);
+    lv.setUint16(28, 0, true);
+    local.set(name, 30);
+    parts.push(local, e.data);
+    const cd = new Uint8Array(46 + name.length);
+    const cv = new DataView(cd.buffer);
+    cv.setUint32(0, 33639248, true);
+    cv.setUint16(4, 20, true);
+    cv.setUint16(6, 20, true);
+    cv.setUint16(8, 2048, true);
+    cv.setUint16(10, 0, true);
+    cv.setUint16(12, dosTime, true);
+    cv.setUint16(14, dosDate, true);
+    cv.setUint32(16, crc, true);
+    cv.setUint32(20, e.data.length, true);
+    cv.setUint32(24, e.data.length, true);
+    cv.setUint16(28, name.length, true);
+    cv.setUint16(30, 0, true);
+    cv.setUint16(32, 0, true);
+    cv.setUint16(34, 0, true);
+    cv.setUint16(36, 0, true);
+    cv.setUint32(38, 0, true);
+    cv.setUint32(42, offset, true);
+    cd.set(name, 46);
+    central.push(cd);
+    offset += local.length + e.data.length;
+  }
+  const cdSize = central.reduce((n, c) => n + c.length, 0);
+  const end = new Uint8Array(22);
+  const ev = new DataView(end.buffer);
+  ev.setUint32(0, 101010256, true);
+  ev.setUint16(4, 0, true);
+  ev.setUint16(6, 0, true);
+  ev.setUint16(8, entries2.length, true);
+  ev.setUint16(10, entries2.length, true);
+  ev.setUint32(12, cdSize, true);
+  ev.setUint32(16, offset, true);
+  ev.setUint16(20, 0, true);
+  const total = offset + cdSize + end.length;
+  const out = new Uint8Array(total);
+  let p = 0;
+  for (const part of [...parts, ...central, end]) {
+    out.set(part, p);
+    p += part.length;
+  }
+  return out;
+}
+function imageInfo(buf) {
+  const dv = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+  if (buf.length >= 24 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return { format: "png", width: dv.getUint32(16), height: dv.getUint32(20) };
+  if (buf.length >= 4 && buf[0] === 255 && buf[1] === 216) {
+    let i = 2;
+    while (i + 9 < buf.length) {
+      if (buf[i] !== 255) {
+        i++;
+        continue;
+      }
+      const marker2 = buf[i + 1];
+      if (marker2 === 216 || marker2 === 1 || marker2 >= 208 && marker2 <= 215) {
+        i += 2;
+        continue;
+      }
+      const len = dv.getUint16(i + 2);
+      if (marker2 >= 192 && marker2 <= 207 && marker2 !== 196 && marker2 !== 200 && marker2 !== 204) return { format: "jpeg", height: dv.getUint16(i + 5), width: dv.getUint16(i + 7) };
+      i += 2 + len;
+    }
+    return { format: "jpeg", width: null, height: null };
+  }
+  if (buf.length >= 30 && buf[0] === 82 && buf[1] === 73 && buf[2] === 70 && buf[3] === 70 && buf[8] === 87 && buf[9] === 69 && buf[10] === 66 && buf[11] === 80) {
+    const chunk = String.fromCharCode(buf[12], buf[13], buf[14], buf[15]);
+    if (chunk === "VP8X") return { format: "webp", width: 1 + (buf[24] | buf[25] << 8 | buf[26] << 16), height: 1 + (buf[27] | buf[28] << 8 | buf[29] << 16) };
+    if (chunk === "VP8 ") return { format: "webp", width: dv.getUint16(26, true) & 16383, height: dv.getUint16(28, true) & 16383 };
+    if (chunk === "VP8L") {
+      const b = dv.getUint32(21, true);
+      return { format: "webp", width: (b & 16383) + 1, height: (b >> 14 & 16383) + 1 };
+    }
+    return { format: "webp", width: null, height: null };
+  }
+  const head = new TextDecoder().decode(buf.subarray(0, 512)).trim();
+  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*<svg[\s>]/i.test(head)) return { format: "svg", width: null, height: null };
+  return { format: "unknown", width: null, height: null };
+}
+function logoProblem(buf) {
+  if (buf.length > 5 * 1024 * 1024) return `the icon is ${(buf.length / 1048576).toFixed(1)} MiB; OpenAI allows 5`;
+  const info = imageInfo(buf);
+  if (info.format === "unknown") return "the icon is not a PNG, JPEG, WebP or SVG";
+  if (info.width != null && info.height != null) {
+    if (info.width !== info.height) return `the icon is ${info.width}\xD7${info.height}; OpenAI wants a square`;
+    if (info.width < 48) return `the icon is ${info.width} px; OpenAI wants at least 48`;
+    if (info.width > 4096) return `the icon is ${info.width} px; OpenAI allows at most 4096`;
+  }
+  return null;
+}
+var CRC_TABLE, LOGO_EXT;
+var init_zip = __esm({
+  "src/lib/zip.ts"() {
+    "use strict";
+    CRC_TABLE = (() => {
+      const t = new Uint32Array(256);
+      for (let n = 0; n < 256; n++) {
+        let c = n;
+        for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
+        t[n] = c >>> 0;
+      }
+      return t;
+    })();
+    LOGO_EXT = { png: "png", jpeg: "jpg", webp: "webp", svg: "svg", unknown: "bin" };
+  }
+});
+
 // src/lib/directory-probes.ts
 var directory_probes_exports = {};
 __export(directory_probes_exports, {
@@ -5239,7 +5374,9 @@ async function probeDirectoryTarget(target2, deps = {}) {
       }
     })() ? redirected : null,
     sseServed: sse.status == null ? null : sse.status === 200,
-    ipv4Reachable: post.status == null && get.status == null ? ipv4 ? null : false : ipv4
+    ipv4Reachable: post.status == null && get.status == null ? ipv4 ? null : false : ipv4,
+    // WP1: a 200 `initialize` says whether the host advertises the MCP Apps UI extension (sign-in hosts answer 401: not probed).
+    uiExtension: post.status === 200 && obj(post.json).result && typeof obj(post.json).result === "object" ? !!obj(obj(post.json).result).capabilities?.extensions?.["io.modelcontextprotocol/ui"] : null
   };
   const prmUrl = `${origin.origin}/.well-known/oauth-protected-resource${origin.pathname.replace(/\/$/, "")}`;
   const prm = await probe(prmUrl, { method: "GET" }, deps);
@@ -5293,6 +5430,39 @@ async function probeDirectoryTarget(target2, deps = {}) {
     if (p.status != null && p.status >= 300 && p.status < 400 && p.location) p = await probe(absolute(p.location, url) ?? p.location, { method: "GET", headers: { accept: "text/html, */*;q=0.5" } }, deps);
     out.metadata = { ...out.metadata ?? {}, [key]: p.status };
   }
+  if (target2.iconUrl && /^https:\/\//i.test(target2.iconUrl)) {
+    const f2 = deps.fetch ?? fetch;
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
+    try {
+      const res = await f2(target2.iconUrl, { redirect: "follow", signal: ctl.signal, headers: { "user-agent": "apiblaze-cli directory-check", accept: "image/*" } });
+      const buf = new Uint8Array(await res.arrayBuffer());
+      const info = res.status === 200 ? imageInfo(buf) : null;
+      out.metadata = { ...out.metadata ?? {}, iconStatus: res.status, iconWidth: info?.width ?? null, iconHeight: info?.height ?? null, iconFormat: info?.format ?? null };
+    } catch {
+      out.metadata = { ...out.metadata ?? {}, iconStatus: null, iconWidth: null, iconHeight: null, iconFormat: null };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  if (target2.screenshots?.length) {
+    const f2 = deps.fetch ?? fetch;
+    const shots = await Promise.all(target2.screenshots.slice(0, 5).map(async (url) => {
+      const ctl = new AbortController();
+      const timer = setTimeout(() => ctl.abort(), PROBE_TIMEOUT_MS);
+      try {
+        const res = await f2(url, { redirect: "follow", signal: ctl.signal, headers: { "user-agent": "apiblaze-cli directory-check", accept: "image/*" } });
+        const buf = new Uint8Array(await res.arrayBuffer());
+        const info = res.status === 200 ? imageInfo(buf) : null;
+        return { url, status: res.status, width: info?.width ?? null, height: info?.height ?? null, format: info?.format ?? null };
+      } catch {
+        return { url, status: null, width: null, height: null, format: null };
+      } finally {
+        clearTimeout(timer);
+      }
+    }));
+    out.metadata = { ...out.metadata ?? {}, screenshots: shots };
+  }
   const ch = await probe(`${origin.origin}/.well-known/openai-apps-challenge`, { method: "GET" }, deps);
   out.openaiChallenge = { servedStatus: ch.status, servedMatches: null };
   if (ch.status === 200 && typeof ch.json === "string") out.openaiChallenge.servedBody = ch.json.trim().slice(0, 128);
@@ -5319,6 +5489,7 @@ var init_directory_probes = __esm({
   "src/lib/directory-probes.ts"() {
     "use strict";
     import_promises = __toESM(require("dns/promises"));
+    init_zip();
     PROBE_TIMEOUT_MS = 5e3;
     strArr = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : null;
     obj = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
@@ -5346,7 +5517,8 @@ __export(directory_exports, {
   parseDataHandling: () => parseDataHandling,
   parsePlatforms: () => parsePlatforms,
   parseYesNo: () => parseYesNo,
-  printReport: () => printReport
+  printReport: () => printReport,
+  writeJsonLine: () => writeJsonLine
 });
 function attestationId(flag) {
   const f2 = flag.trim().toLowerCase();
@@ -5388,6 +5560,24 @@ function directoryBodyFromFlags(f2) {
   if (f2.tagline) m.tagline = f2.tagline;
   if (f2.description) m.description = f2.description;
   if (f2.iconUrl) m.icon_url = f2.iconUrl;
+  if (f2.slug) m.slug = f2.slug.trim().toLowerCase();
+  if (f2.highRisk !== void 0) {
+    const list = (Array.isArray(f2.highRisk) ? f2.highRisk : String(f2.highRisk).split(",")).map((x) => x.trim().toLowerCase()).filter((x) => x && x !== "none");
+    const bad = list.filter((x) => !["legal", "healthcare", "insurance", "finance"].includes(x));
+    if (bad.length) throw new Error(`--high-risk: unknown "${bad.join(", ")}"; use none, or any of legal, healthcare, insurance, finance (comma-separated).`);
+    m.high_risk = list;
+  }
+  if (f2.mcpApp === true) m.mcp_app = true;
+  if (f2.mcpApp === false) m.mcp_app = null;
+  if (f2.screenshot?.length) {
+    m.screenshots = f2.screenshot.map((x) => {
+      const i = x.indexOf("=");
+      const url = (i > 0 ? x.slice(0, i) : x).trim();
+      const prompt = i > 0 ? x.slice(i + 1).trim() : "";
+      if (!/^https:\/\//i.test(url) || !prompt) throw new Error(`--screenshot wants https://\u2026png="<the prompt that produced it>", got "${x}"`);
+      return { url, prompt };
+    });
+  }
   if (f2.vulnContact) m.vuln_contact = f2.vulnContact;
   if (f2.allowedOrigin?.length) m.allowed_origins = f2.allowedOrigin.map((o) => o.trim()).filter(Boolean);
   if (f2.websiteUrl) m.website_url = f2.websiteUrl.trim();
@@ -5467,7 +5657,7 @@ async function fetchDirectoryReport(caller, proj2, opts = {}) {
     const publishedUrl = opts.publishedUrl ?? first?.report?.project?.publishedUrl ?? null;
     const meta = first?.target?.metadata ?? opts.listing ?? void 0;
     const privacyUrl = opts.privacyUrl ?? meta?.privacyUrl ?? null;
-    if (publishedUrl) probes = await probeDirectoryTarget({ publishedUrl, privacyUrl, docsUrl: meta?.docsUrl ?? null, serverName: meta?.serverName ?? null, websiteUrl: meta?.websiteUrl ?? null, supportUrl: meta?.supportUrl ?? null, termsUrl: meta?.termsUrl ?? null });
+    if (publishedUrl) probes = await probeDirectoryTarget({ publishedUrl, privacyUrl, docsUrl: meta?.docsUrl ?? null, serverName: meta?.serverName ?? null, websiteUrl: meta?.websiteUrl ?? null, supportUrl: meta?.supportUrl ?? null, termsUrl: meta?.termsUrl ?? null, screenshots: meta?.mcpApp ? (meta.screenshots ?? []).map((x) => x.url) : null, iconUrl: meta?.iconUrl ?? null });
     else if (first && !opts.refreshSnapshot) return first;
   }
   if (opts.extraProbes) probes = { ...probes ?? {}, ...opts.extraProbes, metadata: { ...probes?.metadata ?? {}, ...opts.extraProbes.metadata ?? {} } };
@@ -5482,9 +5672,12 @@ function isReady(r, platforms) {
   const want = platforms ?? r.report.platformsRequested ?? [...PLATFORMS];
   return want.every((p) => r.report.platforms[p]?.ready === true);
 }
+function writeJsonLine(value) {
+  import_node_fs.default.writeSync(1, JSON.stringify(value) + "\n");
+}
 function printReport(r, json) {
   if (json) {
-    process.stdout.write(JSON.stringify(r) + "\n");
+    writeJsonLine(r);
     return;
   }
   console.log(r.rendered.text.replace(/<project>/g, r.report.project.id));
@@ -5498,10 +5691,11 @@ function blockerLines(r, platforms) {
 function isApiError(e, status2) {
   return e instanceof ApiError && (status2 === void 0 || e.status === status2);
 }
-var import_chalk17, PLATFORMS, ATTESTATIONS, OPENAI_CATEGORIES, AUTH_MODES, DATA_HANDLING_MODES, reportPath, DESCRIPTION_MIN;
+var import_node_fs, import_chalk17, PLATFORMS, ATTESTATIONS, OPENAI_CATEGORIES, AUTH_MODES, DATA_HANDLING_MODES, reportPath, DESCRIPTION_MIN;
 var init_directory = __esm({
   "src/lib/directory.ts"() {
     "use strict";
+    import_node_fs = __toESM(require("fs"));
     import_chalk17 = __toESM(require("chalk"));
     init_caller();
     init_directory_probes();
@@ -5519,6 +5713,8 @@ var init_directory = __esm({
       // ChatGPT's guidelines add these three.
       { id: "no_digital_goods_sales", flags: ["no-digital-goods", "no-digital-goods-sales", "no_digital_goods_sales"], label: "No sale of digital goods, subscriptions or credits; no upgrade/checkout flows (ChatGPT)", platforms: ["chatgpt"] },
       { id: "content_13_no_ads", flags: ["content-13-no-ads", "content-13", "content_13_no_ads"], label: "Content suitable for 13+ and no advertising (ChatGPT)", platforms: ["chatgpt"] },
+      // WP5 (Claude-lane review A11): both directories want the policy to say what is collected, used, shared and kept, and how to reach you.
+      { id: "privacy_policy_covers", flags: ["privacy-policy-covers", "privacy_policy_covers", "privacy-covers"], label: "The privacy policy covers data collection, use, sharing, retention and a contact, and says tool traffic passes through APIblaze as a processor", platforms: PLATFORMS },
       { id: "no_restricted_data", flags: ["no-restricted-data", "no_restricted_data"], label: "No card data, health records, government ids or credentials are collected (ChatGPT)", platforms: ["chatgpt"] }
     ];
     OPENAI_CATEGORIES = ["Productivity", "Creativity", "Developer Tools", "Business & Operations", "Data & Analytics", "Communication", "Education & Research", "Security", "Finance", "Healthcare", "Travel", "Entertainment", "Other"];
@@ -7618,7 +7814,8 @@ __export(portal_drafts_exports, {
   draftDescription: () => draftDescription,
   draftMissing: () => draftMissing,
   draftReviewerInstructions: () => draftReviewerInstructions,
-  draftUseCases: () => draftUseCases
+  draftUseCases: () => draftUseCases,
+  humanizeShape: () => humanizeShape
 });
 function describeResult(text) {
   const t = (text ?? "").trim();
@@ -7635,6 +7832,21 @@ function describeResult(text) {
   const head = t.replace(/\s+/g, " ").slice(0, 80);
   return `a text answer ("${head}${t.length > 80 ? "\u2026" : ""}")`;
 }
+function humanKey(k) {
+  const words = k.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ").toLowerCase().trim();
+  if (/^(is|has) /.test(words)) return `whether it ${words}`;
+  if (/ (at|on)$/.test(words)) return `when it was ${words.replace(/ (at|on)$/, "")}`;
+  if (words === "id") return "an id";
+  if (words === "url") return "the URL";
+  return words;
+}
+function humanizeShape(shape) {
+  const m = /^a (?:JSON answer|list of (\d+) items?) with (.+?)(?: \(\+\d+ more\))?$/.exec(shape.trim());
+  if (!m) return shape.replace(/ \(\+\d+ more\)/, "");
+  const keys = m[2].split(",").map((x) => x.trim()).filter(Boolean).slice(0, 6).map(humanKey);
+  const list = keys.length > 1 ? `${keys.slice(0, -1).join(", ")} and ${keys[keys.length - 1]}` : keys[0] ?? "an answer";
+  return m[1] ? `a list of ${m[1]} item${m[1] === "1" ? "" : "s"}, each with ${list}` : `${list}`;
+}
 function argsText(args) {
   if (!args || !Object.keys(args).length) return "no arguments";
   return Object.entries(args).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(", ");
@@ -7660,7 +7872,7 @@ function draftUseCases(i) {
   for (const g of groups.values()) {
     const row = i.rows.find((r) => r.tool === g.tools[0].name && r.valid === "ok");
     const which = g.prompts.length === list.length && list.length > 1 ? "Each of these" : g.prompts.map(short).join(", ");
-    parts.push(`${which} make${g.prompts.length === 1 ? "s" : ""} the assistant call ${g.tools.map(titleOf).join(" and ")}${row ? `, which returns ${shapeOf(row)}` : ""}.`);
+    parts.push(`${which} answer${g.prompts.length === 1 ? "s" : ""} with ${row ? humanizeShape(shapeOf(row)) : `what ${g.tools.map(titleOf).join(" and ")} gives`}.`);
   }
   const uncalled = i.tools.filter((t) => !Object.values(i.promptTools).some((ns) => ns.includes(t.name)));
   if (uncalled.length) parts.push(`Also available: ${uncalled.map((t) => `${titleOf(t)}${(t.description ?? "").trim() ? ` (${(t.description ?? "").trim().replace(/\.$/, "")})` : ""}`).join("; ")}.`);
@@ -7671,19 +7883,19 @@ function draftReviewerInstructions(i) {
   const lines = [];
   const where = i.platforms?.length === 1 && i.platforms[0] === "chatgpt" ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : i.platforms?.includes("chatgpt") ? "Claude (Settings \u2192 Connectors \u2192 Add custom connector) or ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : "Claude (Settings \u2192 Connectors \u2192 Add custom connector)";
   lines.push(`Add ${i.publishedUrl} as a custom connector in ${where}.`);
-  lines.push(i.open ? "No sign-in: the data is public and every tool is read-only. Connect and ask." : `Sign in with the reviewer account in this packet${i.reviewerUsername ? ` (username ${i.reviewerUsername}; the password is in the packet, never in this text)` : ""}.`);
+  lines.push(i.open ? "No sign-in: the data is public and every tool is read-only. Connect and ask." : `Sign in with the username and password entered in the credential fields of this form${i.reviewerUsername ? ` (username ${i.reviewerUsername})` : ""}: the sign-in page shows a username & password form under the provider buttons; no email, SMS or MFA step.`);
   const seen = /* @__PURE__ */ new Set();
   for (const p of i.prompts) {
     const called = toolsCalledBy(i, p);
     if (!called.length) continue;
     const row = i.rows.find((r) => r.tool === called[0].name && r.valid === "ok");
     called.forEach((t) => seen.add(t.name));
-    lines.push(`Ask: "${p}" \u2014 the assistant calls ${called.map(titleOf).join(" and ")}${row ? `; expect ${shapeOf(row)}` : ""}.`);
+    lines.push(`Ask: "${p}" \u2014 uses ${called.map(titleOf).join(" and ")}${row ? `; expect ${humanizeShape(shapeOf(row))}` : ""}.`);
   }
   for (const r of i.rows) {
     if (seen.has(r.tool) || r.valid !== "ok") continue;
     const t = i.tools.find((x) => x.name === r.tool) ?? { name: r.tool };
-    lines.push(`Ask it to ${titleOf(t).replace(/^./, (c) => c.toLowerCase())} (${argsText(r.args)}); expect ${shapeOf(r)}.`);
+    lines.push(`Ask it to ${titleOf(t).replace(/^./, (c) => c.toLowerCase())} (${argsText(r.args)}); expect ${humanizeShape(shapeOf(r))}.`);
   }
   const errs = i.rows.filter((r) => r.invalid === "error" && r.invalidText);
   for (const r of errs.slice(0, 2)) {
@@ -7708,7 +7920,7 @@ function draftDescription(i) {
   const working = i.prompts.filter((p) => (i.promptTools[p] ?? []).length);
   if (working.length) parts.push(`Ask it things like ${working.map((p) => `"${p}"`).join(", ")}.`);
   const ok = i.rows.find((r) => r.valid === "ok");
-  if (ok) parts.push(`What comes back is ${shapeOf(ok)}, which the assistant reads and explains.`);
+  if (ok) parts.push(`Answers come back as ${humanizeShape(shapeOf(ok))}, explained in plain words.`);
   parts.push(readOnly(i) ? "Every tool only reads; nothing is created or changed." : "Writes change data in the signed-in account only.");
   return parts.join(" ");
 }
@@ -7774,6 +7986,7 @@ __export(connector_exercise_exports, {
   clientsFor: () => clientsFor,
   createPromptTester: () => createPromptTester,
   detectCodex: () => detectCodex,
+  looksEmpty: () => looksEmpty,
   reportLink: () => reportLink,
   runConnectorAnswers: () => runConnectorAnswers,
   runConnectorExercise: () => runConnectorExercise
@@ -7801,6 +8014,16 @@ async function confirm(message, interactive2) {
   const a = await inquirer3.prompt([{ type: "confirm", name: "go", message, default: false }]);
   return a.go;
 }
+function looksEmpty(json) {
+  if (json == null || json === "") return true;
+  if (Array.isArray(json)) return json.length === 0;
+  if (typeof json === "object") {
+    const vals = Object.values(json);
+    if (!vals.length) return true;
+    return vals.every((v) => Array.isArray(v) && v.length === 0 || v === 0 || v === null || v === false || typeof v === "object" && v !== null && !Array.isArray(v) && Object.keys(v).length === 0);
+  }
+  return false;
+}
 async function runConnectorExercise(project, opts = {}) {
   const caller = await requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
@@ -7833,17 +8056,21 @@ async function runConnectorExercise(project, opts = {}) {
   let configDir = null;
   let reviewerUsername = null;
   let userinfo = null;
+  const seeded = {};
   try {
     if (!open) {
       const packet = await producer(caller, { method: "GET", path: `${projectPath(proj2)}/directory-packet?probe=0&force=1`, summary: "Reviewer account (for the login)" });
       const acct = packet.json?.test_account ?? null;
       if (!acct) throw new Error(`No reviewer account on ${proj2.projectName}: create it first (\`${B.cli} connector reviewer ${proj2.projectId}\`), or declare open mode for public read-only data.`);
       const login = await headlessPasswordLogin({ mcpUrl: publishedUrl, username: acct.username, password: acct.password }, deps);
-      if (!login.accessToken) throw new Error(`The reviewer could not sign in at ${login.failedAt}: ${login.detail}. Fix the sign-in and run again.`);
+      if (!login.accessToken) {
+        await producer(caller, { method: "PATCH", path: `${projectPath(proj2)}/directory-runs/${encodeURIComponent(runId2)}`, body: { notes: [{ kind: "failed", note: `reviewer sign-in failed at ${login.failedAt}: ${login.detail}` }], runner: "cli-direct", email: false }, summary: "Close the failed run" }).catch(() => null);
+        throw new Error(`The reviewer could not sign in at ${login.failedAt}: ${login.detail}. Fix the sign-in and run again.`);
+      }
       bearer = login.accessToken;
       asMeta = login.as;
       reviewerUsername = acct.username;
-      say(import_chalk26.default.dim(`  signed in as the reviewer (${acct.username}); the token is revoked at the end`));
+      say(import_chalk26.default.dim(`  signed in as the reviewer (${acct.username}); the token expires in 1 h`));
     } else {
       say(import_chalk26.default.dim("  open mode: no sign-in; this run's calls count as yours"));
     }
@@ -7851,6 +8078,7 @@ async function runConnectorExercise(project, opts = {}) {
     const headers = { [RUN_HEADER]: runId2 };
     const call3 = (name, args) => mcpCall(publishedUrl, "tools/call", { name, arguments: args, _meta: { [RUN_META_KEY]: runId2 } }, { bearer, headers, userAgent: ua }, deps);
     const created = {};
+    const emptyReads = [];
     const examples = { ...target2.metadata?.toolExamples ?? {} };
     const learned = {};
     const prompts = (target2.metadata?.examplePrompts ?? []).filter((p) => typeof p === "string");
@@ -7893,6 +8121,7 @@ async function runConnectorExercise(project, opts = {}) {
       row.validText = redactHead(v.text);
       row.args = args;
       if (v.outcome === "ok") row.resultShape = describeResult(v.text);
+      if (role === "read" && v.outcome === "ok" && looksEmpty(parseResultJson(v.text))) emptyReads.push(t);
       if (v.outcome === "ok" && role === "create") {
         const id = extractCreatedId(parseResultJson(v.text));
         if (id) {
@@ -7915,6 +8144,46 @@ async function runConnectorExercise(project, opts = {}) {
       await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { tool_examples: learned } }, summary: "Remember the working arguments" });
       say(import_chalk26.default.green(`  \u2713 remembered the working arguments for ${Object.keys(learned).join(", ")} (used on every run from now on)`));
     }
+    const creators = tools.filter((t) => toolRole(t) === "create");
+    if (!open && !opts.promptsOnly && opts.seed !== false && emptyReads.length && creators.length) {
+      const names = emptyReads.map((t) => t.name).join(", ");
+      let go = opts.seed === true;
+      if (!go && interactive2) go = await confirm(`${emptyReads.length} read${emptyReads.length > 1 ? "s" : ""} returned nothing for the reviewer (${names}). Create a few records the reviewer will see, through ${creators.map((c) => c.name).join(", ")}? They are kept, not deleted.`, interactive2);
+      if (!go) {
+        say(import_chalk26.default.dim(`  seed skipped${interactive2 ? "" : " (non-interactive: pass --seed to create records for the reviewer, --no-seed to silence this)"}: ${names} stay empty for the reviewer (REVIEWER_ACCOUNT_POPULATED)`));
+        notes.push({ kind: "seed", note: "skipped", tools: emptyReads.map((t) => t.name) });
+      } else {
+        for (const c of creators) {
+          const args = validArgs(c, {}, examples[c.name]);
+          const v = localOutcome(await call3(c.name, args));
+          if (v.outcome !== "ok") {
+            say(`  ${mark(v.outcome)} seed via ${c.name} ${JSON.stringify(args)}: ${import_chalk26.default.dim(redactHead(v.text, 100) || v.outcome)}`);
+            continue;
+          }
+          const id = extractCreatedId(parseResultJson(v.text));
+          const idText = id ? String(id.value).slice(0, 64) : "(no id in the answer)";
+          seeded[c.name] = [...seeded[c.name] ?? [], idText];
+          notes.push({ kind: "seed", tool: c.name, note: `seeded ${id ? `${id.name}=${idText}` : "a record"}` });
+          say(`  ${import_chalk26.default.green("\u2713")} seeded via ${c.name}: ${idText} ${import_chalk26.default.dim("(kept for the reviewer)")}`);
+        }
+        if (Object.keys(seeded).length) {
+          for (const t of emptyReads) {
+            const row = rows.find((x) => x.tool === t.name);
+            const args = validArgs(t, {}, examples[t.name]);
+            const v = localOutcome(await call3(t.name, args));
+            const nonEmpty = v.outcome === "ok" && !looksEmpty(parseResultJson(v.text));
+            if (v.outcome === "ok") {
+              row.valid = v.outcome;
+              row.validText = redactHead(v.text);
+              row.args = args;
+              row.resultShape = describeResult(v.text);
+            }
+            say(`  ${nonEmpty ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} ${t.name} after seeding: ${import_chalk26.default.dim(nonEmpty ? v.text.replace(/\s+/g, " ").slice(0, 80) : "still nothing (a different filter or tenant? mark it --empty-ok if that is correct)")}`);
+          }
+          await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { seeded } }, summary: "Remember what was seeded for the reviewer" }).catch((e) => say(import_chalk26.default.dim(`  (could not store the seeded ids: ${e.message})`)));
+        }
+      }
+    }
     const clients = clientsFor(opts.platforms);
     const claudeInstalled = deps.claudeInstalled ?? detectExternalClis().some((c) => c.kind === "claude");
     const codex = deps.codexInstalled !== void 0 ? { installed: deps.codexInstalled, loggedIn: deps.codexInstalled } : clients.includes("codex") ? detectCodex(deps.spawn ?? import_child_process5.spawnSync) : { installed: false, loggedIn: false };
@@ -8004,6 +8273,7 @@ async function runConnectorExercise(project, opts = {}) {
     reviewerUsername,
     tools,
     userinfo,
+    seeded,
     notes: notes.filter((n) => (n.kind === "prompt" || n.kind === "negative") && typeof n.prompt === "string")
   };
   if (json) {
@@ -8565,141 +8835,6 @@ var init_connector_docs = __esm({
   }
 });
 
-// src/lib/zip.ts
-function crc32(buf) {
-  let c = 4294967295;
-  for (let i = 0; i < buf.length; i++) c = CRC_TABLE[(c ^ buf[i]) & 255] ^ c >>> 8;
-  return (c ^ 4294967295) >>> 0;
-}
-function zipStore(entries2) {
-  const parts = [];
-  const central = [];
-  let offset = 0;
-  const dosTime = 0, dosDate = 1 << 5 | 1;
-  for (const e of entries2) {
-    const name = new TextEncoder().encode(e.path.replace(/^\.\//, ""));
-    const crc = crc32(e.data);
-    const local = new Uint8Array(30 + name.length);
-    const lv = new DataView(local.buffer);
-    lv.setUint32(0, 67324752, true);
-    lv.setUint16(4, 20, true);
-    lv.setUint16(6, 2048, true);
-    lv.setUint16(8, 0, true);
-    lv.setUint16(10, dosTime, true);
-    lv.setUint16(12, dosDate, true);
-    lv.setUint32(14, crc, true);
-    lv.setUint32(18, e.data.length, true);
-    lv.setUint32(22, e.data.length, true);
-    lv.setUint16(26, name.length, true);
-    lv.setUint16(28, 0, true);
-    local.set(name, 30);
-    parts.push(local, e.data);
-    const cd = new Uint8Array(46 + name.length);
-    const cv = new DataView(cd.buffer);
-    cv.setUint32(0, 33639248, true);
-    cv.setUint16(4, 20, true);
-    cv.setUint16(6, 20, true);
-    cv.setUint16(8, 2048, true);
-    cv.setUint16(10, 0, true);
-    cv.setUint16(12, dosTime, true);
-    cv.setUint16(14, dosDate, true);
-    cv.setUint32(16, crc, true);
-    cv.setUint32(20, e.data.length, true);
-    cv.setUint32(24, e.data.length, true);
-    cv.setUint16(28, name.length, true);
-    cv.setUint16(30, 0, true);
-    cv.setUint16(32, 0, true);
-    cv.setUint16(34, 0, true);
-    cv.setUint16(36, 0, true);
-    cv.setUint32(38, 0, true);
-    cv.setUint32(42, offset, true);
-    cd.set(name, 46);
-    central.push(cd);
-    offset += local.length + e.data.length;
-  }
-  const cdSize = central.reduce((n, c) => n + c.length, 0);
-  const end = new Uint8Array(22);
-  const ev = new DataView(end.buffer);
-  ev.setUint32(0, 101010256, true);
-  ev.setUint16(4, 0, true);
-  ev.setUint16(6, 0, true);
-  ev.setUint16(8, entries2.length, true);
-  ev.setUint16(10, entries2.length, true);
-  ev.setUint32(12, cdSize, true);
-  ev.setUint32(16, offset, true);
-  ev.setUint16(20, 0, true);
-  const total = offset + cdSize + end.length;
-  const out = new Uint8Array(total);
-  let p = 0;
-  for (const part of [...parts, ...central, end]) {
-    out.set(part, p);
-    p += part.length;
-  }
-  return out;
-}
-function imageInfo(buf) {
-  const dv = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
-  if (buf.length >= 24 && buf[0] === 137 && buf[1] === 80 && buf[2] === 78 && buf[3] === 71) return { format: "png", width: dv.getUint32(16), height: dv.getUint32(20) };
-  if (buf.length >= 4 && buf[0] === 255 && buf[1] === 216) {
-    let i = 2;
-    while (i + 9 < buf.length) {
-      if (buf[i] !== 255) {
-        i++;
-        continue;
-      }
-      const marker2 = buf[i + 1];
-      if (marker2 === 216 || marker2 === 1 || marker2 >= 208 && marker2 <= 215) {
-        i += 2;
-        continue;
-      }
-      const len = dv.getUint16(i + 2);
-      if (marker2 >= 192 && marker2 <= 207 && marker2 !== 196 && marker2 !== 200 && marker2 !== 204) return { format: "jpeg", height: dv.getUint16(i + 5), width: dv.getUint16(i + 7) };
-      i += 2 + len;
-    }
-    return { format: "jpeg", width: null, height: null };
-  }
-  if (buf.length >= 30 && buf[0] === 82 && buf[1] === 73 && buf[2] === 70 && buf[3] === 70 && buf[8] === 87 && buf[9] === 69 && buf[10] === 66 && buf[11] === 80) {
-    const chunk = String.fromCharCode(buf[12], buf[13], buf[14], buf[15]);
-    if (chunk === "VP8X") return { format: "webp", width: 1 + (buf[24] | buf[25] << 8 | buf[26] << 16), height: 1 + (buf[27] | buf[28] << 8 | buf[29] << 16) };
-    if (chunk === "VP8 ") return { format: "webp", width: dv.getUint16(26, true) & 16383, height: dv.getUint16(28, true) & 16383 };
-    if (chunk === "VP8L") {
-      const b = dv.getUint32(21, true);
-      return { format: "webp", width: (b & 16383) + 1, height: (b >> 14 & 16383) + 1 };
-    }
-    return { format: "webp", width: null, height: null };
-  }
-  const head = new TextDecoder().decode(buf.subarray(0, 512)).trim();
-  if (/^(<\?xml[^>]*>\s*)?(<!--[\s\S]*?-->\s*)*<svg[\s>]/i.test(head)) return { format: "svg", width: null, height: null };
-  return { format: "unknown", width: null, height: null };
-}
-function logoProblem(buf) {
-  if (buf.length > 5 * 1024 * 1024) return `the icon is ${(buf.length / 1048576).toFixed(1)} MiB; OpenAI allows 5`;
-  const info = imageInfo(buf);
-  if (info.format === "unknown") return "the icon is not a PNG, JPEG, WebP or SVG";
-  if (info.width != null && info.height != null) {
-    if (info.width !== info.height) return `the icon is ${info.width}\xD7${info.height}; OpenAI wants a square`;
-    if (info.width < 48) return `the icon is ${info.width} px; OpenAI wants at least 48`;
-    if (info.width > 4096) return `the icon is ${info.width} px; OpenAI allows at most 4096`;
-  }
-  return null;
-}
-var CRC_TABLE, LOGO_EXT;
-var init_zip = __esm({
-  "src/lib/zip.ts"() {
-    "use strict";
-    CRC_TABLE = (() => {
-      const t = new Uint32Array(256);
-      for (let n = 0; n < 256; n++) {
-        let c = n;
-        for (let k = 0; k < 8; k++) c = c & 1 ? 3988292384 ^ c >>> 1 : c >>> 1;
-        t[n] = c >>> 0;
-      }
-      return t;
-    })();
-    LOGO_EXT = { png: "png", jpeg: "jpg", webp: "webp", svg: "svg", unknown: "bin" };
-  }
-});
-
 // src/lib/plugin-package.ts
 var plugin_package_exports = {};
 __export(plugin_package_exports, {
@@ -8996,7 +9131,7 @@ function requireTool(cat, tool) {
 function withOverride(cat, tool, flags) {
   requireTool(cat, tool);
   const patch = {};
-  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync"]) {
+  for (const k of ["readOnly", "destructive", "idempotent", "confirm", "alwaysAsync", "openWorld"]) {
     if (typeof flags[k] === "boolean") patch[k] = flags[k];
   }
   if (typeof flags.title === "string") {
@@ -9005,7 +9140,7 @@ function withOverride(cat, tool, flags) {
     patch.title = t;
   }
   if (Object.keys(patch).length === 0) {
-    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async (or their --no-\u2026 forms).");
+    throw new Error("Nothing to set. Pass --title, --read-only, --destructive, --idempotent, --confirm, --always-async, --open-world (or their --no-\u2026 forms).");
   }
   return { ...cat, overrides: { ...cat.overrides ?? {}, [tool]: { ...cat.overrides?.[tool] ?? {}, ...patch } } };
 }
@@ -12553,6 +12688,9 @@ var PROMPT_FOR_RULE = {
   DESCRIPTION_LEN_CLAUDE: { key: "description", message: "Description", limit: 2e3, portal: "Claude" },
   DESCRIPTION_LEN_CHATGPT: { key: "description", message: "Description", limit: 4e3, portal: "ChatGPT" },
   PROMPT_LEN_CHATGPT: { key: "prompt", message: "Example prompt", multi: true, limit: 128, portal: "ChatGPT" },
+  // WP5: Anthropic's slug (pre-filled from the listing name; permanent once published) and the policy's high-risk question.
+  SLUG_SET: { key: "slug", message: "Listing slug (lowercase-with-hyphens; permanent once published, claude.ai/directory/connectors/<slug>):" },
+  HIGH_RISK_DECLARED: { key: "highRisk", message: "High-risk use cases \u2014 does it serve legal, healthcare, insurance or finance decisions? (none, or a comma-separated list):" },
   // ChatGPT only: the portal issues this token (Plugins → Connect MCP server); we serve it verbatim.
   OPENAI_DOMAIN_CHALLENGE: { key: "openaiChallenge", message: "OpenAI domain challenge token, from platform.openai.com/plugins \u2192 Connect MCP server (Enter to skip for now):" }
 };
@@ -13004,6 +13142,10 @@ async function runConnector(target2, opts) {
     const changed = await fixToolDescriptions(proj2, r.report.project.environment, interactive2, say);
     if (changed) r = await fetchDirectoryReport(caller, proj2, { platforms });
   }
+  if (r.report.results.some((x) => x.id === "TOOL_OPENWORLD_CONFIRMED" && !x.pass)) {
+    const changed = await confirmOpenWorld(proj2, r.report.project.environment, interactive2, opts.openWorld, isOpenMode(r), say);
+    if (changed) r = await fetchDirectoryReport(caller, proj2, { platforms });
+  }
   if (await askOpenMode(caller, proj2, r, opts, interactive2, say)) r = await fetchDirectoryReport(caller, proj2, { platforms });
   let reviewer = null;
   if (r.report.results.some((x) => x.id === "TEST_ACCOUNT_SET" && !x.pass)) {
@@ -13035,6 +13177,7 @@ async function runConnector(target2, opts) {
     const t = tester;
     say(import_chalk30.default.dim(`  trying it through ${t.clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}\u2026`));
     const res = await t.test(p);
+    if (res.tools.length) await patchProject(caller, proj2, { directory_metadata: { prompt_tools: { [p.trim()]: res.tools } } }, "Remember which tool the prompt called").catch(() => null);
     for (const [client, r2] of Object.entries(res.byClient)) say(r2.called ? import_chalk30.default.green(`  \u2713 ${client === "claude" ? "Claude" : "Codex"} called ${r2.tools.join(", ")}`) : import_chalk30.default.yellow(`  \u2013 ${client === "claude" ? "Claude" : "Codex"} called no tool`));
     return res;
   };
@@ -13068,7 +13211,7 @@ async function runConnector(target2, opts) {
     }
     if (run2) {
       const { runConnectorExercise: runConnectorExercise2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
-      const ran = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, yes: opts.yes, noEmail: opts.email === false, report: false, platforms: [...platforms], provenPromptNotes });
+      const ran = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, yes: opts.yes, noEmail: opts.email === false, report: false, platforms: [...platforms], provenPromptNotes, seed: opts.seed });
       if (interactive2 && ran.failedPrompts.length) {
         for (const [p, clients] of Object.entries(ran.failedByClient ?? {})) say(import_chalk30.default.yellow(`  \u2013 "${p.slice(0, 60)}": no tool call in ${clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}`));
         const { rewritten, prompts } = await rewriteFailedPrompts(r, ran.failedPrompts, saveAnswer, say);
@@ -13087,6 +13230,7 @@ async function runConnector(target2, opts) {
       r = await fetchDirectoryReport(caller, proj2, { platforms, publishedUrl: r.report.project.publishedUrl ?? null, extraProbes, listing: listingOf(r) });
     }
   }
+  if (opts.waitLogin !== false && interactive2) r = await waitForClaudeLogin(caller, proj2, r, platforms, interactive2, say);
   if (!readyExceptSnapshot(r, platforms)) {
     if (!domain2.active && domain2.hostname && !json) {
       console.error(import_chalk30.default.yellow(`
@@ -13095,6 +13239,13 @@ async function runConnector(target2, opts) {
     exitWithReport(r, proj2, platforms, json, interactive2);
   }
   r = await fetchDirectoryReport(caller, proj2, { platforms, refreshSnapshot: true, publishedUrl: r.report.project.publishedUrl ?? null, listing: listingOf(r) });
+  let watching = false;
+  if (opts.watch !== false) {
+    watching = await producer(caller, { method: "POST", path: `${projectPath3(proj2)}/directory-watch`, body: { enabled: true }, summary: "Turn on the nightly re-check" }).then(() => true).catch((e) => {
+      say(import_chalk30.default.dim(`  (nightly re-check not switched on: ${e.message})`));
+      return false;
+    });
+  }
   const probes = await packetProbes(r);
   const packet = await producer(caller, { method: "POST", path: `${projectPath3(proj2)}/directory-packet`, body: { platforms, ...probes ? { probes } : {} }, summary: "Submission packet" });
   const dir = opts.out ?? process.cwd();
@@ -13129,9 +13280,42 @@ async function runConnector(target2, opts) {
   console.log(`  Submission packet: ${import_chalk30.default.cyan(mdPath)} and ${import_chalk30.default.cyan(jsonPath)}${zipPath ? `
   OpenAI plugin package: ${import_chalk30.default.cyan(zipPath)}` : ""}`);
   console.log(import_chalk30.default.dim(isOpenMode(r) ? "  (open mode: no reviewer credentials in the packet; the connector takes no sign-in)" : "  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
-  printSubmitSteps(r, mdPath, platforms);
+  printSubmitSteps(r, mdPath, platforms, watching);
   console.log(import_chalk30.default.dim(`  ${r.report.disclaimer}`));
 }
+async function waitForClaudeLogin(caller, proj2, r, platforms, interactive2, say, deps = {}) {
+  const rule = r.report.results.find((x) => x.id === "OAUTH_FLOW_COMPLETED");
+  if (!rule || rule.pass || !interactive2 || isOpenMode(r)) return r;
+  const url = r.report.project.publishedUrl ?? "";
+  const name = r.target?.metadata?.serverName ?? proj2.projectId;
+  const alias = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || proj2.projectId;
+  say("");
+  say(import_chalk30.default.bold("  One sign-in from a real Claude client is the last proof (OAUTH_FLOW_COMPLETED). In another terminal:"));
+  say(`    claude mcp add --transport http ${alias} ${url}`);
+  say(`    claude            then /mcp \u2192 ${alias} \u2192 sign in with the reviewer account`);
+  say(import_chalk30.default.dim(`  or in claude.ai: Settings \u2192 Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
+  say(import_chalk30.default.dim(`  Afterwards: claude mcp remove ${alias}`));
+  const { default: inquirer3 } = await import("inquirer");
+  const { go } = await inquirer3.prompt([{ type: "confirm", name: "go", message: "Sign in from Claude now, then press Enter to check (n skips; the verdict stays red on this rule):", default: true }]);
+  if (!go) return r;
+  const sleep2 = deps.sleep ?? ((ms2) => new Promise((res) => setTimeout(res, ms2)));
+  const maxMs = deps.maxMs ?? 10 * 6e4;
+  const started = Date.now();
+  let cur = r;
+  for (; ; ) {
+    cur = await fetchDirectoryReport(caller, proj2, { platforms });
+    const now = cur.report.results.find((x) => x.id === "OAUTH_FLOW_COMPLETED");
+    if (now?.pass) {
+      say(import_chalk30.default.green(`  \u2713 ${now.message ?? "a Claude client completed the sign-in"}`));
+      return cur;
+    }
+    if (Date.now() - started >= maxMs) {
+      say(import_chalk30.default.yellow("  \u2013 no Claude sign-in seen in 10 minutes; run again after signing in."));
+      return cur;
+    }
+    await sleep2(2e4);
+  }
+}
 async function rewriteFailedPrompts(r, failed, save, say) {
   const current = currentListingValue(r, "prompt");
   const list = Array.isArray(current) ? [...current] : [];
@@ -13234,7 +13418,7 @@ var withProject = (s, projectId) => s.replace(/<project>/g, projectId);
 var ANSWER_RULES = ["PORTAL_ANSWERS_COMPLETE", "HEALTH_SPONSORED_DECLARED", "API_OWNERSHIP_DOMAIN", "WEBSITE_URL_HTTPS_200", "SUPPORT_URL_HTTPS_200", "TERMS_URL_HTTPS_200", "DEVELOPER_NAME_SET", "CATEGORY_SET", "DEMO_RECORDING_URL_SET", "RELEASE_NOTES_SET", "SHORT_DESCRIPTION_SET", "CHATGPT_TEST_CASES_COMPLETE"];
 function exitWithReport(r, proj2, platforms, json, interactive2 = false) {
   if (json) {
-    process.stdout.write(JSON.stringify({ ready: false, project: proj2.projectId, headline: r.rendered.headline, report: r.report }) + "\n");
+    writeJsonLine({ ready: false, project: proj2.projectId, headline: r.rendered.headline, report: r.report });
     process.exit(1);
   }
   printReport(r, false);
@@ -13245,6 +13429,10 @@ function exitWithReport(r, proj2, platforms, json, interactive2 = false) {
   console.error(import_chalk30.default.red(`
 Not ready: ${blocking.length} blocker${blocking.length === 1 ? "" : "s"} (${blocking.map((x) => x.id).join(", ")}).`));
   const name = proj2.projectId;
+  if (!interactive2) {
+    const flags = flagsForRules(real.map((x) => x.id), platforms);
+    if (flags.length) console.error(`  Non-interactive: pass ${flags.join(" ")} to \`${B.cli} connector ${name} --yes\` (or run it in a terminal to be asked).`);
+  }
   const answerish = real.filter((x) => ANSWER_RULES.includes(x.id));
   if (answerish.length && answerish.every((x) => !x.platforms.includes("claude"))) console.error(`  Next: ${withProject(answerish[0].fix ?? answerish[0].message ?? answerish[0].title, name)}`);
   else if (answerish.length) console.error(`  Next: run \`${B.cli} connector ${name}${platforms.includes("chatgpt") ? ` --compliant ${platforms.length > 1 ? "all" : "chatgpt"}` : ""}\` in a terminal with the exercise on \u2014 it asks what only you can answer and writes the use cases, the reviewer instructions and the description from the run; or pass them: \`${B.cli} connector answers ${name} --use-cases \u2026 --data-handling own --health-data no --sponsored-content no\`.`);
@@ -13252,6 +13440,66 @@ Not ready: ${blocking.length} blocker${blocking.length === 1 ? "" : "s"} (${bloc
   console.error(import_chalk30.default.dim(`  Report page: ${DASHBOARD_BASE6}/directory/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}`));
   process.exit(1);
 }
+function flagsForRules(ids, platforms) {
+  const out = [];
+  const kebab = (k) => `--${k.replace(/([a-z])([A-Z])/g, "$1-$2").toLowerCase()}`;
+  const seen = /* @__PURE__ */ new Set();
+  const add = (f2) => {
+    if (!seen.has(f2)) {
+      seen.add(f2);
+      out.push(f2);
+    }
+  };
+  for (const id of ids) {
+    const q = PROMPT_FOR_RULE[id];
+    if (q) {
+      add(`${kebab(q.key)} <\u2026>`);
+      continue;
+    }
+    if (id.startsWith("ATTEST_")) {
+      const a = ATTESTATIONS.find((x) => `ATTEST_${x.id.toUpperCase()}` === id || id === `ATTEST_${x.flags[0].replace(/-/g, "_").toUpperCase()}`);
+      add(a ? `--attest ${a.flags[0]}` : "--attest <\u2026>");
+      continue;
+    }
+    switch (id) {
+      case "HEALTH_SPONSORED_DECLARED":
+        add("--health-data yes|no");
+        add("--sponsored-content yes|no");
+        break;
+      case "HIGH_RISK_DECLARED":
+        add("--high-risk none|legal,\u2026");
+        break;
+      case "TOOL_OPENWORLD_CONFIRMED":
+        add("--open-world yes|no");
+        break;
+      case "REVIEWER_ACCOUNT_POPULATED":
+        add("--seed");
+        break;
+      case "API_OWNERSHIP_DOMAIN":
+        add('--data-handling own|proxied "<permission>"');
+        break;
+      case "DOCS_URL":
+      case "DOCS_PAGE_LIVE":
+      case "DOCS_IS_PROSE":
+        add("--docs-url <https://\u2026>");
+        break;
+      case "PORTAL_ANSWERS_COMPLETE":
+        add(`(then \`connector answers\` with --use-cases --prerequisites --access --company-name --company-website --company-contact)`);
+        break;
+      case "CHATGPT_TEST_CASES_COMPLETE":
+      case "NEGATIVE_PROMPTS_HOLD":
+        add("--negative-prompt <\u2026> (three)");
+        break;
+      case "OPENAI_DOMAIN_CHALLENGE":
+        add("--openai-challenge <token>");
+        break;
+      default:
+        break;
+    }
+  }
+  void platforms;
+  return out;
+}
 var TOOL_DESC_RULE = "TOOL_DESC_NONEMPTY_SPECIFIC";
 var UTILITY_PATH = /(health|ping|status|openapi|swagger|docs|spec|whoami|version)/i;
 var SPECIFIC_MIN = 12;
@@ -13264,7 +13512,10 @@ function needsDescription(t) {
   if (!d || d.length < SPECIFIC_MIN) return true;
   const m = (t["x-route"]?.method ?? "get").toUpperCase();
   const p = t["x-route"]?.path ?? "";
-  return new RegExp(`^(${m}\\s+${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${t.name})\\.?$`, "i").test(d);
+  if (new RegExp(`^(${m}\\s+${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}|${t.name})\\.?$`, "i").test(d)) return true;
+  const norm = (x) => x.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+  const title = (t.summary ?? "").trim() || t.name.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_-]+/g, " ");
+  return norm(d) === norm(title) || d.length < 40;
 }
 function derivedDescription(t) {
   const m = (t["x-route"]?.method ?? "get").toUpperCase();
@@ -13274,9 +13525,40 @@ function derivedDescription(t) {
   const plural = segments.filter((s) => !s.startsWith("{")).pop()?.replace(/[-_]/g, " ") ?? "result";
   const one = segments[segments.length - 1]?.startsWith("{");
   const noun = one ? plural.replace(/s$/, "") : plural;
-  const returns = m === "GET" ? `Returns the ${noun} as JSON.` : m === "POST" ? `Creates it and returns the new ${noun.replace(/s$/, "")} as JSON.` : m === "DELETE" ? `Removes it and returns the result.` : `Applies the change and returns the updated ${noun.replace(/s$/, "")} as JSON.`;
+  const props = t.input_schema?.properties ?? {};
+  const required = t.input_schema?.required ?? [];
+  const firstParam = required.map((k) => [k, props[k]]).find(([, v]) => v && typeof v.description === "string" && v.description.trim()) ?? Object.entries(props).find(([, v]) => v && typeof v.description === "string" && v.description.trim());
+  const takes = firstParam ? ` Takes ${firstParam[0]}: ${firstParam[1].description.trim().replace(/\.$/, "")}.` : "";
+  const returns = m === "GET" ? `Returns the ${noun} as JSON.${takes}` : m === "POST" ? `Creates it and returns the new ${noun.replace(/s$/, "")} as JSON.` : m === "DELETE" ? `Removes it and returns the result.` : `Applies the change and returns the updated ${noun.replace(/s$/, "")} as JSON.`;
   return `${summary.replace(/\.$/, "")}. ${m} ${p}. ${returns}`;
 }
+async function confirmOpenWorld(proj2, environment, interactive2, flag, openMode, say) {
+  const { loadCatalogue: loadCatalogue2, saveCatalogue: saveCatalogue2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
+  const t = { projectId: proj2.projectId, apiVersion: proj2.apiVersion, environment: environment || "dev" };
+  let cat;
+  try {
+    cat = await loadCatalogue2(t);
+  } catch {
+    return false;
+  }
+  const unset = cat.tools.map((x) => x.name).filter((n) => typeof cat.overrides?.[n]?.openWorld !== "boolean");
+  if (!unset.length) return false;
+  let answer = flag ? /^(y|yes|true|1)$/i.test(flag.trim()) : null;
+  if (answer === null && !interactive2) {
+    say(import_chalk30.default.dim(`  openWorldHint not answered for ${unset.length} tool${unset.length === 1 ? "" : "s"} (pass --open-world yes|no)`));
+    return false;
+  }
+  if (answer === null) {
+    const { default: inquirer3 } = await import("inquirer");
+    const { ow } = await inquirer3.prompt([{ type: "confirm", name: "ow", message: `Do the tools reach public or open-ended data \u2014 web pages, other people's records \u2014 (y), or only the signed-in account's own data (n)? Applies to ${unset.length === cat.tools.length ? "every tool" : `${unset.length} tools`}; change one later with \`${B.cli} mcp ops ${proj2.projectId} set <tool> --open-world|--no-open-world\`.`, default: openMode }]);
+    answer = ow;
+  }
+  cat.overrides = { ...cat.overrides ?? {} };
+  for (const n of unset) cat.overrides[n] = { ...cat.overrides[n] ?? {}, openWorld: answer };
+  await saveCatalogue2(t, cat);
+  say(import_chalk30.default.green(`  \u2713 openWorldHint ${answer ? "true" : "false"} on ${unset.length === cat.tools.length ? "every tool" : unset.join(", ")}`));
+  return true;
+}
 async function fixToolDescriptions(proj2, environment, interactive2, say) {
   const { loadCatalogue: loadCatalogue2, saveCatalogue: saveCatalogue2 } = await Promise.resolve().then(() => (init_mcp(), mcp_exports));
   const t = { projectId: proj2.projectId, apiVersion: proj2.apiVersion, environment: environment || "dev" };
@@ -13364,7 +13646,7 @@ async function headStatus(u) {
     return 0;
   }
 }
-function printSubmitSteps(r, mdPath, platforms = PLATFORMS) {
+function printSubmitSteps(r, mdPath, platforms = PLATFORMS, watching = false) {
   const url = r.report.project.publishedUrl ?? "(the MCP URL in the packet)";
   const open = isOpenMode(r);
   const claude = platforms.includes("claude");
@@ -13374,7 +13656,7 @@ function printSubmitSteps(r, mdPath, platforms = PLATFORMS) {
     `Test it yourself first: add ${import_chalk30.default.cyan(url)} as a custom connector in ${where}, ${open ? "no sign-in needed (open mode)" : "sign in with the reviewer account"}, run a tool.`,
     ...claude ? [`Claude: ${import_chalk30.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk30.default.cyan(import_path7.default.basename(mdPath))}.`] : [],
     ...chatgpt ? [`ChatGPT: ${import_chalk30.default.underline(PORTALS.chatgpt)} \u2192 upload ${import_chalk30.default.cyan(`connector-plugin-${r.report.project.id}.zip`)} \u2192 MCPs \u2192 Connect \u2192 Verify Domain \u2192 authorize \u2192 Scan Tools; paste the reviewer credentials under Review details; add the demo recording URL and the release notes; confirm the attestations. The MCP hostname is permanent for the OpenAI listing.`] : [],
-    open ? "A nightly re-check emails you if the listing drifts." : "Keep the reviewer account alive; a nightly re-check emails you if the listing drifts."
+    watching ? open ? "A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : "Keep the reviewer account alive. A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : open ? "The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts." : "Keep the reviewer account alive. The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts."
   ];
   console.log();
   console.log(import_chalk30.default.bold("  Submit (you do this part; the packet has every value to paste):"));
@@ -14415,7 +14697,7 @@ async function runLogout(opts = {}) {
 
 // src/commands/flush.ts
 var import_chalk37 = __toESM(require("chalk"));
-var fs20 = __toESM(require("fs"));
+var fs21 = __toESM(require("fs"));
 var path17 = __toESM(require("path"));
 init_auth();
 init_external_mcp();
@@ -14424,7 +14706,7 @@ async function runFlush(opts) {
   const demos = await stopDemos2().catch(() => 0);
   if (demos) console.log(import_chalk37.default.dim(`  Stopped ${demos} running demo(s).`));
   const dir = getApiblazeDir();
-  const entries2 = fs20.existsSync(dir) ? fs20.readdirSync(dir) : [];
+  const entries2 = fs21.existsSync(dir) ? fs21.readdirSync(dir) : [];
   if (!entries2.length) {
     console.log(import_chalk37.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
@@ -14437,7 +14719,7 @@ async function runFlush(opts) {
   const footprint = apiblazeMcpFootprint();
   const mdFiles = ["claude", "codex"].map((k) => ({ k, file: agentInstructionFile(k) })).filter(({ file: file2 }) => {
     try {
-      return fs20.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
+      return fs21.readFileSync(file2, "utf-8").includes("<!-- apiblaze:mcp:");
     } catch {
       return false;
     }
@@ -14462,7 +14744,7 @@ async function runFlush(opts) {
   let removed = 0;
   for (const e of entries2) {
     try {
-      fs20.rmSync(path17.join(dir, e), { recursive: true, force: true });
+      fs21.rmSync(path17.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
       console.log(import_chalk37.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
@@ -14477,7 +14759,7 @@ async function runFlush(opts) {
   for (const { k, file: file2 } of mdFiles) {
     let text = "";
     try {
-      text = fs20.readFileSync(file2, "utf-8");
+      text = fs21.readFileSync(file2, "utf-8");
     } catch {
       continue;
     }
@@ -18383,7 +18665,7 @@ async function providersMenu(cBase, clientLabel) {
 }
 
 // src/commands/spec.ts
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var import_chalk62 = __toESM(require("chalk"));
 var import_ora27 = __toESM(require("ora"));
 init_admin();
@@ -18406,7 +18688,7 @@ async function runSpecSet(project, opts) {
   }
   let specContent;
   try {
-    specContent = fs21.readFileSync(opts.file, "utf-8");
+    specContent = fs22.readFileSync(opts.file, "utf-8");
   } catch {
     console.error(import_chalk62.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
@@ -20231,28 +20513,28 @@ async function runConsumerApikeys(opts) {
 // src/commands/sidecar.ts
 var import_chalk68 = __toESM(require("chalk"));
 var import_ora33 = __toESM(require("ora"));
-var fs22 = __toESM(require("fs"));
+var fs23 = __toESM(require("fs"));
 var path18 = __toESM(require("path"));
 init_admin();
 init_resolve();
 init_auth();
 function detectNextProject(root) {
-  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f2) => fs22.existsSync(path18.join(root, f2)));
+  const hasConfig = ["next.config.js", "next.config.mjs", "next.config.ts"].some((f2) => fs23.existsSync(path18.join(root, f2)));
   let hasDep = false;
   try {
-    const pkg = JSON.parse(fs22.readFileSync(path18.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs23.readFileSync(path18.join(root, "package.json"), "utf8"));
     hasDep = !!(pkg.dependencies?.next || pkg.devDependencies?.next);
   } catch {
   }
-  const appDir = fs22.existsSync(path18.join(root, "app")) || fs22.existsSync(path18.join(root, "src", "app"));
-  const pagesDir = fs22.existsSync(path18.join(root, "pages")) || fs22.existsSync(path18.join(root, "src", "pages"));
+  const appDir = fs23.existsSync(path18.join(root, "app")) || fs23.existsSync(path18.join(root, "src", "app"));
+  const pagesDir = fs23.existsSync(path18.join(root, "pages")) || fs23.existsSync(path18.join(root, "src", "pages"));
   return { found: hasConfig || hasDep || appDir || pagesDir, router: appDir ? "app" : pagesDir ? "pages" : null };
 }
 function upsertEnvLocal(root, token) {
   const p = path18.join(root, ".env.local");
   let existing = "";
   try {
-    existing = fs22.readFileSync(p, "utf8");
+    existing = fs23.readFileSync(p, "utf8");
   } catch {
   }
   const had = /^APIBLAZE_API_KEY=/m.test(existing) || /^APIBLAZE_TOKEN=/m.test(existing);
@@ -20267,15 +20549,15 @@ function upsertEnvLocal(root, token) {
     next = (next.endsWith("\n") ? next : next + "\n") + `APIBLAZE_SIDECAR_VERBOSE=true
 `;
   }
-  fs22.writeFileSync(p, next);
+  fs23.writeFileSync(p, next);
   return had ? "rotated" : "created";
 }
 function installSidecarPackage(root) {
-  if (fs22.existsSync(path18.join(root, "node_modules", "apiblaze", "package.json"))) {
+  if (fs23.existsSync(path18.join(root, "node_modules", "apiblaze", "package.json"))) {
     console.log(`  ${import_chalk68.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
-  const has = (f2) => fs22.existsSync(path18.join(root, f2));
+  const has = (f2) => fs23.existsSync(path18.join(root, f2));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
   const spinner = (0, import_ora33.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
@@ -20288,7 +20570,7 @@ function installSidecarPackage(root) {
 }
 function readEnvKey(root) {
   try {
-    const s = fs22.readFileSync(path18.join(root, ".env.local"), "utf8");
+    const s = fs23.readFileSync(path18.join(root, ".env.local"), "utf8");
     const m = s.match(/^APIBLAZE_API_KEY=(.+)$/m) ?? s.match(/^APIBLAZE_TOKEN=(.+)$/m);
     return m ? m[1].trim() : null;
   } catch {
@@ -20299,13 +20581,13 @@ function ensureGitignored(root) {
   const p = path18.join(root, ".gitignore");
   let c = "";
   try {
-    c = fs22.readFileSync(p, "utf8");
+    c = fs23.readFileSync(p, "utf8");
   } catch {
   }
-  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs22.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
+  if (!/^\.env\.local$/m.test(c) && !/^\.env\*/m.test(c)) fs23.writeFileSync(p, (c && !c.endsWith("\n") ? c + "\n" : c) + ".env.local\n");
 }
 function wireInstrumentation(root) {
-  const existing = ["instrumentation.ts", "instrumentation.js", path18.join("src", "instrumentation.ts")].map((c) => path18.join(root, c)).find((f2) => fs22.existsSync(f2));
+  const existing = ["instrumentation.ts", "instrumentation.js", path18.join("src", "instrumentation.ts")].map((c) => path18.join(root, c)).find((f2) => fs23.existsSync(f2));
   const body = `import { register as apiblaze } from "apiblaze/sidecar";
 
 export function register() {
@@ -20313,18 +20595,18 @@ export function register() {
 }
 `;
   if (!existing) {
-    fs22.writeFileSync(path18.join(root, "instrumentation.ts"), body);
+    fs23.writeFileSync(path18.join(root, "instrumentation.ts"), body);
     return "created";
   }
-  const cur = fs22.readFileSync(existing, "utf8");
+  const cur = fs23.readFileSync(existing, "utf8");
   if (cur.includes("apiblaze/sidecar")) return "present";
   if (/export\s+function\s+register\s*\(/.test(cur)) {
-    fs22.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+    fs23.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ` + cur.replace(/export\s+function\s+register\s*\(\s*\)\s*\{/, (m) => `${m}
   apiblaze();`));
     return "patched";
   }
-  fs22.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
+  fs23.writeFileSync(existing, `import { register as apiblaze } from "apiblaze/sidecar";
 ${cur}
 // call apiblaze() inside your register() export.
 `);
@@ -20407,16 +20689,16 @@ export default async function Page() {
 function generateInspector(root, router) {
   try {
     if (router === "pages") {
-      const dir2 = fs22.existsSync(path18.join(root, "src", "pages")) ? path18.join(root, "src", "pages") : path18.join(root, "pages");
+      const dir2 = fs23.existsSync(path18.join(root, "src", "pages")) ? path18.join(root, "src", "pages") : path18.join(root, "pages");
       const f3 = path18.join(dir2, "abz-inspector.tsx");
-      fs22.writeFileSync(f3, INSPECTOR_PAGE);
+      fs23.writeFileSync(f3, INSPECTOR_PAGE);
       return path18.relative(root, f3);
     }
-    const base2 = fs22.existsSync(path18.join(root, "src", "app")) ? path18.join(root, "src", "app") : path18.join(root, "app");
+    const base2 = fs23.existsSync(path18.join(root, "src", "app")) ? path18.join(root, "src", "app") : path18.join(root, "app");
     const dir = path18.join(base2, "abz-inspector");
-    fs22.mkdirSync(dir, { recursive: true });
+    fs23.mkdirSync(dir, { recursive: true });
     const f2 = path18.join(dir, "page.tsx");
-    fs22.writeFileSync(f2, INSPECTOR_PAGE);
+    fs23.writeFileSync(f2, INSPECTOR_PAGE);
     return path18.relative(root, f2);
   } catch {
     return null;
@@ -22169,7 +22451,7 @@ program.command("login").description(`Authenticate with ${B.product}`).option("-
     process.exit(1);
   }
 });
-program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.) Add --compliant to make it a Claude connector, or a ChatGPT plugin with --compliant chatgpt, that meets the directory's policies.`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
+program.command("create").description(`Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.) Add --compliant to make it a Claude connector, or a ChatGPT plugin with --compliant chatgpt, that meets the directory's policies.`).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--open-world <yes|no>", "Every tool: reaches public or open-ended data (yes) or only the signed-in account's (no); asked once when omitted").option("--no-watch", "Do not turn on the nightly re-check email when the listing is green").option("--no-wait-login", "Sign-in mode: do not wait for a Claude sign-in before the verdict").option("--mcp-app", "Claude: the listing is an MCP App (the host then advertises the UI extension; needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot (PNG \u2265 1000 px wide) and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
   try {
     const compliant = opts.compliant ?? opts.policy;
     if (compliant !== void 0 && compliant !== false) {
@@ -22189,11 +22471,11 @@ function collect(value, previous) {
   return [...previous ?? [], value];
 }
 program.command("check").description(`Readiness report for the Claude and ChatGPT directories (--directory-ready): what passes, every blocker with its fix, and the ${B.thingShort}'s published URL. Exit 1 while a blocker remains.`).argument("[project]", `The ${B.thingShort} (project name)`).option("--directory-ready", "The directory readiness checks (the only mode today)").option("--compliant [directory]", "Which directory's policies to check against: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--stage <stage>", "create (relaxed: docs URL is a warning) \xB7 ready (the submission gate, default)").option("--refresh-snapshot", "Re-take the listing snapshot (after you edited the listing in the portals)").option("--no-probe", "Skip the live probes from this machine (report what the server can see)").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Print the raw report JSON (report, rendered text, target)").action(action((project, opts) => runCheck(project, { ...opts, noProbe: opts.probe === false })));
-var connector = program.command("connector").description(`A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--no-exercise", 'Skip the "Run every tool now?" step at the end').option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+var connector = program.command("connector").description(`A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--no-exercise", 'Skip the "Run every tool now?" step at the end').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
   if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector https://\u2026/openapi.yaml  \xB7  ${B.cli} connector reviewer <project>  \xB7  ${B.cli} connector exercise <project>  \xB7  ${B.cli} connector answers <project>`);
   await runConnector(project, opts);
 }));
-connector.command("exercise").description("Call every tool the way a reviewer would, as the reviewer account (open mode: as you): reads with a valid and an invalid argument, writes only on ids the run created and only after a y, then the three listing prompts through Claude Code when it is installed. The gateway records the outcomes; the report reads them.").argument("<project>", `The ${B.thingShort} (project name)`).option("--empty-ok <tool>", 'A read-only tool whose correct answer is "nothing" (repeatable)', collect, []).option("--no-claude", "Skip the Claude Code pass").option("--no-email", "No email at the end of the run").option("-y, --yes", "No questions: writes are not exercised (they need a y), the rest runs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+connector.command("exercise").description("Call every tool the way a reviewer would, as the reviewer account (open mode: as you): reads with a valid and an invalid argument, writes only on ids the run created and only after a y, then the three listing prompts through Claude Code when it is installed. The gateway records the outcomes; the report reads them.").argument("<project>", `The ${B.thingShort} (project name)`).option("--empty-ok <tool>", 'A read-only tool whose correct answer is "nothing" (repeatable)', collect, []).option("--no-claude", "Skip the Claude Code pass").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create records through the create tools and keep them").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("-y, --yes", "No questions: writes are not exercised (they need a y), the rest runs").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
   await runConnectorExercise(project, { ...withConnectorOpts(opts), noClaude: opts.claude === false, noEmail: opts.email === false });
 }));
 connector.command("docs").description('Generate the three documents a listing needs \u2014 the public page "Using <name> in Claude" (served at <portal>/connector), the reviewer instructions and the portal answers \u2014 on your Claude Code from the facts of the connector; lint them, store them, point the docs URL at the page. Edit them on the dashboard any time.').argument("<project>", `The ${B.thingShort} (project name)`).option("--from <file>", "Paste back a JSON answer produced elsewhere (see --prompt-out)").option("--prompt-out <file>", "Write the prompt + facts to a file instead of running Claude Code").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runConnectorDocs(project, withConnectorOpts(opts))));
@@ -22226,7 +22508,7 @@ mcpCommon(mcpPrompts.command("set").description("Add or replace a prompt from a
 mcpCommon(mcpPrompts.command("rm").description("Remove a prompt").argument("<project>", "Project name or id").argument("<name>", "Prompt name")).action(action((project, name, opts) => runMcpPrompts("rm", project, name, opts)));
 var mcpOps = mcpCmd.command("ops").description("Per-tool behavior. Default from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm");
 mcpCommon(mcpOps.command("list").description("Every tool with its effective behavior (overrides marked)").argument("<project>", "Project name or id")).action(action((project, opts) => runMcpOps("list", project, void 0, opts)));
-mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--title <text>", "Human label clients and directories show (default: the OpenAPI summary, else the name spelled out)").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
+mcpCommon(mcpOps.command("set").description("Override one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name").option("--title <text>", "Human label clients and directories show (default: the OpenAPI summary, else the name spelled out)").option("--read-only", "Safe to call, changes nothing (e.g. a POST search)").option("--no-read-only", "Not read-only").option("--destructive", "Changes or deletes data (e.g. a GET with side effects)").option("--no-destructive", "Not destructive").option("--idempotent", "Repeating it has no extra effect").option("--no-idempotent", "Not idempotent").option("--confirm", "Ask the user to confirm before running").option("--no-confirm", "Never ask to confirm").option("--always-async", "Return a task handle immediately (long jobs)").option("--no-always-async", "Wait for the result (default)").option("--open-world", "Reaches public or open-ended data (web pages, third-party records); the directories read openWorldHint").option("--no-open-world", "Only the signed-in account's own data")).action(action((project, tool, opts) => runMcpOps("set", project, tool, opts)));
 mcpCommon(mcpOps.command("reset").description("Back to the automatic default for one tool").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpOps("reset", project, tool, opts)));
 mcpCommon(mcpCmd.command("ui").description("Print a tool's MCP Apps UI resource (ui://{project}/{tool}) \u2014 the automatic viewer").argument("<project>", "Project name or id").argument("<tool>", "Tool name")).action(action((project, tool, opts) => runMcpUi(project, tool, opts)));
 program.command("apichat [project]").alias("chat").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.69",
+  "version": "0.21.70",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",