apiblaze 0.21.73 → 0.21.74

package/dist/index.js

@@ -34,7 +34,7 @@ var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__
 var version;
 var init_package = __esm({
   "package.json"() {
-    version = "0.21.73";
+    version = "0.21.74";
   }
 });
 
@@ -5549,8 +5549,12 @@ __export(directory_exports, {
   OPENAI_CATEGORIES: () => OPENAI_CATEGORIES,
   PLATFORMS: () => PLATFORMS,
   STEP_IDS: () => STEP_IDS,
+  askLine: () => askLine,
   attestationId: () => attestationId,
   blockerLines: () => blockerLines,
+  ccServerName: () => ccServerName,
+  claudeCodeTests: () => claudeCodeTests,
+  claudeCodeText: () => claudeCodeText,
   compliantGiven: () => compliantGiven,
   directoryBodyFromFlags: () => directoryBodyFromFlags,
   doneLine: () => doneLine,
@@ -5568,10 +5572,12 @@ __export(directory_exports, {
   printProgressTrailer: () => printProgressTrailer,
   printReport: () => printReport,
   scorecardText: () => scorecardText,
+  shellQuote: () => shellQuote2,
   stepOf: () => stepOf,
   stepOpen: () => stepOpen,
   stepRunnable: () => stepRunnable,
   summaryOf: () => summaryOf,
+  withBrandSource: () => withBrandSource,
   writeJsonLine: () => writeJsonLine
 });
 function attestationId(flag) {
@@ -5669,9 +5675,13 @@ function directoryBodyFromFlags(f2) {
   }
   return out;
 }
+function withBrandSource(url, cli = B.cli) {
+  return cli === "mcpblaze" ? `${url}?source=mcpblazeCli` : url;
+}
 function pageLinkOf(r, proj2, anchor) {
   const base2 = r?.progress?.pageUrl ?? `${DASHBOARD_BASE6}/directory/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}`;
-  return anchor ? `${base2}${anchor.startsWith("#") ? anchor : `#${anchor}`}` : base2;
+  const page = withBrandSource(base2);
+  return anchor ? `${page}${anchor.startsWith("#") ? anchor : `#${anchor}`}` : page;
 }
 function stepOf(r, id) {
   return r?.progress?.steps.find((s) => s.id === id) ?? null;
@@ -5796,7 +5806,39 @@ function blockerLines(r, platforms) {
 function isApiError(e, status2) {
   return e instanceof ApiError && (status2 === void 0 || e.status === status2);
 }
-var import_node_fs, import_chalk17, PLATFORMS, ATTESTATIONS, OPENAI_CATEGORIES, AUTH_MODES, DATA_HANDLING_MODES, STEP_IDS, reportPath, DESCRIPTION_MIN;
+function claudeCodeTests(r, proj2) {
+  const url = r?.report?.project?.publishedUrl;
+  if (!url) return null;
+  const name = ccServerName(proj2.projectId);
+  const t = r?.target;
+  const seen = /* @__PURE__ */ new Set();
+  const cases = [];
+  const add = (prompt, expect, refuse) => {
+    const p = (prompt ?? "").trim();
+    if (!p || seen.has(p)) return;
+    seen.add(p);
+    cases.push({ prompt: p, line: askLine(name, p), expect, refuse });
+  };
+  for (const p of t?.metadata?.examplePrompts ?? []) add(p, "it calls your tools and answers from what comes back", false);
+  const tc = t?.metadata?.portalAnswers?.chatgpt_test_cases;
+  for (const c of tc?.positive ?? []) add(c.prompt, c.expected_behavior || "it calls your tools and answers from what comes back", false);
+  for (const c of tc?.negative ?? []) add(c.prompt, `it says it can't help${c.description ? ` (${c.description})` : ""}, and calls no tool`, true);
+  const open = t?.project?.authMode === "open";
+  return {
+    add: `claude mcp add --transport http ${name} ${url}`,
+    signIn: open ? null : `claude, then /mcp \u2192 ${name} \u2192 Authenticate, and sign in as reviewer-${proj2.projectId} (the test account); /exit after`,
+    cases
+  };
+}
+function claudeCodeText(cc) {
+  const lines = ["Test each use case in Claude Code", `  1. ${cc.add}`];
+  if (cc.signIn) lines.push(`  2. Sign in once: ${cc.signIn}`);
+  const n = cc.signIn ? 3 : 2;
+  if (!cc.cases.length) lines.push(`  ${n}. Add example prompts to the listing first: each becomes a line here.`);
+  else lines.push(`  ${n}. One line per use case:`, ...cc.cases.flatMap((c) => [`     ${c.line}`, `       expect: ${c.expect}`]));
+  return lines.join("\n");
+}
+var import_node_fs, import_chalk17, PLATFORMS, ATTESTATIONS, OPENAI_CATEGORIES, AUTH_MODES, DATA_HANDLING_MODES, STEP_IDS, reportPath, DESCRIPTION_MIN, ccServerName, shellQuote2, askLine;
 var init_directory = __esm({
   "src/lib/directory.ts"() {
     "use strict";
@@ -5806,6 +5848,7 @@ var init_directory = __esm({
     init_op_call();
     init_directory_probes();
     init_types();
+    init_brand();
     PLATFORMS = ["claude", "chatgpt"];
     ATTESTATIONS = [
       // Claude's Compliance step: seven acknowledgments (submission page, 2026-10-16).
@@ -5829,6 +5872,9 @@ var init_directory = __esm({
     STEP_IDS = ["mode", "address", "access", "tools", "listing", "answers", "attestations", "prove", "signin", "token", "packet", "submit"];
     reportPath = (proj2) => `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/directory-report`;
     DESCRIPTION_MIN = 300;
+    ccServerName = (projectId) => projectId.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "app";
+    shellQuote2 = (s) => `'${s.replace(/'/g, `'\\''`)}'`;
+    askLine = (name, prompt) => `claude -p ${shellQuote2(prompt)} --allowedTools ${shellQuote2(`mcp__${name}`)}`;
   }
 });
 
@@ -8248,7 +8294,7 @@ function draftUseCases(i) {
 }
 function draftReviewerInstructions(i) {
   const lines = [];
-  const where = i.platforms?.length === 1 && i.platforms[0] === "chatgpt" ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : i.platforms?.includes("chatgpt") ? "Claude (Settings \u2192 Connectors \u2192 Add custom connector) or ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : "Claude (Settings \u2192 Connectors \u2192 Add custom connector)";
+  const where = i.platforms?.length === 1 && i.platforms[0] === "chatgpt" ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : i.platforms?.includes("chatgpt") ? "Claude (Customize > Connectors \u2192 Add custom connector) or ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : "Claude (Customize > Connectors \u2192 Add custom connector)";
   lines.push(`Add ${i.publishedUrl} as a custom connector in ${where}.`);
   lines.push(i.open ? "No sign-in: the data is public and every tool is read-only. Connect and ask." : `Sign in with the username and password entered in the credential fields of this form${i.reviewerUsername ? ` (username ${i.reviewerUsername})` : ""}: the sign-in page shows a username & password form under the provider buttons; no email, SMS or MFA step.`);
   const seen = /* @__PURE__ */ new Set();
@@ -8375,7 +8421,7 @@ function detectCodex(spawn5 = import_child_process5.spawnSync) {
   return { installed: true, loggedIn: st.status === 0 && !/not logged in/i.test(text) };
 }
 function reportLink(projectId, apiVersion = "1.0.0") {
-  return `${DASHBOARD_BASE8}/directory/${encodeURIComponent(projectId)}/${encodeURIComponent(apiVersion)}`;
+  return withBrandSource(`${DASHBOARD_BASE8}/directory/${encodeURIComponent(projectId)}/${encodeURIComponent(apiVersion)}`);
 }
 async function confirm(message, interactive2) {
   if (!interactive2) return false;
@@ -13571,6 +13617,13 @@ async function projectSpecText(caller, proj2) {
   }
 }
 var DOMAIN_RULE = "DOMAIN_CUSTOM_REQUIRED";
+function hostnameProblem(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  if (!v) return null;
+  if (/^https?:\/\/|\//.test(v)) return "Just the hostname, no https:// and no path: mcp.yourdomain.com";
+  if (!v.includes(".")) return `"${v}" is only part of it. Type the whole hostname: ${v}.yourdomain.com`;
+  return /^([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/.test(v) ? null : "That is not a valid hostname: mcp.yourdomain.com";
+}
 async function ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, say) {
   const domainRule = r.report.results.find((x) => x.id === DOMAIN_RULE);
   if (!domainRule || domainRule.pass) return { active: true };
@@ -13587,14 +13640,36 @@ async function ensureMcpDomain(caller, proj2, r, opts, defaults, interactive2, s
         hostname2 = suggested;
       } else {
         const { default: inquirer3 } = await import("inquirer");
-        const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: "Hostname for the MCP server (on a domain you control):", ...suggested ? { default: suggested } : {} }]);
-        hostname2 = value?.trim().toLowerCase();
+        for (; ; ) {
+          const { value } = await inquirer3.prompt([{ type: "input", name: "value", message: "Full hostname for the MCP server, on a domain you control (mcp.yourdomain.com; Enter to skip for now):", ...suggested ? { default: suggested } : {}, validate: (v) => hostnameProblem(v) ?? true }]);
+          hostname2 = value?.trim().toLowerCase();
+          if (!hostname2) {
+            say(import_chalk32.default.dim("  Skipped: no MCP hostname yet. It stays open on the scorecard."));
+            return { active: false };
+          }
+          const sp2 = (0, import_ora12.default)(`Registering ${hostname2}\u2026`).start();
+          try {
+            row = await producer(caller, { method: "POST", path: base2, body: { hostname: hostname2, api_version: proj2.apiVersion, kind: "mcp" }, summary: `Add custom MCP domain ${hostname2}` });
+            sp2.succeed(`Registered ${row.hostname ?? hostname2} as the MCP server's domain.`);
+            break;
+          } catch (e) {
+            if (!isApiError(e, 400) && !isApiError(e, 409)) {
+              sp2.stop();
+              throw e;
+            }
+            sp2.fail(`${hostname2} was refused: ${e instanceof Error ? e.message : String(e)}`);
+          }
+        }
       }
     }
     if (!hostname2) throw new Error("A custom MCP hostname is required for the directories (--domain mcp.<your domain>).");
-    const sp2 = opts.json ? null : (0, import_ora12.default)(`Registering ${hostname2}\u2026`).start();
-    row = await producer(caller, { method: "POST", path: base2, body: { hostname: hostname2, api_version: proj2.apiVersion, kind: "mcp" }, summary: `Add custom MCP domain ${hostname2}` });
-    sp2?.succeed(`Registered ${row.hostname ?? hostname2} as the MCP server's domain.`);
+    if (!row) {
+      const problem = hostnameProblem(hostname2);
+      if (problem) throw new Error(`${problem} (--domain mcp.<your domain>)`);
+      const sp2 = opts.json ? null : (0, import_ora12.default)(`Registering ${hostname2}\u2026`).start();
+      row = await producer(caller, { method: "POST", path: base2, body: { hostname: hostname2, api_version: proj2.apiVersion, kind: "mcp" }, summary: `Add custom MCP domain ${hostname2}` });
+      sp2?.succeed(`Registered ${row.hostname ?? hostname2} as the MCP server's domain.`);
+    }
   }
   const hostname = row.hostname ?? opts.domain ?? "";
   if (row.status === "active") return { active: true, hostname, id: row.id };
@@ -13849,13 +13924,16 @@ async function runConnector(target2, opts) {
     const stored = r.progress?.platforms ?? null;
     const modeOn = r.target?.project?.directoryReady === true;
     if (opts.status) {
+      const cc = claudeCodeTests(r, proj2);
       if (json) {
-        writeJsonLine({ ready: isReady(r, platforms), project: proj2.projectId, headline: r.rendered.headline, summary: r.progress?.summary ?? null, progress: r.progress ?? null, report: r.report });
+        writeJsonLine({ ready: isReady(r, platforms), project: proj2.projectId, headline: r.rendered.headline, summary: r.progress?.summary ?? null, progress: r.progress ?? null, claude_code: cc, report: r.report });
         process.exit(isReady(r, platforms) ? 0 : 1);
       }
       const card2 = scorecardText(r);
       if (card2) console.log(card2);
       else printReport(r, false);
+      if (cc) console.log(`
+${claudeCodeText(cc)}`);
       process.exit(isReady(r, platforms) ? 0 : 1);
     }
     const dirsDiffer = explicit && !!stored && (stored.length !== platforms.length || stored.some((p) => !platforms.includes(p)));
@@ -14162,7 +14240,7 @@ async function waitForExternal(caller, proj2, r, platforms, domain, opts, intera
     say("  One sign-in from a real Claude client is the last proof. In another terminal:");
     say(`    claude mcp add --transport http ${alias} ${url}`);
     say(`    claude            then /mcp \u2192 ${alias} \u2192 sign in with the reviewer account`);
-    say(import_chalk32.default.dim(`  or in claude.ai: Settings \u2192 Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
+    say(import_chalk32.default.dim(`  or in claude.ai: Customize > Connectors \u2192 Add custom connector \u2192 ${url} (what a reviewer does).`));
     say(import_chalk32.default.dim(`  Afterwards: claude mcp remove ${alias}`));
     const { default: inquirer3 } = await import("inquirer");
     const { go } = await inquirer3.prompt([{ type: "confirm", name: "go", message: "Sign in from Claude now, then press Enter to check (n skips; the step stays open):", default: true }]);
@@ -14583,7 +14661,7 @@ function printSubmitSteps(r, mdPath, platforms = PLATFORMS, watching = false) {
   const open = isOpenMode(r);
   const claude = platforms.includes("claude");
   const chatgpt = platforms.includes("chatgpt");
-  const where = [claude ? "Claude (Settings \u2192 Connectors)" : null, chatgpt ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : null].filter(Boolean).join(" and in ");
+  const where = [claude ? "Claude (Customize > Connectors)" : null, chatgpt ? "ChatGPT (chatgpt.com/plugins \u2192 Add custom MCP server)" : null].filter(Boolean).join(" and in ");
   const steps = [
     `Test it yourself first: add ${import_chalk32.default.cyan(url)} as a custom connector in ${where}, ${open ? "no sign-in needed (open mode)" : "sign in with the reviewer account"}, run a tool.`,
     ...claude ? [`Claude: ${import_chalk32.default.underline(PORTALS.claude)} \u2192 Submit new \u2192 MCP connector. Paste the listing, ${open ? "Authentication: None with the access instructions" : "the reviewer credentials"} and the test steps from ${import_chalk32.default.cyan(import_path7.default.basename(mdPath))}.`] : [],
@@ -14920,6 +14998,42 @@ function backendPort(f2) {
 
 // src/commands/skill.ts
 init_api();
+
+// src/lib/listing-rules.ts
+var LISTING_RULES = `**Who reads what.** The listing (name, tagline, description, example prompts, categories) is read by an ordinary
+person browsing the directory, deciding whether to add the App. They do not know or care what an API, an endpoint, a spec, a gateway,
+a sandbox or hosting is. Use cases and reviewer instructions are read by the directory's review team,
+who add the App and try it.
+
+**Read the input the right way.** The API's own title and description were written by developers for developers: hosting,
+sandboxes, limits, setup, git, internals. Never copy or paraphrase that; use it only to understand the domain. Learn what
+the App does from its tools: each tool is something a person can ask for.
+
+**The fields.**
+- Name (\`--server-name\`): what a person would call it, often the product or brand. No "API", "MCP", "Plugin", "Server",
+  version numbers or the word "App". At most 100 characters, 30 when ChatGPT is a target.
+- Tagline (\`--tagline\`): one plain sentence saying what the person gets done; starts with a verb; at most 200 characters.
+- Description (\`--description\`): 300 to 1,500 characters, two or three short paragraphs. What a person can do, in their
+  terms ("find a table for four on Friday", not "createReservation endpoint"); who it is for; one sentence on whether it
+  only reads or can also change things in their account. No lists of tool names, no marketing adjectives.
+- Example prompts (\`--prompt\`, three to five): what a person would really type, each answered by a tool, under 128
+  characters, varied (look something up, then act on it), concrete values, no placeholders.
+- Prerequisites (\`connector answers --prerequisites\`): one sentence, what someone needs before using it.
+- Categories (\`connector answers --category\`, one to five): plain words a person would browse by.
+- Use cases (\`connector answers --use-cases\`): 200 to 1,500 characters for the review team: the real jobs, in the
+  person's words, each tied to what comes back.
+- Reviewer instructions (\`connector answers --reviewer-instructions\`): 400 to 2,500 characters, numbered: where to add
+  it (the MCP address), how to sign in (the test account; never write a password), then three to six prompts to try,
+  each with what the reviewer should see. Build on what the last test run showed; never invent a result.
+
+**Never write** claims nothing supports (secure, real-time, compliant, best, official, fastest), the names Claude,
+ChatGPT, Anthropic or OpenAI (except in reviewer instructions, to say where to add it), URLs other than the MCP address in
+reviewer instructions, prices, or anything about legal, health or finance use.
+
+**Never answer for the user**: the privacy policy URL, the icon, whose API it is (data handling), health data, sponsored
+content, high-risk areas, and the attestations. Ask; these are promises only they can make.`;
+
+// src/commands/skill.ts
 var SKILL_NAME = "ship-safely";
 var SKILL_RELATIVE_PATH = import_path10.default.join(".claude", "skills", SKILL_NAME, "SKILL.md");
 function skillNameFor(brand = BRAND) {
@@ -15184,10 +15298,10 @@ Most people new to it do not know the words tenant, OpenAPI or header, so plain
 1. **"Want me to make an MCP server from this API?"** \u2014 the API is deployed: \`${run2} create --target <its OpenAPI spec or URL>\`
    (sign-in and per-user rules come with it; it prints the MCP address). The app runs on this machine:
    \`${run2} dev --port <port>\`, as its own detached process. The next step to offer for this folder: ${question}
-2. **"Want it listed in Claude or ChatGPT?"** \u2014 \`${run2} connector <name>\` makes it a Claude connector
-   (\`--compliant chatgpt\` a ChatGPT plugin, \`--compliant all\` both). It prints the scorecard first \u2014 N of 12 done
-   and what is left \u2014 then runs every open step in order and saves each answer as it is given; the user can stop any time
-   and finish on the page it links. \`${run2} connector <name> --status\` is the scorecard alone.
+2. **"Want it listed in Claude or ChatGPT?"** \u2014 right after the MCP server exists, \`${run2} connector <name>\`
+   (\`--compliant chatgpt\` for ChatGPT, \`--compliant all\` both). Its first line is the page link: give it to the user
+   first, then go through the open steps with them, writing the listing yourself (\`${run2} skills connector\` has the
+   steps and the writing rules). \`${run2} connector <name> --status\` says what is left, with a Claude Code test line per use case.
 
 \`${run2} demo\` shows a sample app with an MCP server in front of it in 30 seconds, no login (it prints the links; it opens nothing).
 
@@ -15260,13 +15374,11 @@ function shipMcpMarkdown() {
    who can override: the dashboard, Tenant \u2192 Admins.
 7. **Try it from Claude Code.** \`claude mcp add --transport http <name> <the MCP address it printed>\`, then \`/mcp\` and
    sign in; call one tool. What a reviewer does, before a reviewer does it.
-8. **List it.** \`${run2} connector <name>\` (Claude; \`--compliant chatgpt\` or \`all\` for OpenAI's directory): the scorecard
-   first, then every open step in order \u2014 the MCP hostname (one CNAME the user adds at their DNS provider; relay the exact
-   record), the listing answers pre-filled from the spec, the reviewer account, the proof run \u2014 and the submission packet when
-   every check passes. It needs the hosted app, not a tunnel: have the production URL and any header the backend needs ready, and
-   run the proof again after switching. Stop any time; \`${run2} connector <name> --status\` says what is left and links the page where the rest
-   can be finished.
-   The user submits the packet to Anthropic or OpenAI themselves.
+8. **List it.** \`${run2} connector <name>\` (Claude; \`--compliant chatgpt\` or \`all\` for OpenAI's directory). Give the user
+   the page link it prints first, then follow \`${run2} skills connector\`: the MCP address (one CNAME; relay the exact record),
+   sign-in and the test account, the listing and the review-team answers that you write by its rules, the tests (one
+   \`claude -p\` per use case, from \`--status\`), and the packet. It needs the hosted app, not a tunnel. Stop any time;
+   \`${run2} connector <name> --status\` says what is left. The user submits the packet to Anthropic or OpenAI themselves.
 
 Report what you did in plain words: the MCP address, who can sign in, what is locked, what is left on the scorecard.
 
@@ -15676,6 +15788,41 @@ Each tenant (a group of users with their own sign-in) has a developer portal whe
 
 Tenant admins (they can see and manage every record and every user): the dashboard, Tenant \u2192 Admins, by email, even
 before that person ever signs in. The whole APIblaze command set is here too: \`npx ${cli} help --all\`.`);
+    case "connector":
+      return page("Get it listed in Claude (and ChatGPT) with MCPblaze", `
+The listing is the MCP server, sent to Anthropic's directory (Claude) and, if the user wants, OpenAI's (ChatGPT).
+The user submits. Say it "meets the requirements MCPblaze can verify; listing decisions are made by Anthropic and OpenAI",
+never "certified".
+
+**Start, and give the page first.** \`npx ${cli} connector <name>\` (Claude; add \`--compliant chatgpt\` or \`--compliant all\`).
+Its first line is "Finish this here or at <page link> \xB7 N left": give the user that link before anything else. The page
+has the same steps with forms, a % ready ring, and a Testing tab; the user can work there, here, or both. Every answer is
+saved as it is given; \`npx ${cli} connector <name> --status\` says what is left at any time.
+
+**The steps, in the page's order.** Go through the open ones with the user, one at a time, in plain words:
+1. **Get listed**: the command turns it on. Nothing is public until the user submits.
+2. **Connect your API**: the MCP address on their own domain (one CNAME at their DNS provider; relay the exact record
+   it prints) and the hosted app (\`--target-url\`, \`--upstream-header\`): a tunnel cannot be listed.
+3. **How people sign in to your MCP**: sign-in by default, a test account is made for the reviewers. Public, read-only
+   data can skip sign-in (\`--auth-mode open\`).
+4. **What your App can do**: the tools (\`npx ${cli} skills mcp\` has the method).
+5. **Your listing, and the questions for the review team**: YOU write the text, from the code and the tools, following
+   the rules below. Show the user every field, then save what they approve:
+   \`npx ${cli} connector <name> --step listing -y --server-name "\u2026" --tagline "\u2026" --description "\u2026" --prompt "\u2026" --prompt "\u2026" --prompt "\u2026"\`
+   (plus \`--support\`, \`--vuln-contact\`; for ChatGPT \`--short-description\`, \`--developer-name\`, \`--website-url\`, \`--terms-url\`)
+   and \`npx ${cli} connector answers <name> --use-cases "\u2026" --prerequisites "\u2026" --category "\u2026" --reviewer-instructions "\u2026"\`.
+6. **Test**: \`npx ${cli} connector exercise <name>\` calls every tool as the reviewer. Then
+   \`npx ${cli} connector <name> --status\` prints the Claude Code lines: one \`claude mcp add\`, one sign-in, and one
+   \`claude -p '\u2026' --allowedTools 'mcp__<name>'\` per example prompt, each with what should come back. Run each, tell the user
+   what came back, and fix a tool's description (\`npx ${cli} mcp ops set\`) when a prompt did not reach the right tool.
+7. **Send**: when every check passes it writes the packet. The user submits it on claude.ai/directory/manage (and the
+   OpenAI portal for ChatGPT).
+
+## Writing the listing
+
+${LISTING_RULES}
+
+${HEDGE}`);
     case "rules":
       return page("Who can change what (MCPblaze)", `
 - With a spec, \`dev\` and \`create\` lock every record to the person who created it: an agent acting for Alice
@@ -23513,7 +23660,8 @@ function buildProgram() {
   const connector = program2.command("connector").description(descriptionFor({
     apiblaze: `A compliant Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: from a project or straight from an OpenAPI URL \u2014 creates the ${B.thingShort} if needed, applies the safe fixes, sets up the custom MCP domain (one CNAME), pre-fills every listing answer from the spec, creates the reviewer account, and writes the submission packet when every check passes (you submit it to Anthropic and OpenAI yourself)`,
     mcpblaze: "Make it a Claude connector (--compliant chatgpt: a ChatGPT plugin), directory-ready in one command: the scorecard first, then every open step in order \u2014 the MCP hostname (one CNAME), the listing answers pre-filled from the spec, the reviewer account, the proof run \u2014 and the submission packet when every check passes. Stop any time; `--status` shows what is left and the page to finish on. You submit. They decide."
-  })).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--target-url <url>", "Where the app runs in production (https): a listing needs the hosted app, not a tunnel; asked when missing").option("--upstream-header <header>", '"Name: value", the header the backend needs to accept these calls, stored encrypted; asked when missing').option("--upstream-header-env <name=var>", "The same with the value read from an environment variable, so it stays out of your shell history").option("--upstream-open", "The backend checks its own credentials: no header").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--exercise", "Run every tool now even when the scorecard says step 8 is done (asked only while it is open)").option("--no-exercise", 'Skip the "Run every tool now?" step').option("--step <id>", "Run one step of the scorecard and exit: mode \xB7 address \xB7 access \xB7 tools \xB7 listing \xB7 answers \xB7 attestations \xB7 prove \xB7 signin \xB7 token \xB7 packet").option("--status", "Print the scorecard (what is done, what is left, where) and exit: 0 when ready, 1 while something is left").option("--verbose", "The full rule report at the end instead of the scorecard (also: check --directory-ready)").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (project, opts) => {
+  })).argument("[project-or-spec]", `The ${B.thingShort} (project name), or an OpenAPI URL/file to create a directory-ready ${B.thingShort} from first`).option("--target <url|file>", "Same as giving the OpenAPI URL or file as the argument (the spelling `create` uses)").option("--domain <host>", "Custom hostname for the MCP server (mcp.<your domain>); asked for when missing, suggested from the spec").option("--wait <minutes>", "How long to wait for the custom domain to activate once its CNAME is in place (default 15; 0 = do not wait)").option("--target-url <url>", "Where the app runs in production (https): a listing needs the hosted app, not a tunnel; asked when missing").option("--upstream-header <header>", '"Name: value", the header the backend needs to accept these calls, stored encrypted; asked when missing').option("--upstream-header-env <name=var>", "The same with the value read from an environment variable, so it stays out of your shell history").option("--upstream-open", "The backend checks its own credentials: no header").option("--auth-mode <mode>", "How directory clients get in: signin (default) = OAuth sign-in on the connector, API keys alongside; open = no sign-in at all, for public read-only data (Anthropic allows it) \u2014 the API host keeps its own doors. Asked once when every tool is read-only.").option("--name <name>", `When creating from a spec: the ${B.thingShort} name (default: derived from the spec host)`).option("--privacy-url <url>", "Public https privacy policy").option("--support <email|url>", "Support contact").option("--docs-url <url>", "Public documentation URL").option("--prompt <text>", "An example prompt (repeatable; three are needed)", collect, []).option("--server-name <name>", 'Listing name (2\u201340 chars, no "MCP"/"Plugin" suffix)').option("--tagline <text>", "One-line tagline").option("--description <text>", "Description").option("--icon-url <url>", "Square icon (https)").option("--slug <slug>", "Claude: the listing slug (lowercase-with-hyphens; permanent once published)").option("--high-risk <list>", "Claude policy 1A: none, or any of legal,healthcare,insurance,finance").option("--mcp-app", "Claude: the listing is an MCP App (needs 3\u20135 --screenshot)").option("--no-mcp-app", "Claude: a plain connector (default)").option("--screenshot <url=prompt>", "Claude MCP App: a carousel screenshot and the prompt that produced it (repeatable, 3\u20135)", collect, []).option("--vuln-contact <email|url>", "Vulnerability-disclosure contact").option("--attest <id>", "Attest (repeatable): guidelines \xB7 own-backend \xB7 no-financial \xB7 no-genai-media \xB7 no-prompt-injection \xB7 no-conversation-data \xB7 public-docs (Claude's seven) \xB7 no-digital-goods \xB7 content-13-no-ads \xB7 no-restricted-data (ChatGPT). Alone, this only records the attestation.", collect, []).option("--allowed-origin <origin>", "An extra browser origin allowed on the MCP host (repeatable)", collect, []).option("--openai-challenge <token>", "ChatGPT: the domain-verification token the OpenAI portal shows under Plugins \u2192 Connect MCP server; served verbatim at /.well-known/openai-apps-challenge on your MCP domain").option("--data-handling <mode>", "Whose API this is (portal step 7): own \xB7 proxied (add --data-handling-statement) \xB7 third-party. Never pre-filled.").option("--data-handling-statement <text>", "For proxied: the permission you hold (who granted what, and when)").option("--health-data <yes|no>", "The tools handle health data (never pre-filled; yes adds the human-in-the-loop note to the packet)").option("--sponsored-content <yes|no>", "Tool results carry sponsored content (never pre-filled; yes is an unsupported use case)").option("--website-url <url>", "OpenAI's form: the public website (https)").option("--support-url <url>", "OpenAI's form: the support page (https; a URL, not an email)").option("--terms-url <url>", "OpenAI's form: the terms of service page (https)").option("--developer-name <name>", "OpenAI's form: the developer name (\u2264 80; the directory shows your verified identity)").option("--chatgpt-category <name>", "OpenAI's form: one of Productivity \xB7 Creativity \xB7 Developer Tools \xB7 Business & Operations \xB7 Data & Analytics \xB7 Communication \xB7 Education & Research \xB7 Security \xB7 Finance \xB7 Healthcare \xB7 Travel \xB7 Entertainment \xB7 Other").option("--demo-recording-url <url>", "OpenAI's form: the demo recording (required for MCP review)").option("--release-notes <text>", "OpenAI's form: release notes for this submission").option("--short-description <text>", "OpenAI's form: the 30-character subtitle (Claude's tagline stays \u2264 200)").option("--countries <codes>", "OpenAI's form: ISO country codes, comma-separated (default: everywhere)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--exercise", "Run every tool now even when the scorecard says step 8 is done (asked only while it is open)").option("--no-exercise", 'Skip the "Run every tool now?" step').option("--step <id>", "Run one step of the scorecard and exit: mode \xB7 address \xB7 access \xB7 tools \xB7 listing \xB7 answers \xB7 attestations \xB7 prove \xB7 signin \xB7 token \xB7 packet").option("--status", "Print the scorecard (what is done, what is left, where) and exit: 0 when ready, 1 while something is left").option("--verbose", "The full rule report at the end instead of the scorecard (also: check --directory-ready)").option("--seed", "Sign-in mode: when a read returns nothing for the reviewer, create a few records through the create tools and keep them (asked when omitted)").option("--no-seed", "Never seed the reviewer account").option("--no-email", "No email at the end of the run").option("--full", "Run the full flow even when only --attest was given").option("--compliant [directory]", "Which directory's policies this run must satisfy: bare = claude; or claude \xB7 chatgpt \xB7 all (repeat or comma-separate)", collect, []).addOption(new import_commander.Option("--policy <directory>", "Older spelling of --compliant").hideHelp()).addOption(new import_commander.Option("--platform <list>", "Older spelling of --compliant").hideHelp()).option("--out <dir>", "Where to write connector-packet-<project>.md/.json (default: current directory)").option("-y, --yes", "No questions: apply the flags, report, exit 1 on a blocker").option("--team <id|name>", "Team the project is in (defaults to your active team)").option("--apiversion <version>", "API version (defaults to the project's)").option("--json", "Output machine-readable JSON").action(action(async (arg, opts) => {
+    const project = arg ?? opts.target;
     if (!project) throw new Error(`Which ${B.thingShort}? ${B.cli} connector <project>  \xB7  ${B.cli} connector https://\u2026/openapi.yaml  \xB7  ${B.cli} connector reviewer <project>  \xB7  ${B.cli} connector exercise <project>  \xB7  ${B.cli} connector answers <project>`);
     await runConnector(project, opts);
   }));
@@ -23866,14 +24014,21 @@ Error: ${err.message}`));
   function hintStaleCacheOnUnknownOption(cmd) {
     cmd.exitOverride((err) => {
       if (err.code === "commander.unknownOption") {
-        console.error(import_chalk78.default.yellow(
-          `
-This is ${B.cli} v${version}. If that option is documented but this build
-does not have it, your npx cache is serving an older copy \u2014 re-run as:
+        const help = `${B.cli} ${cmd === program2 ? "" : `${cmd.name()} `}--help`;
+        if (B.cli === "mcpblaze") {
+          console.error(import_chalk78.default.yellow(`
+This is ${B.cli} v${version}. \`npx ${help}\` lists what this command takes.
+`));
+        } else {
+          console.error(import_chalk78.default.yellow(
+            `
+This is ${B.cli} v${version}. \`npx ${help}\` lists what this command takes. If the option is documented
+but this build does not have it, your npx cache is serving an older copy \u2014 re-run as:
 `
-        ));
-        console.error(import_chalk78.default.cyan(`  npx ${B.cli}@latest ${process.argv.slice(2).join(" ")}
+          ));
+          console.error(import_chalk78.default.cyan(`  npx ${B.cli}@latest ${process.argv.slice(2).join(" ")}
 `));
+        }
       }
       process.exit(err.exitCode);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apiblaze",
-  "version": "0.21.73",
+  "version": "0.21.74",
   "description": "APIblaze CLI — Chat with your APIs, Manage your API keys, users and groups with the APIblaze serverless proxy",
   "keywords": [
     "apiblaze",