apiblaze 0.21.72 → 0.21.73

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.72";
+    version = "0.21.73";
   }
 });
 
@@ -424,7 +424,10 @@ function recordCall(e) {
 }
 function maskBody(body) {
   if (body === void 0) return void 0;
-  return JSON.stringify(body, (k, v) => SECRET_KEY.test(k) && typeof v === "string" ? "***" : v);
+  return JSON.stringify(body, function(k, v) {
+    if (typeof v !== "string") return v;
+    return SECRET_KEY.test(k) || k === "value" && this?.value_secret === true ? "***" : v;
+  });
 }
 function renderTrace() {
   if (!verbose || entries.length === 0) return;
@@ -7227,6 +7230,261 @@ var init_create = __esm({
   }
 });
 
+// src/commands/config.ts
+var config_exports = {};
+__export(config_exports, {
+  environmentsWithTarget: () => environmentsWithTarget,
+  runRename: () => runRename,
+  runTargetSet: () => runTargetSet
+});
+async function patchConfig(project, opts, body, summary) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const spinner = (0, import_ora9.default)(summary + "...").start();
+  try {
+    const out = await producer(caller, {
+      method: "PATCH",
+      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
+      body,
+      summary
+    });
+    spinner.succeed(`${summary} \u2014 ${proj2.projectName} v${proj2.apiVersion}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+  } catch (err) {
+    spinner.fail(summary + " failed.");
+    throw err;
+  }
+}
+async function runTargetSet(project, opts) {
+  if (!opts.url) {
+    console.error(import_chalk24.default.red("--url is required."));
+    process.exit(1);
+  }
+  if (!opts.env) {
+    await patchConfig(project, opts, { target_url: opts.url }, `Set target \u2192 ${opts.url}`);
+    return;
+  }
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const environments = await environmentsWithTarget(caller, teamId, proj2, opts.env, opts.url);
+  await patchConfig(project, opts, { environments }, `Set target for env ${opts.env} \u2192 ${opts.url}`);
+}
+async function environmentsWithTarget(caller, teamId, proj2, env, url) {
+  const listing = await pageAll(
+    (cursor) => producer(caller, {
+      method: "GET",
+      path: withPage(`/projects?team_id=${encodeURIComponent(teamId)}`, cursor),
+      summary: `Read environments for ${proj2.projectName}`
+    }),
+    (b) => b?.projects
+  );
+  const row = listing.items.find((r) => r.project_id === proj2.projectId && r.api_version === proj2.apiVersion);
+  const current = row?.config?.environments;
+  const existing = current && typeof current === "object" && !Array.isArray(current) ? current : {};
+  const prev = existing[env];
+  return { ...existing, [env]: { ...prev && typeof prev === "object" ? prev : {}, target: url } };
+}
+async function runRename(project, opts) {
+  if (!opts.displayName) {
+    console.error(import_chalk24.default.red("--display-name is required."));
+    process.exit(1);
+  }
+  await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
+}
+var import_chalk24, import_ora9;
+var init_config = __esm({
+  "src/commands/config.ts"() {
+    "use strict";
+    import_chalk24 = __toESM(require("chalk"));
+    import_ora9 = __toESM(require("ora"));
+    init_caller();
+    init_paging();
+  }
+});
+
+// src/commands/transform.ts
+var transform_exports = {};
+__export(transform_exports, {
+  parseEntries: () => parseEntries,
+  runTransformList: () => runTransformList,
+  runTransformMap: () => runTransformMap,
+  runTransformMapping: () => runTransformMapping,
+  runTransformRemove: () => runTransformRemove,
+  runTransformSetHeader: () => runTransformSetHeader,
+  setUpstreamHeader: () => setUpstreamHeader
+});
+async function target(project, opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/transforms`;
+  return { caller, proj: proj2, base: base2 };
+}
+async function listRules(t) {
+  const out = await producer(t.caller, {
+    method: "GET",
+    path: t.base,
+    summary: `List transforms for ${t.proj.projectName}`
+  });
+  return out?.rules ?? [];
+}
+function describe(r) {
+  const a = r.action ?? { type: "?" };
+  if (a.type === "hardcode") {
+    const secret = !a.value || /^abzsec:|^__ABZSEC_|^•+$/.test(a.value);
+    return `set ${a.destination} = ${secret ? "(secret)" : a.value}`;
+  }
+  if (a.type === "remove") return `remove ${a.field}`;
+  if (a.type === "map") return `map ${a.source} \u2192 ${a.destination}${a.lookup?.mapping_id ? " (through a mapping table)" : ""}`;
+  return a.type;
+}
+async function runTransformList(project, opts) {
+  const t = await target(project, opts);
+  const rules = await listRules(t);
+  if (opts.json) {
+    console.log(JSON.stringify(rules, null, 2));
+    return;
+  }
+  if (!rules.length) {
+    console.log(import_chalk25.default.dim(`No transforms on ${t.proj.projectName} v${t.proj.apiVersion}.`));
+    return;
+  }
+  for (const r of rules) {
+    console.log(`${r.enabled ? import_chalk25.default.green("\u25CF") : import_chalk25.default.gray("\u25CB")} ${import_chalk25.default.bold(r.name)} ${import_chalk25.default.dim(`[${r.phase}] ${r.id}`)}`);
+    console.log(`    ${describe(r)}`);
+  }
+}
+async function headerUpsert(t, header, value, secret) {
+  const name = ruleNameFor(header);
+  const action = {
+    type: "hardcode",
+    destination: `header:${header}`,
+    value,
+    // Encrypted at rest and masked on every read; main-proxy decrypts it only
+    // on the way to the upstream.
+    ...secret ? { value_secret: true } : {}
+  };
+  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
+  const summary = `${existing ? "Update" : "Add"} transform: send ${header} to the upstream`;
+  const send = () => producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action, phase: "request", enabled: true }, summary });
+  return { summary, send };
+}
+async function setUpstreamHeader(caller, proj2, header, value) {
+  if (!HEADER_NAME.test(header)) throw new Error(`"${header}" is not a valid header name.`);
+  if (!value) throw new Error(`The value for ${header} is empty.`);
+  const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/transforms`;
+  await (await headerUpsert({ caller, proj: proj2, base: base2 }, header, value, true)).send();
+}
+async function runTransformSetHeader(project, header, opts) {
+  if (!HEADER_NAME.test(header)) throw new Error(`"${header}" is not a valid header name.`);
+  if (opts.value === void 0 === (opts.valueEnv === void 0)) {
+    throw new Error("Pass exactly one of --value <value> or --value-env <VAR> (reads the value from that environment variable, so it stays out of your shell history).");
+  }
+  const value = opts.value ?? process.env[opts.valueEnv];
+  if (!value) throw new Error(`Environment variable ${opts.valueEnv} is empty or not set.`);
+  const t = await target(project, opts);
+  const { summary, send } = await headerUpsert(t, header, value, !!opts.secret);
+  const spinner = opts.json ? null : (0, import_ora10.default)(summary + "...").start();
+  try {
+    const out = await send();
+    spinner?.succeed(`${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}${opts.secret ? " (stored encrypted)" : ""}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+    else console.log(import_chalk25.default.dim(`  Every call the proxy forwards now carries ${header}. Your backend can reject calls without it.`));
+  } catch (err) {
+    spinner?.fail(summary + " failed.");
+    throw err;
+  }
+}
+async function runTransformRemove(project, nameOrId, opts) {
+  const t = await target(project, opts);
+  const rules = await listRules(t);
+  const want = nameOrId.toLowerCase();
+  const rule = rules.find((r) => r.id === nameOrId || r.name.toLowerCase() === want || r.name === ruleNameFor(nameOrId));
+  if (!rule) {
+    throw new Error(`No transform "${nameOrId}" on ${t.proj.projectName}.` + (rules.length ? ` Transforms: ${rules.map((r) => r.name).join(", ")}` : ""));
+  }
+  await producer(t.caller, {
+    method: "DELETE",
+    path: `${t.base}/${encodeURIComponent(rule.id)}`,
+    summary: `Remove transform "${rule.name}"`
+  });
+  if (opts.json) console.log(JSON.stringify({ ok: true, removed: rule.id }));
+  else console.log(`${import_chalk25.default.green("\u2713")} Removed transform ${import_chalk25.default.bold(rule.name)} from ${t.proj.projectName}.`);
+}
+function tablesBase(t) {
+  return t.base.replace(/\/transforms$/, "/mappings");
+}
+async function listTables(t) {
+  const out = await producer(t.caller, {
+    method: "GET",
+    path: tablesBase(t),
+    summary: `List mapping tables for ${t.proj.projectName}`
+  });
+  return out?.tables ?? [];
+}
+function parseEntries(pairs) {
+  return pairs.map((p) => {
+    const i = p.indexOf("=");
+    if (i <= 0) throw new Error(`"${p}" is not a from=to pair (e.g. FR=EUR).`);
+    return { from: p.slice(0, i), to: p.slice(i + 1) };
+  });
+}
+async function runTransformMapping(project, table, pairs, opts) {
+  if (!pairs.length) throw new Error("Give at least one from=to pair, e.g. FR=EUR US=USD.");
+  const entries2 = parseEntries(pairs);
+  const t = await target(project, opts);
+  const existing = (await listTables(t)).find((m) => m.name === table);
+  const body = { name: table, entries: entries2, ...opts.secret ? { encrypt_values: true } : {} };
+  const summary = `${existing ? "Replace" : "Create"} mapping table "${table}" (${entries2.length} entr${entries2.length === 1 ? "y" : "ies"})`;
+  const out = await producer(t.caller, existing ? { method: "PUT", path: `${tablesBase(t)}/${encodeURIComponent(existing.id)}`, body, summary } : { method: "POST", path: tablesBase(t), body, summary });
+  if (opts.json) {
+    console.log(JSON.stringify(out ?? { ok: true }));
+    return;
+  }
+  console.log(`${import_chalk25.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
+  for (const e of entries2) console.log(import_chalk25.default.dim(`    ${e.from} \u2192 ${opts.secret ? "(secret)" : e.to}`));
+}
+async function runTransformMap(project, source, destination, opts) {
+  if (!FIELD_REF.test(source)) throw new Error(`Source "${source}" must look like header:X-Country, query:country or bodyvar:order.country.`);
+  if (!/^(header|query|bodyvar):.+/.test(destination)) throw new Error(`Destination "${destination}" must look like header:X-Currency, query:currency or bodyvar:order.currency.`);
+  if (!opts.table) throw new Error("--table <name> is required: the mapping table to look the value up in (create it with `transform mapping`).");
+  const onNoMatch = opts.onNoMatch ?? "skip";
+  if (!["skip", "fail", "passthrough"].includes(onNoMatch)) throw new Error("--on-no-match is skip, fail or passthrough.");
+  const t = await target(project, opts);
+  const table = (await listTables(t)).find((m) => m.name === opts.table);
+  if (!table) throw new Error(`No mapping table "${opts.table}" on ${t.proj.projectName}. Create it: npx apiblaze transform mapping ${project} ${opts.table} FR=EUR \u2026`);
+  const name = `map ${source} to ${destination}`;
+  const action = {
+    type: "map",
+    source,
+    destination,
+    lookup: { mapping_id: table.id, on_no_match: onNoMatch }
+  };
+  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
+  const summary = `${existing ? "Update" : "Add"} transform: ${source} \u2192 ${destination} through "${table.name}"`;
+  const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action, phase: "request", enabled: true }, summary });
+  if (opts.json) {
+    console.log(JSON.stringify(out ?? { ok: true }));
+    return;
+  }
+  console.log(`${import_chalk25.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
+  console.log(import_chalk25.default.dim(`  A value not in the table: ${onNoMatch === "skip" ? "nothing is written" : onNoMatch === "fail" ? "the call is refused" : "it is copied as-is"}.`));
+}
+var import_chalk25, import_ora10, HEADER_NAME, ruleNameFor, FIELD_REF;
+var init_transform = __esm({
+  "src/commands/transform.ts"() {
+    "use strict";
+    import_chalk25 = __toESM(require("chalk"));
+    import_ora10 = __toESM(require("ora"));
+    init_caller();
+    HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+    ruleNameFor = (header) => `set header ${header.toLowerCase()}`;
+    FIELD_REF = /^(header|query|param|bodyvar|jwt):.+/;
+  }
+});
+
 // src/lib/tools.ts
 async function proj(teamId, name, version2) {
   return resolveProject(teamId, name, version2);
@@ -7237,11 +7495,11 @@ function toolCatalogue() {
 function findTool(name) {
   return TOOLS.find((t) => t.name === name);
 }
-var import_chalk24, TOOLS;
+var import_chalk26, TOOLS;
 var init_tools = __esm({
   "src/lib/tools.ts"() {
     "use strict";
-    import_chalk24 = __toESM(require("chalk"));
+    import_chalk26 = __toESM(require("chalk"));
     init_admin();
     init_api();
     init_resolve();
@@ -7270,15 +7528,15 @@ var init_tools = __esm({
           const key = keys.dev ?? Object.values(keys)[0];
           const url = `https://${a.name}.abz.run/${version2}/dev`;
           const tryIt = buildTryItCurl(url, auth, key, res.tenant);
-          const lines = [`  ${import_chalk24.default.dim("Proxy URL:")}  ${import_chalk24.default.bold(url)}`];
-          if (res.devPortal) lines.push(`  ${import_chalk24.default.dim("Dev portal:")} ${res.devPortal}`);
+          const lines = [`  ${import_chalk26.default.dim("Proxy URL:")}  ${import_chalk26.default.bold(url)}`];
+          if (res.devPortal) lines.push(`  ${import_chalk26.default.dim("Dev portal:")} ${res.devPortal}`);
           const envs = Object.keys(keys);
           if (envs.length) {
-            lines.push("", `  ${import_chalk24.default.bold("API keys")} ${import_chalk24.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+            lines.push("", `  ${import_chalk26.default.bold("API keys")} ${import_chalk26.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
             const w = Math.max(...envs.map((e) => e.length));
-            for (const env of envs) lines.push(`    ${import_chalk24.default.cyan(env.padEnd(w))}  ${import_chalk24.default.green(keys[env])}`);
+            for (const env of envs) lines.push(`    ${import_chalk26.default.cyan(env.padEnd(w))}  ${import_chalk26.default.green(keys[env])}`);
           }
-          if (tryIt) lines.push("", `  ${import_chalk24.default.dim("Try it:")}`, `    ${import_chalk24.default.cyan(tryIt)}`);
+          if (tryIt) lines.push("", `  ${import_chalk26.default.dim("Try it:")}`, `    ${import_chalk26.default.cyan(tryIt)}`);
           return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
         }
       },
@@ -7446,14 +7704,14 @@ function truncate(value, max = 1500) {
 }
 function printCost(resp) {
   const line = formatBilling(resp.billing);
-  if (line) console.log(import_chalk25.default.magenta(`  ${line}`) + import_chalk25.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
+  if (line) console.log(import_chalk27.default.magenta(`  ${line}`) + import_chalk27.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk25.default.bold("APIblaze agent") + import_chalk25.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk25.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk27.default.bold("APIblaze agent") + import_chalk27.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk27.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   let queued = opts.first ?? (opts.seedFor ? `Seed realistic sample data through the proxy "${opts.seedFor}" so a directory reviewer sees a populated account: create a handful of records with each write tool, then list them back. Never mention or use credentials.` : null);
   while (true) {
@@ -7461,16 +7719,16 @@ async function runAgent(opts) {
     if (queued) {
       text = queued;
       queued = null;
-      console.log(import_chalk25.default.cyan("you") + " \u203A " + text);
+      console.log(import_chalk27.default.cyan("you") + " \u203A " + text);
     } else {
-      const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk25.default.cyan("you") + " \u203A" }]);
+      const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk27.default.cyan("you") + " \u203A" }]);
       text = (input ?? "").trim();
     }
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora9.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora11.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -7485,14 +7743,14 @@ async function runAgent(opts) {
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp);
-      if (resp.reply) console.log(import_chalk25.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk27.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora9.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora11.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -7510,18 +7768,18 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk25.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk27.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk25.default.dim("\nBye."));
+  console.log(import_chalk27.default.dim("\nBye."));
 }
-var import_chalk25, import_ora9, DASHBOARD_BASE7, MAX_TOOL_STEPS;
+var import_chalk27, import_ora11, DASHBOARD_BASE7, MAX_TOOL_STEPS;
 var init_agent = __esm({
   "src/commands/agent.ts"() {
     "use strict";
-    import_chalk25 = __toESM(require("chalk"));
-    import_ora9 = __toESM(require("ora"));
+    import_chalk27 = __toESM(require("chalk"));
+    import_ora11 = __toESM(require("ora"));
     init_auth();
     init_admin();
     init_resolve();
@@ -8157,10 +8415,10 @@ async function runConnectorExercise(project, opts = {}) {
     if (!json) console.log(s);
   };
   const deps = opts.deps ?? {};
-  if (opts.report !== false) say(import_chalk26.default.cyan(`  Report: ${reportLink(proj2.projectId, proj2.apiVersion)}`));
+  if (opts.report !== false) say(import_chalk28.default.cyan(`  Report: ${reportLink(proj2.projectId, proj2.apiVersion)}`));
   if (opts.emptyOk?.length) {
     await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { empty_ok: opts.emptyOk } }, summary: "Mark tools legitimately empty" });
-    say(import_chalk26.default.dim(`  marked legitimately empty: ${opts.emptyOk.join(", ")}`));
+    say(import_chalk28.default.dim(`  marked legitimately empty: ${opts.emptyOk.join(", ")}`));
   }
   let r = await fetchDirectoryReport(caller, proj2, { probe: false });
   const target2 = r.target ?? {};
@@ -8195,9 +8453,9 @@ async function runConnectorExercise(project, opts = {}) {
       bearer = login.accessToken;
       asMeta = login.as;
       reviewerUsername = acct.username;
-      say(import_chalk26.default.dim(`  signed in as the reviewer (${acct.username}); the token expires in 1 h`));
+      say(import_chalk28.default.dim(`  signed in as the reviewer (${acct.username}); the token expires in 1 h`));
     } else {
-      say(import_chalk26.default.dim("  open mode: no sign-in; this run's calls count as yours"));
+      say(import_chalk28.default.dim("  open mode: no sign-in; this run's calls count as yours"));
     }
     const ua = `apiblaze-cli/${version} directory-exercise`;
     const headers = { [RUN_HEADER]: runId2 };
@@ -8217,14 +8475,14 @@ async function runConnectorExercise(project, opts = {}) {
         if (!go) {
           row.note = "not exercised: producer declined";
           notes.push({ tool: t.name, note: "not exercised: producer declined" });
-          say(`  ${import_chalk26.default.yellow("\u2013")} ${t.name}  not exercised (${interactive2 ? "declined" : "non-interactive: writes need a y"})`);
+          say(`  ${import_chalk28.default.yellow("\u2013")} ${t.name}  not exercised (${interactive2 ? "declined" : "non-interactive: writes need a y"})`);
           continue;
         }
       }
       let v = localOutcome(await call3(t.name, args));
       if (role === "read" && v.outcome !== "ok" && interactive2 && Object.keys(args).length) {
         const { default: inquirer3 } = await import("inquirer");
-        say(`  ${mark(v.outcome)} ${t.name} refused ${JSON.stringify(args)}: ${import_chalk26.default.dim(redactHead(v.text, 120) || v.outcome)}`);
+        say(`  ${mark(v.outcome)} ${t.name} refused ${JSON.stringify(args)}: ${import_chalk28.default.dim(redactHead(v.text, 120) || v.outcome)}`);
         const fixed = {};
         for (const [name, cur] of Object.entries(args)) {
           const p = t.inputProperties?.[name] ?? {};
@@ -8263,11 +8521,11 @@ async function runConnectorExercise(project, opts = {}) {
           row.invalidText = redactHead(`${bad.broke} \u2192 ${e.text}`);
         }
       }
-      say(`  ${mark(v.outcome)} ${t.name}  ${import_chalk26.default.dim(v.text.replace(/\s+/g, " ").slice(0, 80))}${row.invalid !== "skipped" ? import_chalk26.default.dim(`  \xB7 bad arg: ${row.invalid === "error" ? "refused with a message" : row.invalid}`) : ""}`);
+      say(`  ${mark(v.outcome)} ${t.name}  ${import_chalk28.default.dim(v.text.replace(/\s+/g, " ").slice(0, 80))}${row.invalid !== "skipped" ? import_chalk28.default.dim(`  \xB7 bad arg: ${row.invalid === "error" ? "refused with a message" : row.invalid}`) : ""}`);
     }
     if (Object.keys(learned).length) {
       await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { tool_examples: learned } }, summary: "Remember the working arguments" });
-      say(import_chalk26.default.green(`  \u2713 remembered the working arguments for ${Object.keys(learned).join(", ")} (used on every run from now on)`));
+      say(import_chalk28.default.green(`  \u2713 remembered the working arguments for ${Object.keys(learned).join(", ")} (used on every run from now on)`));
     }
     const creators = tools.filter((t) => toolRole(t) === "create");
     if (!open && !opts.promptsOnly && opts.seed !== false && emptyReads.length && creators.length) {
@@ -8275,21 +8533,21 @@ async function runConnectorExercise(project, opts = {}) {
       let go = opts.seed === true;
       if (!go && interactive2) go = await confirm(`${emptyReads.length} read${emptyReads.length > 1 ? "s" : ""} returned nothing for the reviewer (${names}). Create a few records the reviewer will see, through ${creators.map((c) => c.name).join(", ")}? They are kept, not deleted.`, interactive2);
       if (!go) {
-        say(import_chalk26.default.dim(`  seed skipped${interactive2 ? "" : " (non-interactive: pass --seed to create records for the reviewer, --no-seed to silence this)"}: ${names} stay empty for the reviewer (REVIEWER_ACCOUNT_POPULATED)`));
+        say(import_chalk28.default.dim(`  seed skipped${interactive2 ? "" : " (non-interactive: pass --seed to create records for the reviewer, --no-seed to silence this)"}: ${names} stay empty for the reviewer (REVIEWER_ACCOUNT_POPULATED)`));
         notes.push({ kind: "seed", note: "skipped", tools: emptyReads.map((t) => t.name) });
       } else {
         for (const c of creators) {
           const args = validArgs(c, {}, examples[c.name]);
           const v = localOutcome(await call3(c.name, args));
           if (v.outcome !== "ok") {
-            say(`  ${mark(v.outcome)} seed via ${c.name} ${JSON.stringify(args)}: ${import_chalk26.default.dim(redactHead(v.text, 100) || v.outcome)}`);
+            say(`  ${mark(v.outcome)} seed via ${c.name} ${JSON.stringify(args)}: ${import_chalk28.default.dim(redactHead(v.text, 100) || v.outcome)}`);
             continue;
           }
           const id = extractCreatedId(parseResultJson(v.text));
           const idText = id ? String(id.value).slice(0, 64) : "(no id in the answer)";
           seeded[c.name] = [...seeded[c.name] ?? [], idText];
           notes.push({ kind: "seed", tool: c.name, note: `seeded ${id ? `${id.name}=${idText}` : "a record"}` });
-          say(`  ${import_chalk26.default.green("\u2713")} seeded via ${c.name}: ${idText} ${import_chalk26.default.dim("(kept for the reviewer)")}`);
+          say(`  ${import_chalk28.default.green("\u2713")} seeded via ${c.name}: ${idText} ${import_chalk28.default.dim("(kept for the reviewer)")}`);
         }
         if (Object.keys(seeded).length) {
           for (const t of emptyReads) {
@@ -8303,9 +8561,9 @@ async function runConnectorExercise(project, opts = {}) {
               row.args = args;
               row.resultShape = describeResult(v.text);
             }
-            say(`  ${nonEmpty ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} ${t.name} after seeding: ${import_chalk26.default.dim(nonEmpty ? v.text.replace(/\s+/g, " ").slice(0, 80) : "still nothing (a different filter or tenant? mark it --empty-ok if that is correct)")}`);
+            say(`  ${nonEmpty ? import_chalk28.default.green("\u2713") : import_chalk28.default.yellow("\u2013")} ${t.name} after seeding: ${import_chalk28.default.dim(nonEmpty ? v.text.replace(/\s+/g, " ").slice(0, 80) : "still nothing (a different filter or tenant? mark it --empty-ok if that is correct)")}`);
           }
-          await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { seeded } }, summary: "Remember what was seeded for the reviewer" }).catch((e) => say(import_chalk26.default.dim(`  (could not store the seeded ids: ${e.message})`)));
+          await producer(caller, { method: "PATCH", path: projectPath(proj2), body: { directory_metadata: { seeded } }, summary: "Remember what was seeded for the reviewer" }).catch((e) => say(import_chalk28.default.dim(`  (could not store the seeded ids: ${e.message})`)));
         }
       }
     }
@@ -8323,11 +8581,11 @@ async function runConnectorExercise(project, opts = {}) {
     for (const client of clients) {
       if (opts.noClaude && client === "claude") continue;
       if (client === "claude" && !claudeInstalled) {
-        say(import_chalk26.default.dim("  Claude Code is not installed here: the Claude pass is skipped (TESTED_FROM_CLAUDE and EXAMPLE_PROMPTS_WORK stay open with their instruction)."));
+        say(import_chalk28.default.dim("  Claude Code is not installed here: the Claude pass is skipped (TESTED_FROM_CLAUDE and EXAMPLE_PROMPTS_WORK stay open with their instruction)."));
         continue;
       }
       if (client === "codex" && !(codex.installed && codex.loggedIn)) {
-        say(import_chalk26.default.dim(`  Codex CLI is ${codex.installed ? "not logged in" : "not installed"} here: the Codex pass is skipped (TESTED_FROM_OPENAI_CLIENT, EXAMPLE_PROMPTS_WORK_OPENAI and NEGATIVE_PROMPTS_HOLD stay open with their instruction).${codex.installed ? " Run `codex login` once." : " Install it: npm i -g @openai/codex, then `codex login`."}`));
+        say(import_chalk28.default.dim(`  Codex CLI is ${codex.installed ? "not logged in" : "not installed"} here: the Codex pass is skipped (TESTED_FROM_OPENAI_CLIENT, EXAMPLE_PROMPTS_WORK_OPENAI and NEGATIVE_PROMPTS_HOLD stay open with their instruction).${codex.installed ? " Run `codex login` once." : " Install it: npm i -g @openai/codex, then `codex login`."}`));
         continue;
       }
       const already = provenFor(client);
@@ -8342,9 +8600,9 @@ async function runConnectorExercise(project, opts = {}) {
         ...client === "codex" && !opts.promptsOnly ? negatives.map((p) => ({ prompt: p, kind: "negative" })) : []
       ];
       const label3 = client === "claude" ? "Claude Code" : "Codex CLI";
-      if (already.size) say(import_chalk26.default.dim(`  ${already.size} prompt${already.size > 1 ? "s" : ""} already run through ${label3} as ${already.size > 1 ? "they were" : "it was"} typed`));
+      if (already.size) say(import_chalk28.default.dim(`  ${already.size} prompt${already.size > 1 ? "s" : ""} already run through ${label3} as ${already.size > 1 ? "they were" : "it was"} typed`));
       if (!runs.length) continue;
-      say(import_chalk26.default.dim(`  ${label3} pass: ${runs.length} one-shot${runs.length > 1 ? "s" : ""} (10\u201325 s each; read-only tools only)`));
+      say(import_chalk28.default.dim(`  ${label3} pass: ${runs.length} one-shot${runs.length > 1 ? "s" : ""} (10\u201325 s each; read-only tools only)`));
       let cfgPath = null;
       if (client === "claude") {
         configDir = configDir ?? import_fs5.default.mkdtempSync(import_path4.default.join(deps.tmpdir ?? import_os2.default.tmpdir(), "abz-exercise-"));
@@ -8358,7 +8616,7 @@ async function runConnectorExercise(project, opts = {}) {
         if (x.kind === "tool") notes.push({ kind: "claude-tool", client, tool: firstRead.name, tool_called: calls.length > 0 });
         else notes.push({ kind: x.kind, prompt: x.prompt, tool_called: calls.length > 0, tools: calls, client });
         const good = x.kind === "negative" ? calls.length === 0 : calls.length > 0;
-        say(`  ${good ? import_chalk26.default.green("\u2713") : import_chalk26.default.yellow("\u2013")} ${client}: "${x.prompt.slice(0, 60)}" \u2192 ${calls.length ? `called ${calls.join(", ")}` : "no tool call"}${x.kind === "negative" ? calls.length ? import_chalk26.default.yellow(" (a negative prompt must hold)") : import_chalk26.default.dim(" (held)") : ""}${status2 !== 0 && status2 != null ? import_chalk26.default.dim(` (exit ${status2})`) : ""}`);
+        say(`  ${good ? import_chalk28.default.green("\u2713") : import_chalk28.default.yellow("\u2013")} ${client}: "${x.prompt.slice(0, 60)}" \u2192 ${calls.length ? `called ${calls.join(", ")}` : "no tool call"}${x.kind === "negative" ? calls.length ? import_chalk28.default.yellow(" (a negative prompt must hold)") : import_chalk28.default.dim(" (held)") : ""}${status2 !== 0 && status2 != null ? import_chalk28.default.dim(` (exit ${status2})`) : ""}`);
       }
     }
     if (bearer && asMeta) userinfo = await probeUserinfo(asMeta, bearer, deps);
@@ -8412,13 +8670,13 @@ async function runConnectorExercise(project, opts = {}) {
     if (card) {
       console.log(card);
       console.log();
-      console.log(import_chalk26.default.bold(`  ${summaryOf(r)}`) + import_chalk26.default.dim(` \xB7 ${pageLinkOf(r, proj2)}`));
+      console.log(import_chalk28.default.bold(`  ${summaryOf(r)}`) + import_chalk28.default.dim(` \xB7 ${pageLinkOf(r, proj2)}`));
     } else {
       printReport(r, false);
-      console.log(import_chalk26.default.cyan(`  Report: ${reportLink(proj2.projectId, proj2.apiVersion)}`));
+      console.log(import_chalk28.default.cyan(`  Report: ${reportLink(proj2.projectId, proj2.apiVersion)}`));
     }
   }
-  console.log(import_chalk26.default.dim(opts.noEmail ? "  (no email for this run)" : closed?.emailed ? "  (the result was emailed to you; --no-email or the project setting turns it off)" : "  (no email: the run has no address to send to)"));
+  console.log(import_chalk28.default.dim(opts.noEmail ? "  (no email for this run)" : closed?.emailed ? "  (the result was emailed to you; --no-email or the project setting turns it off)" : "  (no email: the run has no address to send to)"));
   return summary;
 }
 function claudeOneShot2(spawn5, cfgPath, prompt, allowed) {
@@ -8439,10 +8697,10 @@ async function createPromptTester(caller, proj2, opts = {}) {
   const codex = deps.codexInstalled !== void 0 ? { installed: deps.codexInstalled, loggedIn: deps.codexInstalled } : wanted.includes("codex") ? detectCodex(deps.spawn ?? import_child_process5.spawnSync) : { installed: false, loggedIn: false };
   const clients = wanted.filter((c) => c === "claude" ? claudeInstalled : codex.installed && codex.loggedIn);
   if (!clients.length) {
-    say(import_chalk26.default.dim(`  (${wanted.includes("codex") && !wanted.includes("claude") ? `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}` : "Claude Code is not installed"} here: each prompt is run at the end, in the exercise)`));
+    say(import_chalk28.default.dim(`  (${wanted.includes("codex") && !wanted.includes("claude") ? `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}` : "Claude Code is not installed"} here: each prompt is run at the end, in the exercise)`));
     return null;
   }
-  for (const missing of wanted.filter((c) => !clients.includes(c))) say(import_chalk26.default.dim(`  (${missing === "claude" ? "Claude Code is not installed" : `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}`} here: that pass runs at the end, in the exercise, once it is)`));
+  for (const missing of wanted.filter((c) => !clients.includes(c))) say(import_chalk28.default.dim(`  (${missing === "claude" ? "Claude Code is not installed" : `Codex CLI is ${codex.installed ? "not logged in" : "not installed"}`} here: that pass runs at the end, in the exercise, once it is)`));
   const r = await fetchDirectoryReport(caller, proj2, { probe: false });
   const target2 = r.target ?? {};
   const publishedUrl = r.report.project.publishedUrl;
@@ -8455,12 +8713,12 @@ async function createPromptTester(caller, proj2, opts = {}) {
     const packet = await producer(caller, { method: "GET", path: `${projectPath(proj2)}/directory-packet?probe=0&force=1`, summary: "Reviewer account (for the login)" }).catch(() => null);
     const acct = packet?.json?.test_account ?? null;
     if (!acct) {
-      say(import_chalk26.default.dim("  (no reviewer account yet: each prompt is run at the end, in the exercise)"));
+      say(import_chalk28.default.dim("  (no reviewer account yet: each prompt is run at the end, in the exercise)"));
       return null;
     }
     const login = await headlessPasswordLogin({ mcpUrl: publishedUrl, username: acct.username, password: acct.password }, deps);
     if (!login.accessToken) {
-      say(import_chalk26.default.yellow(`  (the reviewer could not sign in at ${login.failedAt}: ${login.detail}; each prompt is run at the end, in the exercise)`));
+      say(import_chalk28.default.yellow(`  (the reviewer could not sign in at ${login.failedAt}: ${login.detail}; each prompt is run at the end, in the exercise)`));
       return null;
     }
     bearer = login.accessToken;
@@ -8503,7 +8761,7 @@ async function createPromptTester(caller, proj2, opts = {}) {
   };
 }
 function mark(o) {
-  return o === "ok" ? import_chalk26.default.green("\u2713") : o === "error" ? import_chalk26.default.yellow("!") : import_chalk26.default.red("\u2717");
+  return o === "ok" ? import_chalk28.default.green("\u2713") : o === "error" ? import_chalk28.default.yellow("!") : import_chalk28.default.red("\u2717");
 }
 function parseResultJson(text) {
   try {
@@ -8548,14 +8806,14 @@ async function runConnectorAnswers(project, opts = {}) {
       try {
         await producer(caller, { method: "PATCH", path: projectPath(proj2), body: part, summary: "Save an answer" });
       } catch (e) {
-        console.log(import_chalk26.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
+        console.log(import_chalk28.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
       }
     };
     let headed = opts.derived !== false;
     const ask3 = async (qs) => {
       if (!headed) {
         headed = true;
-        console.log(import_chalk26.default.bold("  What the portal asks that only you can answer (saved as you go):"));
+        console.log(import_chalk28.default.bold("  What the portal asks that only you can answer (saved as you go):"));
       }
       return inquirer3.prompt(qs);
     };
@@ -8610,7 +8868,7 @@ async function runConnectorAnswers(project, opts = {}) {
       const ask22 = async (qs) => {
         if (!headed2) {
           headed2 = true;
-          console.log(import_chalk26.default.bold("  What OpenAI's form asks (saved as you go):"));
+          console.log(import_chalk28.default.bold("  What OpenAI's form asks (saved as you go):"));
         }
         return inquirer4.prompt(qs);
       };
@@ -8669,7 +8927,7 @@ async function runConnectorAnswers(project, opts = {}) {
         const open = current.target?.project?.authMode === "open";
         const tools = current.target?.tools ?? [];
         const defaults = defaultNegativePrompts2({ open, tools, serverName: typeof cm.serverName === "string" ? cm.serverName : null });
-        console.log(import_chalk26.default.dim("  Three prompts the plugin must NOT act on (OpenAI asks for them; the exercise checks that no tool is called):"));
+        console.log(import_chalk28.default.dim("  Three prompts the plugin must NOT act on (OpenAI asks for them; the exercise checks that no tool is called):"));
         const negative = [];
         for (let i = 0; i < 3; i++) {
           const a = await ask22([{ type: "input", name: "value", message: `Negative prompt ${i + 1}:`, default: defaults[i].prompt }]);
@@ -8681,16 +8939,16 @@ async function runConnectorAnswers(project, opts = {}) {
       }
       const prompts = Array.isArray(cm.examplePrompts) ? cm.examplePrompts.filter((p) => typeof p === "string" && p.trim()) : [];
       if (prompts.length >= 3 && prompts.length < 5) {
-        console.log(import_chalk26.default.dim(`  OpenAI wants five positive cases; you have ${prompts.length} prompts. ${5 - prompts.length} more a reviewer can try:`));
+        console.log(import_chalk28.default.dim(`  OpenAI wants five positive cases; you have ${prompts.length} prompts. ${5 - prompts.length} more a reviewer can try:`));
         const extra = [...prompts];
         for (let i = prompts.length; i < 5; i++) {
           const a = await ask22([{ type: "input", name: "value", message: `Prompt ${i + 1} (Enter to stop here):`, validate: (v) => v.trim().length <= 128 ? true : `${v.trim().length} characters; ChatGPT allows 128` }]);
           const p = a.value.trim();
           if (!p) break;
           if (opts.testPrompt) {
-            console.log(import_chalk26.default.dim("  trying it\u2026"));
+            console.log(import_chalk28.default.dim("  trying it\u2026"));
             const res = await opts.testPrompt(p);
-            console.log(res.called ? import_chalk26.default.green(`  \u2713 called ${res.tools.join(", ")}`) : import_chalk26.default.yellow("  \u2013 no tool call; kept (the exercise will say so)"));
+            console.log(res.called ? import_chalk28.default.green(`  \u2713 called ${res.tools.join(", ")}`) : import_chalk28.default.yellow("  \u2013 no tool call; kept (the exercise will say so)"));
           }
           extra.push(p);
         }
@@ -8706,7 +8964,7 @@ async function runConnectorAnswers(project, opts = {}) {
   if (Object.keys(meta).length) body.directory_metadata = meta;
   if (!Object.keys(body).length) {
     if (json) process.stdout.write(JSON.stringify({ project: proj2.projectId, changed: [] }) + "\n");
-    else if (opts.derived !== false) console.log(import_chalk26.default.dim("  Nothing to record: pass flags (--use-cases, --data-handling \u2026) or run interactively."));
+    else if (opts.derived !== false) console.log(import_chalk28.default.dim("  Nothing to record: pass flags (--use-cases, --data-handling \u2026) or run interactively."));
     return;
   }
   await producer(caller, { method: "PATCH", path: projectPath(proj2), body, summary: "Store the portal answers" });
@@ -8715,15 +8973,15 @@ async function runConnectorAnswers(project, opts = {}) {
     process.stdout.write(JSON.stringify({ project: proj2.projectId, changed: Object.keys({ ...answers, ...meta }), headline: r.rendered.headline, report: r.report }) + "\n");
     return;
   }
-  console.log(import_chalk26.default.green(`  \u2713 recorded: ${Object.keys({ ...answers, ...meta }).join(", ")}`));
-  if (opts.derived !== false) console.log(import_chalk26.default.dim(`  ${summaryOf(r) ?? r.rendered.headline}${summaryOf(r) ? ` \xB7 ${pageLinkOf(r, proj2)}` : ""}`));
-  else console.log(import_chalk26.default.dim(`  ${r.rendered.headline}`));
+  console.log(import_chalk28.default.green(`  \u2713 recorded: ${Object.keys({ ...answers, ...meta }).join(", ")}`));
+  if (opts.derived !== false) console.log(import_chalk28.default.dim(`  ${summaryOf(r) ?? r.rendered.headline}${summaryOf(r) ? ` \xB7 ${pageLinkOf(r, proj2)}` : ""}`));
+  else console.log(import_chalk28.default.dim(`  ${r.rendered.headline}`));
 }
-var import_chalk26, import_fs5, import_os2, import_path4, import_child_process5, DASHBOARD_BASE8, RUN_META_KEY, RUN_HEADER, projectPath, openRuns, QUESTIONS;
+var import_chalk28, import_fs5, import_os2, import_path4, import_child_process5, DASHBOARD_BASE8, RUN_META_KEY, RUN_HEADER, projectPath, openRuns, QUESTIONS;
 var init_connector_exercise = __esm({
   "src/commands/connector-exercise.ts"() {
     "use strict";
-    import_chalk26 = __toESM(require("chalk"));
+    import_chalk28 = __toESM(require("chalk"));
     import_fs5 = __toESM(require("fs"));
     import_os2 = __toESM(require("os"));
     import_path4 = __toESM(require("path"));
@@ -8907,8 +9165,8 @@ async function runConnectorDocs(project, opts = {}) {
     how = `from ${opts.from}`;
   } else if (opts.promptOut) {
     import_fs6.default.writeFileSync(opts.promptOut, prompt + "\n", { mode: 384 });
-    say(import_chalk27.default.green(`  \u2713 prompt written to ${opts.promptOut}`));
-    say(import_chalk27.default.dim(`  Run it through a model that answers JSON matching the schema, save the answer, then: ${B.cli} connector docs ${proj2.projectName} --from <answer.json>`));
+    say(import_chalk29.default.green(`  \u2713 prompt written to ${opts.promptOut}`));
+    say(import_chalk29.default.dim(`  Run it through a model that answers JSON matching the schema, save the answer, then: ${B.cli} connector docs ${proj2.projectName} --from <answer.json>`));
     return;
   } else {
     const installed3 = deps.claudeInstalled ?? detectExternalClis().some((c) => c.kind === "claude");
@@ -8917,7 +9175,7 @@ async function runConnectorDocs(project, opts = {}) {
       import_fs6.default.writeFileSync(file2, prompt + "\n", { mode: 384 });
       throw new Error(`Claude Code is not installed here, so the documents were not generated. The prompt is at ${file2}: run it through any model that answers JSON, then \`${B.cli} connector docs ${proj2.projectName} --from <answer.json>\`; or write them on the dashboard page.`);
     }
-    say(import_chalk27.default.dim("  generating the three documents on Claude Code (30\u201390 s)\u2026"));
+    say(import_chalk29.default.dim("  generating the three documents on Claude Code (30\u201390 s)\u2026"));
     const g = generateWithClaude(prompt, deps);
     if (!g.docs) throw new Error(`${g.detail}. Run again, or \`${B.cli} connector docs ${proj2.projectName} --prompt-out prompt.txt\` to use another model.`);
     docs = g.docs;
@@ -8928,8 +9186,8 @@ async function runConnectorDocs(project, opts = {}) {
     process.stdout.write(JSON.stringify({ project: proj2.projectId, changed, docs_url: fr.generated_docs_url, how }) + "\n");
     return;
   }
-  console.log(import_chalk27.default.green(`  \u2713 documents stored (${how}): ${changed.join(", ")}`));
-  console.log(`  Documentation page: ${import_chalk27.default.cyan(fr.generated_docs_url)} \u2014 link it from your site; edit it on the dashboard any time.`);
+  console.log(import_chalk29.default.green(`  \u2713 documents stored (${how}): ${changed.join(", ")}`));
+  console.log(`  Documentation page: ${import_chalk29.default.cyan(fr.generated_docs_url)} \u2014 link it from your site; edit it on the dashboard any time.`);
   await printProgressTrailer(caller, proj2);
 }
 async function askDocsQuestion(caller, proj2, state, interactive2, say, deps = {}) {
@@ -8938,29 +9196,29 @@ async function askDocsQuestion(caller, proj2, state, interactive2, say, deps = {
   const a = await inquirer3.prompt([{ type: "input", name: "value", message: `Documentation for this connector on your site? Paste the URL, or N to use the generated page at ${state.generatedDocsUrl} (and link it from your site):`, default: state.docsUrl ?? "N" }]);
   const v = a.value.trim();
   if (!v || /^n(o)?$/i.test(v)) {
-    say(import_chalk27.default.dim("  using the generated page"));
+    say(import_chalk29.default.dim("  using the generated page"));
     try {
       await runConnectorDocs(proj2.projectId, { deps, yes: true, team: proj2.teamId });
     } catch (e) {
-      say(import_chalk27.default.yellow(`  ${e instanceof Error ? e.message : String(e)}`));
+      say(import_chalk29.default.yellow(`  ${e instanceof Error ? e.message : String(e)}`));
       await producer(caller, { method: "PUT", path: `${projectPath2(proj2)}/directory-documents`, body: { use_generated_docs_url: true }, summary: "Point docs at the generated page" });
     }
     return true;
   }
   const check = await verifyDocsUrl(v, state.serverName, deps.fetch);
   if (!check.ok) {
-    say(import_chalk27.default.yellow(`  ${v} is not usable as documentation yet: ${check.reason}. Not stored.`));
+    say(import_chalk29.default.yellow(`  ${v} is not usable as documentation yet: ${check.reason}. Not stored.`));
     return false;
   }
   await producer(caller, { method: "PATCH", path: projectPath2(proj2), body: { directory_metadata: { docs_url: v, docs_confirmed: true } }, summary: "Store the documentation URL" });
-  say(import_chalk27.default.green(`  \u2713 docs: ${v} (live, names ${state.serverName ?? "the server"})`));
+  say(import_chalk29.default.green(`  \u2713 docs: ${v} (live, names ${state.serverName ?? "the server"})`));
   return true;
 }
-var import_chalk27, import_fs6, import_os3, import_path5, import_child_process6, projectPath2;
+var import_chalk29, import_fs6, import_os3, import_path5, import_child_process6, projectPath2;
 var init_connector_docs = __esm({
   "src/commands/connector-docs.ts"() {
     "use strict";
-    import_chalk27 = __toESM(require("chalk"));
+    import_chalk29 = __toESM(require("chalk"));
     init_directory();
     import_fs6 = __toESM(require("fs"));
     import_os3 = __toESM(require("os"));
@@ -9036,24 +9294,24 @@ var init_plugin_package = __esm({
 // src/lib/agent-chat.ts
 async function runAgentChatRepl(opts) {
   const { title, subtitle, endpoint, buildBody, seedPrompt, summarizeProposal, commands } = opts;
-  console.log("\n" + import_chalk28.default.cyan.bold(title));
-  if (subtitle) console.log(import_chalk28.default.dim(subtitle));
+  console.log("\n" + import_chalk30.default.cyan.bold(title));
+  if (subtitle) console.log(import_chalk30.default.dim(subtitle));
   const messages = [];
   const ctx = { proposal: null, lastData: null, log: (s) => console.log(s) };
   const cmdByName = new Map(commands.map((c) => [c.name, c]));
   const footer = () => {
     const parts = [
-      import_chalk28.default.dim("type to chat/refine"),
-      ...commands.map((c) => import_chalk28.default.dim(`/${c.name} ${c.describe}`)),
-      import_chalk28.default.dim("/show"),
-      import_chalk28.default.dim("/exit when done"),
-      import_chalk28.default.dim("/drop discard changes")
+      import_chalk30.default.dim("type to chat/refine"),
+      ...commands.map((c) => import_chalk30.default.dim(`/${c.name} ${c.describe}`)),
+      import_chalk30.default.dim("/show"),
+      import_chalk30.default.dim("/exit when done"),
+      import_chalk30.default.dim("/drop discard changes")
     ];
-    return "  " + import_chalk28.default.dim("[ ") + parts.join(import_chalk28.default.dim(" \xB7 ")) + import_chalk28.default.dim(" ]");
+    return "  " + import_chalk30.default.dim("[ ") + parts.join(import_chalk30.default.dim(" \xB7 ")) + import_chalk30.default.dim(" ]");
   };
   async function turn(content) {
     messages.push({ role: "user", content });
-    process.stdout.write(import_chalk28.default.dim("  \u2026thinking\n"));
+    process.stdout.write(import_chalk30.default.dim("  \u2026thinking\n"));
     const { status: status2, data } = await agentCall(endpoint, "POST", { messages, ...buildBody(messages) });
     if (status2 === 402 || status2 === 503 || parseProblem(data)) {
       await reportRefusal(status2, data, { cli: B.cli });
@@ -9062,7 +9320,7 @@ async function runAgentChatRepl(opts) {
       return;
     }
     if (status2 >= 400 || !data) {
-      console.log(import_chalk28.default.red(`  Error (${status2}): ${(data && data.error) ?? "request failed"}
+      console.log(import_chalk30.default.red(`  Error (${status2}): ${(data && data.error) ?? "request failed"}
 `));
       messages.pop();
       return;
@@ -9070,24 +9328,24 @@ async function runAgentChatRepl(opts) {
     ctx.lastData = data;
     const reply = data.reply ?? data.message ?? "(no reply)";
     messages.push({ role: "assistant", content: reply });
-    console.log("\n" + import_chalk28.default.cyan("agent \u203A ") + reply + "\n");
+    console.log("\n" + import_chalk30.default.cyan("agent \u203A ") + reply + "\n");
     if (data.proposal) {
       ctx.proposal = data.proposal;
       const summary = summarizeProposal?.(data);
-      if (summary) console.log(import_chalk28.default.yellow("  " + summary));
+      if (summary) console.log(import_chalk30.default.yellow("  " + summary));
       const applies = commands.filter((c) => c.needsProposal);
       const primary = applies[applies.length - 1];
       if (primary) {
-        console.log(import_chalk28.default.bold.green("  \u279C Next: type ") + import_chalk28.default.bold.cyan(`/${primary.name}`) + import_chalk28.default.bold.green(" to apply this, then ") + import_chalk28.default.bold.cyan("/exit") + import_chalk28.default.bold.green(" to leave."));
+        console.log(import_chalk30.default.bold.green("  \u279C Next: type ") + import_chalk30.default.bold.cyan(`/${primary.name}`) + import_chalk30.default.bold.green(" to apply this, then ") + import_chalk30.default.bold.cyan("/exit") + import_chalk30.default.bold.green(" to leave."));
         const rest = applies.slice(0, -1).map((c) => `/${c.name} = ${c.describe}`).join(" \xB7 ");
-        console.log(import_chalk28.default.dim(`    (or keep chatting to refine${rest ? ` \xB7 ${rest}` : ""} \xB7 /show = inspect)`));
+        console.log(import_chalk30.default.dim(`    (or keep chatting to refine${rest ? ` \xB7 ${rest}` : ""} \xB7 /show = inspect)`));
       }
       console.log();
     }
     const line = formatBilling(data.billing);
     if (line) {
       const llm = data.llm;
-      console.log(import_chalk28.default.dim(`  ${line}${llm?.model ? ` \xB7 ${llm.model}` : ""}`));
+      console.log(import_chalk30.default.dim(`  ${line}${llm?.model ? ` \xB7 ${llm.model}` : ""}`));
     }
   }
   const rl = import_readline.default.createInterface({ input: process.stdin, output: process.stdout });
@@ -9095,31 +9353,31 @@ async function runAgentChatRepl(opts) {
   await turn(seedPrompt);
   for (; ; ) {
     console.log(footer());
-    const line = (await ask3(import_chalk28.default.green("you \u203A "))).trim();
+    const line = (await ask3(import_chalk30.default.green("you \u203A "))).trim();
     if (!line) continue;
     const lower = line.toLowerCase();
     if (line === "/exit" || line === "/quit" || lower === "exit" || lower === "quit" || lower === "q") {
-      console.log(import_chalk28.default.dim("  Bye \u2014 anything you enabled or published stays in place.\n"));
+      console.log(import_chalk30.default.dim("  Bye \u2014 anything you enabled or published stays in place.\n"));
       break;
     }
     if (line === "/drop") {
-      console.log(import_chalk28.default.dim("  Dropped the pending proposal \u2014 rules you already enabled/published are untouched.\n"));
+      console.log(import_chalk30.default.dim("  Dropped the pending proposal \u2014 rules you already enabled/published are untouched.\n"));
       break;
     }
     if (line === "/show") {
-      if (!ctx.proposal) console.log(import_chalk28.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
+      if (!ctx.proposal) console.log(import_chalk30.default.dim("  No proposal yet \u2014 keep chatting until the agent proposes one.\n"));
       else console.log("\n" + JSON.stringify(ctx.proposal, null, 2) + "\n");
       continue;
     }
     if (line.startsWith("/")) {
       const cmd = cmdByName.get(line.slice(1));
       if (!cmd) {
-        console.log(import_chalk28.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
+        console.log(import_chalk30.default.red(`  Unknown command "${line}". Try one of: ${commands.map((c) => "/" + c.name).join(", ")}, /show, /drop
 `));
         continue;
       }
       if (cmd.needsProposal && !ctx.proposal) {
-        console.log(import_chalk28.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
+        console.log(import_chalk30.default.yellow("  No proposal yet \u2014 keep chatting until the agent generates one, then try again.\n"));
         continue;
       }
       await cmd.run(ctx);
@@ -9129,12 +9387,12 @@ async function runAgentChatRepl(opts) {
   }
   rl.close();
 }
-var import_readline, import_chalk28;
+var import_readline, import_chalk30;
 var init_agent_chat = __esm({
   "src/lib/agent-chat.ts"() {
     "use strict";
     import_readline = __toESM(require("readline"));
-    import_chalk28 = __toESM(require("chalk"));
+    import_chalk30 = __toESM(require("chalk"));
     init_problem();
     init_brand();
     init_api();
@@ -9190,11 +9448,11 @@ async function runMcp(projectArg, apiVersionArg, opts) {
     const spec = ctx.proposal;
     const pub = await agentCall(`/projects/${projectId}/${apiVersion}/mcp/spec`, "PUT", { environment, spec });
     if (pub.status >= 400) {
-      ctx.log(import_chalk29.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+      ctx.log(import_chalk31.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
       return;
     }
-    ctx.log(import_chalk29.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost2}.mcp.apiblaze.com/${apiVersion}/${environment}.
+    ctx.log(import_chalk31.default.green(`  \u2713 Published MCP server \u2014 ${mcpHost2}.mcp.apiblaze.com/${apiVersion}/${environment}.
 `));
   }
   await runAgentChatRepl({
@@ -9425,7 +9683,7 @@ function renderOps(cat) {
   });
   const w = Math.min(40, Math.max(4, ...rows.map((r) => r.name.length)));
   const rw = Math.min(40, Math.max(5, ...rows.map((r) => r.route.length)));
-  return rows.map((r) => `  ${r.name.padEnd(w)}  ${r.route.padEnd(rw)}  ${r.eff}${r.custom ? import_chalk29.default.yellow("  (override)") : ""}`);
+  return rows.map((r) => `  ${r.name.padEnd(w)}  ${r.route.padEnd(rw)}  ${r.eff}${r.custom ? import_chalk31.default.yellow("  (override)") : ""}`);
 }
 async function resolveMcpTarget(projectArg, opts) {
   const creds = loadCredentials();
@@ -9467,7 +9725,7 @@ async function runMcpPrompts(action, project, name, opts) {
   if (action === "list") {
     if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, prompts }, null, 2));
     if (!prompts.length) {
-      console.log(import_chalk29.default.dim(`
+      console.log(import_chalk31.default.dim(`
   No prompts on ${t.projectId} (${t.environment}). Prompts are drafted by the MCP agent (\`${B.cli} agent mcp ${t.projectId}\`) or added with \`${B.cli} mcp prompts set\`.
 `));
       return;
@@ -9475,7 +9733,7 @@ async function runMcpPrompts(action, project, name, opts) {
     console.log("");
     for (const p of prompts) {
       const args = (p.arguments ?? []).map((a) => a.required ? a.name : `${a.name}?`).join(", ");
-      console.log(`  ${import_chalk29.default.bold(p.name)}${args ? import_chalk29.default.dim(`(${args})`) : ""}${p.title || p.description ? `  ${p.title ?? p.description}` : ""}`);
+      console.log(`  ${import_chalk31.default.bold(p.name)}${args ? import_chalk31.default.dim(`(${args})`) : ""}${p.title || p.description ? `  ${p.title ?? p.description}` : ""}`);
     }
     console.log("");
     return;
@@ -9486,9 +9744,9 @@ async function runMcpPrompts(action, project, name, opts) {
     if (!p) throw new Error(`No prompt named "${name}". See \`${B.cli} mcp prompts list ${project}\`.`);
     if (opts.json) return void console.log(JSON.stringify(p, null, 2));
     console.log(`
-  ${import_chalk29.default.bold(p.name)}${p.title ? ` \u2014 ${p.title}` : ""}`);
+  ${import_chalk31.default.bold(p.name)}${p.title ? ` \u2014 ${p.title}` : ""}`);
     if (p.description) console.log(`  ${p.description}`);
-    for (const a of p.arguments ?? []) console.log(import_chalk29.default.dim(`    ${a.name}${a.required ? " (required)" : ""}${a.description ? `: ${a.description}` : ""}`));
+    for (const a of p.arguments ?? []) console.log(import_chalk31.default.dim(`    ${a.name}${a.required ? " (required)" : ""}${a.description ? `: ${a.description}` : ""}`));
     for (const m of p.messages) console.log(`
   [${m.role}] ${m.text}`);
     console.log("");
@@ -9509,7 +9767,7 @@ async function runMcpPrompts(action, project, name, opts) {
   }
   await saveCatalogue(t, next);
   if (opts.json) return void console.log(JSON.stringify({ saved: true, environment: t.environment, prompts: next.prompts }, null, 2));
-  console.log(import_chalk29.default.green(`  \u2713 ${action === "set" ? "Saved" : "Removed"} prompt "${name}" on ${t.projectId} (${t.environment}).`));
+  console.log(import_chalk31.default.green(`  \u2713 ${action === "set" ? "Saved" : "Removed"} prompt "${name}" on ${t.projectId} (${t.environment}).`));
 }
 async function runMcpOps(action, project, tool, opts) {
   const t = await resolveMcpTarget(project, opts);
@@ -9533,13 +9791,13 @@ async function runMcpOps(action, project, tool, opts) {
       });
       return void console.log(JSON.stringify({ environment: t.environment, instruction: cat.contextNote ?? null, tools, hidden: (hidden ?? []).map((c) => ({ method: c.method.toUpperCase(), path: c.path, name: c.name, group: c.group, description: c.description ?? null })) }, null, 2));
     }
-    console.log(import_chalk29.default.dim(`
+    console.log(import_chalk31.default.dim(`
   ${cat.tools.length} tool(s) on ${t.projectId} (${t.environment}). Defaults come from the HTTP method: GET/HEAD/OPTIONS read-only, PUT/DELETE idempotent, DELETE destructive + asks to confirm.
 `));
     for (const l of renderOps(cat)) console.log(l);
-    console.log(import_chalk29.default.dim(`
+    console.log(import_chalk31.default.dim(`
   Override: ${B.cli} mcp ops set ${project} <tool> --name | --description | --read-only | --destructive | --confirm | --no-confirm | --always-async   \xB7   Reset: ${B.cli} mcp ops reset ${project} <tool>`));
-    if (hidden?.length) console.log(import_chalk29.default.dim(`  ${hidden.length} operation(s) of the spec are not tools (${B.cli} mcp ops list ${project} --json shows them; ${B.cli} mcp ops show ${project} <tool> adds one).`));
+    if (hidden?.length) console.log(import_chalk31.default.dim(`  ${hidden.length} operation(s) of the spec are not tools (${B.cli} mcp ops list ${project} --json shows them; ${B.cli} mcp ops show ${project} <tool> adds one).`));
     console.log("");
     return;
   }
@@ -9548,7 +9806,7 @@ async function runMcpOps(action, project, tool, opts) {
     const next2 = withoutTool(cat, tool);
     await saveCatalogue(t, next2);
     if (opts.json) return void console.log(JSON.stringify({ saved: true, hidden: tool, tools: next2.tools.length }, null, 2));
-    console.log(import_chalk29.default.green(`  \u2713 ${tool} is no longer a tool. ${next2.tools.length} tool(s) remain; \`${B.cli} mcp ops show ${project} ${tool}\` brings it back.`));
+    console.log(import_chalk31.default.green(`  \u2713 ${tool} is no longer a tool. ${next2.tools.length} tool(s) remain; \`${B.cli} mcp ops show ${project} ${tool}\` brings it back.`));
     return;
   }
   if (action === "show") {
@@ -9562,7 +9820,7 @@ async function runMcpOps(action, project, tool, opts) {
     const next2 = withTool(cat, c);
     await saveCatalogue(t, next2);
     if (opts.json) return void console.log(JSON.stringify({ saved: true, shown: c.name, method: c.method.toUpperCase(), path: c.path, tools: next2.tools.length }, null, 2));
-    console.log(import_chalk29.default.green(`  \u2713 ${c.name} (${c.method.toUpperCase()} ${c.path}) is a tool. ${next2.tools.length} tool(s). Give it a description: \`${B.cli} mcp ops set ${project} ${c.name} --description "\u2026"\`.`));
+    console.log(import_chalk31.default.green(`  \u2713 ${c.name} (${c.method.toUpperCase()} ${c.path}) is a tool. ${next2.tools.length} tool(s). Give it a description: \`${B.cli} mcp ops set ${project} ${c.name} --description "\u2026"\`.`));
     return;
   }
   let next = cat;
@@ -9584,7 +9842,7 @@ async function runMcpOps(action, project, tool, opts) {
   const eff = effectiveBehavior(method, next.overrides?.[finalName]);
   const edited = next.tools.find((x) => x.name === finalName);
   if (opts.json) return void console.log(JSON.stringify({ saved: true, tool: finalName, ...finalName !== tool ? { renamed_from: tool } : {}, description: edited?.description ?? null, override: next.overrides?.[finalName] ?? null, effective: eff }, null, 2));
-  console.log(import_chalk29.default.green(`  \u2713 ${finalName}${finalName !== tool ? ` (was ${tool})` : ""}: ${flagsLine(eff)}${action === "reset" ? " (automatic default)" : ""}${opts.description !== void 0 ? ` \u2014 ${edited?.description}` : ""}`));
+  console.log(import_chalk31.default.green(`  \u2713 ${finalName}${finalName !== tool ? ` (was ${tool})` : ""}: ${flagsLine(eff)}${action === "reset" ? " (automatic default)" : ""}${opts.description !== void 0 ? ` \u2014 ${edited?.description}` : ""}`));
 }
 async function runMcpInstructions(action, project, text, opts) {
   const t = await resolveMcpTarget(project, opts);
@@ -9593,7 +9851,7 @@ async function runMcpInstructions(action, project, text, opts) {
     if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, instruction: cat.contextNote ?? null }, null, 2));
     console.log(cat.contextNote ? `
   ${cat.contextNote}
-` : import_chalk29.default.dim(`
+` : import_chalk31.default.dim(`
   No instruction on ${t.projectId} (${t.environment}). Set one: ${B.cli} mcp instructions set ${project} "What this MCP is for, how to start, what it will not do."
 `));
     return;
@@ -9610,7 +9868,7 @@ async function runMcpInstructions(action, project, text, opts) {
   const next = withInstruction(cat, body);
   await saveCatalogue(t, next);
   if (opts.json) return void console.log(JSON.stringify({ saved: true, environment: t.environment, instruction: next.contextNote ?? null }, null, 2));
-  console.log(import_chalk29.default.green(next.contextNote ? `  \u2713 Instruction saved (${next.contextNote.length} characters).` : "  \u2713 Instruction cleared."));
+  console.log(import_chalk31.default.green(next.contextNote ? `  \u2713 Instruction saved (${next.contextNote.length} characters).` : "  \u2713 Instruction cleared."));
 }
 async function runMcpCatalogue(project, opts) {
   const t = await resolveMcpTarget(project, opts);
@@ -9618,7 +9876,7 @@ async function runMcpCatalogue(project, opts) {
   const candidates = await loadCandidates(t).catch(() => null);
   const hidden = candidates ? hiddenCandidates(candidates, cat) : null;
   if (opts.json) return void console.log(JSON.stringify({ environment: t.environment, catalogue: cat, hidden: (hidden ?? []).map((c) => ({ method: c.method.toUpperCase(), path: c.path, name: c.name, group: c.group })) }, null, 2));
-  console.log(import_chalk29.default.dim(`
+  console.log(import_chalk31.default.dim(`
   ${t.projectId} (${t.environment}) \u2014 ${cat.tools.length} tool(s)
 `));
   for (const l of renderCatalogue(cat, { hidden })) console.log(`  ${l}`);
@@ -9631,17 +9889,17 @@ async function runMcpUi(project, tool, opts) {
   const uri = uiResourceUri(t.projectId, tool);
   if (opts.json) return void console.log(JSON.stringify({ tool, uri, kind: "automatic" }, null, 2));
   console.log(`
-  ${import_chalk29.default.bold(uri)}
+  ${import_chalk31.default.bold(uri)}
 `);
-  console.log(import_chalk29.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
-  console.log(import_chalk29.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
+  console.log(import_chalk31.default.dim("  This is the automatic viewer: MCP Apps clients render the tool's result with a generic UI built"));
+  console.log(import_chalk31.default.dim("  from its response schema \u2014 nothing to configure. Uploading your own HTML for it comes later.\n"));
 }
-var import_fs8, import_chalk29, PROMPT_NAME_RE, TOOL_NAME_RE, MAX_INSTRUCTION;
+var import_fs8, import_chalk31, PROMPT_NAME_RE, TOOL_NAME_RE, MAX_INSTRUCTION;
 var init_mcp = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
     import_fs8 = __toESM(require("fs"));
-    import_chalk29 = __toESM(require("chalk"));
+    import_chalk31 = __toESM(require("chalk"));
     init_brand();
     init_auth();
     init_api();
@@ -10257,24 +10515,24 @@ ready.then((c) => {
 
 // src/lib/log-view.ts
 function statusColor(status2) {
-  if (status2 < 300) return import_chalk31.default.green;
-  if (status2 < 400) return import_chalk31.default.blue;
-  if (status2 < 500) return import_chalk31.default.yellow;
-  return import_chalk31.default.red;
+  if (status2 < 300) return import_chalk33.default.green;
+  if (status2 < 400) return import_chalk33.default.blue;
+  if (status2 < 500) return import_chalk33.default.yellow;
+  return import_chalk33.default.red;
 }
 function methodColor(method) {
   switch ((method || "").toUpperCase()) {
     case "GET":
-      return import_chalk31.default.green;
+      return import_chalk33.default.green;
     case "POST":
-      return import_chalk31.default.blue;
+      return import_chalk33.default.blue;
     case "PUT":
     case "PATCH":
-      return import_chalk31.default.yellow;
+      return import_chalk33.default.yellow;
     case "DELETE":
-      return import_chalk31.default.red;
+      return import_chalk33.default.red;
     default:
-      return import_chalk31.default.white;
+      return import_chalk33.default.white;
   }
 }
 function clock(ts2) {
@@ -10285,12 +10543,12 @@ function routeCell(route) {
   return (r.length > ROUTE_W ? `\u2026${r.slice(-(ROUTE_W - 1))}` : r).padEnd(ROUTE_W);
 }
 function formatRow(r) {
-  const time = import_chalk31.default.dim(clock(r.ts));
+  const time = import_chalk33.default.dim(clock(r.ts));
   const method = methodColor(r.method)(String(r.method || "\u2014").padEnd(6));
   const route = routeCell(String(r.route || "\u2014"));
   const status2 = statusColor(r.status)(String(r.status ?? "\u2014").padStart(3));
-  const ms2 = import_chalk31.default.dim(`${r.duration_ms}ms`.padStart(8));
-  const step = r.error_step ? import_chalk31.default.dim(` ${r.error_step}`) : "";
+  const ms2 = import_chalk33.default.dim(`${r.duration_ms}ms`.padStart(8));
+  const step = r.error_step ? import_chalk33.default.dim(` ${r.error_step}`) : "";
   return `${time}  ${method} ${route} ${status2} ${ms2}${step}`;
 }
 function printRow(r, json) {
@@ -10344,13 +10602,13 @@ async function runTailSession(opts) {
     if (!held.length && !heldRowsDropped && !heldNotesDropped) return;
     const rows = held.filter((h) => h.kind === "row").length;
     const total = rows + heldRowsDropped;
-    if (total) console.log(import_chalk31.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
+    if (total) console.log(import_chalk33.default.dim(`\u2500\u2500\u2500 ${total} request${total === 1 ? "" : "s"} arrived while paused \u2500\u2500\u2500`));
     for (const h of held) {
       if (h.kind === "row") printRow(h.row, opts.json);
       else console.error(h.msg);
     }
     if (heldRowsDropped || heldNotesDropped) {
-      console.log(import_chalk31.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
+      console.log(import_chalk33.default.dim(`\u2500\u2500\u2500 ${heldRowsDropped} older one${heldRowsDropped === 1 ? "" : "s"} not shown (pause buffer full) \u2014 browse them with \`logs list\` \u2500\u2500\u2500`));
     }
     held.length = 0;
     heldRowsDropped = 0;
@@ -10364,7 +10622,7 @@ async function runTailSession(opts) {
       activeSocket?.close();
     } catch {
     }
-    if (!opts.json) console.log(import_chalk31.default.dim("\nStopped."));
+    if (!opts.json) console.log(import_chalk33.default.dim("\nStopped."));
     process.exit(0);
   }
   function onKeypress(_s, key) {
@@ -10392,17 +10650,17 @@ async function runTailSession(opts) {
   async function openInspector() {
     if (paused) return;
     if (recent.length === 0) {
-      console.log(import_chalk31.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
+      console.log(import_chalk33.default.dim("  nothing captured yet \u2014 waiting for a request\u2026"));
       return;
     }
     paused = true;
     unbindKeys();
     try {
       const { default: inquirer3 } = await import("inquirer");
-      console.log(import_chalk31.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
+      console.log(import_chalk33.default.dim("\n\u2500\u2500\u2500 paused \xB7 still capturing in the background \u2500\u2500\u2500"));
       for (; ; ) {
         const choices = recent.slice(-TAIL_INSPECT_CHOICES).reverse().map((r) => ({ name: formatRow(r), value: r.request_id }));
-        choices.push({ name: import_chalk31.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
+        choices.push({ name: import_chalk33.default.dim("\u2039resume tail\u203A"), value: "__resume__" });
         const { picked } = await inquirer3.prompt([{
           type: "list",
           name: "picked",
@@ -10413,12 +10671,12 @@ async function runTailSession(opts) {
         if (picked === "__resume__") break;
         const row = recent.find((r) => r.request_id === picked);
         if (row) printDetail(row, opts.detail);
-        else console.log(import_chalk31.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
+        else console.log(import_chalk33.default.dim("  that request has scrolled out of the tail buffer \u2014 find it with `logs list`.\n"));
       }
     } finally {
       paused = false;
       flushHeld();
-      console.log(import_chalk31.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
+      console.log(import_chalk33.default.dim("\u2500\u2500\u2500 resumed \u2500\u2500\u2500"));
       bindKeys();
     }
   }
@@ -10428,12 +10686,12 @@ async function runTailSession(opts) {
     if (reconnects >= MAX_RECONNECTS) {
       paused = false;
       flushHeld();
-      console.error(import_chalk31.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
+      console.error(import_chalk33.default.red(`Connection lost \u2014 giving up after repeated reconnects${lastFailure ? ` (last error: ${lastFailure})` : ""}.`));
       process.exit(1);
     }
     const delay = Math.min(1e3 * 2 ** reconnects, 15e3);
     reconnects++;
-    diag(import_chalk31.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
+    diag(import_chalk33.default.dim(`disconnected${lastFailure ? ` (${lastFailure})` : ""} \u2014 reconnecting in ${Math.round(delay / 1e3)}s\u2026`));
     setTimeout(() => {
       if (!closed) void connect();
     }, delay);
@@ -10444,7 +10702,7 @@ async function runTailSession(opts) {
       url = await opts.mintTicket();
     } catch (err) {
       if (!everConnected) {
-        console.error(import_chalk31.default.red(`Could not start tail: ${err.message}`));
+        console.error(import_chalk33.default.red(`Could not start tail: ${err.message}`));
         process.exit(1);
       }
       lastFailure = `ticket mint failed: ${err.message}`;
@@ -10457,7 +10715,7 @@ async function runTailSession(opts) {
     } catch (err) {
       lastFailure = `bad tail URL: ${err.message}`;
       if (!everConnected) {
-        console.error(import_chalk31.default.red(`Could not start tail: ${lastFailure}`));
+        console.error(import_chalk33.default.red(`Could not start tail: ${lastFailure}`));
         process.exit(1);
       }
       scheduleReconnect();
@@ -10472,9 +10730,9 @@ async function runTailSession(opts) {
       lastInbound = Date.now();
       lastFailure = "";
       if (isReconnect) {
-        diag(import_chalk31.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
+        diag(import_chalk33.default.dim("reconnected \u2014 requests during the gap were not replayed (browse them with `logs list`)."));
       } else {
-        diag(import_chalk31.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
+        diag(import_chalk33.default.dim(interactive2 ? "[Enter] inspect a request \xB7 [Ctrl+C] stop\n" : "Ctrl+C to stop."));
       }
       bindKeys();
       pingTimer = setInterval(() => {
@@ -10501,7 +10759,7 @@ async function runTailSession(opts) {
         return;
       }
       if (frame?.type === "ceiling") {
-        diag(import_chalk31.default.yellow(
+        diag(import_chalk33.default.yellow(
           `\u26A0 volume ceiling \u2014 ${Number(frame.dropped_this_hour) || 0} rows dropped this hour; errors keep streaming.`
         ));
         return;
@@ -10577,10 +10835,10 @@ async function fetchPage(fetchWindow3, params, notices) {
       return { rows, nextCursor: res.next_cursor ?? void 0 };
     }
     if (hop >= MAX_EMPTY_HOPS) {
-      console.error(import_chalk31.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
+      console.error(import_chalk33.default.yellow("\u26A0 stopped after scanning a long empty span \u2014 older rows may still exist."));
       return { rows: [], nextCursor: res.next_cursor, fuseTripped: true };
     }
-    if (hop === 0) console.error(import_chalk31.default.dim("searching older history\u2026"));
+    if (hop === 0) console.error(import_chalk33.default.dim("searching older history\u2026"));
     cursor = res.next_cursor;
   }
 }
@@ -10618,18 +10876,18 @@ async function runPlainList(opts, notices) {
     }
   }
   if (rows.length === 0) {
-    console.log(import_chalk31.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+    console.log(import_chalk33.default.dim(fuseTripped ? "Nothing found in the scanned span \u2014 older requests may still exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
     return;
   }
   const now = Date.now();
   for (const d of groupIntoDays(rows)) {
-    console.log(import_chalk31.default.bold(dayLabel(d.dayMs, now)));
+    console.log(import_chalk33.default.bold(dayLabel(d.dayMs, now)));
     for (const r of d.rows) console.log(`  ${formatRow(r)}`);
     console.log("");
   }
   const errs = rows.filter((r) => r.status >= 400).length;
   const tail = fuseTripped ? " \xB7 stopped early (long empty span) \u2014 older requests may still exist" : more ? " \xB7 showing the most recent \u2014 `--json` streams the rest" : "";
-  console.log(import_chalk31.default.dim(
+  console.log(import_chalk33.default.dim(
     `${rows.length} request${rows.length === 1 ? "" : "s"} \xB7 ${errs} error${errs === 1 ? "" : "s"}${tail}`
   ));
 }
@@ -10648,7 +10906,7 @@ async function runHistoryBrowser(opts) {
       for (const r of page.rows) console.log(JSON.stringify(r));
       any = any || page.rows.length > 0;
       if (page.fuseTripped || !page.nextCursor) {
-        if (!any && !page.fuseTripped) console.error(import_chalk31.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+        if (!any && !page.fuseTripped) console.error(import_chalk33.default.dim(opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
         return;
       }
       cursor2 = page.nextCursor;
@@ -10669,7 +10927,7 @@ async function runHistoryBrowser(opts) {
     scanRows = first.rows;
     scanCursor = first.nextCursor;
     if (scanRows.length === 0) {
-      console.log(import_chalk31.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
+      console.log(import_chalk33.default.dim(first.fuseTripped ? "Nothing found in the scanned span \u2014 older rows may exist." : opts.errorsOnly ? "No errors logged yet." : "No requests logged yet."));
       return;
     }
   }
@@ -10680,10 +10938,10 @@ async function runHistoryBrowser(opts) {
     const now2 = Date.now();
     const oldestKey = days[days.length - 1]?.key;
     const choices = days.map((d) => ({
-      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk31.default.red(`  ${d.errors} errors`) : ""}`,
+      name: `${dayLabel(d.dayMs, now2).padEnd(12)} ${String(d.rows.length).padStart(4)}${(scanCursor !== void 0 || scanFloorUnknown) && d.key === oldestKey ? "+" : ""} requests${d.errors ? import_chalk33.default.red(`  ${d.errors} errors`) : ""}`,
       value: d.key
     }));
-    if (scanCursor) choices.push({ name: import_chalk31.default.dim("\u2026 older days"), value: "__older__" });
+    if (scanCursor) choices.push({ name: import_chalk33.default.dim("\u2026 older days"), value: "__older__" });
     const { chosenDay } = await inquirer3.prompt([{
       type: "list",
       name: "chosenDay",
@@ -10703,7 +10961,7 @@ async function runHistoryBrowser(opts) {
         scanCursor = void 0;
       } else {
         scanCursor = more.nextCursor;
-        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk31.default.dim("That was everything \u2014 no older requests."));
+        if (more.rows.length === 0 && !scanCursor) console.log(import_chalk33.default.dim("That was everything \u2014 no older requests."));
       }
       continue;
     }
@@ -10725,11 +10983,11 @@ async function runHistoryBrowser(opts) {
       cursor
     }, notices);
     if (page.rows.length === 0 && pageRows.length === 0) {
-      console.log(import_chalk31.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
+      console.log(import_chalk33.default.dim(page.fuseTripped ? "Stopped scanning this day (long empty span) \u2014 older rows in it may exist." : "No requests for this day."));
       return;
     }
     if (page.rows.length === 0) {
-      console.log(import_chalk31.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
+      console.log(import_chalk33.default.dim(page.fuseTripped ? "Stopped scanning further into this day (long empty span) \u2014 older rows in it may exist." : "That was everything for this day."));
       moreCursor = void 0;
     } else {
       pageRows = page.rows;
@@ -10740,8 +10998,8 @@ async function runHistoryBrowser(opts) {
       name: formatRow(r),
       value: r.request_id
     }));
-    if (moreCursor) choices.push({ name: import_chalk31.default.dim("\u2026 load more"), value: "__more__" });
-    choices.push({ name: import_chalk31.default.dim("quit"), value: "__quit__" });
+    if (moreCursor) choices.push({ name: import_chalk33.default.dim("\u2026 load more"), value: "__more__" });
+    choices.push({ name: import_chalk33.default.dim("quit"), value: "__quit__" });
     for (; ; ) {
       const { picked } = await inquirer3.prompt([{
         type: "list",
@@ -10776,19 +11034,19 @@ function wrapCells(items, width) {
 ${PANE_INDENT}`);
 }
 function renderHeaders(h) {
-  if (!h) return import_chalk31.default.dim("\u2014");
+  if (!h) return import_chalk33.default.dim("\u2014");
   const width = process.stdout.columns || 100;
   if (h.values) {
     const e = Object.entries(h.values);
-    if (!e.length) return import_chalk31.default.dim("none");
+    if (!e.length) return import_chalk33.default.dim("none");
     const rank = (k) => {
       const i = HEADER_PRIORITY.indexOf(k.toLowerCase());
       return i === -1 ? NOISE_HEADER.test(k) ? 999 : 500 : i;
     };
-    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk31.default.dim(k + ":")} ${v}`).join(`
+    return e.sort((a, b) => rank(a[0]) - rank(b[0])).map(([k, v]) => `${import_chalk33.default.dim(k + ":")} ${v}`).join(`
 ${PANE_INDENT}`);
   }
-  if (!h.names?.length) return import_chalk31.default.dim("none");
+  if (!h.names?.length) return import_chalk33.default.dim("none");
   const names = [...h.names];
   const noise = names.filter((n) => NOISE_HEADER.test(n));
   const shown = names.filter((n) => !NOISE_HEADER.test(n)).sort((a, b) => {
@@ -10796,77 +11054,77 @@ ${PANE_INDENT}`);
     const ib = HEADER_PRIORITY.indexOf(b.toLowerCase());
     return (ia === -1 ? 500 : ia) - (ib === -1 ? 500 : ib) || a.localeCompare(b);
   });
-  const body = shown.length ? wrapCells(shown, width) : import_chalk31.default.dim("(all forwarding headers)");
+  const body = shown.length ? wrapCells(shown, width) : import_chalk33.default.dim("(all forwarding headers)");
   const tail = noise.length ? `
-${PANE_INDENT}${import_chalk31.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
-  return `${body}${tail}  ${import_chalk31.default.dim("(names only)")}`;
+${PANE_INDENT}${import_chalk33.default.dim(`+ ${noise.length} forwarding/client-hint header${noise.length === 1 ? "" : "s"} (cf-*, sec-*)`)}` : "";
+  return `${body}${tail}  ${import_chalk33.default.dim("(names only)")}`;
 }
 function renderBody(b) {
-  if (!b) return import_chalk31.default.dim("\u2014");
+  if (!b) return import_chalk33.default.dim("\u2014");
   const meta = [b.content_type, b.size != null ? `${b.size}B` : null, b.truncated ? "truncated" : null].filter(Boolean).join(" \xB7 ");
-  if (b.not_captured) return import_chalk31.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
+  if (b.not_captured) return import_chalk33.default.dim(`not captured (${b.not_captured})${meta ? " \xB7 " + meta : ""}`);
   const isShape = b.value === void 0 && b.shape !== void 0;
   const content = b.value !== void 0 ? b.value : b.shape;
   if (content === null || content === void 0 || content === "" || content === "empty") {
-    return import_chalk31.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
+    return import_chalk33.default.dim(`empty${meta ? " \xB7 " + meta : ""}`);
   }
   const text = typeof content === "string" ? content : JSON.stringify(content, null, 2);
-  const head = isShape ? import_chalk31.default.dim("shape only (values not captured)\n      ") : "";
+  const head = isShape ? import_chalk33.default.dim("shape only (values not captured)\n      ") : "";
   return head + text.split("\n").join("\n      ");
 }
 function pane(title, tone, view, empty) {
   console.log(`  ${tone(title)}`);
   if (empty !== void 0) {
-    console.log(`    ${import_chalk31.default.dim(empty)}`);
+    console.log(`    ${import_chalk33.default.dim(empty)}`);
     return;
   }
   const v = view ?? {};
-  if (v.url) console.log(`    ${import_chalk31.default.dim("target")}   ${v.url}`);
+  if (v.url) console.log(`    ${import_chalk33.default.dim("target")}   ${v.url}`);
   if (v.status != null) {
-    console.log(`    ${import_chalk31.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk31.default.dim(" " + v.status_text) : ""}`);
+    console.log(`    ${import_chalk33.default.dim("status")}   ${statusColor(v.status)(String(v.status))}${v.status_text ? import_chalk33.default.dim(" " + v.status_text) : ""}`);
   }
-  if (v.raw_path) console.log(`    ${import_chalk31.default.dim("path")}     ${v.raw_path}`);
+  if (v.raw_path) console.log(`    ${import_chalk33.default.dim("path")}     ${v.raw_path}`);
   if (v.query && Object.keys(v.query).length) {
-    console.log(`    ${import_chalk31.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
+    console.log(`    ${import_chalk33.default.dim("query")}    ${Object.entries(v.query).map(([k, q]) => `${k}=${q}`).join("  ")}`);
   }
-  if (v.jwt !== void 0) console.log(`    ${import_chalk31.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
-  console.log(`    ${import_chalk31.default.dim("headers")}  ${renderHeaders(v.headers)}`);
-  console.log(`    ${import_chalk31.default.dim("body")}     ${renderBody(v.body)}`);
+  if (v.jwt !== void 0) console.log(`    ${import_chalk33.default.dim("jwt")}      ${JSON.stringify(v.jwt)}`);
+  console.log(`    ${import_chalk33.default.dim("headers")}  ${renderHeaders(v.headers)}`);
+  console.log(`    ${import_chalk33.default.dim("body")}     ${renderBody(v.body)}`);
 }
 function printDetail(r, mode = "producer") {
   const v = r.views;
   console.log("");
-  console.log(import_chalk31.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk31.default.dim(`  ${r.duration_ms}ms`));
+  console.log(import_chalk33.default.bold(`${r.method} ${r.route}`) + "  " + statusColor(r.status)(String(r.status)) + import_chalk33.default.dim(`  ${r.duration_ms}ms`));
   const cost = typeof r.cost_cents === "number" && r.cost_cents > 0 ? ` \xB7 ${r.cost_cents}\xA2` : "";
-  console.log(import_chalk31.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
+  console.log(import_chalk33.default.dim(`  request_id ${r.request_id}${r.environment ? ` \xB7 env ${r.environment}` : ""}${r.consumer_id ? ` \xB7 consumer ${r.consumer_id}` : ""}${cost}`));
   console.log("");
   if (!v) {
-    console.log(import_chalk31.default.dim("  No view detail captured for this request.\n"));
+    console.log(import_chalk33.default.dim("  No view detail captured for this request.\n"));
     return;
   }
-  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk31.default.cyan, v.request);
+  pane("Request (before) \u2014 client \u2192 APIblaze", import_chalk33.default.cyan, v.request);
   if (mode === "producer") {
     pane(
       "Request (after) \u2014 APIblaze \u2192 upstream",
-      import_chalk31.default.cyan,
+      import_chalk33.default.cyan,
       v.forwarded_request,
       v.forwarded_request ? void 0 : "Request did not reach an upstream."
     );
     pane(
       "Response (before) \u2014 upstream \u2192 APIblaze",
-      import_chalk31.default.magenta,
+      import_chalk33.default.magenta,
       v.upstream_response,
       v.upstream_response ? void 0 : "No upstream response."
     );
   }
-  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk31.default.magenta, v.response);
+  pane("Response (after) \u2014 APIblaze \u2192 client", import_chalk33.default.magenta, v.response);
   console.log("");
 }
-var import_chalk31, readline2, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
+var import_chalk33, readline2, ROUTE_W, WindowNotices, MAX_RECONNECTS, PING_MS, LIVENESS_MS, STABLE_MS, SEEN_CAP, TAIL_INSPECT_BUFFER, TAIL_INSPECT_CHOICES, SCAN_LIMIT, PAGE_LIMIT2, JSON_PAGE_LIMIT, MAX_EMPTY_HOPS, epipeGuarded, PLAIN_MAX_ROWS, NOISE_HEADER, HEADER_PRIORITY, PANE_INDENT;
 var init_log_view = __esm({
   "src/lib/log-view.ts"() {
     "use strict";
-    import_chalk31 = __toESM(require("chalk"));
+    import_chalk33 = __toESM(require("chalk"));
     readline2 = __toESM(require("readline"));
     ROUTE_W = 34;
     WindowNotices = class {
@@ -10878,15 +11136,15 @@ var init_log_view = __esm({
       note(res) {
         if (res.history_unavailable && !this.saidUnavailable) {
           this.saidUnavailable = true;
-          console.error(import_chalk31.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
+          console.error(import_chalk33.default.yellow("\u26A0 log history is unreachable right now \u2014 showing the live buffer only, older requests exist but cannot be read."));
         }
         if ((res.history_markers?.length ?? 0) > 0 && !this.saidGap) {
           this.saidGap = true;
-          console.error(import_chalk31.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
+          console.error(import_chalk33.default.yellow("\u26A0 this range includes a volume-ceiling gap \u2014 some rows were dropped at intake and are gone; counts are incomplete."));
         }
         if ((res.dropped_this_hour ?? 0) > 0 && !this.saidDropped) {
           this.saidDropped = true;
-          console.error(import_chalk31.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
+          console.error(import_chalk33.default.yellow(`\u26A0 volume ceiling \u2014 ${res.dropped_this_hour} rows dropped this hour; errors keep logging.`));
         }
       }
     };
@@ -10973,7 +11231,7 @@ async function resolve(projectArg, versionArg, opts) {
   return { projectId, projectName: match.projectName, version: version2, tenant };
 }
 function otherPlaneHint() {
-  if (loadConsumer()) console.log(import_chalk32.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
+  if (loadConsumer()) console.log(import_chalk34.default.dim("  \u2039consumer view: apiblaze consumer logs\u203A"));
 }
 function fetchWindow(projectId, version2, tenant) {
   return (params) => {
@@ -10992,8 +11250,8 @@ function fetchWindow(projectId, version2, tenant) {
 async function runLogsTail(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk32.default.bold("API Producer logs") + import_chalk32.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk32.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk34.default.bold("API Producer logs") + import_chalk34.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk34.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
   }
   await runTailSession({
@@ -11014,8 +11272,8 @@ async function runLogsTail(projectArg, versionArg, opts) {
 async function runLogsList(projectArg, versionArg, opts) {
   const { projectId, projectName, version: version2, tenant } = await resolve(projectArg, versionArg, opts);
   if (!opts.json) {
-    console.log(import_chalk32.default.bold("API Producer logs") + import_chalk32.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk32.default.dim("every caller's requests, with cost and upstream detail"));
+    console.log(import_chalk34.default.bold("API Producer logs") + import_chalk34.default.dim(` \xB7 ${projectName}@${version2} \xB7 tenant ${tenant}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk34.default.dim("every caller's requests, with cost and upstream detail"));
     otherPlaneHint();
     console.log("");
   }
@@ -11027,11 +11285,11 @@ async function runLogsList(projectArg, versionArg, opts) {
     detail: "producer"
   });
 }
-var import_chalk32, activeCaller, viaCaller;
+var import_chalk34, activeCaller, viaCaller;
 var init_logs = __esm({
   "src/commands/logs.ts"() {
     "use strict";
-    import_chalk32 = __toESM(require("chalk"));
+    import_chalk34 = __toESM(require("chalk"));
     init_caller();
     init_auth();
     init_consumer_auth();
@@ -11312,12 +11570,12 @@ async function waitThrough(apiUrl, serverKey) {
 async function confirmStep(opts, question) {
   if (opts.yes || !interactive()) return true;
   console.log();
-  return ask(`${import_chalk33.default.bold("?")} ${question} ${import_chalk33.default.dim("(Y/n)")} `);
+  return ask(`${import_chalk35.default.bold("?")} ${question} ${import_chalk35.default.dim("(Y/n)")} `);
 }
 async function busy(text, fn, minMs = 0) {
   if (!process.stdout.isTTY) return fn();
   const t = Date.now();
-  const spinner = (0, import_ora11.default)({ text: import_chalk33.default.dim(text), indent: 3, discardStdin: false }).start();
+  const spinner = (0, import_ora13.default)({ text: import_chalk35.default.dim(text), indent: 3, discardStdin: false }).start();
   try {
     const out = await fn();
     const left = minMs - (Date.now() - t);
@@ -11350,7 +11608,7 @@ async function offerBrowserAndLogs(dir, opts) {
   console.log();
   if (await ask(`  Open ${url} in your browser? (Y/n) `)) openBrowser3(url);
   if (await ask(`  Show the requests reaching ${B.product} here, live? (Y/n) `)) {
-    console.log(import_chalk33.default.dim(`  $ ${logsCommand(env)}`));
+    console.log(import_chalk35.default.dim(`  $ ${logsCommand(env)}`));
     const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
     await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
   }
@@ -11387,7 +11645,7 @@ async function runDemo(opts = {}) {
     const e = err instanceof DemoError ? err : new DemoError(`The demo could not start (${err.message}).`, `Run again: ${LATEST} demo`);
     countRun({ event: `demo-failed-${e.why}` });
     await stopDemos().catch(() => 0);
-    console.log(`${import_chalk33.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk35.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
@@ -11398,11 +11656,11 @@ function titleCard(lines) {
     const left = Math.floor((inner - t.length) / 2);
     return " ".repeat(left) + t + " ".repeat(inner - t.length - left);
   };
-  const edge = import_chalk33.default.magenta;
+  const edge = import_chalk35.default.magenta;
   console.log();
   console.log(`  ${edge(`\u256D${"\u2500".repeat(inner)}\u256E`)}`);
   console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
-  lines.forEach((l, i) => console.log(`  ${edge("\u2502")}${i === 0 ? import_chalk33.default.bold(center(l)) : import_chalk33.default.dim(center(l))}${edge("\u2502")}`));
+  lines.forEach((l, i) => console.log(`  ${edge("\u2502")}${i === 0 ? import_chalk35.default.bold(center(l)) : import_chalk35.default.dim(center(l))}${edge("\u2502")}`));
   console.log(`  ${edge("\u2502")}${" ".repeat(inner)}${edge("\u2502")}`);
   console.log(`  ${edge(`\u2570${"\u2500".repeat(inner)}\u256F`)}`);
 }
@@ -11422,15 +11680,15 @@ function printTable(rows) {
     if (line) out.push(line);
     return out;
   };
-  const head = (l, r) => console.log(`   ${import_chalk33.default.dim(l.padEnd(leftW))}  ${import_chalk33.default.dim(r)}`);
+  const head = (l, r) => console.log(`   ${import_chalk35.default.dim(l.padEnd(leftW))}  ${import_chalk35.default.dim(r)}`);
   head(`What ${B.product} set up`, "The command that does this");
   head("\u2500".repeat(leftW), "\u2500".repeat(Math.min(rightW, 60)));
   for (const r of rows) {
-    const left = `${import_chalk33.default.green("\u2713")} ${import_chalk33.default.bold(r.label.padEnd(17))} ${r.what}`;
+    const left = `${import_chalk35.default.green("\u2713")} ${import_chalk35.default.bold(r.label.padEnd(17))} ${r.what}`;
     const leftPlain = `\u2713 ${r.label.padEnd(17)} ${r.what}`;
     const right = r.cmds.length ? r.cmds.flatMap(wrap2) : ["\u2014"];
-    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk33.default.cyan(right[0])}`);
-    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk33.default.cyan(extra)}`);
+    console.log(`   ${left}${" ".repeat(Math.max(0, leftW - leftPlain.length))}  ${import_chalk35.default.cyan(right[0])}`);
+    for (const extra of right.slice(1)) console.log(`   ${" ".repeat(leftW)}  ${import_chalk35.default.cyan(extra)}`);
   }
 }
 async function startDemo(opts) {
@@ -11439,8 +11697,8 @@ async function startDemo(opts) {
   const dir = import_fs11.default.existsSync(import_path9.default.join(here, STATE_DIR, "state.json")) ? here : import_path9.default.resolve(here, DIR_NAME);
   const rel = import_path9.default.relative(here, dir) || ".";
   const cdDir = rel === "." ? "" : `cd ${rel} && `;
-  const shell = (c, note = "") => console.log(`   ${import_chalk33.default.dim("$")} ${import_chalk33.default.cyan(c)}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
-  const ok = (text, note = "") => console.log(`   ${import_chalk33.default.green("\u2713")} ${text}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
+  const shell = (c, note = "") => console.log(`   ${import_chalk35.default.dim("$")} ${import_chalk35.default.cyan(c)}${note ? `   ${import_chalk35.default.dim(note)}` : ""}`);
+  const ok = (text, note = "") => console.log(`   ${import_chalk35.default.green("\u2713")} ${text}${note ? `   ${import_chalk35.default.dim(note)}` : ""}`);
   const stopHere = (step, lines) => {
     console.log();
     for (const l of lines) console.log(`  ${l}`);
@@ -11466,14 +11724,14 @@ paths:`));
   const L = (c) => `${LATEST} ${c}`;
   writeEnv(dir, { BACKEND_SECRET: backendSecret, DEMO_NINO_TENANT: ninoTenant, APP_PORT: appPort, BACKEND_PORT: backendPort2, DIRECT_PORT: directPort });
   console.log();
-  console.log(import_chalk33.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk33.default.dim(`   (no ${B.product} yet)`));
+  console.log(import_chalk35.default.bold("1. The app: ResiResi, a table booking app for Tenants (Nino and Gino Pizzas) to allow end-users to book tables in their restaurants") + import_chalk35.default.dim(`   (no ${B.product} yet)`));
   console.log(`   Written to ${rel}. Its routes, from openapi.yaml:`);
-  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk33.default.dim(r.summary)}`);
-  console.log(import_chalk33.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
+  for (const r of routesOf(openapi)) console.log(`     ${r.method.padEnd(7)}${r.path.padEnd(21)}${import_chalk35.default.dim(r.summary)}`);
+  console.log(import_chalk35.default.dim("   No login, no API keys, no permission checks in its code. It only checks one shared backend secret (in .env.local)."));
   if (!await confirmStep(opts, `Ok to serve the backend on localhost:${backendPort2}?`)) {
     return stopHere("backend", [
       `Stopped before starting anything. ResiResi is written to ${rel}.`,
-      `Start it any time: ${cdDir}npm run start  ${import_chalk33.default.dim("\xB7")}  or run the whole demo again: ${LATEST} demo`
+      `Start it any time: ${cdDir}npm run start  ${import_chalk35.default.dim("\xB7")}  or run the whole demo again: ${LATEST} demo`
     ]);
   }
   shell(`${cdDir}npm run start`, "npm run stop \xB7 npm run restart");
@@ -11481,23 +11739,23 @@ paths:`));
   registerDemo(dir);
   const appUp = await busy("Starting the reservation backend and its front-end\u2026", () => waitPorts([backendPort2, directPort]), 1800);
   if (!appUp) throw new DemoError(`The ResiResi app did not start (see ${import_path9.default.join(rel, STATE_DIR, "app.log")}).`, `Run again: ${LATEST} demo`, "app-not-up");
-  ok(`${import_chalk33.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
-  ok(`${import_chalk33.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk33.default.bold(`http://localhost:${directPort}`)}`);
+  ok(`${import_chalk35.default.bold("Reservation backend")}: localhost:${backendPort2}`, "unprotected");
+  ok(`${import_chalk35.default.bold("Unprotected reservation front-end")}, going directly to the reservation backend: ${import_chalk35.default.bold(`http://localhost:${directPort}`)}`);
   console.log("   Book a table directly, the way the unprotected front-end does:");
-  console.log(import_chalk33.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
-  console.log(import_chalk33.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path9.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
-  console.log(import_chalk33.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
+  console.log(import_chalk35.default.cyan(`     curl -X POST http://localhost:${backendPort2}/reservations \\`));
+  console.log(import_chalk35.default.cyan(`       -H "x-target-api-key: $(grep BACKEND_SECRET ${import_path9.default.join(rel, ".env.local")} | cut -d= -f2)" \\`));
+  console.log(import_chalk35.default.cyan(`       -H "x-abz-user-id: ana" -H "x-abz-tenant-id: ${ninoTenant}" \\`));
   const tomorrow = new Date(Date.now() + 864e5);
   const day = `${tomorrow.getFullYear()}-${String(tomorrow.getMonth() + 1).padStart(2, "0")}-${String(tomorrow.getDate()).padStart(2, "0")}`;
-  console.log(import_chalk33.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
+  console.log(import_chalk35.default.cyan(`       -H "content-type: application/json" -d '{"date":"${day}","time":"19:30","guests":2}'`));
   if (!await confirmStep(opts, `Ok to put an ${B.product} proxy and MCP in front of the reservation backend?`)) {
     return stopHere("proxy", [
-      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk33.default.dim(`(${cdDir}npm run stop stops it)`)}`,
+      `Stopped before ${B.product}. ResiResi keeps running on this laptop: http://localhost:${directPort}  ${import_chalk35.default.dim(`(${cdDir}npm run stop stops it)`)}`,
       `Run the whole demo again any time: ${LATEST} demo`
     ]);
   }
   console.log();
-  console.log(import_chalk33.default.bold(`2. ${B.product}, in front of it`));
+  console.log(import_chalk35.default.bold(`2. ${B.product}, in front of it`));
   const tCreate = Date.now();
   const setup = await busy(`Creating the proxy, its tenants, admins, rules and limits\u2026`, async () => {
     const r = await createProxy2(name, backendPort2, openapi, ninoTenant);
@@ -11603,13 +11861,13 @@ paths:`));
     ]);
   }
   console.log();
-  console.log(import_chalk33.default.bold("3. Live on the internet"));
+  console.log(import_chalk35.default.bold("3. Live on the internet"));
   shell(`${LATEST} dev --port ${backendPort2} --project ${project} --auto`, "the tunnel, in the background");
   await busy(`Opening the tunnel to localhost:${backendPort2} and checking it with a real call\u2026`, async () => {
     await spawnTunnel(dir, state);
     await waitThrough(apiUrl, serverKey);
   }, 1200);
-  ok(`${import_chalk33.default.bold("Tunnel")}: the public address reaches localhost:${backendPort2} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
+  ok(`${import_chalk35.default.bold("Tunnel")}: the public address reaches localhost:${backendPort2} on this laptop`, `checked with a real call \xB7 ${Math.round((Date.now() - t0) / 1e3)} s so far`);
   printAddresses(dir);
   if (!await confirmStep(opts, "Ok to launch the protected website, which will use the proxy to reach the backend?")) {
     return stopHere("website", [
@@ -11618,7 +11876,7 @@ paths:`));
     ]);
   }
   console.log();
-  console.log(import_chalk33.default.bold(`4. The protected website, through ${B.product}`));
+  console.log(import_chalk35.default.bold(`4. The protected website, through ${B.product}`));
   shell(`${cdDir}npm run restart`, "picks up the keys in .env.local");
   const siteUp = await busy("Starting the protected website\u2026", async () => {
     appCtl(dir, "--stop");
@@ -11626,16 +11884,16 @@ paths:`));
     return waitPorts([appPort, directPort, backendPort2]);
   }, 1500);
   if (!siteUp) throw new DemoError(`The protected website did not start (see ${import_path9.default.join(rel, STATE_DIR, "app.log")}).`, `Try: ${cdDir}npm run restart`, "site-not-up");
-  ok(`${import_chalk33.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk33.default.bold(`http://localhost:${appPort}`)}`);
-  ok(`${import_chalk33.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
+  ok(`${import_chalk35.default.bold("Protected reservation website")}, going through the ${B.product} proxy ${apiUrl}: ${import_chalk35.default.bold(`http://localhost:${appPort}`)}`);
+  ok(`${import_chalk35.default.bold("Unprotected reservation front-end")}, still going directly to the backend: http://localhost:${directPort}`, "the switch at the top of the page goes between them");
   console.log();
-  console.log(import_chalk33.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path9.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
+  console.log(import_chalk35.default.dim(`  Logs: ${logsCommand(readEnvFile(import_path9.default.join(dir, ".env.local")))}  \xB7  Stop the tunnel: ${LATEST} demo stop  \xB7  Your own app: ${LATEST} dev --port <port>`));
   await offerBrowserAndLogs(dir, opts);
   return "demo-ready";
 }
 function printAddresses(dir) {
   const env = readEnvFile(import_path9.default.join(dir, ".env.local"));
-  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk33.default.dim(note)}` : ""}`);
+  const row = (label3, value, note = "") => console.log(`     ${label3.padEnd(11)} ${value}${note ? `   ${import_chalk35.default.dim(note)}` : ""}`);
   row("Public API", env.APIBLAZE_URL ?? "", `${B.product} tunnel \u2192 localhost:${env.BACKEND_PORT}`);
   row("MCP", env.APIBLAZE_MCP_URL ?? "", "for Claude, ChatGPT, Cursor (Nino Pizza)");
   if (env.APIBLAZE_PORTAL_URL) row("Dev portal", env.APIBLAZE_PORTAL_URL, "sign in, get a key, try the API");
@@ -11654,7 +11912,7 @@ async function runDemoStart(opts = {}) {
   const state = loadState(dir);
   const env = readEnvFile(import_path9.default.join(dir, ".env.local"));
   if (!state || !env.APIBLAZE_SERVER_KEY) {
-    console.log(`${import_chalk33.default.red("\u2717")} There is no demo here to start.`);
+    console.log(`${import_chalk35.default.red("\u2717")} There is no demo here to start.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
@@ -11664,31 +11922,31 @@ async function runDemoStart(opts = {}) {
   } catch (err) {
     const e = err instanceof DemoError ? err : new DemoError(`The tunnel could not start (${err.message}).`, `Start over: ${LATEST} demo`);
     countRun({ event: `demo-restart-failed-${e.why}` });
-    console.log(`${import_chalk33.default.red("\u2717")} ${e.message}`);
+    console.log(`${import_chalk35.default.red("\u2717")} ${e.message}`);
     console.log(`  ${e.fix}`);
     process.exit(1);
   }
   countRun({ event: "demo-restarted" });
-  console.log(`${import_chalk33.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk33.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
+  console.log(`${import_chalk35.default.green("\u2713")} Tunnel open: the public address reaches localhost:${env.BACKEND_PORT} again   ${import_chalk35.default.dim(`(${Math.round((Date.now() - t0) / 1e3)} s)`)}`);
   printAddresses(dir);
   const appUp = await fetch(`http://127.0.0.1:${env.APP_PORT}/api/config`).then(() => true).catch(() => false);
-  if (!appUp) console.log(import_chalk33.default.yellow(`   ResiResi is not running: cd ${import_path9.default.relative(process.cwd(), dir) || "."} && npm run start`));
+  if (!appUp) console.log(import_chalk35.default.yellow(`   ResiResi is not running: cd ${import_path9.default.relative(process.cwd(), dir) || "."} && npm run start`));
   await offerBrowserAndLogs(dir, opts);
 }
 async function runDemoLogs() {
   const env = readEnvFile(import_path9.default.join(demoDir(), ".env.local"));
   if (!env.APIBLAZE_NAME) {
-    console.log(`${import_chalk33.default.red("\u2717")} There is no demo here.`);
+    console.log(`${import_chalk35.default.red("\u2717")} There is no demo here.`);
     console.log(`  Make one: ${LATEST} demo`);
     process.exit(1);
   }
-  console.log(import_chalk33.default.dim(`$ ${logsCommand(env)}`));
+  console.log(import_chalk35.default.dim(`$ ${logsCommand(env)}`));
   const { runLogsTail: runLogsTail2 } = await Promise.resolve().then(() => (init_logs(), logs_exports));
   await runLogsTail2(env.APIBLAZE_NAME, void 0, { tenant: env.APIBLAZE_TENANT });
 }
 async function runDemoStop() {
   const n = await stopTunnels();
-  console.log(n ? `${import_chalk33.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
+  console.log(n ? `${import_chalk35.default.green("\u2713")} Stopped the tunnel. ResiResi still runs on this laptop (npm run stop stops it).` : "No demo tunnel is running.");
 }
 async function serveTunnel(dir) {
   const state = loadState(dir);
@@ -11746,7 +12004,7 @@ async function serveTunnel(dir) {
   await new Promise(() => {
   });
 }
-var import_fs11, import_path9, import_net2, import_child_process7, import_crypto, import_chalk33, import_ora11, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
+var import_fs11, import_path9, import_net2, import_child_process7, import_crypto, import_chalk35, import_ora13, DIR_NAME, STATE_DIR, LATEST, DEMO_RPS, DEMO_ADMIN_EMAIL, DEMO_GINO_ADMIN_EMAIL, RULE_SENTENCE, DemoError, ADJ, NOUN, pick2, registryFile, alive, interactive, logsCommand;
 var init_demo = __esm({
   "src/commands/demo.ts"() {
     "use strict";
@@ -11755,8 +12013,8 @@ var init_demo = __esm({
     import_net2 = __toESM(require("net"));
     import_child_process7 = require("child_process");
     import_crypto = __toESM(require("crypto"));
-    import_chalk33 = __toESM(require("chalk"));
-    import_ora11 = __toESM(require("ora"));
+    import_chalk35 = __toESM(require("chalk"));
+    import_ora13 = __toESM(require("ora"));
     init_api();
     init_tunnel_client();
     init_auth();
@@ -12849,8 +13107,8 @@ Not ready: ${lines.length} blocker${lines.length === 1 ? "" : "s"} (${r.rendered
 // src/commands/connector.ts
 var import_fs9 = __toESM(require("fs"));
 var import_path7 = __toESM(require("path"));
-var import_chalk30 = __toESM(require("chalk"));
-var import_ora10 = __toESM(require("ora"));
+var import_chalk32 = __toESM(require("chalk"));
+var import_ora12 = __toESM(require("ora"));
 init_caller();
 init_directory();
 init_brand();
@@ -13152,14 +13410,14 @@ async function promptForMissing(r, interactive2, defaults = { prompts: [] }, pla
         if (testPrompt) {
           let res = await testPrompt(text);
           if (!res.called) {
-            say_(import_chalk30.default.yellow(`  \u2013 No tool call for "${text}". A prompt should say what the tool does (a real URL, name or id helps).`));
+            say_(import_chalk32.default.yellow(`  \u2013 No tool call for "${text}". A prompt should say what the tool does (a real URL, name or id helps).`));
             const again = await inquirer3.prompt([{ type: "input", name: "line", message: "Reword it (Enter keeps it):", default: text, validate: withinLimit(a) }]);
             if (again.line?.trim() && again.line.trim() !== text) {
               text = again.line.trim();
               res = await testPrompt(text);
             }
           }
-          if (!res.called) say_(import_chalk30.default.yellow("  \u2013 still no tool call; kept (the report will say so)"));
+          if (!res.called) say_(import_chalk32.default.yellow("  \u2013 still no tool call; kept (the report will say so)"));
         }
         lines.push(text);
       }
@@ -13167,7 +13425,7 @@ async function promptForMissing(r, interactive2, defaults = { prompts: [] }, pla
         out.prompt = lines;
         if (save) {
           const why = await save({ prompt: lines });
-          if (why) say_(import_chalk30.default.yellow(`  not saved: ${why}`));
+          if (why) say_(import_chalk32.default.yellow(`  not saved: ${why}`));
         }
       }
       continue;
@@ -13190,7 +13448,7 @@ async function promptForMissing(r, interactive2, defaults = { prompts: [] }, pla
       if (save) {
         const why = await save({ [a.key]: value.trim() });
         if (why) {
-          say_(import_chalk30.default.yellow(`  not saved: ${why}`));
+          say_(import_chalk32.default.yellow(`  not saved: ${why}`));
           delete out[a.key];
         }
       }
@@ -13223,7 +13481,7 @@ async function askOpenMode(caller, proj2, r, opts, interactive2, say) {
   const { open } = await inquirer3.prompt([{ type: "confirm", name: "open", message: OPEN_MODE_QUESTION, default: false }]);
   if (!open) return false;
   await patchProject(caller, proj2, { directory_metadata: { auth_mode: "open" } }, "Open mode: no sign-in on the connector");
-  say(import_chalk30.default.green("  \u2713 open mode: the connector takes no sign-in (public data); no reviewer account is needed."));
+  say(import_chalk32.default.green("  \u2713 open mode: the connector takes no sign-in (public data); no reviewer account is needed."));
   return true;
 }
 async function promptListingBasics(r, interactive2, defaults, given, platforms = PLATFORMS, save) {
@@ -13251,7 +13509,7 @@ async function promptListingBasics(r, interactive2, defaults, given, platforms =
       if (save) {
         const why = await save({ [w.key]: value.trim() });
         if (why) {
-          say_(import_chalk30.default.yellow(`  not saved: ${why}`));
+          say_(import_chalk32.default.yellow(`  not saved: ${why}`));
           delete out[w.key];
         }
       }
@@ -13262,7 +13520,7 @@ async function promptListingBasics(r, interactive2, defaults, given, platforms =
 async function createFromSpec(spec, opts, say) {
   const { runCreate: runCreate2 } = await Promise.resolve().then(() => (init_create(), create_exports));
   let created = null;
-  say(import_chalk30.default.bold(`Creating a directory-ready ${B.thingShort} from ${spec}\u2026`));
+  say(import_chalk32.default.bold(`Creating a directory-ready ${B.thingShort} from ${spec}\u2026`));
   await runCreate2({
     openapi: spec,
     directoryReady: true,
@@ -13334,20 +13592,20 @@ async function ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, s
       }
     }
     if (!hostname2) throw new Error("A custom MCP hostname is required for the directories (--domain mcp.<your domain>).");
-    const sp2 = opts.json ? null : (0, import_ora10.default)(`Registering ${hostname2}\u2026`).start();
+    const sp2 = opts.json ? null : (0, import_ora12.default)(`Registering ${hostname2}\u2026`).start();
     row = await producer(caller, { method: "POST", path: base2, body: { hostname: hostname2, api_version: proj2.apiVersion, kind: "mcp" }, summary: `Add custom MCP domain ${hostname2}` });
     sp2?.succeed(`Registered ${row.hostname ?? hostname2} as the MCP server's domain.`);
   }
   const hostname = row.hostname ?? opts.domain ?? "";
   if (row.status === "active") return { active: true, hostname, id: row.id };
   say("");
-  say(import_chalk30.default.bold("  Add this DNS record at your DNS provider (one record; nothing else to add):"));
-  say(`  ${import_chalk30.default.cyan("CNAME")}  ${row.cnameRecord?.name ?? hostname}  \u2192  ${row.cnameRecord?.value ?? "proxy.abz.run"}`);
-  if (row.dcv) say(`  ${import_chalk30.default.cyan("TXT")}    ${row.dcv.name}  =  ${row.dcv.value}`);
+  say(import_chalk32.default.bold("  Add this DNS record at your DNS provider (one record; nothing else to add):"));
+  say(`  ${import_chalk32.default.cyan("CNAME")}  ${row.cnameRecord?.name ?? hostname}  \u2192  ${row.cnameRecord?.value ?? "proxy.abz.run"}`);
+  if (row.dcv) say(`  ${import_chalk32.default.cyan("TXT")}    ${row.dcv.name}  =  ${row.dcv.value}`);
   say("");
   const minutes = opts.wait === void 0 ? 15 : Number(opts.wait);
   if (!(minutes > 0) || !row.id) return { active: false, hostname, id: row.id };
-  const sp = opts.json ? null : (0, import_ora10.default)(`Waiting for ${hostname} to activate (Cloudflare validates it once the CNAME resolves; up to ${minutes} min, Ctrl-C to stop and re-run later)\u2026`).start();
+  const sp = opts.json ? null : (0, import_ora12.default)(`Waiting for ${hostname} to activate (Cloudflare validates it once the CNAME resolves; up to ${minutes} min, Ctrl-C to stop and re-run later)\u2026`).start();
   const until = Date.now() + minutes * 6e4;
   let status2 = row.status ?? "pending";
   while (Date.now() < until) {
@@ -13364,6 +13622,93 @@ async function ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, s
   sp?.fail(`${hostname} is not active yet (${status2}).`);
   return { active: false, hostname, id: row.id };
 }
+var HOSTED_RULE = "UPSTREAM_HOSTED";
+var PROTECTED_RULE = "UPSTREAM_PROTECTED";
+function validateProductionUrl(input) {
+  const v = (input ?? "").trim();
+  if (!/^https:\/\//i.test(v)) return "It must start with https://";
+  let host = "";
+  try {
+    host = new URL(v).hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  } catch {
+    return `${v} is not a URL.`;
+  }
+  const privateHost = host === "localhost" || host === "::1" || /\.(localhost|local|internal)$/.test(host) || /^(127\.|10\.|192\.168\.|169\.254\.|0\.)/.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+  return privateHost ? `${host} is this machine or a private network; reviewers cannot reach it.` : true;
+}
+function parseUpstreamHeader(opts) {
+  if (opts.upstreamHeader !== void 0 && opts.upstreamHeaderEnv !== void 0) throw new Error("Pass one of --upstream-header and --upstream-header-env.");
+  if (opts.upstreamHeaderEnv !== void 0) {
+    const i2 = opts.upstreamHeaderEnv.indexOf("=");
+    const name2 = i2 > 0 ? opts.upstreamHeaderEnv.slice(0, i2).trim() : "";
+    const variable = i2 > 0 ? opts.upstreamHeaderEnv.slice(i2 + 1).trim() : "";
+    if (!name2 || !variable) throw new Error("--upstream-header-env wants NAME=ENVVAR.");
+    const value2 = process.env[variable];
+    if (!value2) throw new Error(`Environment variable ${variable} is empty or not set.`);
+    return { name: name2, value: value2 };
+  }
+  if (opts.upstreamHeader === void 0) return null;
+  const i = opts.upstreamHeader.indexOf(":");
+  const name = i > 0 ? opts.upstreamHeader.slice(0, i).trim() : "";
+  const value = i > 0 ? opts.upstreamHeader.slice(i + 1).trim() : "";
+  if (!name || !value) throw new Error('--upstream-header wants "Name: value".');
+  return { name, value };
+}
+async function ensureHostedUpstream(caller, teamId, proj2, r, opts, interactive2, say, refetch) {
+  const failing = (x, id) => x.report.results.some((y) => y.id === id && !y.pass);
+  const shape = (x) => x.target ?? {};
+  let cur = r;
+  const header = parseUpstreamHeader(opts);
+  if (header && opts.upstreamOpen) throw new Error("Pass one of --upstream-header and --upstream-open.");
+  if (failing(cur, HOSTED_RULE)) {
+    let url = opts.targetUrl?.trim();
+    if (url) {
+      const ok = validateProductionUrl(url);
+      if (ok !== true) throw new Error(`--target-url: ${ok}`);
+    } else if (interactive2) {
+      say("  A listing has to stay up when your laptop sleeps, so reviewers and users need the hosted app, not this machine.");
+      const { default: inquirer3 } = await import("inquirer");
+      const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: "Where does this run in production? (https URL; Enter to skip for now)", validate: (v) => !(v ?? "").trim() ? true : validateProductionUrl(v) }]);
+      url = value?.trim();
+    }
+    if (url) {
+      const env = cur.report.project.environment;
+      const { environmentsWithTarget: environmentsWithTarget2 } = await Promise.resolve().then(() => (init_config(), config_exports));
+      const environments = await environmentsWithTarget2(caller, teamId, proj2, env, url);
+      await patchProject(caller, proj2, { environments }, `Point ${env} at ${url}`);
+      say(import_chalk32.default.green(`  \u2713 ${env} now forwards to ${url}`));
+      cur = await refetch();
+    } else {
+      say(import_chalk32.default.dim(`  Skipped: still not hosted, so this cannot be submitted yet. Everything else goes on; ${B.cli} connector ${proj2.projectName} --target-url <url> finishes it.`));
+    }
+  } else if (opts.targetUrl) {
+    say(import_chalk32.default.dim(`  --target-url ignored: this already forwards to a hosted server (${shape(cur).hosts?.upstreamTarget ?? "see the scorecard"}).`));
+  }
+  const skipped = shape(cur).metadata?.skippedRules ?? [];
+  if (failing(cur, PROTECTED_RULE) && !skipped.includes(PROTECTED_RULE)) {
+    let chosen = header;
+    let open = !!opts.upstreamOpen;
+    if (!chosen && !open && interactive2) {
+      if (shape(cur).hosts?.upstreamKind === "public" && !shape(cur).hosts?.upstreamHeader) say(import_chalk32.default.dim("  An open backend can be called around sign-in and the per-user rules; a shared secret header closes that."));
+      const { default: inquirer3 } = await import("inquirer");
+      const { name } = await inquirer3.prompt([{ type: "input", name: "name", message: `Does the backend need a header to accept calls from ${B.product}, such as an API key or a shared secret? (Header name; Enter = no, it checks its own credentials)` }]);
+      if (name?.trim()) {
+        const { value } = await inquirer3.prompt([{ type: "password", name: "value", mask: "*", message: `Value of ${name.trim()} (stored encrypted, never shown again):`, validate: (v) => (v ?? "").length > 0 ? true : "A value is needed; Ctrl-C leaves." }]);
+        chosen = { name: name.trim(), value };
+      } else open = true;
+    }
+    if (chosen) {
+      const { setUpstreamHeader: setUpstreamHeader2 } = await Promise.resolve().then(() => (init_transform(), transform_exports));
+      await setUpstreamHeader2(caller, proj2, chosen.name, chosen.value);
+      say(import_chalk32.default.green(`  \u2713 every forwarded call now carries ${chosen.name} (stored encrypted)`));
+      cur = await refetch();
+    } else if (open) {
+      await patchProject(caller, proj2, { directory_metadata: { skipped_rules: [.../* @__PURE__ */ new Set([...skipped, PROTECTED_RULE])] } }, "The backend checks its own credentials");
+      cur = await refetch();
+    }
+  }
+  return cur;
+}
 function generatePassword(bytes = () => crypto.getRandomValues(new Uint8Array(20))) {
   const alphabet = "abcdefghijkmnpqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ23456789";
   return Array.from(bytes(), (b) => alphabet[b % alphabet.length]).join("");
@@ -13399,12 +13744,12 @@ async function ensureReviewerAccount(caller, teamId, proj2, opts = {}) {
   return { username: finalUser, password, tenant: proj2.tenant };
 }
 function printReviewer(acct, proj2) {
-  console.log(import_chalk30.default.green(`Reviewer account ${import_chalk30.default.bold(acct.username)} on tenant ${acct.tenant} \u2014 stored (encrypted) for the submission packet.`));
+  console.log(import_chalk32.default.green(`Reviewer account ${import_chalk32.default.bold(acct.username)} on tenant ${acct.tenant} \u2014 stored (encrypted) for the submission packet.`));
   console.log();
-  console.log(import_chalk30.default.bold("  Password (shown once):"));
-  console.log(`  ${import_chalk30.default.cyan(acct.username)}  ${import_chalk30.default.bgWhite.black(` ${acct.password} `)}`);
+  console.log(import_chalk32.default.bold("  Password (shown once):"));
+  console.log(`  ${import_chalk32.default.cyan(acct.username)}  ${import_chalk32.default.bgWhite.black(` ${acct.password} `)}`);
   console.log();
-  console.log(import_chalk30.default.dim(`  Seed realistic data through the ${B.thingShort} (billed per turn): ${B.cli} agent --seed-for ${proj2.projectName}`));
+  console.log(import_chalk32.default.dim(`  Seed realistic data through the ${B.thingShort} (billed per turn): ${B.cli} agent --seed-for ${proj2.projectName}`));
 }
 async function runConnectorReviewer(project, opts) {
   const caller = requireCaller();
@@ -13446,7 +13791,7 @@ async function interruptConnector(ctx) {
   const sum = summaryOf(r);
   if (!ctx.json) {
     console.log("");
-    console.log(import_chalk30.default.bold(`Saved.${sum ? ` ${sum}.` : ""}`) + ` Pick up any time: ${import_chalk30.default.cyan(`${B.cli} connector ${ctx.proj.projectId}`)} or ${import_chalk30.default.cyan(pageLinkOf(r, ctx.proj))}`);
+    console.log(import_chalk32.default.bold(`Saved.${sum ? ` ${sum}.` : ""}`) + ` Pick up any time: ${import_chalk32.default.cyan(`${B.cli} connector ${ctx.proj.projectId}`)} or ${import_chalk32.default.cyan(pageLinkOf(r, ctx.proj))}`);
   }
   process.exit(0);
 }
@@ -13478,7 +13823,7 @@ async function runConnector(target2, opts) {
     const created = await createFromSpec(specSource, opts, say);
     projectName = created.name;
     version2 = created.version;
-    say(import_chalk30.default.green(`  ${B.thing} ${import_chalk30.default.bold(created.name)} created.`));
+    say(import_chalk32.default.green(`  ${B.thing} ${import_chalk32.default.bold(created.name)} created.`));
   }
   const proj2 = await resolveProjectVia(caller, teamId, projectName, version2);
   const flagBody = directoryBodyFromFlags(opts);
@@ -13490,7 +13835,7 @@ async function runConnector(target2, opts) {
       process.stdout.write(JSON.stringify({ attested: Object.keys(flagBody.directory_attestations), headline: r2.rendered.headline, summary: r2.progress?.summary ?? null }) + "\n");
       return;
     }
-    say(import_chalk30.default.green(`Attested: ${Object.keys(flagBody.directory_attestations).join(", ")}.`) + import_chalk30.default.dim(`  ${summaryOf(r2) ?? r2.rendered.headline}`));
+    say(import_chalk32.default.green(`Attested: ${Object.keys(flagBody.directory_attestations).join(", ")}.`) + import_chalk32.default.dim(`  ${summaryOf(r2) ?? r2.rendered.headline}`));
     return;
   }
   const explicit = compliantGiven(opts);
@@ -13516,36 +13861,36 @@ async function runConnector(target2, opts) {
     const dirsDiffer = explicit && !!stored && (stored.length !== platforms.length || stored.some((p) => !platforms.includes(p)));
     const needPatch = !modeOn || !!flagBody.directory_metadata || !!flagBody.directory_attestations || !!flagBody.openai_challenge_token || dirsDiffer;
     if (needPatch) {
-      const sp = json || modeOn ? null : (0, import_ora10.default)(`Turning directory-ready mode on for ${proj2.projectName}\u2026`).start();
+      const sp = json || modeOn ? null : (0, import_ora12.default)(`Turning directory-ready mode on for ${proj2.projectName}\u2026`).start();
       const meta = { ...flagBody.directory_metadata ?? {}, ...!modeOn || dirsDiffer || !stored ? { directories: platforms } : {} };
       await patchProject(caller, proj2, { directory_ready: true, ...flagBody, directory_metadata: meta }, modeOn ? "Save the flags" : "Enable directory-ready mode");
       sp?.succeed(`Directory-ready mode is on for ${proj2.projectName} v${proj2.apiVersion}.`);
-      if (dirsDiffer) say(import_chalk30.default.dim(`  directories: ${platforms.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")} (was ${stored.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")})`));
+      if (dirsDiffer) say(import_chalk32.default.dim(`  directories: ${platforms.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")} (was ${stored.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")})`));
       r = await fetchDirectoryReport(caller, proj2, reportOpts());
     }
     const link = pageLinkOf(r, proj2);
     const sum = summaryOf(r);
     if (sum) {
-      say(`${import_chalk30.default.bold("Finish this here or at")} ${import_chalk30.default.cyan(link)} ${import_chalk30.default.dim("\xB7")} ${import_chalk30.default.bold(sum)}`);
+      say(`${import_chalk32.default.bold("Finish this here or at")} ${import_chalk32.default.cyan(link)} ${import_chalk32.default.dim("\xB7")} ${import_chalk32.default.bold(sum)}`);
       const done = doneLine(r);
-      if (done) say(import_chalk30.default.dim(`  ${done}`));
+      if (done) say(import_chalk32.default.dim(`  ${done}`));
     } else {
-      say(import_chalk30.default.dim(`  ${r.rendered.headline}`));
+      say(import_chalk32.default.dim(`  ${r.rendered.headline}`));
     }
     const framed = /* @__PURE__ */ new Set();
     const frame = (id) => {
       const st = stepOf(r, id);
       if (!st || framed.has(id)) return;
       framed.add(id);
-      say(import_chalk30.default.bold(`\u2500\u2500 ${st.n} ${st.title} (${openCount(st)} left) \u2500\u2500`));
+      say(import_chalk32.default.bold(`\u2500\u2500 ${st.n} ${st.title} (${openCount(st)} left) \u2500\u2500`));
     };
     const closed = (id) => {
       const st = stepOf(r, id);
-      if (st && framed.has(id) && st.status === "done") say(import_chalk30.default.green(`  \u2713 ${st.n} ${st.title}`));
+      if (st && framed.has(id) && st.status === "done") say(import_chalk32.default.green(`  \u2713 ${st.n} ${st.title}`));
     };
     const formHint = (id) => {
       const st = stepOf(r, id);
-      if (st && framed.has(id) && interactive2) say(import_chalk30.default.dim(`  Prefer a form? ${pageLinkOf(r, proj2, st.web)} has the same fields.`));
+      if (st && framed.has(id) && interactive2) say(import_chalk32.default.dim(`  Prefer a form? ${pageLinkOf(r, proj2, st.web)} has the same fields.`));
     };
     const open = (id) => stepOpen(stepOf(r, id));
     const runnable = (id) => stepRunnable(stepOf(r, id));
@@ -13560,7 +13905,7 @@ async function runConnector(target2, opts) {
         if (isApiError(e, 404)) return { applied: [], skipped: [{ fix: "all", reason: "server has no auto-fixes yet" }] };
         throw e;
       });
-      for (const f2 of fixes.applied ?? []) say(import_chalk30.default.green(`  \u2713 fixed: ${f2}`));
+      for (const f2 of fixes.applied ?? []) say(import_chalk32.default.green(`  \u2713 fixed: ${f2}`));
       if (fixes.applied?.length) r = await fetchDirectoryReport(caller, proj2, reportOpts());
     }
     let defaults = { prompts: [] };
@@ -13577,6 +13922,7 @@ async function runConnector(target2, opts) {
     let domain = { active: true };
     if (wantStep("address") && open("address")) {
       frame("address");
+      r = await ensureHostedUpstream(caller, teamId, proj2, r, opts, interactive2, say, () => fetchDirectoryReport(caller, proj2, reportOpts()));
       const domainWasBlocking = r.report.results.some((x) => x.id === DOMAIN_RULE && !x.pass);
       domain = await ensureMcpDomain(caller, proj2, r, { ...opts, wait: 0 }, defaults, interactive2, say);
       if (domainWasBlocking && domain.active) r = await fetchDirectoryReport(caller, proj2, reportOpts());
@@ -13630,10 +13976,10 @@ async function runConnector(target2, opts) {
       }
       if (!tester) return { called: true, tools: [] };
       const t = tester;
-      say(import_chalk30.default.dim(`  trying it through ${t.clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}\u2026`));
+      say(import_chalk32.default.dim(`  trying it through ${t.clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}\u2026`));
       const res = await t.test(p);
       if (res.tools.length) await patchProject(caller, proj2, { directory_metadata: { prompt_tools: { [p.trim()]: res.tools } } }, "Remember which tool the prompt called").catch(() => null);
-      for (const [client, rr] of Object.entries(res.byClient)) say(rr.called ? import_chalk30.default.green(`  \u2713 ${client === "claude" ? "Claude" : "Codex"} called ${rr.tools.join(", ")}`) : import_chalk30.default.yellow(`  \u2013 ${client === "claude" ? "Claude" : "Codex"} called no tool`));
+      for (const [client, rr] of Object.entries(res.byClient)) say(rr.called ? import_chalk32.default.green(`  \u2713 ${client === "claude" ? "Claude" : "Codex"} called ${rr.tools.join(", ")}`) : import_chalk32.default.yellow(`  \u2013 ${client === "claude" ? "Claude" : "Codex"} called no tool`));
       return res;
     };
     const askSteps = ["listing", "attestations", "token"].filter((id) => wantStep(id) && runnable(id));
@@ -13687,11 +14033,11 @@ async function runConnector(target2, opts) {
         const { runConnectorExercise: runConnectorExercise2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
         const ran = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, yes: opts.yes, noEmail: opts.email === false, report: false, platforms: [...platforms], provenPromptNotes, seed: opts.seed });
         if (interactive2 && ran.failedPrompts.length) {
-          for (const [p, clients] of Object.entries(ran.failedByClient ?? {})) say(import_chalk30.default.yellow(`  \u2013 "${p.slice(0, 60)}": no tool call in ${clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}`));
+          for (const [p, clients] of Object.entries(ran.failedByClient ?? {})) say(import_chalk32.default.yellow(`  \u2013 "${p.slice(0, 60)}": no tool call in ${clients.map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")}`));
           const { rewritten, prompts } = await rewriteFailedPrompts(r, ran.failedPrompts, saveAnswer, say);
           if (rewritten.length) {
             const { clientsFor: clientsFor2 } = await Promise.resolve().then(() => (init_connector_exercise(), connector_exercise_exports));
-            say(import_chalk30.default.dim(`  Running the ${prompts.length} prompts through ${clientsFor2(platforms).map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")} again (the report reads the last run)\u2026`));
+            say(import_chalk32.default.dim(`  Running the ${prompts.length} prompts through ${clientsFor2(platforms).map((c) => c === "claude" ? "Claude Code" : "Codex CLI").join(" and ")} again (the report reads the last run)\u2026`));
             const again = await runConnectorExercise2(proj2.projectId, { team: opts.team ?? proj2.teamId, apiversion: opts.apiversion, json, noEmail: opts.email === false, report: false, platforms: [...platforms], promptsOnly: prompts, provenPromptNotes: ran.notes.filter((n) => n.kind === "negative") });
             ran.promptTools = { ...ran.promptTools, ...again.promptTools };
             ran.codexPromptTools = { ...ran.codexPromptTools, ...again.codexPromptTools };
@@ -13717,13 +14063,13 @@ async function runConnector(target2, opts) {
         process.exit(isReady(r, platforms) ? 0 : 1);
       }
       say("");
-      say(`${import_chalk30.default.bold(s2 ?? r.rendered.headline)} ${import_chalk30.default.dim(`\xB7 ${link}`)}`);
+      say(`${import_chalk32.default.bold(s2 ?? r.rendered.headline)} ${import_chalk32.default.dim(`\xB7 ${link}`)}`);
       process.exit(isReady(r, platforms) ? 0 : 1);
     }
     const tokenOnly = readyExcept(r, platforms, [SNAPSHOT_RULE, TOKEN_RULE]) && r.report.results.some((x) => x.id === TOKEN_RULE && !x.pass);
     if (!readyExceptSnapshot(r, platforms) && !tokenOnly) {
       if (!domain.active && domain.hostname && !json) {
-        console.error(import_chalk30.default.yellow(`
+        console.error(import_chalk32.default.yellow(`
   ${domain.hostname} is not active yet. Once the CNAME is in place, run again: ${B.cli} connector ${proj2.projectId}`));
       }
       exitWithReport(r, proj2, platforms, json, interactive2, opts.verbose);
@@ -13732,7 +14078,7 @@ async function runConnector(target2, opts) {
     let watching = false;
     if (opts.watch !== false) {
       watching = await producer(caller, { method: "POST", path: `${projectPath3(proj2)}/directory-watch`, body: { enabled: true }, summary: "Turn on the nightly re-check" }).then(() => true).catch((e) => {
-        say(import_chalk30.default.dim(`  (nightly re-check not switched on: ${e.message})`));
+        say(import_chalk32.default.dim(`  (nightly re-check not switched on: ${e.message})`));
         return false;
       });
     }
@@ -13750,7 +14096,7 @@ async function runConnector(target2, opts) {
       const manifest = packet.json.chatgpt;
       if (manifest) {
         const written = await writePluginPackage2(dir, manifest);
-        if (written.problem) say(import_chalk30.default.yellow(`  ${written.problem}`));
+        if (written.problem) say(import_chalk32.default.yellow(`  ${written.problem}`));
         zipPath = written.zipPath;
         if (written.seq) await patchProject(caller, proj2, { directory_metadata: { plugin_package_seq: written.seq } }, "Bump the plugin package version").catch(() => null);
       }
@@ -13764,28 +14110,28 @@ async function runConnector(target2, opts) {
     console.log();
     const card = scorecardText(r);
     if (opts.verbose && r.rendered.compliance) {
-      console.log(r.rendered.compliance.split("\n").map((l, i) => i === 0 ? import_chalk30.default.bold(l) : l.replace(/^(\s+)✓ /, (_m, sp) => `${sp}${import_chalk30.default.green("\u2713")} `).replace(/^(\s+)! /, (_m, sp) => `${sp}${import_chalk30.default.yellow("!")} `)).join("\n"));
+      console.log(r.rendered.compliance.split("\n").map((l, i) => i === 0 ? import_chalk32.default.bold(l) : l.replace(/^(\s+)✓ /, (_m, sp) => `${sp}${import_chalk32.default.green("\u2713")} `).replace(/^(\s+)! /, (_m, sp) => `${sp}${import_chalk32.default.yellow("!")} `)).join("\n"));
     } else if (card) {
       console.log(card);
     } else if (r.rendered.compliance) {
-      console.log(r.rendered.compliance.split("\n").map((l, i) => i === 0 ? import_chalk30.default.bold(l) : l.replace(/^(\s+)✓ /, (_m, sp) => `${sp}${import_chalk30.default.green("\u2713")} `).replace(/^(\s+)! /, (_m, sp) => `${sp}${import_chalk30.default.yellow("!")} `)).join("\n"));
+      console.log(r.rendered.compliance.split("\n").map((l, i) => i === 0 ? import_chalk32.default.bold(l) : l.replace(/^(\s+)✓ /, (_m, sp) => `${sp}${import_chalk32.default.green("\u2713")} `).replace(/^(\s+)! /, (_m, sp) => `${sp}${import_chalk32.default.yellow("!")} `)).join("\n"));
     } else {
       printReport(r, false);
     }
     console.log();
-    console.log(import_chalk30.default.green.bold(`  ${r.rendered.headline}`));
-    console.log(`  Submission packet: ${import_chalk30.default.cyan(mdPath)} and ${import_chalk30.default.cyan(jsonPath)}${zipPath ? `
-  OpenAI plugin package: ${import_chalk30.default.cyan(zipPath)}` : ""}`);
-    console.log(import_chalk30.default.dim(isOpenMode(r) ? "  (open mode: no reviewer credentials in the packet; the connector takes no sign-in)" : "  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
+    console.log(import_chalk32.default.green.bold(`  ${r.rendered.headline}`));
+    console.log(`  Submission packet: ${import_chalk32.default.cyan(mdPath)} and ${import_chalk32.default.cyan(jsonPath)}${zipPath ? `
+  OpenAI plugin package: ${import_chalk32.default.cyan(zipPath)}` : ""}`);
+    console.log(import_chalk32.default.dim(isOpenMode(r) ? "  (open mode: no reviewer credentials in the packet; the connector takes no sign-in)" : "  (the packet carries the reviewer credentials \u2014 keep it out of git)"));
     printSubmitSteps(r, mdPath, platforms, watching);
     if (tokenOnly) {
       const tok = r.report.results.find((x) => x.id === TOKEN_RULE);
-      console.log(import_chalk30.default.yellow(`  One thing left for ChatGPT: ${withProject(tok?.fix ?? "paste the OpenAI domain token", proj2.projectId)}`));
-      console.log(import_chalk30.default.dim(`  Then tell us you submitted: ${B.cli} connector submitted ${proj2.projectId}`));
+      console.log(import_chalk32.default.yellow(`  One thing left for ChatGPT: ${withProject(tok?.fix ?? "paste the OpenAI domain token", proj2.projectId)}`));
+      console.log(import_chalk32.default.dim(`  Then tell us you submitted: ${B.cli} connector submitted ${proj2.projectId}`));
     } else {
-      console.log(import_chalk30.default.dim(`  When you have submitted: ${B.cli} connector submitted ${proj2.projectId} \u2014 we re-check nightly and email you if anything drifts.`));
+      console.log(import_chalk32.default.dim(`  When you have submitted: ${B.cli} connector submitted ${proj2.projectId} \u2014 we re-check nightly and email you if anything drifts.`));
     }
-    console.log(import_chalk30.default.dim(`  ${r.report.disclaimer}`));
+    console.log(import_chalk32.default.dim(`  ${r.report.disclaimer}`));
     if (!isReady(r, platforms)) process.exit(1);
   } catch (e) {
     if (interrupting) return;
@@ -13808,7 +14154,7 @@ async function waitForExternal(caller, proj2, r, platforms, domain, opts, intera
   const sleep2 = deps.sleep ?? ((ms2) => new Promise((res) => setTimeout(res, ms2)));
   const link = pageLinkOf(r, proj2, "#step-9");
   say("");
-  say(import_chalk30.default.bold(`  Waiting for: ${[needDomain ? `your CNAME (${domain.hostname})` : null, needLogin ? "your Claude sign-in" : null].filter(Boolean).join(" \xB7 ")}`));
+  say(import_chalk32.default.bold(`  Waiting for: ${[needDomain ? `your CNAME (${domain.hostname})` : null, needLogin ? "your Claude sign-in" : null].filter(Boolean).join(" \xB7 ")}`));
   if (needLogin) {
     const url = r.report.project.publishedUrl ?? "";
     const name = r.target?.metadata?.serverName ?? proj2.projectId;
@@ -13816,19 +14162,19 @@ async function waitForExternal(caller, proj2, r, platforms, domain, opts, intera
     say("  One sign-in from a real Claude client is the last proof. In another terminal:");
     say(`    claude mcp add --transport http ${alias} ${url}`);
     say(`    claude            then /mcp \u2192 ${alias} \u2192 sign in with the reviewer account`);
-    say(import_chalk30.default.dim(`  or in claude.ai: Settings \u2192 Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
-    say(import_chalk30.default.dim(`  Afterwards: claude mcp remove ${alias}`));
+    say(import_chalk32.default.dim(`  or in claude.ai: Settings \u2192 Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
+    say(import_chalk32.default.dim(`  Afterwards: claude mcp remove ${alias}`));
     const { default: inquirer3 } = await import("inquirer");
     const { go } = await inquirer3.prompt([{ type: "confirm", name: "go", message: "Sign in from Claude now, then press Enter to check (n skips; the step stays open):", default: true }]);
     if (!go) needLogin = false;
     if (!needDomain && !needLogin) return r;
   }
-  say(import_chalk30.default.dim(`  Or leave now: run ${B.cli} connector ${proj2.projectId} again any time, or watch it at ${link}`));
+  say(import_chalk32.default.dim(`  Or leave now: run ${B.cli} connector ${proj2.projectId} again any time, or watch it at ${link}`));
   const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/domains`;
   const started = now();
   const domainUntil = started + minutes * 6e4;
   const loginUntil = started + (deps.maxLoginMs ?? 10 * 6e4);
-  const sp = opts.json ? null : (0, import_ora10.default)("Checking every 15 seconds\u2026").start();
+  const sp = opts.json ? null : (0, import_ora12.default)("Checking every 15 seconds\u2026").start();
   let cur = r;
   let status2 = "pending";
   let activated = false;
@@ -13839,13 +14185,13 @@ async function waitForExternal(caller, proj2, r, platforms, domain, opts, intera
       status2 = s?.status ?? status2;
       if (status2 === "active") {
         sp?.stop();
-        say(import_chalk30.default.green(`  \u2713 ${domain.hostname} is active.`));
+        say(import_chalk32.default.green(`  \u2713 ${domain.hostname} is active.`));
         sp?.start();
         needDomain = false;
         activated = true;
       } else if (status2 === "suspended" || status2 === "missing" || now() >= domainUntil) {
         sp?.stop();
-        say(import_chalk30.default.yellow(`  \u2013 ${domain.hostname} is not active yet (${status2}); run again once the CNAME is in place.`));
+        say(import_chalk32.default.yellow(`  \u2013 ${domain.hostname} is not active yet (${status2}); run again once the CNAME is in place.`));
         sp?.start();
         needDomain = false;
       }
@@ -13855,12 +14201,12 @@ async function waitForExternal(caller, proj2, r, platforms, domain, opts, intera
       const nowRule = cur.report.results.find((x) => x.id === "OAUTH_FLOW_COMPLETED");
       if (nowRule?.pass) {
         sp?.stop();
-        say(import_chalk30.default.green(`  \u2713 ${nowRule.message ?? "a Claude client completed the sign-in"}`));
+        say(import_chalk32.default.green(`  \u2713 ${nowRule.message ?? "a Claude client completed the sign-in"}`));
         sp?.start();
         needLogin = false;
       } else if (now() >= loginUntil) {
         sp?.stop();
-        say(import_chalk30.default.yellow("  \u2013 no Claude sign-in seen in 10 minutes; run again after signing in."));
+        say(import_chalk32.default.yellow("  \u2013 no Claude sign-in seen in 10 minutes; run again after signing in."));
         sp?.start();
         needLogin = false;
       }
@@ -13888,16 +14234,16 @@ async function runConnectorSubmitted(project, opts) {
     writeJsonLine({ project: proj2.projectId, submitted: r.progress?.submitted ?? submitted, summary: r.progress?.summary ?? null, line: step?.line ?? null });
     return;
   }
-  console.log(import_chalk30.default.green(`  \u2713 ${opts.undo ? "forgotten" : "recorded"}: ${dirs.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")}`));
+  console.log(import_chalk32.default.green(`  \u2713 ${opts.undo ? "forgotten" : "recorded"}: ${dirs.map((p) => p === "claude" ? "Claude" : "ChatGPT").join(" + ")}`));
   if (step) console.log(`  ${step.line}`);
-  console.log(import_chalk30.default.dim(`  ${summaryOf(r) ?? r.rendered.headline} \xB7 ${pageLinkOf(r, proj2)}`));
+  console.log(import_chalk32.default.dim(`  ${summaryOf(r) ?? r.rendered.headline} \xB7 ${pageLinkOf(r, proj2)}`));
 }
 async function rewriteFailedPrompts(r, failed, save, say) {
   const current = currentListingValue(r, "prompt");
   const list = Array.isArray(current) ? [...current] : [];
   const { default: inquirer3 } = await import("inquirer");
   const rewritten = [];
-  say(import_chalk30.default.yellow(`  ${failed.length === 1 ? "This prompt" : `${failed.length} prompts`} produced no tool call; a prompt should name what the tool does${failed.length === 1 ? "" : ", one at a time"}:`));
+  say(import_chalk32.default.yellow(`  ${failed.length === 1 ? "This prompt" : `${failed.length} prompts`} produced no tool call; a prompt should name what the tool does${failed.length === 1 ? "" : ", one at a time"}:`));
   for (const old of failed) {
     const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: `Rewrite "${old}" (Enter keeps it):`, default: old, validate: (v) => v.trim().length <= 300 ? true : `${v.trim().length} characters; 300 at most` }]);
     const next = (value ?? "").trim();
@@ -13910,7 +14256,7 @@ async function rewriteFailedPrompts(r, failed, save, say) {
   if (rewritten.length) {
     const why = await save({ prompt: list });
     if (why) {
-      say_(import_chalk30.default.yellow(`  not saved: ${why}`));
+      say_(import_chalk32.default.yellow(`  not saved: ${why}`));
       return { rewritten: [], prompts: list };
     }
   }
@@ -13955,9 +14301,9 @@ async function offerDrafts(caller, proj2, r, ran, interactive2, say, platforms =
       try {
         await patchProject(caller, proj2, { directory_portal_answers: { chatgpt_test_cases: cases } }, "Save OpenAI's test cases");
         saved = true;
-        say(import_chalk30.default.green(`  \u2713 OpenAI's positive test cases written from the Codex run: ${cases.positive.length}/5${cases.positive.length < 5 ? " (more prompts that call a tool are needed for five)" : ""}`));
+        say(import_chalk32.default.green(`  \u2713 OpenAI's positive test cases written from the Codex run: ${cases.positive.length}/5${cases.positive.length < 5 ? " (more prompts that call a tool are needed for five)" : ""}`));
       } catch (e) {
-        say(import_chalk30.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
+        say(import_chalk32.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
       }
     }
   }
@@ -13965,11 +14311,11 @@ async function offerDrafts(caller, proj2, r, ran, interactive2, say, platforms =
   if (!drafts.length) return saved;
   const inquirer3 = interactive2 ? (await import("inquirer")).default : null;
   say("");
-  say(import_chalk30.default.bold(`  Written from the run \u2014 the portal's ${drafts.map((d) => d.label.toLowerCase()).join(", ")}:`));
+  say(import_chalk32.default.bold(`  Written from the run \u2014 the portal's ${drafts.map((d) => d.label.toLowerCase()).join(", ")}:`));
   for (const d of drafts) {
     let text = d.draft;
     say("");
-    say(import_chalk30.default.bold(`  ${d.label}`) + import_chalk30.default.dim(` (${d.draft.length} characters; the portal wants ${ANSWER_MIN2[d.key]}+)`));
+    say(import_chalk32.default.bold(`  ${d.label}`) + import_chalk32.default.dim(` (${d.draft.length} characters; the portal wants ${ANSWER_MIN2[d.key]}+)`));
     for (const line of d.draft.split("\n")) say(`    ${line}`);
     if (inquirer3) {
       const { ok } = await inquirer3.prompt([{ type: "confirm", name: "ok", message: `Use this ${d.label.toLowerCase()}? (n = type your own)`, default: true }]);
@@ -13982,9 +14328,9 @@ async function offerDrafts(caller, proj2, r, ran, interactive2, say, platforms =
     try {
       await patchProject(caller, proj2, body, `Save the ${d.label.toLowerCase()}`);
       saved = true;
-      say(import_chalk30.default.green(`  \u2713 ${d.label.toLowerCase()} saved`));
+      say(import_chalk32.default.green(`  \u2713 ${d.label.toLowerCase()} saved`));
     } catch (e) {
-      say(import_chalk30.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
+      say(import_chalk32.default.yellow(`  not saved: ${e instanceof Error ? e.message : String(e)}`));
     }
   }
   return saved;
@@ -14006,7 +14352,7 @@ function exitWithReport(r, proj2, platforms, json, interactive2 = false, verbose
   const blocking = r.report.results.filter((x) => !x.pass && x.severity === "block" && !x.unverified && x.platforms.some((p) => want.includes(p)));
   const real = blocking.filter((x) => x.id !== SNAPSHOT_RULE);
   const first = real.find((x) => x.tier !== "review") ?? real[0] ?? blocking[0];
-  console.error(import_chalk30.default.red(`
+  console.error(import_chalk32.default.red(`
 Not ready: ${blocking.length} blocker${blocking.length === 1 ? "" : "s"} (${blocking.map((x) => x.id).join(", ")}).`));
   const name = proj2.projectId;
   if (!interactive2) {
@@ -14017,7 +14363,7 @@ Not ready: ${blocking.length} blocker${blocking.length === 1 ? "" : "s"} (${bloc
   if (answerish.length && answerish.every((x) => !x.platforms.includes("claude"))) console.error(`  Next: ${withProject(answerish[0].fix ?? answerish[0].message ?? answerish[0].title, name)}`);
   else if (answerish.length) console.error(`  Next: run \`${B.cli} connector ${name}${platforms.includes("chatgpt") ? ` --compliant ${platforms.length > 1 ? "all" : "chatgpt"}` : ""}\` in a terminal with the exercise on \u2014 it asks what only you can answer and writes the use cases, the reviewer instructions and the description from the run; or pass them: \`${B.cli} connector answers ${name} --use-cases \u2026 --data-handling own --health-data no --sponsored-content no\`.`);
   else if (first) console.error(`  Next: ${withProject(first.fix ?? first.message ?? first.title, name)}`);
-  console.error(import_chalk30.default.dim(`  Report page: ${pageLinkOf(r, proj2)}`));
+  console.error(import_chalk32.default.dim(`  Report page: ${pageLinkOf(r, proj2)}`));
   process.exit(1);
 }
 function flagsForRules(ids, platforms) {
@@ -14055,6 +14401,12 @@ function flagsForRules(ids, platforms) {
       case "REVIEWER_ACCOUNT_POPULATED":
         add("--seed");
         break;
+      case HOSTED_RULE:
+        add("--target-url <https://\u2026>");
+        break;
+      case PROTECTED_RULE:
+        add('--upstream-header "<Name>: <value>" (or --upstream-open)');
+        break;
       case "API_OWNERSHIP_DOMAIN":
         add('--data-handling own|proxied "<permission>"');
         break;
@@ -14125,7 +14477,7 @@ async function confirmOpenWorld(proj2, environment, interactive2, flag, openMode
   if (!unset.length) return false;
   let answer = flag ? /^(y|yes|true|1)$/i.test(flag.trim()) : null;
   if (answer === null && !interactive2) {
-    say(import_chalk30.default.dim(`  openWorldHint not answered for ${unset.length} tool${unset.length === 1 ? "" : "s"} (pass --open-world yes|no)`));
+    say(import_chalk32.default.dim(`  openWorldHint not answered for ${unset.length} tool${unset.length === 1 ? "" : "s"} (pass --open-world yes|no)`));
     return false;
   }
   if (answer === null) {
@@ -14136,7 +14488,7 @@ async function confirmOpenWorld(proj2, environment, interactive2, flag, openMode
   cat.overrides = { ...cat.overrides ?? {} };
   for (const n of unset) cat.overrides[n] = { ...cat.overrides[n] ?? {}, openWorld: answer };
   await saveCatalogue2(t, cat);
-  say(import_chalk30.default.green(`  \u2713 openWorldHint ${answer ? "true" : "false"} on ${unset.length === cat.tools.length ? "every tool" : unset.join(", ")}`));
+  say(import_chalk32.default.green(`  \u2713 openWorldHint ${answer ? "true" : "false"} on ${unset.length === cat.tools.length ? "every tool" : unset.join(", ")}`));
   return true;
 }
 async function fixToolDescriptions(proj2, environment, interactive2, say) {
@@ -14153,9 +14505,9 @@ async function fixToolDescriptions(proj2, environment, interactive2, say) {
   const dropped = tools.filter(isUtilityTool).map((x) => x.name);
   const todo = kept.filter(needsDescription);
   if (!dropped.length && !todo.length) return false;
-  if (dropped.length) say(import_chalk30.default.green(`  \u2713 hidden from the MCP (utility endpoints, not tools): ${dropped.join(", ")}`));
+  if (dropped.length) say(import_chalk32.default.green(`  \u2713 hidden from the MCP (utility endpoints, not tools): ${dropped.join(", ")}`));
   if (todo.length) {
-    say(import_chalk30.default.dim(`  ${todo.length} tool${todo.length === 1 ? "" : "s"} need a description (what it does and returns):`));
+    say(import_chalk32.default.dim(`  ${todo.length} tool${todo.length === 1 ? "" : "s"} need a description (what it does and returns):`));
     const inquirer3 = interactive2 ? (await import("inquirer")).default : null;
     for (const x of todo) {
       const def = derivedDescription(x);
@@ -14165,7 +14517,7 @@ async function fixToolDescriptions(proj2, environment, interactive2, say) {
         text = value?.trim() || def;
       }
       x.description = text;
-      say(import_chalk30.default.green(`  \u2713 ${x.name}: ${text}`));
+      say(import_chalk32.default.green(`  \u2713 ${x.name}: ${text}`));
     }
   }
   cat.tools = kept;
@@ -14233,13 +14585,13 @@ function printSubmitSteps(r, mdPath, platforms = PLATFORMS, watching = false) {
   const chatgpt = platforms.includes("chatgpt");
   const where = [claude ? "Claude (Settings \u2192 Connectors)" : null, chatgpt ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : null].filter(Boolean).join(" and in ");
   const steps = [
-    `Test it yourself first: add ${import_chalk30.default.cyan(url)} as a custom connector in ${where}, ${open ? "no sign-in needed (open mode)" : "sign in with the reviewer account"}, run a tool.`,
-    ...claude ? [`Claude: ${import_chalk30.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk30.default.cyan(import_path7.default.basename(mdPath))}.`] : [],
-    ...chatgpt ? [`ChatGPT: ${import_chalk30.default.underline(PORTALS.chatgpt)} \u2192 upload ${import_chalk30.default.cyan(`connector-plugin-${r.report.project.id}.zip`)} \u2192 MCPs \u2192 Connect \u2192 Verify Domain \u2192 authorize \u2192 Scan Tools; paste the reviewer credentials under Review details; add the demo recording URL and the release notes; confirm the attestations. The MCP hostname is permanent for the OpenAI listing.`] : [],
+    `Test it yourself first: add ${import_chalk32.default.cyan(url)} as a custom connector in ${where}, ${open ? "no sign-in needed (open mode)" : "sign in with the reviewer account"}, run a tool.`,
+    ...claude ? [`Claude: ${import_chalk32.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk32.default.cyan(import_path7.default.basename(mdPath))}.`] : [],
+    ...chatgpt ? [`ChatGPT: ${import_chalk32.default.underline(PORTALS.chatgpt)} \u2192 upload ${import_chalk32.default.cyan(`connector-plugin-${r.report.project.id}.zip`)} \u2192 MCPs \u2192 Connect \u2192 Verify Domain \u2192 authorize \u2192 Scan Tools; paste the reviewer credentials under Review details; add the demo recording URL and the release notes; confirm the attestations. The MCP hostname is permanent for the OpenAI listing.`] : [],
     watching ? open ? "A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : "Keep the reviewer account alive. A nightly re-check is on: it emails the team owner if the listing drifts or a new check is added." : open ? "The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts." : "Keep the reviewer account alive. The nightly re-check is off (--no-watch); turn it on in the dashboard to be emailed when the listing drifts."
   ];
   console.log();
-  console.log(import_chalk30.default.bold("  Submit (you do this part; the packet has every value to paste):"));
+  console.log(import_chalk32.default.bold("  Submit (you do this part; the packet has every value to paste):"));
   steps.forEach((s, i) => console.log(`  ${i + 1}. ${s}`));
   console.log();
 }
@@ -14252,7 +14604,7 @@ init_connector_docs();
 var import_fs12 = __toESM(require("fs"));
 var import_os4 = __toESM(require("os"));
 var import_path10 = __toESM(require("path"));
-var import_chalk34 = __toESM(require("chalk"));
+var import_chalk36 = __toESM(require("chalk"));
 init_brand();
 
 // src/lib/brand-surface.ts
@@ -14911,7 +15263,8 @@ function shipMcpMarkdown() {
 8. **List it.** \`${run2} connector <name>\` (Claude; \`--compliant chatgpt\` or \`all\` for OpenAI's directory): the scorecard
    first, then every open step in order \u2014 the MCP hostname (one CNAME the user adds at their DNS provider; relay the exact
    record), the listing answers pre-filled from the spec, the reviewer account, the proof run \u2014 and the submission packet when
-   every check passes. Stop any time; \`${run2} connector <name> --status\` says what is left and links the page where the rest
+   every check passes. It needs the hosted app, not a tunnel: have the production URL and any header the backend needs ready, and
+   run the proof again after switching. Stop any time; \`${run2} connector <name> --status\` says what is left and links the page where the rest
    can be finished.
    The user submits the packet to Anthropic or OpenAI themselves.
 
@@ -15244,6 +15597,9 @@ and attestations. \`--compliant\` makes the ${Bb.thingShort} meet them to the le
 - Which directory: \`--compliant\` alone is Claude. \`--compliant chatgpt\` is OpenAI's, \`--compliant all\` is both.
 - From an OpenAPI URL: \`npx ${cli} create --compliant --target https://yourdomain.com/openapi.yaml --domain mcp.yourdomain.com\`.
   On an existing ${Bb.thingShort}: \`npx ${cli} connector <name> --compliant --domain mcp.yourdomain.com\`.
+- A listing needs the hosted app: \`dev\` is for building and trying it, and a tunnel cannot be submitted. Have the production URL
+  and any header the backend needs ready (\`--target-url\`, \`--upstream-header\`); it asks when they are missing.
+- A proof run made on a tunnel does not count: run \`npx ${cli} connector exercise <name>\` again after switching to the hosted app.
 - It asks for the listing answers with every field pre-filled from the spec and cut to the portal's limits
   (Enter accepts), and waits for ONE CNAME (mcp.yourdomain.com \u2192 proxy.abz.run) \u2014 the user adds it at their DNS
   provider; relay the exact record it prints. For ChatGPT it also asks for the challenge token the OpenAI portal
@@ -15349,21 +15705,21 @@ async function runForPerson(found) {
   const P = B.product;
   const run2 = `npx ${B.cli}@latest`;
   console.log();
-  console.log(`  ${import_chalk34.default.bold(pitchText().split(". ")[0] + ".")}`);
+  console.log(`  ${import_chalk36.default.bold(pitchText().split(". ")[0] + ".")}`);
   console.log(`  ${pitchText().split(". ").slice(1).join(". ")}`);
   console.log();
-  console.log(import_chalk34.default.dim(B.cli === "mcpblaze" ? `  With an AI assistant? Tell it: "Help me get my app listed in Claude and ChatGPT using ${run2} skills"` : `  With an AI assistant? Tell it: "Tell me what ${B.cli} can do for me using ${run2} skills"`));
+  console.log(import_chalk36.default.dim(B.cli === "mcpblaze" ? `  With an AI assistant? Tell it: "Help me get my app listed in Claude and ChatGPT using ${run2} skills"` : `  With an AI assistant? Tell it: "Tell me what ${B.cli} can do for me using ${run2} skills"`));
   console.log();
   const report = folderReport(found, { forPerson: true });
   for (const l of report.lines) console.log(`  ${l.replace(/`/g, "")}`);
   const port = backendPort(found);
   if (B.cli === "mcpblaze" && report.ownApi && (found.specFile || found.specUrl)) {
     const spec = found.specFile ?? found.specUrl;
-    if (!await ask2(`  ${import_chalk34.default.bold("?")} Make it a Claude connector now? (${run2} connector ${spec}) ${import_chalk34.default.dim("(Y/n)")} `)) {
-      console.log(`  Any time: ${import_chalk34.default.cyan(`${run2} connector ${spec}`)}${found.listening ? `   \xB7 or just the MCP server: ${import_chalk34.default.cyan(`${run2} dev --port ${found.listening}`)}` : ""}`);
+    if (!await ask2(`  ${import_chalk36.default.bold("?")} Make it a Claude connector now? (${run2} connector ${spec}) ${import_chalk36.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk36.default.cyan(`${run2} connector ${spec}`)}${found.listening ? `   \xB7 or just the MCP server: ${import_chalk36.default.cyan(`${run2} dev --port ${found.listening}`)}` : ""}`);
       return;
     }
-    console.log(import_chalk34.default.dim(`  $ ${run2} connector ${spec}`));
+    console.log(import_chalk36.default.dim(`  $ ${run2} connector ${spec}`));
     const { spawnSync: spawnSync6 } = await import("child_process");
     const r = spawnSync6(process.execPath, [process.argv[1], "connector", spec], { stdio: "inherit" });
     process.exitCode = r.status ?? 0;
@@ -15371,11 +15727,11 @@ async function runForPerson(found) {
   }
   if (report.ownApi && found.listening) {
     const args = ["dev", "--port", String(found.listening), ...found.specFile ? ["--openapi", found.specFile] : []];
-    if (!await ask2(`  ${import_chalk34.default.bold("?")} Put your API on port ${found.listening} behind ${P} now? ${import_chalk34.default.dim("(Y/n)")} `)) {
-      console.log(`  Any time: ${import_chalk34.default.cyan(`${run2} ${args.join(" ")}`)}`);
+    if (!await ask2(`  ${import_chalk36.default.bold("?")} Put your API on port ${found.listening} behind ${P} now? ${import_chalk36.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk36.default.cyan(`${run2} ${args.join(" ")}`)}`);
       return;
     }
-    console.log(import_chalk34.default.dim(`  $ ${run2} ${args.join(" ")}`));
+    console.log(import_chalk36.default.dim(`  $ ${run2} ${args.join(" ")}`));
     const { spawnSync: spawnSync6 } = await import("child_process");
     const r = spawnSync6(process.execPath, [process.argv[1], ...args], { stdio: "inherit" });
     process.exitCode = r.status ?? 0;
@@ -15384,18 +15740,18 @@ async function runForPerson(found) {
   if (report.ownApi) {
     const args = ["dev", "--port", String(port ?? 3e3), ...found.specFile ? ["--openapi", found.specFile] : []];
     const startHint = found.start ? `, once you start it (${found.start})` : ", once it runs";
-    if (!await ask2(`  ${import_chalk34.default.bold("?")} Put it behind ${P} now? It reaches your app on port ${port ?? 3e3}${startHint}. ${import_chalk34.default.dim("(Y/n)")} `)) {
-      console.log(`  Any time: ${import_chalk34.default.cyan(`${run2} ${args.join(" ")}`)}`);
+    if (!await ask2(`  ${import_chalk36.default.bold("?")} Put it behind ${P} now? It reaches your app on port ${port ?? 3e3}${startHint}. ${import_chalk36.default.dim("(Y/n)")} `)) {
+      console.log(`  Any time: ${import_chalk36.default.cyan(`${run2} ${args.join(" ")}`)}`);
       return;
     }
-    console.log(import_chalk34.default.dim(`  $ ${run2} ${args.join(" ")}`));
+    console.log(import_chalk36.default.dim(`  $ ${run2} ${args.join(" ")}`));
     const { spawnSync: spawnSync6 } = await import("child_process");
     const r = spawnSync6(process.execPath, [process.argv[1], ...args], { stdio: "inherit" });
     process.exitCode = r.status ?? 0;
     return;
   }
-  if (!await ask2(`  ${import_chalk34.default.bold("?")} Create a demo app to try out ${P}? ${import_chalk34.default.dim("(Y/n)")} `)) {
-    console.log(`  Your own app, when it runs: ${import_chalk34.default.cyan(`${run2} dev --port <port>`)}`);
+  if (!await ask2(`  ${import_chalk36.default.bold("?")} Create a demo app to try out ${P}? ${import_chalk36.default.dim("(Y/n)")} `)) {
+    console.log(`  Your own app, when it runs: ${import_chalk36.default.cyan(`${run2} dev --port <port>`)}`);
     return;
   }
   const { runDemo: runDemo2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
@@ -15430,28 +15786,28 @@ function installSkill(opts) {
   const rel = skillRelativePathFor();
   const target2 = import_path10.default.resolve(process.cwd(), rel);
   if (import_fs12.default.existsSync(target2) && !opts.force) {
-    console.error(import_chalk34.default.yellow(`${rel} already exists \u2014 re-run with --force to overwrite it.`));
+    console.error(import_chalk36.default.yellow(`${rel} already exists \u2014 re-run with --force to overwrite it.`));
     process.exit(1);
   }
   import_fs12.default.mkdirSync(import_path10.default.dirname(target2), { recursive: true });
   import_fs12.default.writeFileSync(target2, md, "utf8");
-  console.log(`${import_chalk34.default.green("\u2713")} Installed the ${import_chalk34.default.bold(skillNameFor())} skill: ${import_chalk34.default.bold(target2)}`);
-  console.log(import_chalk34.default.dim(B.cli === "mcpblaze" ? `  Claude Code picks it up in this project. Say "make this an MCP server" or "list it in Claude" and it runs npx ${B.cli}@latest create / connector for you.` : `  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
+  console.log(`${import_chalk36.default.green("\u2713")} Installed the ${import_chalk36.default.bold(skillNameFor())} skill: ${import_chalk36.default.bold(target2)}`);
+  console.log(import_chalk36.default.dim(B.cli === "mcpblaze" ? `  Claude Code picks it up in this project. Say "make this an MCP server" or "list it in Claude" and it runs npx ${B.cli}@latest create / connector for you.` : `  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli}@latest dev / create for you.`));
 }
 
 // src/commands/integration.ts
-var import_chalk35 = __toESM(require("chalk"));
-var import_ora12 = __toESM(require("ora"));
+var import_chalk37 = __toESM(require("chalk"));
+var import_ora14 = __toESM(require("ora"));
 init_caller();
 init_api();
 init_brand();
 function file(f2, indent2 = "     ") {
-  console.log(`   ${import_chalk35.default.cyan(f2.file)}`);
+  console.log(`   ${import_chalk37.default.cyan(f2.file)}`);
   for (const line of f2.code.split("\n")) console.log(`${indent2}${line}`);
   console.log();
 }
 function bullets(lines, indent2 = "   ") {
-  for (const l of lines) console.log(`${indent2}${import_chalk35.default.dim("\u2022")} ${l}`);
+  for (const l of lines) console.log(`${indent2}${import_chalk37.default.dim("\u2022")} ${l}`);
 }
 async function runIntegration(name, opts = {}) {
   const stackRaw = (opts.stack ?? "nextjs").trim().toLowerCase();
@@ -15462,7 +15818,7 @@ async function runIntegration(name, opts = {}) {
   const project = name.trim().toLowerCase();
   const caller = requireCaller();
   if (opts.team && caller.mode === "anon") throw new Error("--team is not available in an anonymous workspace.");
-  const spinner = opts.json ? null : (0, import_ora12.default)(`Rendering the ${stack} kit for ${project}\u2026`).start();
+  const spinner = opts.json ? null : (0, import_ora14.default)(`Rendering the ${stack} kit for ${project}\u2026`).start();
   let kit;
   try {
     kit = await producer(caller, integrationKitCall(project, stack));
@@ -15476,44 +15832,44 @@ async function runIntegration(name, opts = {}) {
     return;
   }
   console.log();
-  console.log(import_chalk35.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
-  console.log(import_chalk35.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
+  console.log(import_chalk37.default.bold(`Integration kit \u2014 ${kit.project} (${kit.stack})`));
+  console.log(import_chalk37.default.dim(`  Edit only the frontend and the frontend-server. Your backend changes in one way: it trusts the ${B.product} identity headers.`));
   console.log();
-  console.log(`  ${import_chalk35.default.dim("Proxy:  ")} ${import_chalk35.default.bold(kit.urls.proxy)}`);
-  console.log(`  ${import_chalk35.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk35.default.dim(" \xB7 "))}`);
-  console.log(`  ${import_chalk35.default.dim("Portal: ")} ${kit.urls.portal}`);
-  console.log(`  ${import_chalk35.default.dim("Spec:   ")} ${kit.urls.openapi}`);
+  console.log(`  ${import_chalk37.default.dim("Proxy:  ")} ${import_chalk37.default.bold(kit.urls.proxy)}`);
+  console.log(`  ${import_chalk37.default.dim("MCP:    ")} ${kit.urls.mcp.join(import_chalk37.default.dim(" \xB7 "))}`);
+  console.log(`  ${import_chalk37.default.dim("Portal: ")} ${kit.urls.portal}`);
+  console.log(`  ${import_chalk37.default.dim("Spec:   ")} ${kit.urls.openapi}`);
   const w = kit["1_frontend_widgets"];
   console.log();
-  console.log(import_chalk35.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
-  console.log(import_chalk35.default.dim(`   ${w.note}`));
+  console.log(import_chalk37.default.bold("1. Frontend \u2014 the widgets (keys + chat)"));
+  console.log(import_chalk37.default.dim(`   ${w.note}`));
   console.log();
   file(w.frontend);
   for (const r of w.server_routes) file(r);
   const c = kit["2_frontend_server_call_through"];
-  console.log(import_chalk35.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
+  console.log(import_chalk37.default.bold("2. Frontend-server \u2014 call the proxy with the server key and say who is calling"));
   console.log();
   file(c);
   const t = kit["3_backend_trust_contract"];
-  console.log(import_chalk35.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
-  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk35.default.cyan(h)} \u2014 ${why}`);
+  console.log(import_chalk37.default.bold("3. Backend \u2014 trust the identity headers, and nothing else"));
+  for (const [h, why] of Object.entries(t.headers_you_receive)) console.log(`   ${import_chalk37.default.cyan(h)} \u2014 ${why}`);
   console.log();
-  console.log(`   ${import_chalk35.default.dim("How to verify:")}`);
+  console.log(`   ${import_chalk37.default.dim("How to verify:")}`);
   bullets(t.how_to_verify);
   console.log();
-  console.log(`   ${import_chalk35.default.dim("Never:")}`);
+  console.log(`   ${import_chalk37.default.dim("Never:")}`);
   bullets(t.what_not_to_do);
   console.log();
-  console.log(import_chalk35.default.bold("4. Env vars (server only)"));
-  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk35.default.cyan(k)}  ${import_chalk35.default.dim("=")}  ${v}`);
+  console.log(import_chalk37.default.bold("4. Env vars (server only)"));
+  for (const [k, v] of Object.entries(kit["4_env_vars"])) console.log(`   ${import_chalk37.default.cyan(k)}  ${import_chalk37.default.dim("=")}  ${v}`);
   const o = kit["5_what_stays_open"];
   console.log();
-  console.log(import_chalk35.default.bold("5. What stays open"));
-  console.log(`   ${import_chalk35.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk35.default.dim("nothing")}`);
-  console.log(`   ${import_chalk35.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk35.default.dim("nothing")}`);
-  console.log(import_chalk35.default.dim(`   ${o.note}`));
+  console.log(import_chalk37.default.bold("5. What stays open"));
+  console.log(`   ${import_chalk37.default.dim("Protected by a rule:")} ${o.protected.length ? o.protected.join(", ") : import_chalk37.default.dim("nothing")}`);
+  console.log(`   ${import_chalk37.default.dim("Open to any identified caller:")} ${o.open.length ? o.open.join(", ") : import_chalk37.default.dim("nothing")}`);
+  console.log(import_chalk37.default.dim(`   ${o.note}`));
   console.log();
-  console.log(import_chalk35.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
+  console.log(import_chalk37.default.dim(`  Raw JSON: npx ${B.cli} integration ${kit.project} --stack ${kit.stack} --json`));
   console.log();
 }
 
@@ -15521,14 +15877,14 @@ async function runIntegration(name, opts = {}) {
 init_claim();
 
 // src/commands/logout.ts
-var import_chalk36 = __toESM(require("chalk"));
+var import_chalk38 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 async function runLogout(opts = {}) {
   const creds = loadCredentials();
   const consumer = loadConsumer();
   if (!creds && !consumer) {
-    console.log(import_chalk36.default.yellow("You were not logged in."));
+    console.log(import_chalk38.default.yellow("You were not logged in."));
     return;
   }
   let target2;
@@ -15555,16 +15911,16 @@ async function runLogout(opts = {}) {
   }
   if (target2 === "producer" || target2 === "all") {
     clearCredentials();
-    console.log(import_chalk36.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
+    console.log(import_chalk38.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
   }
   if (target2 === "consumer" || target2 === "all") {
     clearConsumer();
-    console.log(import_chalk36.default.green(`\u2714 Logged out of API Consumer${consumer?.tenant ? ` (${consumer.tenant})` : ""}.`));
+    console.log(import_chalk38.default.green(`\u2714 Logged out of API Consumer${consumer?.tenant ? ` (${consumer.tenant})` : ""}.`));
   }
 }
 
 // src/commands/flush.ts
-var import_chalk37 = __toESM(require("chalk"));
+var import_chalk39 = __toESM(require("chalk"));
 var fs21 = __toESM(require("fs"));
 var path17 = __toESM(require("path"));
 init_auth();
@@ -15572,18 +15928,18 @@ init_external_mcp();
 async function runFlush(opts) {
   const { stopDemos: stopDemos2 } = await Promise.resolve().then(() => (init_demo(), demo_exports));
   const demos = await stopDemos2().catch(() => 0);
-  if (demos) console.log(import_chalk37.default.dim(`  Stopped ${demos} running demo(s).`));
+  if (demos) console.log(import_chalk39.default.dim(`  Stopped ${demos} running demo(s).`));
   const dir = getApiblazeDir();
   const entries2 = fs21.existsSync(dir) ? fs21.readdirSync(dir) : [];
   if (!entries2.length) {
-    console.log(import_chalk37.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
+    console.log(import_chalk39.default.dim("Nothing to flush \u2014 no local apiblaze config found."));
     return;
   }
-  console.log(import_chalk37.default.yellow("This removes ALL local apiblaze state from this machine:"));
-  console.log(import_chalk37.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
-  console.log(import_chalk37.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
-  console.log(import_chalk37.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
-  console.log(import_chalk37.default.dim(`  (${entries2.length} item(s) in ${dir})`));
+  console.log(import_chalk39.default.yellow("This removes ALL local apiblaze state from this machine:"));
+  console.log(import_chalk39.default.dim("  \u2022 login credentials & anonymous-workspace keys"));
+  console.log(import_chalk39.default.dim("  \u2022 saved apichats \u2014 their DP API keys and transcripts"));
+  console.log(import_chalk39.default.dim("  \u2022 your BYO LLM key and any cached secrets"));
+  console.log(import_chalk39.default.dim(`  (${entries2.length} item(s) in ${dir})`));
   const footprint = apiblazeMcpFootprint();
   const mdFiles = ["claude", "codex"].map((k) => ({ k, file: agentInstructionFile(k) })).filter(({ file: file2 }) => {
     try {
@@ -15593,19 +15949,19 @@ async function runFlush(opts) {
     }
   });
   if (footprint.claude.length || footprint.codex.length) {
-    console.log(import_chalk37.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
+    console.log(import_chalk39.default.dim(`  \u2022 MCP servers installed in other tools: ${[...footprint.claude, ...footprint.codex].join(", ")}`));
   }
   if (mdFiles.length) {
-    console.log(import_chalk37.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path17.basename(m.file)).join(" and ")} (here)`));
+    console.log(import_chalk39.default.dim(`  \u2022 the "use this MCP" blocks in ${mdFiles.map((m) => path17.basename(m.file)).join(" and ")} (here)`));
   }
-  console.log(import_chalk37.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
+  console.log(import_chalk39.default.dim("  It does NOT delete server-side proxies/keys \u2014 those GC or are revoked separately."));
   if (!opts.yes) {
     const { default: inquirer3 } = await import("inquirer");
     const { ok } = await inquirer3.prompt([
       { type: "confirm", name: "ok", message: "Delete all local state?", default: false }
     ]);
     if (!ok) {
-      console.log(import_chalk37.default.dim("Cancelled \u2014 nothing removed."));
+      console.log(import_chalk39.default.dim("Cancelled \u2014 nothing removed."));
       return;
     }
   }
@@ -15615,14 +15971,14 @@ async function runFlush(opts) {
       fs21.rmSync(path17.join(dir, e), { recursive: true, force: true });
       removed++;
     } catch (err) {
-      console.log(import_chalk37.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
+      console.log(import_chalk39.default.red(`  \u2717 could not remove ${e}: ${err instanceof Error ? err.message : "error"}`));
     }
   }
   for (const name of footprint.claude) {
-    console.log(removeClaudeServer(name) ? `  ${import_chalk37.default.dim("\u2022")} removed MCP ${import_chalk37.default.bold(name)} from Claude CLI` : import_chalk37.default.yellow(`  \u2717 could not remove MCP ${name} from Claude CLI`));
+    console.log(removeClaudeServer(name) ? `  ${import_chalk39.default.dim("\u2022")} removed MCP ${import_chalk39.default.bold(name)} from Claude CLI` : import_chalk39.default.yellow(`  \u2717 could not remove MCP ${name} from Claude CLI`));
   }
   for (const name of footprint.codex) {
-    console.log(removeCodexServer(name) ? `  ${import_chalk37.default.dim("\u2022")} removed MCP ${import_chalk37.default.bold(name)} from Codex` : import_chalk37.default.yellow(`  \u2717 could not remove MCP ${name} from Codex`));
+    console.log(removeCodexServer(name) ? `  ${import_chalk39.default.dim("\u2022")} removed MCP ${import_chalk39.default.bold(name)} from Codex` : import_chalk39.default.yellow(`  \u2717 could not remove MCP ${name} from Codex`));
   }
   for (const { k, file: file2 } of mdFiles) {
     let text = "";
@@ -15634,17 +15990,17 @@ async function runFlush(opts) {
     const names = [...text.matchAll(/<!-- apiblaze:mcp:([^\s>]+) -->/g)].map((m) => m[1]);
     let cleared = 0;
     for (const n of new Set(names)) if (removeAgentInstruction(k, n)) cleared++;
-    if (cleared) console.log(`  ${import_chalk37.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk37.default.bold(path17.basename(file2))}`);
+    if (cleared) console.log(`  ${import_chalk39.default.dim("\u2022")} removed ${cleared} APIblaze block(s) from ${import_chalk39.default.bold(path17.basename(file2))}`);
   }
-  console.log(`${import_chalk37.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
-  console.log(import_chalk37.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
+  console.log(`${import_chalk39.default.green("\u2714")} Flushed \u2014 removed ${removed} item(s). You're fully logged out and clean.`);
+  console.log(import_chalk39.default.dim("  Next `apiblaze create` starts a brand-new workspace with nothing carried over."));
 }
 
 // src/cli.ts
 init_demo();
 
 // src/commands/whoami.ts
-var import_chalk38 = __toESM(require("chalk"));
+var import_chalk40 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 init_anon_cred();
@@ -15668,54 +16024,54 @@ async function runWhoami(opts = {}) {
     }, null, 2));
     return;
   }
-  console.log(import_chalk38.default.bold("API Producer"));
+  console.log(import_chalk40.default.bold("API Producer"));
   if (!creds) {
-    console.log(import_chalk38.default.dim("  Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk40.default.dim("  Not logged in. Run `apiblaze login`."));
   } else {
     const who = creds.githubHandle ?? creds.email ?? creds.apiblazeUserId ?? "unknown";
-    console.log(`  ${import_chalk38.default.cyan("Signed in as")} ${import_chalk38.default.bold(who)}`);
+    console.log(`  ${import_chalk40.default.cyan("Signed in as")} ${import_chalk40.default.bold(who)}`);
     if (creds.email && creds.email !== who) console.log(`  Email:   ${creds.email}`);
-    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk38.default.bold(creds.teamName ?? creds.teamId)}`);
-    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk38.default.bold(creds.activeTenant)}  ${import_chalk38.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
-    if (Date.now() >= creds.expiresAt) console.log(import_chalk38.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
+    if (creds.teamName || creds.teamId) console.log(`  Team:    ${import_chalk40.default.bold(creds.teamName ?? creds.teamId)}`);
+    if (creds.activeTenant) console.log(`  Tenant scope: ${import_chalk40.default.bold(creds.activeTenant)}  ${import_chalk40.default.dim("(clear: `apiblaze tenant use --clear`)")}`);
+    if (Date.now() >= creds.expiresAt) console.log(import_chalk40.default.yellow("  \u26A0 Session expired \u2014 run `apiblaze login`."));
   }
   if (anon) {
     const masked = `${anon.cp_key.slice(0, 11)}\u2026${anon.cp_key.slice(-4)}`;
-    console.log(import_chalk38.default.bold("\nAnonymous workspace") + import_chalk38.default.dim("  (created without an account \u2014 unclaimed)"));
-    console.log(`  Team:    ${import_chalk38.default.bold(anon.team_id)}`);
-    console.log(`  CP key:  ${import_chalk38.default.bold(masked)}  ${import_chalk38.default.dim("controls the proxies you created anonymously")}`);
+    console.log(import_chalk40.default.bold("\nAnonymous workspace") + import_chalk40.default.dim("  (created without an account \u2014 unclaimed)"));
+    console.log(`  Team:    ${import_chalk40.default.bold(anon.team_id)}`);
+    console.log(`  CP key:  ${import_chalk40.default.bold(masked)}  ${import_chalk40.default.dim("controls the proxies you created anonymously")}`);
     console.log(
-      import_chalk38.default.dim(`  Keep it: ${import_chalk38.default.cyan("apiblaze login")} then ${import_chalk38.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk38.default.dim(`  \xB7  from another machine: ${import_chalk38.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
+      import_chalk40.default.dim(`  Keep it: ${import_chalk40.default.cyan("apiblaze login")} then ${import_chalk40.default.cyan("apiblaze claim")}`) + (anon.claim_code ? import_chalk40.default.dim(`  \xB7  from another machine: ${import_chalk40.default.cyan(`apiblaze claim ${anon.claim_code}`)}`) : "")
     );
-    if (creds) console.log(import_chalk38.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
+    if (creds) console.log(import_chalk40.default.dim("  (you're logged in \u2014 `apiblaze claim` folds this workspace into your account)"));
   }
-  console.log(import_chalk38.default.bold("\nAPI Consumer"));
+  console.log(import_chalk40.default.bold("\nAPI Consumer"));
   if (!consumer) {
-    console.log(import_chalk38.default.dim("  Not logged in. Run `apiblaze consumer login`."));
+    console.log(import_chalk40.default.dim("  Not logged in. Run `apiblaze consumer login`."));
   } else {
-    console.log(`  ${import_chalk38.default.cyan("Signed in as")} ${import_chalk38.default.bold(consumer.email ?? consumer.tenant)}`);
-    console.log(`  Tenant:  ${import_chalk38.default.bold(consumer.tenant)}`);
-    if (Date.now() >= consumer.expiresAt) console.log(import_chalk38.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
+    console.log(`  ${import_chalk40.default.cyan("Signed in as")} ${import_chalk40.default.bold(consumer.email ?? consumer.tenant)}`);
+    console.log(`  Tenant:  ${import_chalk40.default.bold(consumer.tenant)}`);
+    if (Date.now() >= consumer.expiresAt) console.log(import_chalk40.default.yellow("  \u26A0 Token expired \u2014 it will refresh on next use, or re-run `apiblaze consumer login`."));
   }
 }
 
 // src/commands/team.ts
-var import_chalk39 = __toESM(require("chalk"));
-var import_ora13 = __toESM(require("ora"));
+var import_chalk41 = __toESM(require("chalk"));
+var import_ora15 = __toESM(require("ora"));
 init_auth();
 init_api();
 init_admin();
 function fail5(message, hint) {
-  console.error(import_chalk39.default.red(`Error: ${message}`));
-  if (hint) console.error(import_chalk39.default.dim(hint));
+  console.error(import_chalk41.default.red(`Error: ${message}`));
+  if (hint) console.error(import_chalk41.default.dim(hint));
   process.exit(1);
 }
 function activate(creds, team) {
   const next = { ...creds, teamId: team.teamId, teamName: team.name };
   if (creds.teamId !== team.teamId) delete next.activeTenant;
   saveCredentials(next);
-  console.log(import_chalk39.default.green(`
-\u2714 Active team: ${import_chalk39.default.bold(team.name)}`));
+  console.log(import_chalk41.default.green(`
+\u2714 Active team: ${import_chalk41.default.bold(team.name)}`));
 }
 async function promptName(message) {
   const { default: inquirer3 } = await import("inquirer");
@@ -15723,14 +16079,14 @@ async function promptName(message) {
     const { name } = await inquirer3.prompt([{ type: "input", name: "name", message }]);
     const trimmed = (name ?? "").trim();
     if (trimmed.length >= 2) return trimmed;
-    console.log(import_chalk39.default.yellow("  Team name must be at least 2 characters.\n"));
+    console.log(import_chalk41.default.yellow("  Team name must be at least 2 characters.\n"));
   }
 }
 async function createAndActivate(creds, name) {
   if (!creds.apiblazeUserId) {
     fail5("Your login is missing its user id.", "Run `apiblaze login` again, then retry.");
   }
-  const spinner = (0, import_ora13.default)(`Creating team "${name}"...`).start();
+  const spinner = (0, import_ora15.default)(`Creating team "${name}"...`).start();
   let created;
   try {
     created = await admin({
@@ -15745,7 +16101,7 @@ async function createAndActivate(creds, name) {
   }
   spinner.stop();
   if (!created?.team_id) fail5("The server created no team id.");
-  console.log(`${import_chalk39.default.green("\u2714")} Team created: ${import_chalk39.default.bold(created.name ?? name)} ${import_chalk39.default.dim(`(${created.team_id})`)}`);
+  console.log(`${import_chalk41.default.green("\u2714")} Team created: ${import_chalk41.default.bold(created.name ?? name)} ${import_chalk41.default.dim(`(${created.team_id})`)}`);
   activate(creds, { teamId: created.team_id, name: created.name ?? name });
 }
 async function runTeam(arg, opts = {}) {
@@ -15802,11 +16158,11 @@ async function runTeam(arg, opts = {}) {
     default: creds.teamId,
     choices: [
       ...teams.map((t) => ({
-        name: t.teamId === creds.teamId ? `${t.name} ${import_chalk39.default.dim("(current)")}` : t.name,
+        name: t.teamId === creds.teamId ? `${t.name} ${import_chalk41.default.dim("(current)")}` : t.name,
         value: t.teamId
       })),
       new inquirer3.Separator(),
-      { name: import_chalk39.default.green("\uFF0B Create a new team"), value: CREATE }
+      { name: import_chalk41.default.green("\uFF0B Create a new team"), value: CREATE }
     ]
   }]);
   if (picked === CREATE) {
@@ -15821,7 +16177,7 @@ async function runTeam(arg, opts = {}) {
 init_allow_oauth_registration();
 
 // src/commands/docs.ts
-var import_chalk40 = __toESM(require("chalk"));
+var import_chalk42 = __toESM(require("chalk"));
 init_apichat();
 init_brand();
 var MCPBLAZE_DOCS_NOTE = 'The user is on MCPblaze: say "MCP server", never "proxy". The front door is create_mcp_server (an MCP server from an OpenAPI spec; it returns the connector URL and the scorecard page), get_readiness (where a listing stands and what is next) and, in the terminal, `npx mcpblaze connector <name>`. The details \u2014 the custom hostname, the listing fields, attestations, the reviewer account, the packet \u2014 are finished on the scorecard page, not here. Passing the checks means the MCP meets the requirements we can verify; the user submits, the directories decide.';
@@ -15834,32 +16190,32 @@ async function runDocsWeb() {
   const { openRegistrationAuthorization: openRegistrationAuthorization2 } = await Promise.resolve().then(() => (init_allow_oauth_registration(), allow_oauth_registration_exports));
   const creds = loadCredentials2();
   if (!creds?.teamId) {
-    console.error(import_chalk40.default.red("Error: Connecting a web chatbot needs an account."));
-    console.error(import_chalk40.default.dim("Run `apiblaze login` first (free)."));
+    console.error(import_chalk42.default.red("Error: Connecting a web chatbot needs an account."));
+    console.error(import_chalk42.default.dim("Run `apiblaze login` first (free)."));
     process.exit(1);
   }
   const tenant = opTenantForTeam3(creds.teamId);
   const url = B.cli === "mcpblaze" ? `https://externalauth-${tenant}.mcpblaze.com/1.0.0/prod` : `https://externalauth-${tenant}.mcp.apiblaze.com/1.0.0/prod`;
-  console.log(import_chalk40.default.bold(`
+  console.log(import_chalk42.default.bold(`
   Your personal ${B.product} MCP URL \u2014 paste it into claude.ai or ChatGPT:
 `));
-  console.log("    " + import_chalk40.default.bgCyan.black.bold(` ${url} `));
-  console.log(import_chalk40.default.dim(`
+  console.log("    " + import_chalk42.default.bgCyan.black.bold(` ${url} `));
+  console.log(import_chalk42.default.dim(`
   It is scoped to your team (${creds.teamName ?? creds.teamId}) \u2014 nobody else's account is reachable through it.`));
   const ok = await openRegistrationAuthorization2(creds.teamId, tenant, 900);
   console.log(ok ? `
-  ${import_chalk40.default.green("\u2714")} Connection pre-authorized (single use, 15 min) \u2014 connect now and it won't ask you to approve the app.` : import_chalk40.default.yellow(`
+  ${import_chalk42.default.green("\u2714")} Connection pre-authorized (single use, 15 min) \u2014 connect now and it won't ask you to approve the app.` : import_chalk42.default.yellow(`
   Could not pre-authorize the connection. If the sign-in says the app needs verifying, run:
     ${B.cli} allowoauthregistration ${B.cli === "mcpblaze" ? "--control-plane" : "--apiblaze"}`));
-  console.log(import_chalk40.default.dim("\n  Re-run this command any time to authorize another client."));
+  console.log(import_chalk42.default.dim("\n  Re-run this command any time to authorize another client."));
 }
 async function runDocs(opts) {
   console.log("");
-  console.log(import_chalk40.default.bgYellow.black.bold("  This is not a docs search \u2014 the chatbot can CHANGE your account.  "));
-  console.log(import_chalk40.default.yellow(`  It connects ${import_chalk40.default.bold("Claude Code")} or ${import_chalk40.default.bold("Codex")} to the real ${B.product} ${B.cli === "mcpblaze" ? "MCP server" : "API"}, acting as you:`));
-  console.log(import_chalk40.default.yellow(B.cli === "mcpblaze" ? "  it can create MCP servers, change their settings and delete them for real." : "  it can create proxies, add logins, invite teammates and point domains for real."));
-  console.log(import_chalk40.default.yellow("  Destructive actions (deleting proxies, teams or products) are deliberately not exposed."));
-  console.log(import_chalk40.default.dim('  Read-only questions ("what proxies do I have?") are of course fine.'));
+  console.log(import_chalk42.default.bgYellow.black.bold("  This is not a docs search \u2014 the chatbot can CHANGE your account.  "));
+  console.log(import_chalk42.default.yellow(`  It connects ${import_chalk42.default.bold("Claude Code")} or ${import_chalk42.default.bold("Codex")} to the real ${B.product} ${B.cli === "mcpblaze" ? "MCP server" : "API"}, acting as you:`));
+  console.log(import_chalk42.default.yellow(B.cli === "mcpblaze" ? "  it can create MCP servers, change their settings and delete them for real." : "  it can create proxies, add logins, invite teammates and point domains for real."));
+  console.log(import_chalk42.default.yellow("  Destructive actions (deleting proxies, teams or products) are deliberately not exposed."));
+  console.log(import_chalk42.default.dim('  Read-only questions ("what proxies do I have?") are of course fine.'));
   console.log("");
   if (!opts.yes && !opts.prompt && process.stdin.isTTY) {
     const { default: inquirer3 } = await import("inquirer");
@@ -15870,7 +16226,7 @@ async function runDocs(opts) {
       message: "Continue, knowing the chatbot can act on your account?"
     }]);
     if (!ok) {
-      console.log(import_chalk40.default.dim(`
+      console.log(import_chalk42.default.dim(`
   Nothing connected. The written docs are at ${B.cli === "mcpblaze" ? "https://mcpblaze.com" : "https://www.apiblaze.com/docs"}`));
       return;
     }
@@ -15893,13 +16249,13 @@ async function runDocs(opts) {
 }
 
 // src/commands/authz.ts
-var import_chalk42 = __toESM(require("chalk"));
+var import_chalk44 = __toESM(require("chalk"));
 init_auth();
 init_api();
 init_agent_chat();
 
 // src/lib/authz-apply.ts
-var import_chalk41 = __toESM(require("chalk"));
+var import_chalk43 = __toESM(require("chalk"));
 init_api();
 async function gatherSampleIds(projectId, apiVersion, cap2 = 50) {
   try {
@@ -15924,10 +16280,10 @@ async function gatherSampleIds(projectId, apiVersion, cap2 = 50) {
 }
 function maybeWarnNoTraffic(total, projectArg) {
   if (total >= 3) return;
-  console.log(import_chalk41.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
-  console.log(import_chalk41.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
-  console.log(import_chalk41.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
-  console.log(import_chalk41.default.dim(`    curl a few endpoints, or `) + import_chalk41.default.cyan("npx apiblaze dev") + import_chalk41.default.dim(` \u2014 then re-run.
+  console.log(import_chalk43.default.yellow(total === 0 ? "  \u26A0 No captured traffic for this API yet." : `  \u26A0 Only ${total} captured request(s) so far.`));
+  console.log(import_chalk43.default.dim("    The authorization agent designs much better models & rules from REAL requests"));
+  console.log(import_chalk43.default.dim("    (it sees who is allowed vs denied). Send some through your proxy first \u2014"));
+  console.log(import_chalk43.default.dim(`    curl a few endpoints, or `) + import_chalk43.default.cyan("npx apiblaze dev") + import_chalk43.default.dim(` \u2014 then re-run.
 `));
 }
 async function applyProposal(opts) {
@@ -15936,12 +16292,12 @@ async function applyProposal(opts) {
   {
     const m = await agentCall(`/projects/${projectId}/${apiVersion}/policies/model?tenantId=${encodeURIComponent(tenant)}`, "POST", proposal.model);
     if (m.status === 404) {
-      log4(import_chalk41.default.red(`  Project ${projectId} ${apiVersion} not found on the authorization service \u2014 check \`apiblaze projects\`.
+      log4(import_chalk43.default.red(`  Project ${projectId} ${apiVersion} not found on the authorization service \u2014 check \`apiblaze projects\`.
 `));
       return { ok: 0, fail: 0, enabled: false, aborted: true };
     }
     if (m.status >= 400) {
-      log4(import_chalk41.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
+      log4(import_chalk43.default.red(`  Model save failed (${m.status}): ${m.data?.error ?? ""}
 `));
       return { ok: 0, fail: 0, enabled: false, aborted: true };
     }
@@ -15973,17 +16329,17 @@ async function applyProposal(opts) {
     }
   }
   if (fail7 > 0) {
-    log4(import_chalk41.default.red(`  ${fail7} of ${proposal.routes.length} route rule(s) could not be saved:`));
-    for (const f2 of failed) log4(import_chalk41.default.red(`    ${f2}`));
+    log4(import_chalk43.default.red(`  ${fail7} of ${proposal.routes.length} route rule(s) could not be saved:`));
+    for (const f2 of failed) log4(import_chalk43.default.red(`    ${f2}`));
     if (enable) {
-      log4(import_chalk41.default.red("  Enforcement NOT turned on \u2014 a route without a saved rule is left open by the gateway. Fix the rule(s) above and re-run with --enforce.\n"));
+      log4(import_chalk43.default.red("  Enforcement NOT turned on \u2014 a route without a saved rule is left open by the gateway. Fix the rule(s) above and re-run with --enforce.\n"));
     }
     return { ok, fail: fail7, enabled: false, aborted: true, failed };
   }
   if (enable) {
     const e = await agentCall(`/projects/${projectId}/${apiVersion}`, "PATCH", { authorization: { enforce_authorization: true }, tenant });
     if (e.status >= 400) {
-      log4(import_chalk41.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
+      log4(import_chalk43.default.red(`  Enforced ${ok} route(s) but turning on the project-level switch failed (${e.status}). Toggle "Enforce Authorization" on in the dashboard.
 `));
       return { ok, fail: fail7, enabled: false, failed };
     }
@@ -16011,19 +16367,19 @@ async function runAuthz(projectArg, apiVersionArg) {
     const proposal = ctx.proposal;
     const r = await applyProposal({ projectId, apiVersion, tenant, proposal, enable, log: ctx.log });
     if (r.aborted) {
-      ctx.log(import_chalk42.default.red(enable ? `  Enforcement NOT on \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /enable again.
+      ctx.log(import_chalk44.default.red(enable ? `  Enforcement NOT on \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /enable again.
 ` : `  Not published \u2014 ${r.fail || "the"} route rule(s) failed. Fix them and /publish again.
 `));
       return;
     }
     if (enable && r.enabled) {
-      ctx.log(import_chalk42.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on.`));
-      ctx.log(import_chalk42.default.dim("  Route config takes up to ~90 s to reach every edge. Undo any time: ") + import_chalk42.default.cyan(`apiblaze config ${projectArg} authorization.enforce_authorization false`));
-      ctx.log(import_chalk42.default.dim("  Done here? Type /exit to leave the chat (your rule stays on).\n"));
+      ctx.log(import_chalk44.default.green(`  \u2713 Enforcement ON \u2014 ${r.ok} route(s) + project switch on.`));
+      ctx.log(import_chalk44.default.dim("  Route config takes up to ~90 s to reach every edge. Undo any time: ") + import_chalk44.default.cyan(`apiblaze config ${projectArg} authorization.enforce_authorization false`));
+      ctx.log(import_chalk44.default.dim("  Done here? Type /exit to leave the chat (your rule stays on).\n"));
     } else if (enable) {
-      ctx.log(import_chalk42.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above).\n"));
+      ctx.log(import_chalk44.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above).\n"));
     } else {
-      ctx.log(import_chalk42.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s). Review, then /enable.
+      ctx.log(import_chalk44.default.green(`  \u2713 Published (shadow): model + ${r.ok} route(s). Review, then /enable.
 `));
     }
   }
@@ -16050,8 +16406,8 @@ async function runAuthz(projectArg, apiVersionArg) {
 }
 
 // src/commands/rule.ts
-var import_chalk43 = __toESM(require("chalk"));
-var import_ora14 = __toESM(require("ora"));
+var import_chalk45 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
 init_auth();
 init_api();
 init_create();
@@ -16075,15 +16431,15 @@ async function runRule(projectArg, ruleText, opts) {
   if (opts.off) {
     const { status: status3, data: data2 } = await agentCall(`/projects/${projectId}/${apiVersion}`, "PATCH", { authorization: { enforce_authorization: false }, tenant });
     if (status3 >= 400) throw new Error(`Could not turn enforcement off (${status3}): ${data2?.error ?? ""}`);
-    console.log(import_chalk43.default.green("  \u2713 Enforcement OFF \u2014 the rules are kept (shadow mode)."));
-    console.log(import_chalk43.default.dim("  Turn it back on: ") + import_chalk43.default.cyan(`${B.cli} rule ${projectArg} --enforce`));
+    console.log(import_chalk45.default.green("  \u2713 Enforcement OFF \u2014 the rules are kept (shadow mode)."));
+    console.log(import_chalk45.default.dim("  Turn it back on: ") + import_chalk45.default.cyan(`${B.cli} rule ${projectArg} --enforce`));
     return;
   }
   const rule = (ruleText ?? "").trim();
   if (!rule) return proposeFromSpecBranch(ctx, opts);
   const { ids: sampleIds, total: sampleTotal } = await gatherSampleIds(projectId, apiVersion);
   maybeWarnNoTraffic(sampleTotal, projectArg);
-  const spinner = (0, import_ora14.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
+  const spinner = (0, import_ora16.default)(sampleIds.length ? `Designing the rule from ${sampleIds.length} traffic sample(s)\u2026` : "Designing the rule\u2026").start();
   const messages = [{
     role: "user",
     content: `Author this authorization rule and generate the COMPLETE proposal (OpenFGA model + per-route rules) NOW for every affected route. Do not ask clarifying questions; make reasonable assumptions and state them briefly. Rule: "${rule}"`
@@ -16100,18 +16456,18 @@ async function runRule(projectArg, ruleText, opts) {
   const proposal = data?.proposal;
   if (!proposal || !Array.isArray(proposal.routes) || proposal.routes.length === 0) {
     spinner.fail("The agent couldn\u2019t turn that into a rule in one shot.");
-    if (data?.reply) console.log(import_chalk43.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
-    console.log(import_chalk43.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk43.default.cyan(`${B.cli} agent authz ${projectArg}`));
+    if (data?.reply) console.log(import_chalk45.default.dim("\n  " + String(data.reply).slice(0, 500) + "\n"));
+    console.log(import_chalk45.default.dim("  Try an interactive session for anything nuanced: ") + import_chalk45.default.cyan(`${B.cli} agent authz ${projectArg}`));
     return;
   }
   spinner.succeed(`Rule designed \u2014 ${proposal.routes.length} route(s) affected.`);
-  if (data?.reply) console.log(import_chalk43.default.dim("  " + String(data.reply).slice(0, 240)));
+  if (data?.reply) console.log(import_chalk45.default.dim("  " + String(data.reply).slice(0, 240)));
   await shadowThenEnforce(ctx, proposal, opts.enforce ? "yes" : "no", `${B.cli} rule ${projectArg} "${rule}" --enforce`);
 }
 async function proposeFromSpecBranch(ctx, opts) {
   const { projectId, apiVersion, projectArg } = ctx;
   const interactive2 = !!process.stdin.isTTY;
-  const spinner = (0, import_ora14.default)("Reading the spec for things to protect\u2026").start();
+  const spinner = (0, import_ora16.default)("Reading the spec for things to protect\u2026").start();
   const first = await agentCall(`/projects/${projectId}/${apiVersion}/authz/propose`, "POST", {});
   if (first.status >= 400) {
     spinner.fail(`Could not work out what to protect (${first.status}): ${first.data?.details ?? first.data?.error ?? ""}`);
@@ -16121,36 +16477,36 @@ async function proposeFromSpecBranch(ctx, opts) {
   const protectable = families.filter((f2) => !f2.skipped_reason);
   if (!protectable.length) {
     spinner.stop();
-    console.log(import_chalk43.default.dim(`  Nothing to lock: the spec has no resource with a POST collection plus item routes${families.length ? ` (${families.length} candidate(s) not protectable)` : ""}.`));
-    console.log(import_chalk43.default.dim("  Describe the rule instead: ") + import_chalk43.default.cyan(`${B.cli} rule ${projectArg} "users see only their own rows"`));
+    console.log(import_chalk45.default.dim(`  Nothing to lock: the spec has no resource with a POST collection plus item routes${families.length ? ` (${families.length} candidate(s) not protectable)` : ""}.`));
+    console.log(import_chalk45.default.dim("  Describe the rule instead: ") + import_chalk45.default.cyan(`${B.cli} rule ${projectArg} "users see only their own rows"`));
     return;
   }
   spinner.stop();
   const chosen = interactive2 ? await pickFamilies(families) : protectable.map((f2) => f2.key);
   if (!chosen.length) {
-    console.log(import_chalk43.default.dim("  Nothing selected \u2014 no rules written."));
+    console.log(import_chalk45.default.dim("  Nothing selected \u2014 no rules written."));
     return;
   }
   let data = first.data;
   if (chosen.length !== protectable.length) {
     const second = await agentCall(`/projects/${projectId}/${apiVersion}/authz/propose`, "POST", { families: chosen });
     if (second.status >= 400) {
-      console.log(import_chalk43.default.red(`  Could not build the rules for that selection (${second.status}): ${second.data?.error ?? ""}`));
+      console.log(import_chalk45.default.red(`  Could not build the rules for that selection (${second.status}): ${second.data?.error ?? ""}`));
       return;
     }
     data = second.data;
   }
   const proposal = data?.proposal;
   if (!proposal || !Array.isArray(proposal.routes) || !proposal.routes.length) {
-    console.log(import_chalk43.default.red("  The authorization service returned no routes for that selection."));
+    console.log(import_chalk45.default.red("  The authorization service returned no routes for that selection."));
     return;
   }
   const sim = data?.simulation;
   if (sim?.blocked_without_backfill) {
-    console.log(import_chalk43.default.yellow(`  \u26A0 ${sim.blocked_without_backfill} request(s) that succeed today would be denied once enforced \u2014`));
-    console.log(import_chalk43.default.yellow("    rows created before the rules have no recorded owner. Backfill them or accept it."));
+    console.log(import_chalk45.default.yellow(`  \u26A0 ${sim.blocked_without_backfill} request(s) that succeed today would be denied once enforced \u2014`));
+    console.log(import_chalk45.default.yellow("    rows created before the rules have no recorded owner. Backfill them or accept it."));
   }
-  console.log(import_chalk43.default.green(`  \u2713 ${chosen.map((k) => k.replace(/^\//, "")).join(" + ")} \u2014 ${proposal.routes.length} route rule(s).`));
+  console.log(import_chalk45.default.green(`  \u2713 ${chosen.map((k) => k.replace(/^\//, "")).join(" + ")} \u2014 ${proposal.routes.length} route rule(s).`));
   let enforce = opts.enforce ? "yes" : interactive2 ? "ask" : "no";
   await shadowThenEnforce(ctx, proposal, enforce, `${B.cli} rule ${projectArg} --enforce`);
 }
@@ -16158,37 +16514,37 @@ async function shadowThenEnforce(ctx, proposal, enforce, enforceCmd) {
   const { projectId, apiVersion, tenant, projectArg } = ctx;
   const pub = await applyProposal({ projectId, apiVersion, tenant, proposal, enable: false });
   if (pub.aborted) {
-    console.log(import_chalk43.default.red(`  Nothing saved${pub.ok ? ` beyond ${pub.ok} route(s)` : ""} \u2014 fix the error above and re-run.`));
+    console.log(import_chalk45.default.red(`  Nothing saved${pub.ok ? ` beyond ${pub.ok} route(s)` : ""} \u2014 fix the error above and re-run.`));
     return;
   }
-  console.log(import_chalk43.default.green(`  \u2713 Saved in shadow mode \u2014 model + ${pub.ok} route(s). Nothing is blocked yet.`));
+  console.log(import_chalk45.default.green(`  \u2713 Saved in shadow mode \u2014 model + ${pub.ok} route(s). Nothing is blocked yet.`));
   if (enforce === "ask") {
     const { default: inquirer3 } = await import("inquirer");
     const { on } = await inquirer3.prompt([{ type: "confirm", name: "on", message: "Turn enforcement on now?", default: true }]);
     enforce = on ? "yes" : "no";
   }
   if (enforce !== "yes") {
-    console.log(import_chalk43.default.dim("  Review it (shadow logs), then enforce: ") + import_chalk43.default.cyan(enforceCmd));
+    console.log(import_chalk45.default.dim("  Review it (shadow logs), then enforce: ") + import_chalk45.default.cyan(enforceCmd));
     return;
   }
   const enf = await applyProposal({ projectId, apiVersion, tenant, proposal, enable: true });
   if (enf.aborted) {
-    console.log(import_chalk43.default.red(`  Enforcement NOT on \u2014 ${enf.fail} route rule(s) failed (listed above). Rules stay in shadow mode.`));
+    console.log(import_chalk45.default.red(`  Enforcement NOT on \u2014 ${enf.fail} route rule(s) failed (listed above). Rules stay in shadow mode.`));
     return;
   }
   if (!enf.enabled) {
-    console.log(import_chalk43.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above)."));
+    console.log(import_chalk45.default.red("  Enforcement NOT on \u2014 the routes are set but the project switch did not flip (see above)."));
     return;
   }
-  console.log(import_chalk43.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on.`));
-  console.log(import_chalk43.default.dim("  Route config takes up to ~90 s to reach every edge."));
-  console.log(import_chalk43.default.dim("  Testing a locked route? Use the sign-in door, or send X-End-User-Id / a key minted with --for \u2014"));
-  console.log(import_chalk43.default.dim("  a bare key has no person to check."));
-  console.log(import_chalk43.default.dim(`  Undo: `) + import_chalk43.default.cyan(B.cli === "mcpblaze" ? `${B.cli} rule ${projectArg} --off` : `${B.cli} config ${projectArg} authorization.enforce_authorization false`));
+  console.log(import_chalk45.default.green(`  \u2713 Enforcement ON \u2014 ${enf.ok} route(s) + project switch on.`));
+  console.log(import_chalk45.default.dim("  Route config takes up to ~90 s to reach every edge."));
+  console.log(import_chalk45.default.dim("  Testing a locked route? Use the sign-in door, or send X-End-User-Id / a key minted with --for \u2014"));
+  console.log(import_chalk45.default.dim("  a bare key has no person to check."));
+  console.log(import_chalk45.default.dim(`  Undo: `) + import_chalk45.default.cyan(B.cli === "mcpblaze" ? `${B.cli} rule ${projectArg} --off` : `${B.cli} config ${projectArg} authorization.enforce_authorization false`));
 }
 
 // src/commands/openapi.ts
-var import_chalk44 = __toESM(require("chalk"));
+var import_chalk46 = __toESM(require("chalk"));
 init_auth();
 init_api();
 init_agent_chat();
@@ -16200,10 +16556,10 @@ async function runOpenapi(projectArg, apiVersionArg) {
   if (!match) throw new Error(`Project "${projectArg}" not found in your active team. Run \`apiblaze projects\`.`);
   const projectId = match.projectId;
   const apiVersion = apiVersionArg || match.apiVersion;
-  console.log(import_chalk44.default.dim("Gathering captured traffic samples\u2026"));
+  console.log(import_chalk46.default.dim("Gathering captured traffic samples\u2026"));
   const routesRes = await agentCall(`/projects/${projectId}/${apiVersion}/samples/routes`, "GET");
   if (routesRes.status >= 400) {
-    console.log(import_chalk44.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
+    console.log(import_chalk46.default.red(`Could not list traffic (${routesRes.status}): ${routesRes.data?.error ?? ""}`));
     return;
   }
   const routes = routesRes.data?.routes ?? (Array.isArray(routesRes.data) ? routesRes.data : []);
@@ -16216,25 +16572,25 @@ async function runOpenapi(projectArg, apiVersionArg) {
   }
   const sampleIds = [...ids];
   if (sampleIds.length === 0) {
-    console.log(import_chalk44.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
+    console.log(import_chalk46.default.yellow("No captured traffic samples found. Hit the dev environment of this proxy to capture some traces, then retry."));
     return;
   }
   async function publish(ctx) {
     const patch = ctx.proposal.patch;
     if (!Array.isArray(patch) || patch.length === 0) {
-      ctx.log(import_chalk44.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
+      ctx.log(import_chalk46.default.green("  Nothing to publish \u2014 the spec already covers the observed traffic.\n"));
       return;
     }
     const specSource = ctx.lastData?.spec_source ?? "unknown";
     const endpoint = specSource === "github" ? "open-pr" : "publish-openapi";
     const pub = await agentCall(`/projects/${projectId}/${apiVersion}/samples/${endpoint}`, "POST", { patch, sample_ids_used: sampleIds });
     if (pub.status >= 400) {
-      ctx.log(import_chalk44.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
+      ctx.log(import_chalk46.default.red(`  Publish failed (${pub.status}): ${pub.data?.error ?? ""}
 `));
       return;
     }
     const prUrl = pub.data?.pr_url;
-    ctx.log(import_chalk44.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
+    ctx.log(import_chalk46.default.green(prUrl ? `  \u2713 Pull request opened: ${prUrl}
 ` : "  \u2713 Published updated OpenAPI spec.\n"));
   }
   await runAgentChatRepl({
@@ -16258,13 +16614,13 @@ async function runOpenapi(projectArg, apiVersionArg) {
 init_mcp();
 
 // src/commands/delete.ts
-var import_chalk46 = __toESM(require("chalk"));
-var import_ora15 = __toESM(require("ora"));
+var import_chalk48 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 
 // src/lib/job.ts
-var import_chalk45 = __toESM(require("chalk"));
+var import_chalk47 = __toESM(require("chalk"));
 init_admin();
 var POLL_MS = 3e3;
 var MAX_WAIT_MS = 30 * 6e4;
@@ -16298,7 +16654,7 @@ async function pollJob(jobId, opts = {}) {
   const started = Date.now();
   const path20 = jobPath(jobId, opts.teamId);
   let lastPhase = "";
-  if (!opts.quiet) process.stdout.write(import_chalk45.default.dim(opts.label ?? "Deleting"));
+  if (!opts.quiet) process.stdout.write(import_chalk47.default.dim(opts.label ?? "Deleting"));
   for (; ; ) {
     if (Date.now() - started > MAX_WAIT_MS) {
       if (!opts.quiet) process.stdout.write("\n");
@@ -16312,11 +16668,11 @@ async function pollJob(jobId, opts = {}) {
     if (!opts.quiet) {
       const phase = describeJob(job);
       if (phase !== lastPhase) {
-        process.stdout.write(import_chalk45.default.dim(`
+        process.stdout.write(import_chalk47.default.dim(`
   ${phase}`));
         lastPhase = phase;
       }
-      process.stdout.write(import_chalk45.default.dim("."));
+      process.stdout.write(import_chalk47.default.dim("."));
     }
     if (job.status === "done" || job.status === "failed") {
       if (!opts.quiet) process.stdout.write("\n");
@@ -16329,7 +16685,7 @@ async function settleDelete(accepted, opts) {
   if (!jobId) return null;
   if (opts.noWait) {
     if (!opts.json) {
-      console.log(import_chalk45.default.dim(`Queued as job ${jobId}. Check it with: apiblaze job ${jobId}${opts.teamId ? ` --team ${opts.teamId}` : ""}`));
+      console.log(import_chalk47.default.dim(`Queued as job ${jobId}. Check it with: apiblaze job ${jobId}${opts.teamId ? ` --team ${opts.teamId}` : ""}`));
     }
     return null;
   }
@@ -16350,7 +16706,7 @@ async function settleDelete(accepted, opts) {
 async function runDelete(project, version2, opts) {
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, version2);
-  const spinner = (0, import_ora15.default)("Checking delete impact...").start();
+  const spinner = (0, import_ora17.default)("Checking delete impact...").start();
   let impact;
   try {
     impact = await admin({
@@ -16369,10 +16725,10 @@ async function runDelete(project, version2, opts) {
       return;
     }
   } else {
-    console.log(`${import_chalk46.default.red.bold("Delete")} ${import_chalk46.default.bold(proj2.projectName)} ${import_chalk46.default.dim("v" + proj2.apiVersion)} ${import_chalk46.default.dim("(" + proj2.projectId + ")")}`);
+    console.log(`${import_chalk48.default.red.bold("Delete")} ${import_chalk48.default.bold(proj2.projectName)} ${import_chalk48.default.dim("v" + proj2.apiVersion)} ${import_chalk48.default.dim("(" + proj2.projectId + ")")}`);
     if (impact && typeof impact === "object") {
       const counts = impact.counts ?? impact.impact ?? impact;
-      console.log(import_chalk46.default.dim("  This removes (cascade): ") + import_chalk46.default.yellow(JSON.stringify(counts)));
+      console.log(import_chalk48.default.dim("  This removes (cascade): ") + import_chalk48.default.yellow(JSON.stringify(counts)));
     }
     if (!opts.yes) {
       const { default: inquirer3 } = await import("inquirer");
@@ -16380,12 +16736,12 @@ async function runDelete(project, version2, opts) {
         { type: "confirm", name: "confirm", message: `Permanently delete ${proj2.projectName} v${proj2.apiVersion}? This cannot be undone.`, default: false }
       ]);
       if (!confirm3) {
-        console.log(import_chalk46.default.dim("Aborted."));
+        console.log(import_chalk48.default.dim("Aborted."));
         return;
       }
     }
   }
-  const s2 = (0, import_ora15.default)("Deleting...").start();
+  const s2 = (0, import_ora17.default)("Deleting...").start();
   let accepted;
   try {
     accepted = await admin({
@@ -16406,7 +16762,7 @@ async function runDelete(project, version2, opts) {
   });
   if (!opts.json) {
     if (job || accepted?.job_id == null) {
-      console.log(import_chalk46.default.green(`\u2714 Deleted ${proj2.projectName} v${proj2.apiVersion}.`));
+      console.log(import_chalk48.default.green(`\u2714 Deleted ${proj2.projectName} v${proj2.apiVersion}.`));
     }
   } else {
     console.log(JSON.stringify({
@@ -16419,7 +16775,7 @@ async function runDelete(project, version2, opts) {
 }
 
 // src/commands/job.ts
-var import_chalk47 = __toESM(require("chalk"));
+var import_chalk49 = __toESM(require("chalk"));
 init_admin();
 init_resolve();
 async function runJobStatus(jobId, opts) {
@@ -16435,24 +16791,24 @@ async function runJobStatus(jobId, opts) {
     if (job.status === "failed") process.exitCode = 1;
     return;
   }
-  const colour = job.status === "done" ? import_chalk47.default.green : job.status === "failed" ? import_chalk47.default.red : import_chalk47.default.yellow;
-  console.log(`${import_chalk47.default.bold(job.job_id)} ${import_chalk47.default.dim(`(${job.kind})`)}  ${colour.bold(job.status)}`);
+  const colour = job.status === "done" ? import_chalk49.default.green : job.status === "failed" ? import_chalk49.default.red : import_chalk49.default.yellow;
+  console.log(`${import_chalk49.default.bold(job.job_id)} ${import_chalk49.default.dim(`(${job.kind})`)}  ${colour.bold(job.status)}`);
   if (job.status === "queued" || job.status === "running") {
-    console.log(import_chalk47.default.dim(`  ${describeJob(job)}`));
+    console.log(import_chalk49.default.dim(`  ${describeJob(job)}`));
   }
   const counts = [];
   if (job.progress?.proxies) counts.push(`${job.progress.proxies} prox`);
   if (job.progress?.tenants) counts.push(`${job.progress.tenants} tenant(s)`);
-  if (counts.length) console.log(import_chalk47.default.dim(`  removed: ${counts.join(", ")}`));
-  if (job.attempts > 1) console.log(import_chalk47.default.dim(`  attempts: ${job.attempts}`));
-  if (job.error) console.log(import_chalk47.default.red(`  ${job.error}`));
+  if (counts.length) console.log(import_chalk49.default.dim(`  removed: ${counts.join(", ")}`));
+  if (job.attempts > 1) console.log(import_chalk49.default.dim(`  attempts: ${job.attempts}`));
+  if (job.error) console.log(import_chalk49.default.red(`  ${job.error}`));
   const parked = job.progress?.failed_units ?? [];
-  if (parked.length) console.log(import_chalk47.default.red(`  left behind: ${parked.slice(0, 10).join(", ")}`));
+  if (parked.length) console.log(import_chalk49.default.red(`  left behind: ${parked.slice(0, 10).join(", ")}`));
   if (job.status === "failed") process.exitCode = 1;
 }
 
 // src/commands/export.ts
-var import_chalk48 = __toESM(require("chalk"));
+var import_chalk50 = __toESM(require("chalk"));
 var import_fs13 = require("fs");
 init_admin();
 init_auth();
@@ -16471,7 +16827,7 @@ async function runExport(projectArg, versionArg, opts) {
   if (opts.noConsumers) q.set("include_consumers", "0");
   if (opts.keys) q.set("keys", opts.keys);
   const qs = q.toString() ? `?${q.toString()}` : "";
-  console.log(import_chalk48.default.dim(`Queuing ${target2} export of ${projectId}@${version2}\u2026`));
+  console.log(import_chalk50.default.dim(`Queuing ${target2} export of ${projectId}@${version2}\u2026`));
   const job = await admin({
     path: `/projects/${projectId}/${version2}/export/${target2}${qs}`,
     method: "GET",
@@ -16481,11 +16837,11 @@ async function runExport(projectArg, versionArg, opts) {
   const statusPath = `/projects/${projectId}/${version2}/export/jobs/${job.job_id}`;
   let status2 = "queued";
   const started = Date.now();
-  process.stdout.write(import_chalk48.default.dim("Building bundle"));
+  process.stdout.write(import_chalk50.default.dim("Building bundle"));
   while (status2 !== "ready" && status2 !== "failed") {
     if (Date.now() - started > 10 * 6e4) throw new Error("Export timed out after 10 minutes.");
     await new Promise((r) => setTimeout(r, 3e3));
-    process.stdout.write(import_chalk48.default.dim("."));
+    process.stdout.write(import_chalk50.default.dim("."));
     const st = await admin({ path: statusPath, method: "GET", summary: "poll export" });
     status2 = st?.status ?? "queued";
     if (status2 === "failed") {
@@ -16503,15 +16859,15 @@ async function runExport(projectArg, versionArg, opts) {
   if (!res.ok) throw new Error(`Download failed (${res.status}): ${await res.text().catch(() => "")}`);
   const buf = Buffer.from(await res.arrayBuffer());
   (0, import_fs13.writeFileSync)(outFile, buf);
-  console.log(import_chalk48.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
-  if (job.decryption_key) console.log(import_chalk48.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
-  console.log(import_chalk48.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
-  if (target2 === "kong") console.log(import_chalk48.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
+  console.log(import_chalk50.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
+  if (job.decryption_key) console.log(import_chalk50.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
+  console.log(import_chalk50.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
+  if (target2 === "kong") console.log(import_chalk50.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
 }
 
 // src/commands/recipe-search.ts
-var import_chalk49 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_chalk51 = __toESM(require("chalk"));
+var import_ora18 = __toESM(require("ora"));
 init_caller();
 
 // src/lib/recipes.ts
@@ -16697,7 +17053,7 @@ function upstreamHosts(recipe) {
 
 // src/commands/recipe-search.ts
 async function runRecipeSearch(query, opts) {
-  const spinner = !opts.json ? (0, import_ora16.default)("Searching recipes...").start() : null;
+  const spinner = !opts.json ? (0, import_ora18.default)("Searching recipes...").start() : null;
   let hits;
   try {
     hits = await searchRecipes(query ?? "", opts.limit ? Number(opts.limit) : void 0);
@@ -16711,20 +17067,20 @@ async function runRecipeSearch(query, opts) {
     return;
   }
   if (!hits.length) {
-    console.log(import_chalk49.default.yellow(query ? `No public recipes match "${query}".` : "No public recipes yet."));
-    console.log(import_chalk49.default.dim("  Publish one with: apiblaze publish <proxy> --as @yourhandle/name"));
+    console.log(import_chalk51.default.yellow(query ? `No public recipes match "${query}".` : "No public recipes yet."));
+    console.log(import_chalk51.default.dim("  Publish one with: apiblaze publish <proxy> --as @yourhandle/name"));
     return;
   }
   console.log();
   for (const h of hits) {
-    const pin = h.latest_revision ? import_chalk49.default.dim(`@${h.latest_revision}`) : "";
-    const installs = h.install_count ? import_chalk49.default.dim(`  ${h.install_count} install${h.install_count === 1 ? "" : "s"}`) : "";
-    console.log(`  ${import_chalk49.default.bold(h.name)}${pin}${h.display_name ? import_chalk49.default.dim(` \u2014 ${h.display_name}`) : ""}${installs}`);
-    if (h.summary) console.log(`      ${import_chalk49.default.dim(h.summary)}`);
+    const pin = h.latest_revision ? import_chalk51.default.dim(`@${h.latest_revision}`) : "";
+    const installs = h.install_count ? import_chalk51.default.dim(`  ${h.install_count} install${h.install_count === 1 ? "" : "s"}`) : "";
+    console.log(`  ${import_chalk51.default.bold(h.name)}${pin}${h.display_name ? import_chalk51.default.dim(` \u2014 ${h.display_name}`) : ""}${installs}`);
+    if (h.summary) console.log(`      ${import_chalk51.default.dim(h.summary)}`);
   }
   console.log();
-  console.log(import_chalk49.default.dim(`  Install one with: ${import_chalk49.default.cyan(`npx apiblaze install ${hits[0].name}`)}`));
-  console.log(import_chalk49.default.dim(`  Read one first:   ${import_chalk49.default.cyan(`npx apiblaze show ${hits[0].name}`)}`));
+  console.log(import_chalk51.default.dim(`  Install one with: ${import_chalk51.default.cyan(`npx apiblaze install ${hits[0].name}`)}`));
+  console.log(import_chalk51.default.dim(`  Read one first:   ${import_chalk51.default.cyan(`npx apiblaze show ${hits[0].name}`)}`));
   console.log();
 }
 async function runRecipeShow(nameArg, opts) {
@@ -16732,7 +17088,7 @@ async function runRecipeShow(nameArg, opts) {
   const wantsSection = !!(opts.transforms || opts.settings || opts.auth || opts.openapi);
   const caller = resolveCaller();
   const head = ref.revision === void 0 ? await getRecipeHead(ref).catch(() => null) : null;
-  const spinner = !opts.json ? (0, import_ora16.default)(`Reading ${ref.name}...`).start() : null;
+  const spinner = !opts.json ? (0, import_ora18.default)(`Reading ${ref.name}...`).start() : null;
   let recipe;
   try {
     recipe = await fetchRecipeFile(ref, caller);
@@ -16750,8 +17106,8 @@ async function runRecipeShow(nameArg, opts) {
     return;
   }
   console.log();
-  console.log(`${import_chalk49.default.bold(`${recipe.name}@${recipe.revision}`)}${import_chalk49.default.dim(` \u2014 by ${ref.handle}`)}`);
-  if (recipe.display_name) console.log(`  ${import_chalk49.default.bold(recipe.display_name)}`);
+  console.log(`${import_chalk51.default.bold(`${recipe.name}@${recipe.revision}`)}${import_chalk51.default.dim(` \u2014 by ${ref.handle}`)}`);
+  if (recipe.display_name) console.log(`  ${import_chalk51.default.bold(recipe.display_name)}`);
   if (recipe.summary) console.log(`  ${recipe.summary}`);
   const meta = [
     head?.install_count !== void 0 ? `${head.install_count} install${head.install_count === 1 ? "" : "s"}` : null,
@@ -16759,7 +17115,7 @@ async function runRecipeShow(nameArg, opts) {
     recipe.published_at ? `published ${recipe.published_at.slice(0, 10)}` : null,
     `api version ${recipe.api_version}`
   ].filter(Boolean).join("  \xB7  ");
-  console.log(import_chalk49.default.dim(`  ${meta}`));
+  console.log(import_chalk51.default.dim(`  ${meta}`));
   console.log();
   if (wantsSection) {
     if (opts.settings) printSection("settings", recipe.settings);
@@ -16773,34 +17129,34 @@ async function runRecipeShow(nameArg, opts) {
   const rules = recipe.transformations?.rules?.length ?? 0;
   const tables = recipe.transformations?.mapping_tables?.length ?? 0;
   const keyTypes = recipe.auth?.key_types?.length ?? 0;
-  if (hosts.length) console.log(`  ${import_chalk49.default.dim("sends requests to")}  ${hosts.join(", ")}`);
-  console.log(`  ${import_chalk49.default.dim("creates          ")}  ${describeCreates(keyTypes, routes, !!recipe.settings.mcp_enabled)}`);
-  console.log(`  ${import_chalk49.default.dim("asks you for     ")}  ${recipe.questions.length} value${recipe.questions.length === 1 ? "" : "s"}`);
+  if (hosts.length) console.log(`  ${import_chalk51.default.dim("sends requests to")}  ${hosts.join(", ")}`);
+  console.log(`  ${import_chalk51.default.dim("creates          ")}  ${describeCreates(keyTypes, routes, !!recipe.settings.mcp_enabled)}`);
+  console.log(`  ${import_chalk51.default.dim("asks you for     ")}  ${recipe.questions.length} value${recipe.questions.length === 1 ? "" : "s"}`);
   if (rules || tables) {
-    console.log(`  ${import_chalk49.default.dim("transforms       ")}  ${rules} rule${rules === 1 ? "" : "s"}${tables ? `, ${tables} mapping table${tables === 1 ? "" : "s"}` : ""}`);
+    console.log(`  ${import_chalk51.default.dim("transforms       ")}  ${rules} rule${rules === 1 ? "" : "s"}${tables ? `, ${tables} mapping table${tables === 1 ? "" : "s"}` : ""}`);
   }
   if (recipe.settings.publish_openapi === true) {
-    console.log(`  ${import_chalk49.default.dim("makes public     ")}  this API's spec`);
+    console.log(`  ${import_chalk51.default.dim("makes public     ")}  this API's spec`);
   }
   if (recipe.questions.length) {
     console.log();
-    console.log(import_chalk49.default.bold("  It will ask you for"));
+    console.log(import_chalk51.default.bold("  It will ask you for"));
     for (const q of recipe.questions) {
-      console.log(`    ${q.prompt}${q.secret ? import_chalk49.default.dim("  (hidden while you type)") : ""}`);
-      if (q.example) console.log(import_chalk49.default.dim(`      e.g. ${q.example}`));
+      console.log(`    ${q.prompt}${q.secret ? import_chalk51.default.dim("  (hidden while you type)") : ""}`);
+      if (q.example) console.log(import_chalk51.default.dim(`      e.g. ${q.example}`));
     }
   }
   if (recipe.requires_confirmation?.length) {
     console.log();
-    console.log(import_chalk49.default.yellow("  Needs your explicit consent at install time"));
+    console.log(import_chalk51.default.yellow("  Needs your explicit consent at install time"));
     for (const c of recipe.requires_confirmation) {
-      console.log(`    ${import_chalk49.default.bold(c.kind)}  ${c.value}`);
-      console.log(import_chalk49.default.dim(`      ${c.why}`));
+      console.log(`    ${import_chalk51.default.bold(c.kind)}  ${c.value}`);
+      console.log(import_chalk51.default.dim(`      ${c.why}`));
     }
   }
   console.log();
-  console.log(import_chalk49.default.dim(`  Install:  ${import_chalk49.default.cyan(`npx apiblaze install ${recipe.name}`)}`));
-  console.log(import_chalk49.default.dim("  Sections: --settings  --auth  --transforms  --openapi"));
+  console.log(import_chalk51.default.dim(`  Install:  ${import_chalk51.default.cyan(`npx apiblaze install ${recipe.name}`)}`));
+  console.log(import_chalk51.default.dim("  Sections: --settings  --auth  --transforms  --openapi"));
   console.log();
 }
 function describeCreates(keyTypes, routes, mcp, includeProxy = true) {
@@ -16810,45 +17166,45 @@ function describeCreates(keyTypes, routes, mcp, includeProxy = true) {
   return parts.length ? parts.join(", ") : "nothing else";
 }
 function printSection(title, value) {
-  console.log(import_chalk49.default.bold(`  ${title}`));
+  console.log(import_chalk51.default.bold(`  ${title}`));
   console.log(indent(JSON.stringify(value ?? null, null, 2), "    "));
   console.log();
 }
 function printAuth(recipe) {
   const a = recipe.auth ?? { app_client: null, provider: null, key_types: [] };
-  console.log(import_chalk49.default.bold("  auth"));
+  console.log(import_chalk51.default.bold("  auth"));
   if (a.provider) {
-    console.log(`    ${import_chalk49.default.dim("provider    ")} ${a.provider.type ?? "(unknown)"}`);
-    if (a.provider.scopes) console.log(`    ${import_chalk49.default.dim("scopes      ")} ${a.provider.scopes}`);
-    if (a.provider.target_server_token) console.log(`    ${import_chalk49.default.dim("sends to API")} ${a.provider.target_server_token}`);
-    console.log(a.provider.managed === true ? import_chalk49.default.dim("    (APIblaze's own GitHub app \u2014 installers get the same zero-config door, nothing to create)") : import_chalk49.default.dim("    (no credentials travel in a recipe \u2014 install asks for your own OAuth app)"));
+    console.log(`    ${import_chalk51.default.dim("provider    ")} ${a.provider.type ?? "(unknown)"}`);
+    if (a.provider.scopes) console.log(`    ${import_chalk51.default.dim("scopes      ")} ${a.provider.scopes}`);
+    if (a.provider.target_server_token) console.log(`    ${import_chalk51.default.dim("sends to API")} ${a.provider.target_server_token}`);
+    console.log(a.provider.managed === true ? import_chalk51.default.dim("    (APIblaze's own GitHub app \u2014 installers get the same zero-config door, nothing to create)") : import_chalk51.default.dim("    (no credentials travel in a recipe \u2014 install asks for your own OAuth app)"));
   } else {
-    console.log(import_chalk49.default.dim("    no login provider \u2014 consumers call it with an API key"));
+    console.log(import_chalk51.default.dim("    no login provider \u2014 consumers call it with an API key"));
   }
   if (a.app_client) {
-    console.log(`    ${import_chalk49.default.dim("login app   ")} ${a.app_client.name ?? "(unnamed)"}`);
+    console.log(`    ${import_chalk51.default.dim("login app   ")} ${a.app_client.name ?? "(unnamed)"}`);
   }
   if (a.key_types?.length) {
-    console.log(`    ${import_chalk49.default.dim("key types   ")} ${a.key_types.map((k) => String(k.name)).join(", ")}`);
+    console.log(`    ${import_chalk51.default.dim("key types   ")} ${a.key_types.map((k) => String(k.name)).join(", ")}`);
   }
   console.log();
 }
 function printTransforms(recipe) {
   const rules = recipe.transformations?.rules ?? [];
   const tables = recipe.transformations?.mapping_tables ?? [];
-  console.log(import_chalk49.default.bold(`  transforms (${rules.length})`));
+  console.log(import_chalk51.default.bold(`  transforms (${rules.length})`));
   for (const r of rules) {
-    const off = r.enabled === false ? import_chalk49.default.dim(" (disabled)") : "";
-    console.log(`    ${import_chalk49.default.bold(String(r.name ?? "(unnamed)"))}  ${import_chalk49.default.dim(String(r.phase ?? "request"))}${off}`);
+    const off = r.enabled === false ? import_chalk51.default.dim(" (disabled)") : "";
+    console.log(`    ${import_chalk51.default.bold(String(r.name ?? "(unnamed)"))}  ${import_chalk51.default.dim(String(r.phase ?? "request"))}${off}`);
     console.log(indent(JSON.stringify(r.action ?? null, null, 2), "      "));
     if (r.condition) console.log(indent(`when ${JSON.stringify(r.condition)}`, "      "));
   }
   if (tables.length) {
     console.log();
-    console.log(import_chalk49.default.bold(`  mapping tables (${tables.length})`));
+    console.log(import_chalk51.default.bold(`  mapping tables (${tables.length})`));
     for (const t of tables) {
       const entries2 = Array.isArray(t.entries) ? t.entries.length : 0;
-      console.log(`    ${import_chalk49.default.bold(String(t.name ?? "(unnamed)"))}  ${import_chalk49.default.dim(`${entries2} entr${entries2 === 1 ? "y" : "ies"}`)}`);
+      console.log(`    ${import_chalk51.default.bold(String(t.name ?? "(unnamed)"))}  ${import_chalk51.default.dim(`${entries2} entr${entries2 === 1 ? "y" : "ies"}`)}`);
     }
   }
   console.log();
@@ -16858,7 +17214,7 @@ function indent(text, pad) {
 }
 
 // src/commands/recipe-install.ts
-var import_chalk50 = __toESM(require("chalk"));
+var import_chalk52 = __toESM(require("chalk"));
 init_types();
 init_caller();
 init_api();
@@ -16875,7 +17231,7 @@ async function runRecipeInstall(nameArg, opts) {
   const chosenTeamId = picked.chosen ? picked.teamId : void 0;
   const teamName = picked.teamName;
   console.log();
-  console.log(`${import_chalk50.default.bold(pinned)}${import_chalk50.default.dim(` \u2014 by ${ref.handle}`)}`);
+  console.log(`${import_chalk52.default.bold(pinned)}${import_chalk52.default.dim(` \u2014 by ${ref.handle}`)}`);
   if (recipe.summary) console.log(`  ${recipe.summary}`);
   console.log();
   let project;
@@ -16899,7 +17255,7 @@ async function runRecipeInstall(nameArg, opts) {
     reuseTenant = chosenTenant.existing;
     printSummary(recipe, project, tenant, reuseTenant);
     if (!assumeYes && !await confirmYesNo("  continue?", interactive2)) {
-      console.log(import_chalk50.default.yellow("  Cancelled \u2014 nothing was created."));
+      console.log(import_chalk52.default.yellow("  Cancelled \u2014 nothing was created."));
       return;
     }
   }
@@ -16918,18 +17274,18 @@ async function runRecipeInstall(nameArg, opts) {
     process.stdout.write(`  ${step.label.padEnd(33)}`);
     try {
       const note = await step.run();
-      console.log(`${import_chalk50.default.green("\u2713")}${note ? `  ${import_chalk50.default.dim(note)}` : ""}`);
+      console.log(`${import_chalk52.default.green("\u2713")}${note ? `  ${import_chalk52.default.dim(note)}` : ""}`);
     } catch (err) {
-      console.log(`${import_chalk50.default.red("\u2717")}  ${import_chalk50.default.red(describeError(err))}`);
+      console.log(`${import_chalk52.default.red("\u2717")}  ${import_chalk52.default.red(describeError(err))}`);
       console.log();
       if (step.n === 1) {
-        console.log(import_chalk50.default.red(`stopped at step 1 of ${steps.length}. Nothing was created.`));
+        console.log(import_chalk52.default.red(`stopped at step 1 of ${steps.length}. Nothing was created.`));
         console.log("run the same command again once the problem above is fixed:");
-        console.log(import_chalk50.default.cyan(`    npx apiblaze install ${nameArg}`));
+        console.log(import_chalk52.default.cyan(`    npx apiblaze install ${nameArg}`));
       } else {
-        console.log(import_chalk50.default.red(`stopped at step ${step.n} of ${steps.length}. ${project} exists but is not finished.`));
+        console.log(import_chalk52.default.red(`stopped at step ${step.n} of ${steps.length}. ${project} exists but is not finished.`));
         console.log("continue with:");
-        console.log(import_chalk50.default.cyan(`    npx apiblaze install ${nameArg} --into ${project}`));
+        console.log(import_chalk52.default.cyan(`    npx apiblaze install ${nameArg} --into ${project}`));
       }
       console.log();
       process.exit(1);
@@ -16939,9 +17295,9 @@ async function runRecipeInstall(nameArg, opts) {
   const urls = installUrls(ctx);
   console.log();
   console.log(`done in ${secs}s.`);
-  console.log(`  ${import_chalk50.default.dim("proxy ")} ${import_chalk50.default.bold(urls.proxy_url)}`);
-  if (recipe.settings.mcp_enabled === true) console.log(`  ${import_chalk50.default.dim("mcp   ")} ${import_chalk50.default.bold(urls.mcp_url)}`);
-  if (recipe.settings.enable_portal === true) console.log(`  ${import_chalk50.default.dim("portal")} ${import_chalk50.default.bold(urls.portal_url)}`);
+  console.log(`  ${import_chalk52.default.dim("proxy ")} ${import_chalk52.default.bold(urls.proxy_url)}`);
+  if (recipe.settings.mcp_enabled === true) console.log(`  ${import_chalk52.default.dim("mcp   ")} ${import_chalk52.default.bold(urls.mcp_url)}`);
+  if (recipe.settings.enable_portal === true) console.log(`  ${import_chalk52.default.dim("portal")} ${import_chalk52.default.bold(urls.portal_url)}`);
   console.log();
 }
 function buildSteps(inp) {
@@ -17243,7 +17599,7 @@ async function nameIsFree(name, teamId) {
 async function chooseProxyName(slug, asOpt, teamId, interactive2) {
   if (asOpt !== void 0) {
     const name = normalizeName3(asOpt);
-    if (name !== asOpt) console.log(import_chalk50.default.yellow(`  Using "${name}" \u2014 names are lowercase letters and digits only.`));
+    if (name !== asOpt) console.log(import_chalk52.default.yellow(`  Using "${name}" \u2014 names are lowercase letters and digits only.`));
     if (name.length < 3) throw new Error("A proxy name must be at least 3 characters (lowercase letters and digits only).");
     const free = await nameIsFree(name, teamId);
     if (free === false) throw new Error(`"${name}" is already taken. Pick another with --as.`);
@@ -17260,7 +17616,7 @@ async function chooseProxyName(slug, asOpt, teamId, interactive2) {
   }
   if (!interactive2) return suggested;
   const { default: inquirer3 } = await import("inquirer");
-  console.log(`  ${import_chalk50.default.dim("proxy")}   ${slug} \u2192 ${import_chalk50.default.bold(suggested)}   ${import_chalk50.default.dim("[enter to accept, or type a name]")}`);
+  console.log(`  ${import_chalk52.default.dim("proxy")}   ${slug} \u2192 ${import_chalk52.default.bold(suggested)}   ${import_chalk52.default.dim("[enter to accept, or type a name]")}`);
   for (; ; ) {
     const { raw } = await inquirer3.prompt([{
       type: "input",
@@ -17271,20 +17627,20 @@ async function chooseProxyName(slug, asOpt, teamId, interactive2) {
     }]);
     const name = normalizeName3(raw);
     if (name !== String(raw).trim()) {
-      console.log(import_chalk50.default.yellow(`  \u2192 using ${import_chalk50.default.bold(name)} (lowercase letters and digits only)`));
+      console.log(import_chalk52.default.yellow(`  \u2192 using ${import_chalk52.default.bold(name)} (lowercase letters and digits only)`));
     }
     if (name.length < 3) {
-      console.log(import_chalk50.default.yellow("  Name must be at least 3 characters.\n"));
+      console.log(import_chalk52.default.yellow("  Name must be at least 3 characters.\n"));
       continue;
     }
     const free = await nameIsFree(name, teamId);
     if (free === false) {
-      console.log(import_chalk50.default.yellow(`  "${name}" is taken. Try another.
+      console.log(import_chalk52.default.yellow(`  "${name}" is taken. Try another.
 `));
       continue;
     }
-    if (free === null) console.log(import_chalk50.default.dim("  (could not verify availability; continuing)"));
-    console.log(`  ${import_chalk50.default.cyan("\u2192")} ${import_chalk50.default.bold(`https://${name}.abz.run`)}`);
+    if (free === null) console.log(import_chalk52.default.dim("  (could not verify availability; continuing)"));
+    console.log(`  ${import_chalk52.default.cyan("\u2192")} ${import_chalk52.default.bold(`https://${name}.abz.run`)}`);
     return name;
   }
 }
@@ -17302,20 +17658,20 @@ function printSummary(recipe, project, tenant, reuseTenant = false) {
   const keyTypes = recipe.auth?.key_types?.length ?? 0;
   const questions = reuseTenant ? 0 : recipe.questions?.length ?? 0;
   const row = (label3, value, note) => {
-    console.log(`  ${import_chalk50.default.dim(label3.padEnd(21))}${value}${note ? import_chalk50.default.dim(`  ${note}`) : ""}`);
+    console.log(`  ${import_chalk52.default.dim(label3.padEnd(21))}${value}${note ? import_chalk52.default.dim(`  ${note}`) : ""}`);
   };
   console.log();
-  console.log(import_chalk50.default.bold("  This will:"));
+  console.log(import_chalk52.default.bold("  This will:"));
   console.log();
-  row("create a proxy", import_chalk50.default.bold(project), `at https://${project}.abz.run`);
-  row("for its users", import_chalk50.default.bold(tenant), reuseTenant ? "(one you already have)" : "(a new tenant)");
+  row("create a proxy", import_chalk52.default.bold(project), `at https://${project}.abz.run`);
+  row("for its users", import_chalk52.default.bold(tenant), reuseTenant ? "(one you already have)" : "(a new tenant)");
   if (hosts.length) row("sending requests to", hosts.join(", "));
   row("and set up", describeCreates(keyTypes, routes, recipe.settings.mcp_enabled === true, false));
   row("asking you for", questions ? `${questions} value${questions === 1 ? "" : "s"}` : "nothing");
   if (reuseTenant) {
     console.log();
-    console.log(import_chalk50.default.dim(`  ${tenant} is used exactly as it is \u2014 its existing login stays, and this`));
-    console.log(import_chalk50.default.dim("  recipe's own login setup is not applied."));
+    console.log(import_chalk52.default.dim(`  ${tenant} is used exactly as it is \u2014 its existing login stays, and this`));
+    console.log(import_chalk52.default.dim("  recipe's own login setup is not applied."));
   }
   console.log();
 }
@@ -17324,11 +17680,11 @@ function declineAll(items) {
   const upstreams = items.filter((i) => i.kind === "upstream");
   console.log();
   for (const u of upstreams) {
-    console.log(import_chalk50.default.yellow(`  --yes: this proxy sends every request to ${import_chalk50.default.bold(u.value)}.`));
+    console.log(import_chalk52.default.yellow(`  --yes: this proxy sends every request to ${import_chalk52.default.bold(u.value)}.`));
   }
   if (skippable.length) {
-    console.log(import_chalk50.default.yellow(`  --yes: installing without ${skippable.length} setting${skippable.length === 1 ? "" : "s"} that need consent.`));
-    for (const i of skippable) console.log(import_chalk50.default.dim(`    skipped  ${i.kind}  ${i.value}`));
+    console.log(import_chalk52.default.yellow(`  --yes: installing without ${skippable.length} setting${skippable.length === 1 ? "" : "s"} that need consent.`));
+    for (const i of skippable) console.log(import_chalk52.default.dim(`    skipped  ${i.kind}  ${i.value}`));
   }
   return new Set(skippable.map(declineKey));
 }
@@ -17349,14 +17705,14 @@ async function askConsent(items, interactive2, reinstalling) {
   const count = items.length;
   const word = ["", "it", "both", "all three", "all four", "all five", "all six"][count] ?? `all ${count}`;
   console.log();
-  console.log(import_chalk50.default.yellow(reinstalling ? "\u26A0 This recipe changes who can reach your proxy, what it trusts, and what it can cost." : "\u26A0 The proxy this creates will be reachable by others, trust an upstream host, and can cost you money:"));
+  console.log(import_chalk52.default.yellow(reinstalling ? "\u26A0 This recipe changes who can reach your proxy, what it trusts, and what it can cost." : "\u26A0 The proxy this creates will be reachable by others, trust an upstream host, and can cost you money:"));
   console.log();
   for (const item of items) {
-    console.log(`  ${import_chalk50.default.bold(item.kind.padEnd(16))}  ${item.value}`);
-    for (const line of wrapText(item.why, 62)) console.log(`  ${" ".repeat(16)}  ${import_chalk50.default.dim(line)}`);
+    console.log(`  ${import_chalk52.default.bold(item.kind.padEnd(16))}  ${item.value}`);
+    for (const line of wrapText(item.why, 62)) console.log(`  ${" ".repeat(16)}  ${import_chalk52.default.dim(line)}`);
   }
   console.log();
-  console.log(`Type "${import_chalk50.default.bold("yes")}" to accept ${word}.`);
+  console.log(`Type "${import_chalk52.default.bold("yes")}" to accept ${word}.`);
   console.log("Press enter to install the recipe without them.");
   let typed = "";
   if (interactive2) {
@@ -17368,7 +17724,7 @@ async function askConsent(items, interactive2, reinstalling) {
   for (const item of items) {
     declined.add(declineKey(item));
   }
-  console.log(import_chalk50.default.dim(`  Installing without ${count} setting${count === 1 ? "" : "s"} \u2014 everything else is applied.`));
+  console.log(import_chalk52.default.dim(`  Installing without ${count} setting${count === 1 ? "" : "s"} \u2014 everything else is applied.`));
   return declined;
 }
 async function askQuestions(questions, ctx, interactive2) {
@@ -17381,13 +17737,13 @@ async function askQuestions(questions, ctx, interactive2) {
       const BOX = 64;
       const title = "\u2500\u2500 from the publisher ";
       console.log();
-      console.log(`  ${import_chalk50.default.dim(title + "\u2500".repeat(BOX - title.length))}`);
-      for (const line of fillContext(q.before, ctx).split("\n")) console.log(`  ${import_chalk50.default.dim("\u2502")} ${line}`);
-      console.log(`  ${import_chalk50.default.dim("\u2500".repeat(BOX))}`);
+      console.log(`  ${import_chalk52.default.dim(title + "\u2500".repeat(BOX - title.length))}`);
+      for (const line of fillContext(q.before, ctx).split("\n")) console.log(`  ${import_chalk52.default.dim("\u2502")} ${line}`);
+      console.log(`  ${import_chalk52.default.dim("\u2500".repeat(BOX))}`);
     }
     if (fromEnv !== void 0 && fromEnv !== "") {
       answers[q.id] = fromEnv;
-      console.log(`  ${q.prompt}:  ${import_chalk50.default.dim(`(from ${envName})`)}`);
+      console.log(`  ${q.prompt}:  ${import_chalk52.default.dim(`(from ${envName})`)}`);
       continue;
     }
     if (!interactive2) {
@@ -17397,7 +17753,7 @@ async function askQuestions(questions, ctx, interactive2) {
       );
     }
     const { default: inquirer3 } = await import("inquirer");
-    if (q.example && !q.secret) console.log(import_chalk50.default.dim(`  e.g. ${q.example}`));
+    if (q.example && !q.secret) console.log(import_chalk52.default.dim(`  e.g. ${q.example}`));
     const { value } = await inquirer3.prompt([{
       // `secret: true` masks the input — the Google client secret is typed once,
       // goes to provider creation, and is never echoed or stored.
@@ -17431,30 +17787,30 @@ async function confirmReinstall(recipe, project, tenant, interactive2) {
   const tables = recipe.transformations?.mapping_tables?.length ?? 0;
   const routes = countRoutes(recipe.openapi);
   const keyTypes = recipe.auth?.key_types?.length ?? 0;
-  console.log(`This installs ${import_chalk50.default.bold(`${recipe.name}@${recipe.revision}`)} over ${import_chalk50.default.bold(project)}.`);
+  console.log(`This installs ${import_chalk52.default.bold(`${recipe.name}@${recipe.revision}`)} over ${import_chalk52.default.bold(project)}.`);
   console.log();
-  console.log(`  ${import_chalk50.default.dim("settings  ".padEnd(16))}replaced`);
+  console.log(`  ${import_chalk52.default.dim("settings  ".padEnd(16))}replaced`);
   if (rules || tables) {
-    console.log(`  ${import_chalk50.default.dim("transforms".padEnd(16))}${rules} rule${rules === 1 ? "" : "s"}${tables ? ` and ${tables} mapping table${tables === 1 ? "" : "s"}` : ""} replaced \u2014 your edits to them are lost`);
+    console.log(`  ${import_chalk52.default.dim("transforms".padEnd(16))}${rules} rule${rules === 1 ? "" : "s"}${tables ? ` and ${tables} mapping table${tables === 1 ? "" : "s"}` : ""} replaced \u2014 your edits to them are lost`);
   }
   if (routes) {
-    console.log(`  ${import_chalk50.default.dim("api spec  ".padEnd(16))}replaced, ${routes} routes regenerated${recipe.settings.mcp_enabled === true ? ", MCP rebuilt" : ""}`);
+    console.log(`  ${import_chalk52.default.dim("api spec  ".padEnd(16))}replaced, ${routes} routes regenerated${recipe.settings.mcp_enabled === true ? ", MCP rebuilt" : ""}`);
   }
   if (keyTypes) {
-    console.log(`  ${import_chalk50.default.dim("key types ".padEnd(16))}${keyTypes} added if missing; existing types left alone`);
+    console.log(`  ${import_chalk52.default.dim("key types ".padEnd(16))}${keyTypes} added if missing; existing types left alone`);
   }
   console.log();
-  console.log(`  ${import_chalk50.default.dim("unchanged ".padEnd(16))}your API keys, your proxy URL, your users,`);
+  console.log(`  ${import_chalk52.default.dim("unchanged ".padEnd(16))}your API keys, your proxy URL, your users,`);
   console.log(`  ${" ".repeat(16)}and any tenant other than ${tenant}`);
   console.log();
-  console.log(import_chalk50.default.yellow("This cannot be undone."));
+  console.log(import_chalk52.default.yellow("This cannot be undone."));
   if (!interactive2) {
     throw new Error("Reinstall needs a typed confirmation and there is no terminal to ask on.");
   }
   const { default: inquirer3 } = await import("inquirer");
   const { typed } = await inquirer3.prompt([{ type: "input", name: "typed", message: `Type the proxy name (${project}) to continue:` }]);
   if (String(typed ?? "").trim() !== project) {
-    console.log(import_chalk50.default.yellow("Cancelled \u2014 nothing was changed."));
+    console.log(import_chalk52.default.yellow("Cancelled \u2014 nothing was changed."));
     process.exit(0);
   }
 }
@@ -17462,7 +17818,7 @@ function requireCallerForInstall() {
   try {
     return requireCaller();
   } catch {
-    console.error(import_chalk50.default.red(
+    console.error(import_chalk52.default.red(
       "Installing writes a proxy into an account, so it needs a credential.\n  Run `apiblaze login`, or `apiblaze create` first (an anonymous workspace works too)."
     ));
     process.exit(1);
@@ -17498,7 +17854,7 @@ async function chooseTeam(caller, optTeam, interactive2) {
     message: "  which team should own this proxy?",
     default: active.teamId,
     choices: teams.map((t) => ({
-      name: t.teamId === active.teamId ? `${t.name} ${import_chalk50.default.dim("(active)")}` : t.name,
+      name: t.teamId === active.teamId ? `${t.name} ${import_chalk52.default.dim("(active)")}` : t.name,
       value: t.teamId
     }))
   }]);
@@ -17526,10 +17882,10 @@ async function chooseTenant(caller, project, teamId, optTenant, interactive2) {
     message: "  where should this proxy's users live?",
     default: "__new__",
     choices: [
-      { name: `create ${fresh}  ${import_chalk50.default.dim("(a fresh tenant, set up by the recipe)")}`, value: "__new__" },
-      new inquirer3.Separator(import_chalk50.default.dim("  \u2014 or reuse one you already have \u2014")),
+      { name: `create ${fresh}  ${import_chalk52.default.dim("(a fresh tenant, set up by the recipe)")}`, value: "__new__" },
+      new inquirer3.Separator(import_chalk52.default.dim("  \u2014 or reuse one you already have \u2014")),
       ...owned.map((t2) => ({
-        name: `${t2}  ${import_chalk50.default.dim("(existing \u2014 its own login is kept)")}`,
+        name: `${t2}  ${import_chalk52.default.dim("(existing \u2014 its own login is kept)")}`,
         value: t2
       }))
     ]
@@ -17559,8 +17915,8 @@ async function teamTenants(caller, teamId) {
 }
 
 // src/commands/recipe-publish.ts
-var import_chalk51 = __toESM(require("chalk"));
-var import_ora17 = __toESM(require("ora"));
+var import_chalk53 = __toESM(require("chalk"));
+var import_ora19 = __toESM(require("ora"));
 init_caller();
 init_auth();
 async function runRecipePublish(projectArg, opts) {
@@ -17569,22 +17925,22 @@ async function runRecipePublish(projectArg, opts) {
   try {
     resolved = resolveRecipeName(opts.as, creds?.githubHandle, normalizeName3(projectArg));
   } catch (err) {
-    console.error(import_chalk51.default.red(err instanceof Error ? err.message : String(err)));
+    console.error(import_chalk53.default.red(err instanceof Error ? err.message : String(err)));
     process.exitCode = 1;
     return;
   }
   const ref = resolved.ref;
   if (resolved.derivedHandle) {
-    console.log(import_chalk51.default.dim(`  publishing as ${import_chalk51.default.bold(ref.name)}`));
+    console.log(import_chalk53.default.dim(`  publishing as ${import_chalk53.default.bold(ref.name)}`));
     if (resolved.normalizedFrom) {
-      console.log(import_chalk51.default.dim(`  (your GitHub login is ${resolved.normalizedFrom}; apiblaze names are letters and digits only)`));
+      console.log(import_chalk53.default.dim(`  (your GitHub login is ${resolved.normalizedFrom}; apiblaze names are letters and digits only)`));
     }
   }
   const interactive2 = !!process.stdin.isTTY && !opts.json;
   const caller = requireCaller();
   const { teamId } = await resolveActingTeam(caller, opts.team);
   const proj2 = await resolveProjectVia(caller, teamId, projectArg, opts.apiversion);
-  const spinner = !opts.json ? (0, import_ora17.default)(`Reading ${proj2.projectId} v${proj2.apiVersion}...`).start() : null;
+  const spinner = !opts.json ? (0, import_ora19.default)(`Reading ${proj2.projectId} v${proj2.apiVersion}...`).start() : null;
   let prep;
   try {
     prep = await prepare(caller, proj2.projectId, proj2.apiVersion, ref.name, opts.tenant);
@@ -17596,7 +17952,7 @@ async function runRecipePublish(projectArg, opts) {
   let tenant = opts.tenant;
   if (!prep.tenant_used && prep.tenants.length > 1) {
     if (!interactive2) {
-      console.error(import_chalk51.default.red(
+      console.error(import_chalk53.default.red(
         `${proj2.projectId} has ${prep.tenants.length} tenants (${prep.tenants.join(", ")}). Pass --tenant <slug> to say which auth setup the recipe carries.`
       ));
       process.exit(1);
@@ -17612,7 +17968,7 @@ async function runRecipePublish(projectArg, opts) {
     prep = await prepare(caller, proj2.projectId, proj2.apiVersion, ref.name, tenant);
   }
   if (!prep.name_available) {
-    console.error(import_chalk51.default.red(`${ref.name} belongs to another team, so you cannot publish a revision of it.`));
+    console.error(import_chalk53.default.red(`${ref.name} belongs to another team, so you cannot publish a revision of it.`));
     process.exit(1);
   }
   if (prep.envelope_violations.length) {
@@ -17622,13 +17978,13 @@ async function runRecipePublish(projectArg, opts) {
   if (prep.dropped.length) {
     console.log();
     console.log(`${prep.dropped.length} setting${prep.dropped.length === 1 ? " was" : "s were"} not included, because they are not on the publish list:`);
-    for (const d of prep.dropped) console.log(import_chalk51.default.dim(`    ${d}`));
+    for (const d of prep.dropped) console.log(import_chalk53.default.dim(`    ${d}`));
     if (prep.hidden_tables_excluded) {
-      console.log(import_chalk51.default.dim(`  (${prep.hidden_tables_excluded} hidden mapping table${prep.hidden_tables_excluded === 1 ? "" : "s"} excluded \u2014 those values belong to your consumers.)`));
+      console.log(import_chalk53.default.dim(`  (${prep.hidden_tables_excluded} hidden mapping table${prep.hidden_tables_excluded === 1 ? "" : "s"} excluded \u2014 those values belong to your consumers.)`));
     }
     console.log();
     if (!opts.yes && !await confirm2("  continue without them?", interactive2)) {
-      console.log(import_chalk51.default.yellow("Cancelled."));
+      console.log(import_chalk53.default.yellow("Cancelled."));
       return;
     }
   }
@@ -17641,12 +17997,12 @@ async function runRecipePublish(projectArg, opts) {
       console.log();
       for (const f2 of prep.findings) printFinding(f2);
       console.log();
-      console.error(import_chalk51.default.red("--yes cannot accept scanner findings. Fix the value in the proxy, or publish interactively and decide."));
+      console.error(import_chalk53.default.red("--yes cannot accept scanner findings. Fix the value in the proxy, or publish interactively and decide."));
       process.exit(1);
     }
     if (!interactive2) {
       for (const f2 of prep.findings) printFinding(f2);
-      console.error(import_chalk51.default.red("\nThese need a decision and there is no terminal to ask on."));
+      console.error(import_chalk53.default.red("\nThese need a decision and there is no terminal to ask on."));
       process.exit(1);
     }
     const { default: inquirer3 } = await import("inquirer");
@@ -17667,10 +18023,10 @@ async function runRecipePublish(projectArg, opts) {
       if (verdict === "ask") promotions.push(await askPromotion(f2.path));
     }
   }
-  console.log(import_chalk51.default.dim(`we cannot judge the other ${prep.unjudged_count} values. run \`apiblaze show ${ref.name}\` after publishing to read the whole recipe.`));
+  console.log(import_chalk53.default.dim(`we cannot judge the other ${prep.unjudged_count} values. run \`apiblaze show ${ref.name}\` after publishing to read the whole recipe.`));
   const totalQuestions = prep.question_ids.length + promotions.length;
   if (totalQuestions > 5) {
-    console.log(import_chalk51.default.yellow(`
+    console.log(import_chalk53.default.yellow(`
 \u26A0 installers will have to supply ${totalQuestions} values before this works.`));
   }
   const visibility = opts.private ? "private" : "public";
@@ -17678,15 +18034,15 @@ async function runRecipePublish(projectArg, opts) {
   if (visibility === "public" && prep.spec_will_become_public) {
     console.log();
     console.log("Publishing publicly also makes this API's spec readable at");
-    console.log(`  ${import_chalk51.default.bold(`https://${proj2.projectId}.abz.run/${proj2.apiVersion}/openapi.json`)}`);
+    console.log(`  ${import_chalk53.default.bold(`https://${proj2.projectId}.abz.run/${proj2.apiVersion}/openapi.json`)}`);
     console.log("It is currently private.");
     confirmSpecPublic = opts.yes ? true : await confirm2("Continue?", interactive2);
     if (!confirmSpecPublic) {
-      console.log(import_chalk51.default.yellow("Cancelled \u2014 nothing was published."));
+      console.log(import_chalk53.default.yellow("Cancelled \u2014 nothing was published."));
       return;
     }
   }
-  const spin2 = !opts.json ? (0, import_ora17.default)(`Publishing ${ref.name}...`).start() : null;
+  const spin2 = !opts.json ? (0, import_ora19.default)(`Publishing ${ref.name}...`).start() : null;
   let out;
   try {
     out = await producer(caller, {
@@ -17708,7 +18064,7 @@ async function runRecipePublish(projectArg, opts) {
       },
       summary: `Publish ${proj2.projectId} as ${ref.name} (${visibility})`
     });
-    spin2?.succeed(`Published ${import_chalk51.default.bold(`${out.name}@${out.revision}`)} (${out.visibility}).`);
+    spin2?.succeed(`Published ${import_chalk53.default.bold(`${out.name}@${out.revision}`)} (${out.visibility}).`);
   } catch (err) {
     spin2?.fail("Publish failed.");
     throw err;
@@ -17717,15 +18073,15 @@ async function runRecipePublish(projectArg, opts) {
     console.log(JSON.stringify(out));
     return;
   }
-  console.log(`  ${import_chalk51.default.dim("size    ")} ${(out.size_bytes / 1024).toFixed(1)} KB`);
-  console.log(`  ${import_chalk51.default.dim("checksum")} ${out.sha256.slice(0, 16)}\u2026`);
+  console.log(`  ${import_chalk53.default.dim("size    ")} ${(out.size_bytes / 1024).toFixed(1)} KB`);
+  console.log(`  ${import_chalk53.default.dim("checksum")} ${out.sha256.slice(0, 16)}\u2026`);
   console.log();
   if (out.visibility === "public") {
-    console.log(import_chalk51.default.dim(`  Anyone can now run: ${import_chalk51.default.cyan(`npx apiblaze install ${out.name}`)}`));
+    console.log(import_chalk53.default.dim(`  Anyone can now run: ${import_chalk53.default.cyan(`npx apiblaze install ${out.name}`)}`));
   } else {
-    console.log(import_chalk51.default.dim("  Private \u2014 only members of this team can see or install it."));
+    console.log(import_chalk53.default.dim("  Private \u2014 only members of this team can see or install it."));
   }
-  console.log(import_chalk51.default.dim(`  Pull it back with:  ${import_chalk51.default.cyan(`npx apiblaze withdraw ${out.name}@${out.revision}`)}`));
+  console.log(import_chalk53.default.dim(`  Pull it back with:  ${import_chalk53.default.cyan(`npx apiblaze withdraw ${out.name}@${out.revision}`)}`));
   console.log();
 }
 async function prepare(caller, projectId, apiVersion, name, tenant) {
@@ -17738,23 +18094,23 @@ async function prepare(caller, projectId, apiVersion, name, tenant) {
 }
 function printFinding(f2) {
   const preview = (f2.preview ?? "").replace(/\s+/g, " ").trim();
-  console.log(`  ${import_chalk51.default.bold(f2.path)}`);
-  console.log(`      ${import_chalk51.default.yellow(preview.padEnd(38))}${import_chalk51.default.dim(f2.why)}`);
+  console.log(`  ${import_chalk53.default.bold(f2.path)}`);
+  console.log(`      ${import_chalk53.default.yellow(preview.padEnd(38))}${import_chalk53.default.dim(f2.why)}`);
 }
 function printEnvelopeViolations(violations) {
   console.log();
-  console.error(import_chalk51.default.red("This proxy has transform rules a recipe cannot carry."));
+  console.error(import_chalk53.default.red("This proxy has transform rules a recipe cannot carry."));
   console.log();
   for (const v of violations) {
-    console.log(`  ${import_chalk51.default.bold(v.rule)}  ${import_chalk51.default.dim(`(${v.kind}s ${v.field})`)}`);
+    console.log(`  ${import_chalk53.default.bold(v.rule)}  ${import_chalk53.default.dim(`(${v.kind}s ${v.field})`)}`);
     console.log(`      ${v.why}`);
   }
   console.log();
   console.log("A recipe runs in a stranger's account, after apiblaze has attached their end user's");
   console.log("real third-party token, so two rules are absolute:");
-  console.log(`  ${import_chalk51.default.dim("\u2022")} a rule may never READ Authorization, Cookie, or the third-party token headers \u2014`);
+  console.log(`  ${import_chalk53.default.dim("\u2022")} a rule may never READ Authorization, Cookie, or the third-party token headers \u2014`);
   console.log("    those hold a live credential that works at the provider without apiblaze;");
-  console.log(`  ${import_chalk51.default.dim("\u2022")} a rule may never WRITE an identity header (x-end-user-id and friends) \u2014`);
+  console.log(`  ${import_chalk53.default.dim("\u2022")} a rule may never WRITE an identity header (x-end-user-id and friends) \u2014`);
   console.log("    those tell the installer's own backend who is calling.");
   console.log();
   console.log("Writing Authorization from a question or a fixed value is fine \u2014 that is the");
@@ -17772,7 +18128,7 @@ async function askPromotion(path20) {
     { type: "input", name: "id", message: "  id:", default: suggestedId }
   ]);
   const id = String(answers.id || suggestedId).toLowerCase().replace(/[^a-z0-9_]/g, "_");
-  console.log(import_chalk51.default.dim(`      \u2192 replaced with {{${id}}}`));
+  console.log(import_chalk53.default.dim(`      \u2192 replaced with {{${id}}}`));
   return {
     path: path20,
     id,
@@ -17791,7 +18147,7 @@ async function confirm2(message, interactive2) {
 async function runRecipeWithdraw(nameArg, opts) {
   const ref = parseRecipeRef(nameArg);
   if (ref.revision === void 0) {
-    console.error(import_chalk51.default.red(`Name the revision to withdraw, e.g. ${nameArg}@3. Revisions are withdrawn one at a time.`));
+    console.error(import_chalk53.default.red(`Name the revision to withdraw, e.g. ${nameArg}@3. Revisions are withdrawn one at a time.`));
     process.exit(1);
   }
   const interactive2 = !!process.stdin.isTTY && !opts.json;
@@ -17811,14 +18167,14 @@ async function runRecipeWithdraw(nameArg, opts) {
     const { default: inquirer3 } = await import("inquirer");
     const { typed } = await inquirer3.prompt([{ type: "input", name: "typed", message: `type the recipe name to confirm (${ref.name}):` }]);
     if (String(typed ?? "").trim() !== ref.name) {
-      console.log(import_chalk51.default.yellow("Cancelled \u2014 nothing was withdrawn."));
+      console.log(import_chalk53.default.yellow("Cancelled \u2014 nothing was withdrawn."));
       return;
     }
   } else {
-    console.error(import_chalk51.default.red("Withdrawing needs a typed confirmation and there is no terminal to ask on."));
+    console.error(import_chalk53.default.red("Withdrawing needs a typed confirmation and there is no terminal to ask on."));
     process.exit(1);
   }
-  const spinner = !opts.json ? (0, import_ora17.default)("Withdrawing...").start() : null;
+  const spinner = !opts.json ? (0, import_ora19.default)("Withdrawing...").start() : null;
   let out;
   try {
     out = await producer(caller, {
@@ -17847,7 +18203,7 @@ async function runRecipeWithdraw(nameArg, opts) {
 init_logs();
 
 // src/commands/consumer-logs.ts
-var import_chalk52 = __toESM(require("chalk"));
+var import_chalk54 = __toESM(require("chalk"));
 init_auth();
 init_consumer_auth();
 init_log_view();
@@ -17855,9 +18211,9 @@ var CONSUMER_LOGS_BASE = process.env.APIBLAZE_CONSUMER_LOGS_BASE || "https://log
 function requireConsumer() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk52.default.red("Not logged in as an API Consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk54.default.red("Not logged in as an API Consumer. Run `apiblaze consumer login` first."));
     if (loadCredentials()) {
-      console.error(import_chalk52.default.dim("You're signed in as an API Producer \u2014 for a proxy's full logs run `apiblaze logs <project>`."));
+      console.error(import_chalk54.default.dim("You're signed in as an API Producer \u2014 for a proxy's full logs run `apiblaze logs <project>`."));
     }
     process.exit(1);
   }
@@ -17888,7 +18244,7 @@ async function consumerLogsFetch(session, suffix, init) {
   return data;
 }
 function otherPlaneHint2() {
-  if (loadCredentials()) console.log(import_chalk52.default.dim("  \u2039producer view: apiblaze logs <project>\u203A"));
+  if (loadCredentials()) console.log(import_chalk54.default.dim("  \u2039producer view: apiblaze logs <project>\u203A"));
 }
 function fetchWindow2(session, project) {
   return (params) => {
@@ -17904,8 +18260,8 @@ function fetchWindow2(session, project) {
 async function runConsumerLogsTail(opts) {
   const session = requireConsumer();
   if (!opts.json) {
-    console.log(import_chalk52.default.bold("API Consumer logs") + import_chalk52.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk52.default.dim("cost and upstream details are producer-only and are not sent"));
+    console.log(import_chalk54.default.bold("API Consumer logs") + import_chalk54.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk54.default.dim("cost and upstream details are producer-only and are not sent"));
     otherPlaneHint2();
   }
   await runTailSession({
@@ -17923,8 +18279,8 @@ async function runConsumerLogsTail(opts) {
 async function runConsumerLogsList(opts) {
   const session = requireConsumer();
   if (!opts.json) {
-    console.log(import_chalk52.default.bold("API Consumer logs") + import_chalk52.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
-    console.log(import_chalk52.default.dim("cost and upstream details are producer-only and are not sent"));
+    console.log(import_chalk54.default.bold("API Consumer logs") + import_chalk54.default.dim(` \xB7 your own requests on ${session.creds.tenant}${opts.project ? ` \xB7 ${opts.project}` : ""}${opts.errorsOnly ? " \xB7 errors only" : ""}`));
+    console.log(import_chalk54.default.dim("cost and upstream details are producer-only and are not sent"));
     otherPlaneHint2();
     console.log("");
   }
@@ -17937,71 +18293,12 @@ async function runConsumerLogsList(opts) {
   });
 }
 
-// src/commands/config.ts
-var import_chalk53 = __toESM(require("chalk"));
-var import_ora18 = __toESM(require("ora"));
-init_caller();
-init_paging();
-async function patchConfig(project, opts, body, summary) {
-  const caller = requireCaller();
-  const { teamId } = await resolveActingTeam(caller, opts.team);
-  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const spinner = (0, import_ora18.default)(summary + "...").start();
-  try {
-    const out = await producer(caller, {
-      method: "PATCH",
-      path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
-      body,
-      summary
-    });
-    spinner.succeed(`${summary} \u2014 ${proj2.projectName} v${proj2.apiVersion}.`);
-    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
-  } catch (err) {
-    spinner.fail(summary + " failed.");
-    throw err;
-  }
-}
-async function runTargetSet(project, opts) {
-  if (!opts.url) {
-    console.error(import_chalk53.default.red("--url is required."));
-    process.exit(1);
-  }
-  if (!opts.env) {
-    await patchConfig(project, opts, { target_url: opts.url }, `Set target \u2192 ${opts.url}`);
-    return;
-  }
-  const caller = requireCaller();
-  const { teamId } = await resolveActingTeam(caller, opts.team);
-  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const listing = await pageAll(
-    (cursor) => producer(caller, {
-      method: "GET",
-      path: withPage(`/projects?team_id=${encodeURIComponent(teamId)}`, cursor),
-      summary: `Read environments for ${proj2.projectName}`
-    }),
-    (b) => b?.projects
-  );
-  const row = listing.items.find((r) => r.project_id === proj2.projectId && r.api_version === proj2.apiVersion);
-  const current = row?.config?.environments;
-  const existing = current && typeof current === "object" && !Array.isArray(current) ? current : {};
-  const prev = existing[opts.env];
-  const environments = {
-    ...existing,
-    [opts.env]: { ...prev && typeof prev === "object" ? prev : {}, target: opts.url }
-  };
-  await patchConfig(project, opts, { environments }, `Set target for env ${opts.env} \u2192 ${opts.url}`);
-}
-async function runRename(project, opts) {
-  if (!opts.displayName) {
-    console.error(import_chalk53.default.red("--display-name is required."));
-    process.exit(1);
-  }
-  await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
-}
+// src/cli.ts
+init_config();
 
 // src/commands/limits.ts
-var import_chalk54 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_chalk55 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 init_caller();
 init_admin();
 init_resolve();
@@ -18099,18 +18396,18 @@ function renderLimits(r, name) {
   const cred = l.credentialQuota ? `${l.credentialQuota.limit.toLocaleString()} per key (${l.credentialQuota.period})` : "(none)";
   const cap2 = typeof l.spendCapUnits === "number" ? usd(Math.round(l.spendCapUnits / LEDGER_UNITS_PER_CENT)) + " / month" : "(none)";
   const lines = [
-    `${import_chalk54.default.bold(name)}${r.api_version ? import_chalk54.default.dim(` v${r.api_version}`) : ""}${r.anonymous ? import_chalk54.default.dim("  (anonymous workspace)") : ""}`,
+    `${import_chalk55.default.bold(name)}${r.api_version ? import_chalk55.default.dim(` v${r.api_version}`) : ""}${r.anonymous ? import_chalk55.default.dim("  (anonymous workspace)") : ""}`,
     // Standard is the only mode; a stored `strict` (pre-2026-09-29 config) is
     // served as standard by the API, and named as such here.
-    `  ${"mode".padEnd(18)} standard${l.mode === "strict" ? " (legacy strict setting)" : ""}${import_chalk54.default.dim("  per consumer key, approximate per location")}`,
-    `  ${"rate limit".padEnd(18)} ${ladder(l.consumerRps, t.consumerRps)}${import_chalk54.default.dim("  per consumer key")}`,
-    `  ${"end-user rate".padEnd(18)} ${ladder(l.endUserRps, t.endUserRps)}${import_chalk54.default.dim("  per X-End-User-Id")}`,
-    `  ${"ceiling".padEnd(18)} ${ladder(l.ceilingRps, t.ceilingRps)}${import_chalk54.default.dim(`  whole proxy \xB7 read-only${typeof r.self_serve_ceiling_rps === "number" ? `, self-serve up to ${r.self_serve_ceiling_rps}/s` : ""}`)}`,
-    `  ${"quota".padEnd(18)} ${quota}${import_chalk54.default.dim("  fixed UTC windows")}`,
+    `  ${"mode".padEnd(18)} standard${l.mode === "strict" ? " (legacy strict setting)" : ""}${import_chalk55.default.dim("  per consumer key, approximate per location")}`,
+    `  ${"rate limit".padEnd(18)} ${ladder(l.consumerRps, t.consumerRps)}${import_chalk55.default.dim("  per consumer key")}`,
+    `  ${"end-user rate".padEnd(18)} ${ladder(l.endUserRps, t.endUserRps)}${import_chalk55.default.dim("  per X-End-User-Id")}`,
+    `  ${"ceiling".padEnd(18)} ${ladder(l.ceilingRps, t.ceilingRps)}${import_chalk55.default.dim(`  whole proxy \xB7 read-only${typeof r.self_serve_ceiling_rps === "number" ? `, self-serve up to ${r.self_serve_ceiling_rps}/s` : ""}`)}`,
+    `  ${"quota".padEnd(18)} ${quota}${import_chalk55.default.dim("  fixed UTC windows")}`,
     `  ${"spend cap".padEnd(18)} ${cap2}`,
     `  ${"credential quota".padEnd(18)} ${cred}`
   ];
-  if (typeof l.configVersion === "number") lines.push(import_chalk54.default.dim(`  config version ${l.configVersion} \xB7 edits bind within 30 s, no reset on edit`));
+  if (typeof l.configVersion === "number") lines.push(import_chalk55.default.dim(`  config version ${l.configVersion} \xB7 edits bind within 30 s, no reset on edit`));
   return lines;
 }
 async function resolve2(project, opts) {
@@ -18129,7 +18426,7 @@ async function runLimitsGet(project, opts) {
   if (opts.json) return void console.log(JSON.stringify(r, null, 2));
   console.log("");
   for (const l of renderLimits(r, proj2.projectName)) console.log(l);
-  console.log(import_chalk54.default.dim(`
+  console.log(import_chalk55.default.dim(`
   Change: ${B.cli} limits set ${proj2.projectName} --rate <n> [--end-user-rate <n>] [--quota <n> --period daily|weekly|monthly] [--spend-cap <usd>]
 `));
 }
@@ -18139,7 +18436,7 @@ async function runLimitsSet(project, opts) {
   const needsCurrent = opts.quota !== void 0 && opts.period === void 0 || opts.period !== void 0 && opts.quota === void 0 || opts.credentialQuota !== void 0;
   const current = needsCurrent ? (await getLimits(caller, proj2).catch(() => null))?.limits ?? null : null;
   const body = buildLimitsPatch(opts, current);
-  const spinner = (0, import_ora19.default)(`Update limits for ${proj2.projectName}...`).start();
+  const spinner = (0, import_ora20.default)(`Update limits for ${proj2.projectName}...`).start();
   let r;
   try {
     r = await producer(caller, { method: "PUT", path: limitsPath(proj2), body, summary: `Set limits ${JSON.stringify(body)}` });
@@ -18155,9 +18452,9 @@ async function runLimitsSet(project, opts) {
           console.log(JSON.stringify({ error: inner.error ?? b.error, details: inner.details ?? b.details, max_self_serve_rps: inner.max_self_serve_rps ?? b.max_self_serve_rps, request_ceiling: hint, command: cmd }));
           process.exit(1);
         }
-        console.log(import_chalk54.default.yellow(`  ${inner.details ?? b.details ?? inner.error ?? b.error ?? "That ceiling needs approval."}`));
-        if (typeof (inner.max_self_serve_rps ?? b.max_self_serve_rps) === "number") console.log(import_chalk54.default.dim(`  Self-serve ceiling: ${inner.max_self_serve_rps ?? b.max_self_serve_rps}/s. Above that an operator approves.`));
-        console.log(`  Request it: ${import_chalk54.default.cyan(cmd)}`);
+        console.log(import_chalk55.default.yellow(`  ${inner.details ?? b.details ?? inner.error ?? b.error ?? "That ceiling needs approval."}`));
+        if (typeof (inner.max_self_serve_rps ?? b.max_self_serve_rps) === "number") console.log(import_chalk55.default.dim(`  Self-serve ceiling: ${inner.max_self_serve_rps ?? b.max_self_serve_rps}/s. Above that an operator approves.`));
+        console.log(`  Request it: ${import_chalk55.default.cyan(cmd)}`);
         process.exit(1);
       }
     }
@@ -18167,7 +18464,7 @@ async function runLimitsSet(project, opts) {
   if (opts.json) return void console.log(JSON.stringify(r, null, 2));
   for (const l of renderLimits(r, proj2.projectName)) console.log(l);
   if (resolveCaller()?.mode === "anon") {
-    console.log(import_chalk54.default.dim("  Anonymous workspace: rates are capped at the anonymous ceiling until you claim it (`apiblaze login`, then `apiblaze claim`)."));
+    console.log(import_chalk55.default.dim("  Anonymous workspace: rates are capped at the anonymous ceiling until you claim it (`apiblaze login`, then `apiblaze claim`)."));
   }
   console.log("");
 }
@@ -18176,7 +18473,7 @@ async function runLimitsRequestMax(project, opts) {
   if (rps === void 0) throw new UsageError("--rps <n> is required: the ceiling you are asking for, in requests per second.");
   const { caller, proj: proj2 } = await resolve2(project, opts);
   const body = { requested_rps: rps, ...opts.useCase ? { use_case: opts.useCase } : {} };
-  const spinner = (0, import_ora19.default)(`Request a ${rps}/s ceiling for ${proj2.projectName}...`).start();
+  const spinner = (0, import_ora20.default)(`Request a ${rps}/s ceiling for ${proj2.projectName}...`).start();
   let r;
   try {
     r = await producer(caller, { method: "POST", path: `${limitsPath(proj2)}/ceiling-request`, body, summary: `Request ceiling ${rps}/s` });
@@ -18186,8 +18483,8 @@ async function runLimitsRequestMax(project, opts) {
   }
   spinner.succeed(`Requested: ${ladder(rps)} for ${proj2.projectName}.`);
   if (opts.json) return void console.log(JSON.stringify(r ?? { accepted: true, requested_rps: rps }, null, 2));
-  console.log(import_chalk54.default.dim("  Up to 1,000/s is granted instantly to a proven wallet; above that an operator approves (1k / 10k / 100k presets)."));
-  console.log(import_chalk54.default.dim(`  Check: ${B.cli} limits get ${proj2.projectName}
+  console.log(import_chalk55.default.dim("  Up to 1,000/s is granted instantly to a proven wallet; above that an operator approves (1k / 10k / 100k presets)."));
+  console.log(import_chalk55.default.dim(`  Check: ${B.cli} limits get ${proj2.projectName}
 `));
 }
 function renderTeamQuota(q, teamLabel2, now = Date.now()) {
@@ -18202,9 +18499,9 @@ function renderTeamQuota(q, teamLabel2, now = Date.now()) {
     resets = Number.isFinite(ms2) && ms2 > now ? `${q.resets_at.replace("T", " ").slice(0, 16)} UTC (in ${humanIn(ms2 - now)})` : q.resets_at;
   }
   return [
-    `${import_chalk54.default.bold(teamLabel2)} \u2014 team quota${q.quotaPeriod ? ` (${q.quotaPeriod})` : ""}`,
+    `${import_chalk55.default.bold(teamLabel2)} \u2014 team quota${q.quotaPeriod ? ` (${q.quotaPeriod})` : ""}`,
     `  ${"used".padEnd(12)} ${used.toLocaleString()}`,
-    `  ${"in use".padEnd(12)} ${inUse.toLocaleString()}${import_chalk54.default.dim("  pre-granted to live requests")}`,
+    `  ${"in use".padEnd(12)} ${inUse.toLocaleString()}${import_chalk55.default.dim("  pre-granted to live requests")}`,
     `  ${"limit".padEnd(12)} ${limit === null ? "(none)" : limit.toLocaleString()}${bar}`,
     `  ${"resets".padEnd(12)} ${resets}`,
     `  ${"spend cap".padEnd(12)} ${usd(q.spend_cap_cents)}${typeof q.spend_cap_cents === "number" ? " / month" : ""}`
@@ -18225,7 +18522,7 @@ async function runLimitsUsage(project, opts) {
   const read = () => admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/quota`, summary: `Team quota for ${teamId}` });
   const render = (q) => {
     const lines = renderTeamQuota(q, teamName ?? teamId);
-    lines.push(import_chalk54.default.dim(`  ${proj2.projectName}: per-project quota usage is not exposed by the API yet \u2014 this is the team-wide meter that also gates ${proj2.projectName}.`));
+    lines.push(import_chalk55.default.dim(`  ${proj2.projectName}: per-project quota usage is not exposed by the API yet \u2014 this is the team-wide meter that also gates ${proj2.projectName}.`));
     return lines;
   };
   if (!opts.watch) {
@@ -18242,7 +18539,7 @@ async function runLimitsUsage(project, opts) {
     else {
       process.stdout.write("\x1B[2J\x1B[H");
       for (const l of render(q)) console.log(l);
-      console.log(import_chalk54.default.dim(`
+      console.log(import_chalk55.default.dim(`
   ${(/* @__PURE__ */ new Date()).toISOString()} \xB7 every 5 s \xB7 Ctrl-C to stop`));
     }
     await new Promise((r) => setTimeout(r, 5e3));
@@ -18251,13 +18548,13 @@ async function runLimitsUsage(project, opts) {
 async function runThrottleAlias(project, opts) {
   const mapped = throttleToLimitsOpts(opts);
   const flags = Object.entries(mapped).map(([k, v]) => `--${k.replace(/[A-Z]/g, (c) => "-" + c.toLowerCase())} ${v}`).join(" ");
-  console.error(import_chalk54.default.yellow(`  \`${B.cli} throttle\` is deprecated and will be removed next release \u2014 use: ${B.cli} limits set ${project}${flags ? " " + flags : ""}`));
+  console.error(import_chalk55.default.yellow(`  \`${B.cli} throttle\` is deprecated and will be removed next release \u2014 use: ${B.cli} limits set ${project}${flags ? " " + flags : ""}`));
   await runLimitsSet(project, { ...opts, ...mapped });
 }
 
 // src/commands/billing.ts
-var import_chalk55 = __toESM(require("chalk"));
-var import_ora20 = __toESM(require("ora"));
+var import_chalk56 = __toESM(require("chalk"));
+var import_ora21 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_brand();
@@ -18276,34 +18573,34 @@ var STATUS_WORDS = {
   unavailable: "unavailable (the wallet root could not be reached)"
 };
 function statusColour(status2) {
-  if (status2 === "covered" || status2 === "free") return import_chalk55.default.green;
-  if (status2 === "low" || status2 === "grace" || status2 === "unavailable") return import_chalk55.default.yellow;
-  return import_chalk55.default.red;
+  if (status2 === "covered" || status2 === "free") return import_chalk56.default.green;
+  if (status2 === "low" || status2 === "grace" || status2 === "unavailable") return import_chalk56.default.yellow;
+  return import_chalk56.default.red;
 }
 function renderBalance(c, teamLabel2) {
   const owner = typeof c.balance === "number" || typeof c.available_cents === "number";
   const status2 = String(c.status ?? "unavailable");
-  const lines = [`${import_chalk55.default.bold(teamLabel2)} \u2014 wallet${c.billing_account_id ? import_chalk55.default.dim(` ${c.billing_account_id}`) : ""}`];
-  lines.push(`  ${"status".padEnd(14)} ${statusColour(status2)(STATUS_WORDS[status2] ?? status2)}${c.frozen && c.frozen_reason ? import_chalk55.default.dim(`  (${c.frozen_reason})`) : ""}`);
+  const lines = [`${import_chalk56.default.bold(teamLabel2)} \u2014 wallet${c.billing_account_id ? import_chalk56.default.dim(` ${c.billing_account_id}`) : ""}`];
+  lines.push(`  ${"status".padEnd(14)} ${statusColour(status2)(STATUS_WORDS[status2] ?? status2)}${c.frozen && c.frozen_reason ? import_chalk56.default.dim(`  (${c.frozen_reason})`) : ""}`);
   if (!owner) {
-    lines.push(import_chalk55.default.dim("  This team runs on another owner's wallet: only its status is visible to you."));
+    lines.push(import_chalk56.default.dim("  This team runs on another owner's wallet: only its status is visible to you."));
     return lines;
   }
   const available = c.available_cents ?? c.balance ?? 0;
-  lines.push(`  ${"available".padEnd(14)} ${import_chalk55.default.bold(money(available))}`);
-  lines.push(`  ${"in use".padEnd(14)} ${money(c.in_use_cents ?? 0)}${import_chalk55.default.dim("  pre-paid to live requests; returns as they finish")}`);
+  lines.push(`  ${"available".padEnd(14)} ${import_chalk56.default.bold(money(available))}`);
+  lines.push(`  ${"in use".padEnd(14)} ${money(c.in_use_cents ?? 0)}${import_chalk56.default.dim("  pre-paid to live requests; returns as they finish")}`);
   if (typeof c.grace_limit_cents === "number" || typeof c.grace_used_cents === "number") {
     const used = c.grace_used_cents ?? 0;
-    lines.push(`  ${"grace".padEnd(14)} ${used > 0 ? import_chalk55.default.yellow(`${money(used)} owed`) : money(0)} of ${money(c.grace_limit_cents ?? 0)}${import_chalk55.default.dim("  a debt, repaid from the next top-up")}`);
+    lines.push(`  ${"grace".padEnd(14)} ${used > 0 ? import_chalk56.default.yellow(`${money(used)} owed`) : money(0)} of ${money(c.grace_limit_cents ?? 0)}${import_chalk56.default.dim("  a debt, repaid from the next top-up")}`);
   }
   if (typeof c.free_requests_remaining === "number" || typeof c.free_turns_remaining === "number") {
     lines.push(`  ${"free tier".padEnd(14)} ${c.free_requests_remaining ?? 0} requests \xB7 ${c.free_turns_remaining ?? 0} chat turns left`);
   }
   const ar = c.auto_rebuy;
-  lines.push(`  ${"auto-rebuy".padEnd(14)} ${ar?.enabled ? import_chalk55.default.green(`on \u2014 add ${money(ar.amount_cents)} when available drops under ${money(ar.threshold_cents)}`) : import_chalk55.default.dim("off")}`);
-  lines.push(`  ${"last top-up".padEnd(14)} ${c.last_topup ? `${money(c.last_topup.cents)} on ${c.last_topup.at.replace("T", " ").slice(0, 16)} UTC` : import_chalk55.default.dim("never")}`);
+  lines.push(`  ${"auto-rebuy".padEnd(14)} ${ar?.enabled ? import_chalk56.default.green(`on \u2014 add ${money(ar.amount_cents)} when available drops under ${money(ar.threshold_cents)}`) : import_chalk56.default.dim("off")}`);
+  lines.push(`  ${"last top-up".padEnd(14)} ${c.last_topup ? `${money(c.last_topup.cents)} on ${c.last_topup.at.replace("T", " ").slice(0, 16)} UTC` : import_chalk56.default.dim("never")}`);
   if (c.terms && c.terms !== "prepaid") lines.push(`  ${"terms".padEnd(14)} ${c.terms}`);
-  if (c.closed) lines.push(import_chalk55.default.red("  This wallet is closed."));
+  if (c.closed) lines.push(import_chalk56.default.red("  This wallet is closed."));
   return lines;
 }
 async function readCredits(teamId) {
@@ -18317,7 +18614,7 @@ async function runBillingBalance(opts) {
   for (const l of renderBalance(c, teamName ?? teamId)) console.log(l);
   const status2 = String(c.status);
   if (typeof c.balance === "number" && (status2 === "low" || status2 === "out" || status2 === "grace" || status2 === "frozen")) {
-    console.log(import_chalk55.default.dim(`
+    console.log(import_chalk56.default.dim(`
   Top up: ${B.cli} billing topup <usd>`));
   }
   console.log("");
@@ -18337,18 +18634,18 @@ async function runBillingTopup(amount, opts) {
     return;
   }
   if (c && typeof c.balance !== "number") {
-    console.log(import_chalk55.default.yellow(`
+    console.log(import_chalk56.default.yellow(`
   ${teamName ?? teamId} runs on another owner's wallet \u2014 only that owner can top it up.`));
-    console.log(import_chalk55.default.dim(`  Ask them, or fund your own: ${url}
+    console.log(import_chalk56.default.dim(`  Ask them, or fund your own: ${url}
 `));
     return;
   }
   console.log(`
-  Top up ${import_chalk55.default.bold(`$${usd2.toFixed(2)}`)} for ${import_chalk55.default.bold(teamName ?? teamId)} in the dashboard (card checkout needs your browser session):`);
-  console.log(`  ${import_chalk55.default.cyan(url)}`);
-  console.log(import_chalk55.default.dim(`  Enter $${usd2.toFixed(2)} in the wallet panel; the balance updates within seconds of Stripe confirming.`));
-  if (c?.auto_rebuy?.enabled) console.log(import_chalk55.default.dim(`  Auto-rebuy is on (${money(c.auto_rebuy.amount_cents)} under ${money(c.auto_rebuy.threshold_cents)}).`));
-  else console.log(import_chalk55.default.dim(`  Never run dry: ${B.cli} billing rebuy on --amount 50 --threshold 10`));
+  Top up ${import_chalk56.default.bold(`$${usd2.toFixed(2)}`)} for ${import_chalk56.default.bold(teamName ?? teamId)} in the dashboard (card checkout needs your browser session):`);
+  console.log(`  ${import_chalk56.default.cyan(url)}`);
+  console.log(import_chalk56.default.dim(`  Enter $${usd2.toFixed(2)} in the wallet panel; the balance updates within seconds of Stripe confirming.`));
+  if (c?.auto_rebuy?.enabled) console.log(import_chalk56.default.dim(`  Auto-rebuy is on (${money(c.auto_rebuy.amount_cents)} under ${money(c.auto_rebuy.threshold_cents)}).`));
+  else console.log(import_chalk56.default.dim(`  Never run dry: ${B.cli} billing rebuy on --amount 50 --threshold 10`));
   if (opts.open) {
     const { spawn: spawn5 } = await import("child_process");
     const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
@@ -18370,15 +18667,15 @@ function usageToCsv(rows) {
 }
 function renderUsageTable(r, hourly) {
   const rows = r.rows ?? [];
-  if (!rows.length) return [import_chalk55.default.dim("  No usage in that window.")];
+  if (!rows.length) return [import_chalk56.default.dim("  No usage in that window.")];
   const w = hourly ? 16 : 10;
-  const lines = [import_chalk55.default.dim(`  ${"bucket".padEnd(w)}  ${"project".padEnd(24)}  ${"requests".padStart(10)}  ${"free".padStart(8)}  ${"cost".padStart(10)}`)];
+  const lines = [import_chalk56.default.dim(`  ${"bucket".padEnd(w)}  ${"project".padEnd(24)}  ${"requests".padStart(10)}  ${"free".padStart(8)}  ${"cost".padStart(10)}`)];
   for (const row of rows) {
     const bucket = hourly ? row.bucket.replace("T", " ").slice(0, 16) : row.bucket.slice(0, 10);
-    lines.push(`  ${bucket.padEnd(w)}  ${(row.project_id || "(no project)").slice(0, 24).padEnd(24)}  ${row.requests.toLocaleString().padStart(10)}  ${(row.free_used ?? 0).toLocaleString().padStart(8)}  ${money(row.cost_cents).padStart(10)}${row.exact === false ? import_chalk55.default.dim("  ~") : ""}`);
+    lines.push(`  ${bucket.padEnd(w)}  ${(row.project_id || "(no project)").slice(0, 24).padEnd(24)}  ${row.requests.toLocaleString().padStart(10)}  ${(row.free_used ?? 0).toLocaleString().padStart(8)}  ${money(row.cost_cents).padStart(10)}${row.exact === false ? import_chalk56.default.dim("  ~") : ""}`);
   }
   const t = r.totals ?? { requests: rows.reduce((a, x) => a + x.requests, 0), cost_cents: rows.reduce((a, x) => a + x.cost_cents, 0), free_used: rows.reduce((a, x) => a + (x.free_used ?? 0), 0) };
-  lines.push(import_chalk55.default.bold(`  ${"total".padEnd(w)}  ${"".padEnd(24)}  ${Number(t.requests ?? 0).toLocaleString().padStart(10)}  ${Number(t.free_used ?? 0).toLocaleString().padStart(8)}  ${money(t.cost_cents ?? 0).padStart(10)}`));
+  lines.push(import_chalk56.default.bold(`  ${"total".padEnd(w)}  ${"".padEnd(24)}  ${Number(t.requests ?? 0).toLocaleString().padStart(10)}  ${Number(t.free_used ?? 0).toLocaleString().padStart(8)}  ${money(t.cost_cents ?? 0).padStart(10)}`));
   return lines;
 }
 var HISTORY_PAGE_MAX = 500;
@@ -18422,33 +18719,33 @@ async function readTeamLedger(teamId, q) {
   return out;
 }
 function renderLedgerLine(l) {
-  const tag = l.pending ? import_chalk55.default.yellow("pending ") : " ".repeat(8);
-  const amt = (l.amount_cents < 0 ? import_chalk55.default.red : l.amount_cents > 0 ? import_chalk55.default.green : import_chalk55.default.dim)(signedMoney(l.amount_cents).padStart(12));
+  const tag = l.pending ? import_chalk56.default.yellow("pending ") : " ".repeat(8);
+  const amt = (l.amount_cents < 0 ? import_chalk56.default.red : l.amount_cents > 0 ? import_chalk56.default.green : import_chalk56.default.dim)(signedMoney(l.amount_cents).padStart(12));
   if (l.class === "flow") {
     const reqs = `${(l.requests ?? 0).toLocaleString()} request${l.requests === 1 ? "" : "s"}`;
-    return `  ${tag}${utc(l.ts_from).slice(0, 10).padEnd(16)}  ${`${l.label} UTC`.slice(0, 26).padEnd(26)}  ${reqs.padStart(16)}  ${amt}${l.project_id ? import_chalk55.default.dim(`  ${l.project_id}`) : ""}`;
+    return `  ${tag}${utc(l.ts_from).slice(0, 10).padEnd(16)}  ${`${l.label} UTC`.slice(0, 26).padEnd(26)}  ${reqs.padStart(16)}  ${amt}${l.project_id ? import_chalk56.default.dim(`  ${l.project_id}`) : ""}`;
   }
-  const bal = typeof l.balance_after_cents === "number" ? `${import_chalk55.default.dim("balance")} ${money(l.balance_after_cents)}` : "";
+  const bal = typeof l.balance_after_cents === "number" ? `${import_chalk56.default.dim("balance")} ${money(l.balance_after_cents)}` : "";
   const extra = [l.label && l.label !== l.kind ? l.label : null, l.project_id].filter(Boolean).join(" \xB7 ");
-  return `  ${tag}${utc(l.ts).padEnd(16)}  ${String(l.kind).slice(0, 26).padEnd(26)}  ${"".padStart(16)}  ${amt}${bal ? `  ${bal}` : ""}${extra ? import_chalk55.default.dim(`  ${extra}`) : ""}`;
+  return `  ${tag}${utc(l.ts).padEnd(16)}  ${String(l.kind).slice(0, 26).padEnd(26)}  ${"".padStart(16)}  ${amt}${bal ? `  ${bal}` : ""}${extra ? import_chalk56.default.dim(`  ${extra}`) : ""}`;
 }
 function renderLedger(r, limit) {
   const lines = [];
-  lines.push(import_chalk55.default.bold(`  Ledger \u2014 newest first${r.window_days ? `, last ${r.window_days} day${r.window_days === 1 ? "" : "s"}` : ""}`) + import_chalk55.default.dim("  (events one line each; usage in 5-minute blocks, UTC)"));
-  if (!r.pending_sync_available) lines.push(import_chalk55.default.yellow("  Pending lines unavailable right now \u2014 the last few minutes of charges may not be listed yet."));
+  lines.push(import_chalk56.default.bold(`  Ledger \u2014 newest first${r.window_days ? `, last ${r.window_days} day${r.window_days === 1 ? "" : "s"}` : ""}`) + import_chalk56.default.dim("  (events one line each; usage in 5-minute blocks, UTC)"));
+  if (!r.pending_sync_available) lines.push(import_chalk56.default.yellow("  Pending lines unavailable right now \u2014 the last few minutes of charges may not be listed yet."));
   if (r.pending_sync.length) {
-    lines.push(import_chalk55.default.yellow("  Pending sync \u2014 made by the wallet, not in the ledger yet:"));
+    lines.push(import_chalk56.default.yellow("  Pending sync \u2014 made by the wallet, not in the ledger yet:"));
     for (const l of r.pending_sync) lines.push(renderLedgerLine({ ...l, pending: true }));
   }
   if (!r.history_available) {
-    lines.push(import_chalk55.default.yellow("  The ledger could not be read right now \u2014 history unknown (not empty). Try again shortly."));
+    lines.push(import_chalk56.default.yellow("  The ledger could not be read right now \u2014 history unknown (not empty). Try again shortly."));
   } else if (!r.history.length && !r.pending_sync.length) {
-    lines.push(import_chalk55.default.dim("  No ledger lines in that window."));
+    lines.push(import_chalk56.default.dim("  No ledger lines in that window."));
   } else {
     for (const l of r.history) lines.push(renderLedgerLine(l));
   }
   if (r.history_next_before) {
-    lines.push(import_chalk55.default.dim(`  More lines than --limit ${limit}. Next page: ${B.cli} billing history --before ${r.history_next_before}  (or raise --limit)`));
+    lines.push(import_chalk56.default.dim(`  More lines than --limit ${limit}. Next page: ${B.cli} billing history --before ${r.history_next_before}  (or raise --limit)`));
   }
   return lines;
 }
@@ -18482,9 +18779,9 @@ async function runBillingHistory(opts) {
   console.log("");
   if (ledger) for (const l of renderLedger(ledger, limit)) console.log(l);
   console.log("");
-  console.log(import_chalk55.default.bold(`  Usage \u2014 ${opts.raw ? "raw, one row per 5-minute UTC bucket" : "daily rollups"}${opts.since ? ` since ${opts.since}` : ""}${opts.until ? ` until ${opts.until}` : ""}`));
+  console.log(import_chalk56.default.bold(`  Usage \u2014 ${opts.raw ? "raw, one row per 5-minute UTC bucket" : "daily rollups"}${opts.since ? ` since ${opts.since}` : ""}${opts.until ? ` until ${opts.until}` : ""}`));
   for (const l of renderUsageTable(r, !!opts.raw)) console.log(l);
-  console.log(import_chalk55.default.dim("\n  Exact figures from the money ledger, per project (UTC). Entries the wallet has not sent yet (\u2264 ~5 min) are the pending lines above, not this table. CSV: --format csv\n"));
+  console.log(import_chalk56.default.dim("\n  Exact figures from the money ledger, per project (UTC). Entries the wallet has not sent yet (\u2264 ~5 min) are the pending lines above, not this table. CSV: --format csv\n"));
 }
 async function runBillingRebuy(mode, opts) {
   const which = (mode ?? "status").toLowerCase();
@@ -18494,12 +18791,12 @@ async function runBillingRebuy(mode, opts) {
     const c = await readCredits(teamId);
     if (opts.json) return void console.log(JSON.stringify({ team_id: teamId, auto_rebuy: c.auto_rebuy ?? null, owner: typeof c.balance === "number" }));
     const ar2 = c.auto_rebuy;
-    if (typeof c.balance !== "number") return void console.log(import_chalk55.default.dim(`
+    if (typeof c.balance !== "number") return void console.log(import_chalk56.default.dim(`
   ${teamName ?? teamId} runs on another owner's wallet; auto-rebuy is theirs to set.
 `));
     console.log(`
-  auto-rebuy ${ar2?.enabled ? import_chalk55.default.green("on") : import_chalk55.default.dim("off")}${ar2?.enabled ? ` \u2014 add ${money(ar2.amount_cents)} when available drops under ${money(ar2.threshold_cents)}` : ""}`);
-    console.log(import_chalk55.default.dim(`  ${B.cli} billing rebuy on --amount 50 --threshold 10 \xB7 ${B.cli} billing rebuy off
+  auto-rebuy ${ar2?.enabled ? import_chalk56.default.green("on") : import_chalk56.default.dim("off")}${ar2?.enabled ? ` \u2014 add ${money(ar2.amount_cents)} when available drops under ${money(ar2.threshold_cents)}` : ""}`);
+    console.log(import_chalk56.default.dim(`  ${B.cli} billing rebuy on --amount 50 --threshold 10 \xB7 ${B.cli} billing rebuy off
 `));
     return;
   }
@@ -18515,7 +18812,7 @@ async function runBillingRebuy(mode, opts) {
       throw new UsageError(`--amount must be between $${TOPUP_MIN_USD} and $${TOPUP_MAX_USD} (one card charge).`);
     }
   }
-  const spinner = (0, import_ora20.default)(`Auto-rebuy ${which}...`).start();
+  const spinner = (0, import_ora21.default)(`Auto-rebuy ${which}...`).start();
   let r;
   try {
     r = await admin({ method: "PUT", path: `/credits/auto-rebuy?teamId=${encodeURIComponent(teamId)}`, body, summary: `Auto-rebuy ${which}` });
@@ -18528,159 +18825,8 @@ async function runBillingRebuy(mode, opts) {
   if (opts.json) console.log(JSON.stringify(r ?? { auto_rebuy: body }));
 }
 
-// src/commands/transform.ts
-var import_chalk56 = __toESM(require("chalk"));
-var import_ora21 = __toESM(require("ora"));
-init_caller();
-var HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
-var ruleNameFor = (header) => `set header ${header.toLowerCase()}`;
-async function target(project, opts) {
-  const caller = requireCaller();
-  const { teamId } = await resolveActingTeam(caller, opts.team);
-  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
-  const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/transforms`;
-  return { caller, proj: proj2, base: base2 };
-}
-async function listRules(t) {
-  const out = await producer(t.caller, {
-    method: "GET",
-    path: t.base,
-    summary: `List transforms for ${t.proj.projectName}`
-  });
-  return out?.rules ?? [];
-}
-function describe(r) {
-  const a = r.action ?? { type: "?" };
-  if (a.type === "hardcode") {
-    const secret = !a.value || /^abzsec:|^__ABZSEC_|^•+$/.test(a.value);
-    return `set ${a.destination} = ${secret ? "(secret)" : a.value}`;
-  }
-  if (a.type === "remove") return `remove ${a.field}`;
-  if (a.type === "map") return `map ${a.source} \u2192 ${a.destination}${a.lookup?.mapping_id ? " (through a mapping table)" : ""}`;
-  return a.type;
-}
-async function runTransformList(project, opts) {
-  const t = await target(project, opts);
-  const rules = await listRules(t);
-  if (opts.json) {
-    console.log(JSON.stringify(rules, null, 2));
-    return;
-  }
-  if (!rules.length) {
-    console.log(import_chalk56.default.dim(`No transforms on ${t.proj.projectName} v${t.proj.apiVersion}.`));
-    return;
-  }
-  for (const r of rules) {
-    console.log(`${r.enabled ? import_chalk56.default.green("\u25CF") : import_chalk56.default.gray("\u25CB")} ${import_chalk56.default.bold(r.name)} ${import_chalk56.default.dim(`[${r.phase}] ${r.id}`)}`);
-    console.log(`    ${describe(r)}`);
-  }
-}
-async function runTransformSetHeader(project, header, opts) {
-  if (!HEADER_NAME.test(header)) throw new Error(`"${header}" is not a valid header name.`);
-  if (opts.value === void 0 === (opts.valueEnv === void 0)) {
-    throw new Error("Pass exactly one of --value <value> or --value-env <VAR> (reads the value from that environment variable, so it stays out of your shell history).");
-  }
-  const value = opts.value ?? process.env[opts.valueEnv];
-  if (!value) throw new Error(`Environment variable ${opts.valueEnv} is empty or not set.`);
-  const t = await target(project, opts);
-  const name = ruleNameFor(header);
-  const action = {
-    type: "hardcode",
-    destination: `header:${header}`,
-    value,
-    // Encrypted at rest and masked on every read; main-proxy decrypts it only
-    // on the way to the upstream.
-    ...opts.secret ? { value_secret: true } : {}
-  };
-  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
-  const summary = `${existing ? "Update" : "Add"} transform: send ${header} to the upstream`;
-  const spinner = opts.json ? null : (0, import_ora21.default)(summary + "...").start();
-  try {
-    const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action, phase: "request", enabled: true }, summary });
-    spinner?.succeed(`${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}${opts.secret ? " (stored encrypted)" : ""}.`);
-    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
-    else console.log(import_chalk56.default.dim(`  Every call the proxy forwards now carries ${header}. Your backend can reject calls without it.`));
-  } catch (err) {
-    spinner?.fail(summary + " failed.");
-    throw err;
-  }
-}
-async function runTransformRemove(project, nameOrId, opts) {
-  const t = await target(project, opts);
-  const rules = await listRules(t);
-  const want = nameOrId.toLowerCase();
-  const rule = rules.find((r) => r.id === nameOrId || r.name.toLowerCase() === want || r.name === ruleNameFor(nameOrId));
-  if (!rule) {
-    throw new Error(`No transform "${nameOrId}" on ${t.proj.projectName}.` + (rules.length ? ` Transforms: ${rules.map((r) => r.name).join(", ")}` : ""));
-  }
-  await producer(t.caller, {
-    method: "DELETE",
-    path: `${t.base}/${encodeURIComponent(rule.id)}`,
-    summary: `Remove transform "${rule.name}"`
-  });
-  if (opts.json) console.log(JSON.stringify({ ok: true, removed: rule.id }));
-  else console.log(`${import_chalk56.default.green("\u2713")} Removed transform ${import_chalk56.default.bold(rule.name)} from ${t.proj.projectName}.`);
-}
-function tablesBase(t) {
-  return t.base.replace(/\/transforms$/, "/mappings");
-}
-async function listTables(t) {
-  const out = await producer(t.caller, {
-    method: "GET",
-    path: tablesBase(t),
-    summary: `List mapping tables for ${t.proj.projectName}`
-  });
-  return out?.tables ?? [];
-}
-function parseEntries(pairs) {
-  return pairs.map((p) => {
-    const i = p.indexOf("=");
-    if (i <= 0) throw new Error(`"${p}" is not a from=to pair (e.g. FR=EUR).`);
-    return { from: p.slice(0, i), to: p.slice(i + 1) };
-  });
-}
-var FIELD_REF = /^(header|query|param|bodyvar|jwt):.+/;
-async function runTransformMapping(project, table, pairs, opts) {
-  if (!pairs.length) throw new Error("Give at least one from=to pair, e.g. FR=EUR US=USD.");
-  const entries2 = parseEntries(pairs);
-  const t = await target(project, opts);
-  const existing = (await listTables(t)).find((m) => m.name === table);
-  const body = { name: table, entries: entries2, ...opts.secret ? { encrypt_values: true } : {} };
-  const summary = `${existing ? "Replace" : "Create"} mapping table "${table}" (${entries2.length} entr${entries2.length === 1 ? "y" : "ies"})`;
-  const out = await producer(t.caller, existing ? { method: "PUT", path: `${tablesBase(t)}/${encodeURIComponent(existing.id)}`, body, summary } : { method: "POST", path: tablesBase(t), body, summary });
-  if (opts.json) {
-    console.log(JSON.stringify(out ?? { ok: true }));
-    return;
-  }
-  console.log(`${import_chalk56.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
-  for (const e of entries2) console.log(import_chalk56.default.dim(`    ${e.from} \u2192 ${opts.secret ? "(secret)" : e.to}`));
-}
-async function runTransformMap(project, source, destination, opts) {
-  if (!FIELD_REF.test(source)) throw new Error(`Source "${source}" must look like header:X-Country, query:country or bodyvar:order.country.`);
-  if (!/^(header|query|bodyvar):.+/.test(destination)) throw new Error(`Destination "${destination}" must look like header:X-Currency, query:currency or bodyvar:order.currency.`);
-  if (!opts.table) throw new Error("--table <name> is required: the mapping table to look the value up in (create it with `transform mapping`).");
-  const onNoMatch = opts.onNoMatch ?? "skip";
-  if (!["skip", "fail", "passthrough"].includes(onNoMatch)) throw new Error("--on-no-match is skip, fail or passthrough.");
-  const t = await target(project, opts);
-  const table = (await listTables(t)).find((m) => m.name === opts.table);
-  if (!table) throw new Error(`No mapping table "${opts.table}" on ${t.proj.projectName}. Create it: npx apiblaze transform mapping ${project} ${opts.table} FR=EUR \u2026`);
-  const name = `map ${source} to ${destination}`;
-  const action = {
-    type: "map",
-    source,
-    destination,
-    lookup: { mapping_id: table.id, on_no_match: onNoMatch }
-  };
-  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
-  const summary = `${existing ? "Update" : "Add"} transform: ${source} \u2192 ${destination} through "${table.name}"`;
-  const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action, phase: "request", enabled: true }, summary });
-  if (opts.json) {
-    console.log(JSON.stringify(out ?? { ok: true }));
-    return;
-  }
-  console.log(`${import_chalk56.default.green("\u2714")} ${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}.`);
-  console.log(import_chalk56.default.dim(`  A value not in the table: ${onNoMatch === "skip" ? "nothing is written" : onNoMatch === "fail" ? "the call is refused" : "it is copied as-is"}.`));
-}
+// src/cli.ts
+init_transform();
 
 // src/commands/config-browse.ts
 var import_chalk63 = __toESM(require("chalk"));
@@ -23341,7 +23487,7 @@ function buildProgram() {
   program2.command("create").description(descriptionFor({
     apiblaze: `Put an app that is already DEPLOYED behind ${B.product}: a public URL and an MCP address for AI agents in front of your URL or OpenAPI spec. Included: API keys, sign-in, ownership rules, rate limits. No login needed. (App on this machine? Use \`dev\`.) Add --compliant to make it a Claude connector, or a ChatGPT plugin with --compliant chatgpt, that meets the directory's policies.`,
     mcpblaze: "Make an MCP server from a deployed API's OpenAPI spec or URL: a connector address, sign-in and per-user rules included. No login needed. (App on this machine? Use `dev`.) Add --compliant for a Claude connector (or a ChatGPT plugin with --compliant chatgpt) that meets the directory policies; it says what is left at every step and hands you the page to finish."
-  })).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", descriptionFor({ apiblaze: "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec", mcpblaze: "What to serve as an MCP server \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec" })).addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--open-world <yes|no>", "Every tool: reaches public or open-ended data (yes) or only the signed-in account's (no); asked once when omitted").option("--no-watch", "Do not turn on the nightly re-check email when the listing is green").option("--no-wait-login", "Sign-in mode: do not wait for a Claude sign-in before the verdict").option("--mcp-app", "Claude: the listing is an MCP App (the host then advertises the UI extension; needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot (PNG \u2265 1000 px wide) and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
+  })).option("--name <name>", B.cli === "mcpblaze" ? "MCP server name (becomes <name>-<tenant>.mcpblaze.com)" : "Proxy name (becomes <name>.abz.run)").option("--target <url|file>", descriptionFor({ apiblaze: "What to proxy \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec", mcpblaze: "What to serve as an MCP server \u2014 pass ANY of: a target server base URL (https://httpbin.org), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml). Spec inputs are detected automatically; routes, API version and environments then come from the spec" })).addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--team <id|name>", "Team to create under (defaults to your active team)").option("--auth <type>", "Open ONE door only: api_key | oauth (sign in with GitHub, APIblaze-hosted) | none. Omitted = both doors.").option("--apikey", "API-key door only (no sign-in): the bootstrap keys are minted and printed; callers send X-API-Key, agents connect with a key.").option("--oauth [config]", `Sign-in door only (no API key). Bare = APIblaze-hosted GitHub sign-in. '{"iss","aud","jwks"}' = trust YOUR hosted login's JWTs. '{"provider","clientId","clientSecret"?}' = APIblaze-hosted login page with YOUR OAuth app (github \xB7 google \xB7 microsoft \xB7 facebook \xB7 auth0 \xB7 oidc); the secret is optional except for github and facebook. '{"provider":"oidc","issuer":"https://acme.okta.com/oauth2/default","clientId":"\u2026"}' = any OpenID Connect IdP by issuer (Okta \xB7 Entra \xB7 Keycloak \xB7 Cognito \xB7 \u2026).`).option("--identified", "Require every call to identify its end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot); unattributed calls are rejected").option("--iam", `Turn IAM on for the ${B.thingShort}'s tenant so users & groups apply to identified calls`).option("--apiversion <version>", `API version to create (e.g. 2.0.0). Creating a new version of a ${B.thingShort} you own adds a version to the existing project.`).option("--tenant <slug>", `Tenant to attach the ${B.thingShort} to (created if new). Omitted \u2192 your team's most-recently-used tenant.`).option("--product <slug>", "Product tag to group this project under in the portal (team-scoped; anonymous create). Defaults to your team's existing/placeholder tag.").option("--display-name <name>", "Human-friendly display name").option("--subdomain <slug>", "Explicit subdomain (defaults to --name)").option("--config <file>", "JSON file with the full request body (anonymous create): requests_auth, login providers + client/server token types, scopes, callback URLs, etc. See apiblaze_anonymous.yaml. Flags override its fields.").option("-y, --yes", "Skip the confirmation prompt").option("--auto", `Zero prompts, start to finish: generates the ${B.thingShort} name when --name is omitted (from the target host, salted), takes every confirmation as yes, auto-picks the tenant. Implies --yes.`).option("--new-session", "Start a fresh anonymous session (do not group with prior anonymous creates)").option("--json", "Output machine-readable JSON (non-interactive)").option("--compliant [directories...]", `Directory-ready in one command, to the letter of that directory's policies: create the ${B.thingShort} from --target (an OpenAPI URL/file), apply the safe fixes, set up the custom MCP domain (--domain, one CNAME), ask for every listing answer with the spec's proposal pre-filled (cut to the portal's limits), create the reviewer account, write the submission packet. Bare = claude; or claude \xB7 chatgpt \xB7 all. Ends with the compliance table: every rule the listing satisfies and the policy page it comes from. Same as \`${B.cli} connector <spec> --compliant \u2026\`.`).addOption(new import_commander.Option("--policy [directories...]", "Older spelling of --compliant").hideHelp()).option("--domain <host>", "With --compliant: the MCP server's custom hostname (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "With --compliant: how long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--target-url <url>", "With --compliant: Where the app runs in production (https): a listing needs the hosted app, not a tunnel; asked when missing").option("--upstream-header <header>", 'With --compliant: "Name: value", the header the backend needs to accept these calls, stored encrypted; asked when missing').option("--upstream-header-env <name=var>", "With --compliant: The same with the value read from an environment variable, so it stays out of your shell history").option("--upstream-open", "With --compliant: The backend checks its own credentials: no header").option("--auth-mode <mode>", "With --compliant: how directory clients get in. signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--data-handling <mode>", "Compliant: whose API this is (own \xB7 proxied + --data-handling-statement \xB7 third-party); never pre-filled").option("--data-handling-statement <text>", "Compliant, proxied: the permission you hold").option("--health-data <yes|no>", "Compliant: the tools handle health data (never pre-filled)").option("--sponsored-content <yes|no>", "Compliant: tool results carry sponsored content (never pre-filled)").option("--no-exercise", 'Compliant: skip the "Run every tool now?" step').option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "Compliant: no email at the end of the run").option("--directory-ready", "Make it directory-ready for the Claude and ChatGPT directories: OAuth door, custom-domain checks, listing fields; the readiness report runs after the create and a blocker exits 1").option("--privacy-url <url>", "Directory listing: public https privacy policy").option("--support <email|url>", "Directory listing: support contact").option("--docs-url <url>", "Directory listing: public documentation URL (the developer portal by default)").option("--prompt <text>", "Directory listing: an example prompt (repeat the flag; three are needed)", collect, []).option("--server-name <name>", 'Directory listing: the name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "Directory listing: one-line tagline").option("--description <text>", "Directory listing: description").option("--icon-url <url>", "Directory listing: square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--open-world <yes|no>", "Every tool: reaches public or open-ended data (yes) or only the signed-in account's (no); asked once when omitted").option("--no-watch", "Do not turn on the nightly re-check email when the listing is green").option("--no-wait-login", "Sign-in mode: do not wait for a Claude sign-in before the verdict").option("--mcp-app", "Claude: the listing is an MCP App (the host then advertises the UI extension; needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot (PNG \u2265 1000 px wide) and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Directory listing: vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT)", collect, []).option("--allowed-origin <origin>", "Directory mode: an extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server").action(async (opts) => {
     try {
       const compliant = opts.compliant ?? opts.policy;
       if (compliant !== void 0 && compliant !== false) {
@@ -23367,7 +23513,7 @@ function buildProgram() {
   const connector = program2.command("connector").description(descriptionFor({
     apiblaze: `A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`,
     mcpblaze: "Make it a Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: the scorecard first, then every open step in order \u2014 the MCP hostname (one CNAME), the listing answers pre-filled from the spec, the reviewer account, the proof run \u2014 and the submission packet when every check passes. Stop any time; `--status` shows what is left and the page to finish on. You submit. They decide."
-  })).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--exercise", "Run every tool now even when the scorecard says step 8 is done (asked only while it is open)").option("--no-exercise", 'Skip the "Run every tool now?" step').option("--step <id>", "Run one step of the scorecard and exit: mode \xB7 address \xB7 access \xB7 tools \xB7 listing \xB7 answers \xB7 attestations \xB7 prove \xB7 signin \xB7 token \xB7 packet").option("--status", "Print the scorecard (what is done, what is left, where) and exit: 0 when ready, 1 while something is left").option("--verbose", "The full rule report at the end instead of the scorecard (also: check --directory-ready)").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+  })).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--target-url <url>", "Where the app runs in production (https): a listing needs the hosted app, not a tunnel; asked when missing").option("--upstream-header <header>", '"Name: value", the header the backend needs to accept these calls, stored encrypted; asked when missing').option("--upstream-header-env <name=var>", "The same with the value read from an environment variable, so it stays out of your shell history").option("--upstream-open", "The backend checks its own credentials: no header").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--exercise", "Run every tool now even when the scorecard says step 8 is done (asked only while it is open)").option("--no-exercise", 'Skip the "Run every tool now?" step').option("--step <id>", "Run one step of the scorecard and exit: mode \xB7 address \xB7 access \xB7 tools \xB7 listing \xB7 answers \xB7 attestations \xB7 prove \xB7 signin \xB7 token \xB7 packet").option("--status", "Print the scorecard (what is done, what is left, where) and exit: 0 when ready, 1 while something is left").option("--verbose", "The full rule report at the end instead of the scorecard (also: check --directory-ready)").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
     if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector https://\u2026/openapi.yaml  \xB7  ${B.cli} connector reviewer <project>  \xB7  ${B.cli} connector exercise <project>  \xB7  ${B.cli} connector answers <project>`);
     await runConnector(project, opts);
   }));