apiblaze 0.21.9 → 0.21.13

package/dist/index.js

@@ -9,9 +9,9 @@ var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
-var __export = (target, all) => {
+var __export = (target2, all) => {
   for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+    __defProp(target2, name, { get: all[name], enumerable: true });
 };
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
@@ -21,12 +21,12 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
   // compatible transform (i.e. "__esModule" has not been set), then set
   // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,
   mod
 ));
 
@@ -524,7 +524,7 @@ function renderTrace() {
     const url = `https://api.apiblaze.com/${CONTROL_API_VERSION}/prod${e.path}`;
     const masked = maskBody(e.body);
     const hasBody = e.method !== "GET" && masked !== void 0;
-    console.error(import_chalk6.default.green(`  curl -sS -X ${e.method} ${url}` + (hasBody ? " \\" : "")));
+    console.error(import_chalk6.default.green(`  curl -sS -X ${e.method} '${url}' \\`));
     console.error(import_chalk6.default.green('    -H "X-API-Key: $APIBLAZE_CONTROLPLANE_APIKEY"' + (hasBody ? " \\" : "")));
     if (hasBody) {
       console.error(import_chalk6.default.green("    -H 'Content-Type: application/json' \\"));
@@ -1123,7 +1123,7 @@ async function createTenantRow(teamId) {
     const { name } = await inquirer3.prompt([{
       type: "input",
       name: "name",
-      message: `Tenant name ${import_chalk45.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
+      message: `Tenant name ${import_chalk46.default.dim("(lowercase letters/numbers; globally unique \u2014 becomes {name}.portal.apiblaze.com)")}:`,
       validate: (s) => /^[a-z0-9]+$/.test(s.trim()) ? true : "lowercase letters and numbers only"
     }]);
     const slug = name.trim();
@@ -1138,7 +1138,7 @@ async function createTenantRow(teamId) {
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
       if (/taken|unique|exists|reserved|conflict/i.test(msg)) {
-        console.log(import_chalk45.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
+        console.log(import_chalk46.default.yellow(`  "${slug}" is not available (tenant names are global): ${msg}`));
         continue;
       }
       throw err;
@@ -1155,11 +1155,11 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     pageSize: 10,
     choices: [
       ...PROVIDERS2.map((p) => ({ name: p.label, value: p.id })),
-      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk45.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
+      ...opts.allowSkip ? [new inquirer3.Separator(), { name: import_chalk46.default.dim("Skip for now \u2014 set up a login method later"), value: null }] : []
     ]
   }]);
   if (!provider) {
-    console.log(import_chalk45.default.dim("  No login method yet \u2014 add one later under Login methods."));
+    console.log(import_chalk46.default.dim("  No login method yet \u2014 add one later under Login methods."));
     return false;
   }
   const opt = PROVIDERS2.find((p) => p.id === provider);
@@ -1190,7 +1190,7 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
     if (a.callbacks.trim()) clientBody.authorizedCallbackUrls = a.callbacks.split(/\s*,\s*/).map((s) => s.trim()).filter(Boolean);
     if (a.scopes.trim() && opt.own) providerBody.scopes = a.scopes.split(/\s+/).filter(Boolean);
   }
-  const spinner = (0, import_ora17.default)("Setting up login...").start();
+  const spinner = (0, import_ora18.default)("Setting up login...").start();
   try {
     const client = await admin({ method: "POST", path: `${base2}/app-clients`, body: clientBody, summary: `Create login for ${tenant2}` });
     const clientId = client?.clientId ?? client?.client_id;
@@ -1205,27 +1205,27 @@ async function addApiblazeHostedLogin(teamId, tenant2, opts = {}) {
 async function createTenantInteractive(teamId) {
   const { default: inquirer3 } = await import("inquirer");
   const tenant2 = await createTenantRow(teamId);
-  console.log(import_chalk45.default.green(`  Tenant ${import_chalk45.default.bold(tenant2)} created.`));
+  console.log(import_chalk46.default.green(`  Tenant ${import_chalk46.default.bold(tenant2)} created.`));
   const { users } = await inquirer3.prompt([{
     type: "confirm",
     name: "users",
     default: false,
-    message: `Enable Users & groups? ${import_chalk45.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
+    message: `Enable Users & groups? ${import_chalk46.default.dim(`(identity/key management at iam.apiblaze.com)`)}`
   }]);
   if (users) {
     await admin({ method: "PATCH", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/iam`, body: { enabled: true }, summary: "Enable Users & groups" }).catch(() => {
     });
-    console.log(import_chalk45.default.green("  Users & groups enabled."));
+    console.log(import_chalk46.default.green("  Users & groups enabled."));
   }
   await addApiblazeHostedLogin(teamId, tenant2, { allowSkip: true });
   return tenant2;
 }
-var import_chalk45, import_ora17, PROVIDERS2, DEFAULT_SCOPES;
+var import_chalk46, import_ora18, PROVIDERS2, DEFAULT_SCOPES;
 var init_tenant_create = __esm({
   "src/lib/tenant-create.ts"() {
     "use strict";
-    import_chalk45 = __toESM(require("chalk"));
-    import_ora17 = __toESM(require("ora"));
+    import_chalk46 = __toESM(require("chalk"));
+    import_ora18 = __toESM(require("ora"));
     init_admin();
     PROVIDERS2 = [
       { id: "apiblaze", label: "APIblaze (via GitHub) \u2014 zero setup, recommended", own: false },
@@ -1263,10 +1263,10 @@ async function fetchPage2(teamId, q) {
 }
 function label(t, defaultTenant, active) {
   const tags = [
-    t.tenant_name === active ? import_chalk46.default.cyan("active scope") : "",
-    t.tenant_name === defaultTenant ? import_chalk46.default.dim("team default") : ""
+    t.tenant_name === active ? import_chalk47.default.cyan("active scope") : "",
+    t.tenant_name === defaultTenant ? import_chalk47.default.dim("team default") : ""
   ].filter(Boolean).join(", ");
-  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk46.default.dim(`  ${t.display_name}`) : "";
+  const disp = t.display_name && t.display_name !== t.tenant_name ? import_chalk47.default.dim(`  ${t.display_name}`) : "";
   return `${t.tenant_name}${disp}${tags ? `  (${tags})` : ""}`;
 }
 async function pickTenant(teamId, opts = {}) {
@@ -1274,14 +1274,14 @@ async function pickTenant(teamId, opts = {}) {
   const active = loadCredentials()?.activeTenant;
   let q = opts.initialQuery ?? "";
   for (; ; ) {
-    const spinner = (0, import_ora18.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
+    const spinner = (0, import_ora19.default)(q ? `Searching tenants for "${q}"...` : "Loading tenants...").start();
     const page = await fetchPage2(teamId, q).finally(() => spinner.stop());
     if (!page.total && !q) {
       if (opts.allowCreate) {
         const { make } = await inquirer3.prompt([{ type: "confirm", name: "make", message: "No tenants yet \u2014 create one?", default: true }]);
         if (make) return await createTenantInline(teamId);
       }
-      console.error(import_chalk46.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
+      console.error(import_chalk47.default.red("This team has no tenants. Create one with `apiblaze tenant create`."));
       return null;
     }
     const truncated = page.total > page.rows.length;
@@ -1290,7 +1290,7 @@ async function pickTenant(teamId, opts = {}) {
       value: t.tenant_name
     }));
     if (truncated || q) {
-      choices.push(new inquirer3.Separator(import_chalk46.default.dim(
+      choices.push(new inquirer3.Separator(import_chalk47.default.dim(
         truncated ? `showing ${page.rows.length} of ${page.total}${q ? ` matching "${q}"` : ""} \u2014 search to narrow` : `matches for "${q}"`
       )));
       choices.push({ name: `\u{1F50D} Search${q ? " again" : ""}\u2026`, value: "\0search" });
@@ -1324,12 +1324,12 @@ async function createTenantInline(teamId) {
   const { createTenantInteractive: createTenantInteractive2 } = await Promise.resolve().then(() => (init_tenant_create(), tenant_create_exports));
   return createTenantInteractive2(teamId);
 }
-var import_chalk46, import_ora18, PAGE;
+var import_chalk47, import_ora19, PAGE;
 var init_tenant_pick = __esm({
   "src/lib/tenant-pick.ts"() {
     "use strict";
-    import_chalk46 = __toESM(require("chalk"));
-    import_ora18 = __toESM(require("ora"));
+    import_chalk47 = __toESM(require("chalk"));
+    import_ora19 = __toESM(require("ora"));
     init_admin();
     init_auth();
     PAGE = 15;
@@ -1339,10 +1339,10 @@ var init_tenant_pick = __esm({
 // src/index.ts
 var import_fs5 = __toESM(require("fs"));
 var import_commander = require("commander");
-var import_chalk63 = __toESM(require("chalk"));
+var import_chalk64 = __toESM(require("chalk"));
 
 // package.json
-var version = "0.21.9";
+var version = "0.21.13";
 
 // src/index.ts
 init_types();
@@ -1972,8 +1972,10 @@ function randomProxyName() {
 // src/lib/tunnel-client.ts
 var import_ws = __toESM(require("ws"));
 var CHUNK_BYTES = 512 * 1024;
-var PING_INTERVAL_MS = 6e4;
+var PING_INTERVAL_MS = 3e4;
+var SILENCE_LIMIT_MS = 75e3;
 var MAX_RECONNECT_DELAY_MS = 15e3;
+var TOKEN_REFRESH_AFTER_MS = 24e4;
 var OFFLINE_CODES = /* @__PURE__ */ new Set(["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "EHOSTUNREACH"]);
 var STRIP_HEADERS = /* @__PURE__ */ new Set([
   "host",
@@ -1997,28 +1999,52 @@ function encodeBody(buf) {
   return { value: buf.toString("utf8"), encoding: "utf8" };
 }
 function startTunnelClient(opts) {
-  const target = `http://127.0.0.1:${opts.localPort}`;
+  const target2 = `http://127.0.0.1:${opts.localPort}`;
   const inflight = /* @__PURE__ */ new Map();
   let ws = null;
   let closed = false;
   let reconnects = 0;
   let pingTimer;
+  let connectUrl = opts.connectUrl;
+  let token = opts.token;
+  let tokenAt = Date.now();
+  let tokenRefused = false;
+  let lastFrameAt = Date.now();
   let capturing = false;
   function connect() {
-    const url = `${opts.connectUrl}?project=${encodeURIComponent(opts.projectId)}&token=${encodeURIComponent(opts.token)}`;
+    const url = `${connectUrl}?project=${encodeURIComponent(opts.projectId)}&token=${encodeURIComponent(token)}`;
     const socket = new import_ws.default(url);
     ws = socket;
     socket.on("open", () => {
       reconnects = 0;
+      tokenRefused = false;
+      lastFrameAt = Date.now();
       opts.onStatus?.("connected");
       pingTimer = setInterval(() => {
+        if (Date.now() - lastFrameAt > SILENCE_LIMIT_MS) {
+          try {
+            socket.terminate();
+          } catch {
+          }
+          return;
+        }
         try {
           socket.send("ping");
         } catch {
         }
       }, PING_INTERVAL_MS);
     });
-    socket.on("message", (data) => handleFrame(socket, data.toString()));
+    socket.on("unexpected-response", (_req, res) => {
+      if (res.statusCode === 401 || res.statusCode === 403) tokenRefused = true;
+      try {
+        socket.terminate();
+      } catch {
+      }
+    });
+    socket.on("message", (data) => {
+      lastFrameAt = Date.now();
+      handleFrame(socket, data.toString());
+    });
     socket.on("close", () => {
       if (pingTimer) clearInterval(pingTimer);
       if (!closed) scheduleReconnect();
@@ -2031,9 +2057,26 @@ function startTunnelClient(opts) {
     reconnects++;
     opts.onStatus?.(`disconnected \u2014 reconnecting in ${Math.round(delay / 1e3)}s`);
     setTimeout(() => {
-      if (!closed) connect();
+      void reconnect();
     }, delay);
   }
+  async function reconnect() {
+    if (closed) return;
+    if (opts.refresh && (tokenRefused || Date.now() - tokenAt > TOKEN_REFRESH_AFTER_MS)) {
+      try {
+        const fresh = await opts.refresh();
+        connectUrl = fresh.url;
+        token = fresh.token;
+        tokenAt = Date.now();
+        tokenRefused = false;
+      } catch (err) {
+        opts.onStatus?.(`could not refresh the tunnel token (${err?.message ?? err}) \u2014 retrying`);
+        scheduleReconnect();
+        return;
+      }
+    }
+    if (!closed) connect();
+  }
   function handleFrame(socket, raw) {
     let frame;
     try {
@@ -2099,7 +2142,7 @@ function startTunnelClient(opts) {
     const init = { method: f.method, headers: stripHeaders(f.headers) };
     if (body.length) init.body = body;
     try {
-      const resp = await fetch(target + f.path, init);
+      const resp = await fetch(target2 + f.path, init);
       const status2 = resp.status;
       const buf = Buffer.from(await resp.arrayBuffer());
       const headers = {};
@@ -2713,7 +2756,7 @@ function writeAgentInstruction(cli, spec2, dir = process.cwd()) {
       "asking for data the API can provide.",
       ...spec2.contextNote ? ["", spec2.contextNote] : [],
       "",
-      `_Added by \`apiblaze apichat\`. Remove this block, or run \`npx apiblaze apichat ${spec2.name} --remove-mcp ${cli}\`._`,
+      `_Added by \`apiblaze apichat\`. Remove this block, or run \`npx apiblaze@latest apichat ${spec2.name} --remove-mcp ${cli}\`._`,
       m.end,
       ""
     ].join("\n");
@@ -2835,7 +2878,7 @@ async function installAndDemo(cli, spec2, getQuestion, log4 = console.log) {
   ${cli.label} exited with ${ans.status ?? "no status"} \u2014 the MCP stays installed.`));
   }
   const instructionFile = writeAgentInstruction(cli.kind, spec2);
-  const off = `npx apiblaze apichat ${spec2.name} --remove-mcp ${cli.kind}`;
+  const off = `npx apiblaze@latest apichat ${spec2.name} --remove-mcp ${cli.kind}`;
   const mdName = cli.kind === "claude" ? "CLAUDE.md" : "AGENTS.md";
   log4("");
   log4(import_chalk11.default.bgRed.white.bold(`  ${cli.label} will launch with your MCP to ${spec2.projectLabel} enabled from now on.  `));
@@ -3028,8 +3071,8 @@ async function fetchText(url) {
     return null;
   }
 }
-async function discoverSpec(target) {
-  const base2 = target.replace(/\/+$/, "");
+async function discoverSpec(target2) {
+  const base2 = target2.replace(/\/+$/, "");
   for (const suffix of ["/openapi.json", "/openapi.yaml", "/swagger.json"]) {
     const url = base2 + suffix;
     const text = await fetchText(url);
@@ -3261,14 +3304,14 @@ async function cpPost(anon, path11, body, summary) {
   }
   return admin({ method: "POST", path: path11, body, summary });
 }
-async function provision(spec2, target, opts) {
+async function provision(spec2, target2, opts) {
   const loggedIn = !!loadCredentials();
   const anon = !loggedIn;
   const salt = () => Math.random().toString(36).slice(2, 6);
   let base2 = opts.name ? normalizeName(opts.name) : "";
   if (!base2) {
     try {
-      const host = new URL(target).hostname;
+      const host = new URL(target2).hostname;
       base2 = normalizeName(host.split(".")[0]);
       if (base2.length < 3) base2 = normalizeName(host);
     } catch {
@@ -3295,7 +3338,7 @@ async function provision(spec2, target, opts) {
         const creds = loadCredentials();
         result = await createProxy({
           name,
-          target_url: target,
+          target_url: target2,
           auth_type: "api_key",
           requests_auth: DUAL_AUTH,
           team_id: creds.teamId,
@@ -3307,8 +3350,8 @@ async function provision(spec2, target, opts) {
         const body = {
           name,
           subdomain: name,
-          target,
-          target_url: target,
+          target: target2,
+          target_url: target2,
           auth_type: "api_key",
           requests_auth: DUAL_AUTH,
           ...opts.apiversion ? { api_version: opts.apiversion } : {}
@@ -4493,9 +4536,9 @@ async function startChat(p, messages, opts) {
   }
   await runRepl(p, messages);
 }
-function isApiblazeControlPlaneTarget(target) {
+function isApiblazeControlPlaneTarget(target2) {
   try {
-    const h = new URL(target).hostname.toLowerCase();
+    const h = new URL(target2).hostname.toLowerCase();
     return h === "api.mcp.apiblaze.com" || /^externalauth(-[a-z0-9]+)?\.mcp\.apiblaze\.com$/.test(h);
   } catch {
     return false;
@@ -4631,8 +4674,8 @@ async function runApichat(opts) {
     }
   }
   const { spec: spec2, sourceUrl } = await loadSpec(opts);
-  const target = resolveTarget(spec2, opts, sourceUrl);
-  console.log(`  ${import_chalk13.default.dim("Target:")} ${import_chalk13.default.bold(target)}`);
+  const target2 = resolveTarget(spec2, opts, sourceUrl);
+  console.log(`  ${import_chalk13.default.dim("Target:")} ${import_chalk13.default.bold(target2)}`);
   const auth = await resolveTargetAuth(spec2, opts);
   if (auth && !process.stdin.isTTY && !opts.targetAuthEnv) {
     fail3(
@@ -4640,11 +4683,11 @@ async function runApichat(opts) {
       `Re-run with --target-auth-env <ENV_VAR> holding the ${auth.basic ? "base64(user:pass)" : "secret"}.`
     );
   }
-  const p = await provision(spec2, target, opts);
+  const p = await provision(spec2, target2, opts);
   console.log(`  ${import_chalk13.default.dim("Proxy: ")} ${import_chalk13.default.bold(p.proxyUrl || `${p.projectId} v${p.version}`)}`);
   upsertApichat({
     name: p.projectId,
-    target,
+    target: target2,
     projectId: p.projectId,
     version: p.version,
     environment: p.environment,
@@ -4848,10 +4891,30 @@ async function mintConsumerKey(o) {
     raw: out
   };
 }
+async function tenantKeyEndUserMode(caller, teamId, tenant2) {
+  try {
+    const p = await producer(caller, {
+      method: "GET",
+      path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/key-policy`,
+      summary: "Read the tenant key policy (default holder)"
+    });
+    return p?.key_end_user_mode === "one" ? "one" : "many";
+  } catch {
+    return "many";
+  }
+}
+function defaultHolderRefusal(tenant2) {
+  return `Tenant ${tenant2} issues one key per end user (1 API key = 1 end user): add --for <email|id>. To create a different key anyway, pass --backend (a server key that names each caller) or --client.`;
+}
 async function runConsumerKeyMint(opts) {
   const kind = resolveHolder(opts);
   const who = (opts.for ?? "").trim();
   const tenant2 = (opts.tenant ?? "").trim();
+  if (tenant2 && !who && !opts.backend && !opts.client) {
+    const caller = requireCaller();
+    const { teamId } = await resolveActingTeam(caller, opts.team);
+    if (await tenantKeyEndUserMode(caller, teamId, tenant2) === "one") throw new Error(defaultHolderRefusal(tenant2));
+  }
   const spinner = (0, import_ora3.default)(who ? `Minting a key for ${who} in ${tenant2}...` : `Minting a ${kind} key in ${tenant2}...`).start();
   let out;
   try {
@@ -5426,8 +5489,8 @@ function printEnvironments(o) {
   const rows = names.length ? names.map((e) => [`/${e}`, o.dev && e === "dev" ? `localhost:${o.dev.port}  (tunnelled from this machine)` : envs[e]?.target ?? "\u2014"]) : o.dev ? [["/dev", `localhost:${o.dev.port}  (tunnelled from this machine)`]] : [];
   if (!rows.length) return;
   const w = Math.max(...rows.map(([e]) => e.length));
-  for (const [env, target] of rows) {
-    console.log(`      ${import_chalk17.default.cyan(env.padEnd(w))} ${import_chalk17.default.green("\u2192")} ${target}`);
+  for (const [env, target2] of rows) {
+    console.log(`      ${import_chalk17.default.cyan(env.padEnd(w))} ${import_chalk17.default.green("\u2192")} ${target2}`);
   }
 }
 async function finishSetup(o) {
@@ -5875,9 +5938,9 @@ Create an ${B.thing}`));
     body.openapi = await loadOpenapiSource(opts.openapi);
   }
   if (opts.target && !isHttpUrl3(opts.target)) fail4("--target must be a valid http(s) URL.");
-  let target = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
+  let target2 = opts.target?.trim() || (typeof body.target === "string" ? body.target : "") || (typeof body.target_url === "string" ? body.target_url : "");
   const hasOtherSource = !!(body.openapi || body.github);
-  if (!target && !hasOtherSource) {
+  if (!target2 && !hasOtherSource) {
     if (interactive) {
       const { default: inquirer3 } = await import("inquirer");
       if (name === void 0) {
@@ -5902,7 +5965,7 @@ Create an ${B.thing}`));
           console.log(import_chalk17.default.yellow("  Enter a valid http(s) URL.\n"));
           continue;
         }
-        target = url.trim();
+        target2 = url.trim();
         break;
       }
     } else {
@@ -5910,12 +5973,12 @@ Create an ${B.thing}`));
     }
   }
   if (name === void 0 && opts.auto) {
-    const nameSource = target || (typeof opts.openapi === "string" ? opts.openapi : void 0);
+    const nameSource = target2 || (typeof opts.openapi === "string" ? opts.openapi : void 0);
     name = deriveNameFrom(nameSource) ?? randomProxyName();
   }
-  if (target) {
-    body.target = target;
-    body.target_url = target;
+  if (target2) {
+    body.target = target2;
+    body.target_url = target2;
   }
   if (name) {
     body.name = name;
@@ -6126,13 +6189,13 @@ async function chooseName(opts, openapi, teamId, interactive) {
 }
 async function createDevProxy(args) {
   const { auth, name, port, openapi, authChoice, families, tenant: tenant2, teamId } = args;
-  const target = `http://localhost:${port}`;
+  const target2 = `http://localhost:${port}`;
   const body = {
     name,
     subdomain: name,
     auth_type: authChoice.auth,
     ...authChoice.bodyPatch,
-    ...openapi ? { openapi, environments: { dev: { target, description: `localhost:${port} through the ${B.cli} dev tunnel` } } } : { target_url: target },
+    ...openapi ? { openapi, environments: { dev: { target: target2, description: `localhost:${port} through the ${B.cli} dev tunnel` } } } : { target_url: target2 },
     ...tenant2 ? { tenant: tenant2 } : {},
     ...teamId ? { team_id: teamId } : {},
     ...families ? { secure: { families } } : {}
@@ -6142,7 +6205,7 @@ async function createDevProxy(args) {
   let keyAuth = auth.mode === "key" ? { apiKey: auth.apiKey } : void 0;
   let resolvedTeam = teamId;
   if (caller) {
-    result = await producer(caller, { method: "POST", path: "/projects", body, summary: `Create ${B.thingShort} ${name} \u2192 ${target}` });
+    result = await producer(caller, { method: "POST", path: "/projects", body, summary: `Create ${B.thingShort} ${name} \u2192 ${target2}` });
   } else {
     result = await createProxyAnonymous(body);
     if (result.cp_key && result.team_id) {
@@ -6198,7 +6261,7 @@ async function runDev(options) {
   }
   let targets = [];
   const wantsNew = options.openapi !== void 0 || options.name !== void 0;
-  if (auth.mode !== "none" && !wantsNew) {
+  if (auth.mode !== "none" && (!wantsNew || options.name !== void 0 && !options.project)) {
     const spinner = (0, import_ora7.default)("Looking for projects that point at this machine...").start();
     try {
       targets = await getLocalhostTargets(teamId, keyAuth);
@@ -6212,7 +6275,15 @@ async function runDev(options) {
   let selected = [];
   let created = null;
   let setup = null;
-  if (options.project) {
+  const rerun = !options.project && options.name !== void 0 ? targets.find((t) => t.projectId?.toLowerCase() === normalizeName2(options.name) || t.projectName?.toLowerCase() === normalizeName2(options.name)) : void 0;
+  if (rerun) {
+    console.log(import_chalk18.default.dim(`  "${rerun.projectName}" already points at this machine \u2014 reattaching the tunnel (spec and keys unchanged).`));
+    selected = [rerun];
+  } else if (wantsNew) {
+    targets = [];
+  }
+  if (selected.length) {
+  } else if (options.project) {
     const want = options.project.toLowerCase();
     const match = targets.find((t) => t.projectId?.toLowerCase() === want || t.projectName?.toLowerCase() === want);
     if (!match) {
@@ -6318,11 +6389,12 @@ async function runDev(options) {
   }
   let restore = [];
   let connect;
+  const registerTargets = { targets: selected.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId })) };
   {
     const spinner = (0, import_ora7.default)("Registering the tunnel...").start();
     try {
-      const result = await putDevTunnel({ targets: selected.map((t) => ({ projectId: t.projectId, tenantId: t.tenantId })) }, keyAuth);
-      restore = result.restore ?? [];
+      const result = await putDevTunnel(registerTargets, keyAuth);
+      restore = (result.restore ?? []).map((r) => unmarkRestore(r, options.port));
       connect = result.connect;
       spinner.stop();
     } catch (err) {
@@ -6340,6 +6412,13 @@ async function runDev(options) {
     (projectId) => startTunnelClient({
       connectUrl: connect.url,
       token: connect.token,
+      // Re-register for a fresh token. PUT is idempotent on an already-tunnelled
+      // project; its restore snapshot would be the marker, so it is IGNORED —
+      // teardown keeps replaying the one taken at start.
+      refresh: async () => {
+        const again = await putDevTunnel(registerTargets, keyAuth);
+        return { url: again.connect.url, token: again.connect.token };
+      },
       projectId,
       localPort: options.port,
       onEntry: (entry) => say(formatLogLine(entry)),
@@ -6359,6 +6438,7 @@ async function runDev(options) {
   const localUp = await probeLocalServer(options.port);
   console.log();
   console.log(`  ${import_chalk18.default.bold("Tunnel is up \u2014 leave this running. Ctrl-C stops it.")}`);
+  console.log(import_chalk18.default.dim(`  If it stops, run: npx ${B.cli} dev --port ${options.port} --project ${selected[0]?.projectName ?? "<name>"} --auto   (reattaches; creates nothing)`));
   if (!localUp) console.log(import_chalk18.default.magenta(`  \u26B2 Nothing listening on port ${options.port} yet \u2014 requests are captured until your server starts.`));
   if (options.captureFile) console.log(import_chalk18.default.gray(`  Streaming full traffic to ${options.captureFile}`));
   console.log();
@@ -6378,9 +6458,30 @@ async function runDev(options) {
   }
   process.on("SIGINT", () => void cleanup());
   process.on("SIGTERM", () => void cleanup());
+  process.on("SIGHUP", () => void cleanup());
+  for (const stream of [process.stdout, process.stderr]) {
+    stream.on("error", (err) => {
+      if (err.code !== "EPIPE") throw err;
+    });
+  }
   await new Promise(() => {
   });
 }
+function unmarkRestore(r, port) {
+  const envs = r.environments;
+  if (!envs || typeof envs !== "object") return r;
+  let changed = false;
+  const next = {};
+  for (const [stage, value] of Object.entries(envs)) {
+    if (typeof value?.target === "string" && value.target.startsWith("devtunnel://")) {
+      next[stage] = { ...value, target: `http://localhost:${port}` };
+      changed = true;
+    } else {
+      next[stage] = value;
+    }
+  }
+  return changed ? { ...r, environments: next } : r;
+}
 
 // src/commands/projects.ts
 var import_chalk19 = __toESM(require("chalk"));
@@ -6485,10 +6586,16 @@ business logic: the gateway sits in front of the code and enforces it.
 - They say yes to "can I read the code" \u2192 **Adopt**: scan their app, ask only what the scan
   could not find, then ship it through the Ship steps.
 - They have a backend, just wrote one, or ask you to BUILD one and then ship it \u2192 **Ship**.
-  No code yet? First write the smallest plain backend that serves the resources they named \u2014
-  no auth, no tenancy, no ownership checks (the gateway does those); stamp rows with the
-  \`x-abz-user-id\` header so ownership is visible \u2014 plus its \`openapi.yaml\`, start it on
-  their port, then continue at Ship \xA71. Do NOT build the Demo app for this. If they say "use
+  No code yet? First write the smallest plain backend that serves the resources they named,
+  plus its \`openapi.yaml\`, start it on their port, then continue at Ship \xA71. Do NOT build
+  the Demo app for this. The gateway does auth, tenancy and item ownership; the backend does
+  only these three things:
+  - stamp each new row's \`owner\` with the \`x-abz-user-id\` header;
+  - filter every collection GET to rows whose \`owner\` is that header (the gateway's rules
+    lock single records, never lists \u2014 a list route has no one record to check);
+  - answer 401 to any call whose \`x-target-api-key\` is not \`process.env.TARGET_SERVER_SECRET\`
+    (generate it with \`openssl rand -hex 24\`, put it in \`.env.local\`, start the backend with
+    it; Ship \xA73b makes the proxy send it). If they say "use
   ${cli} on this" or "ship it with ${cli}" and point at a backend, skip any pitch and run it.
 
 Tie-breaks: a question ("what can it do", "what is it") is always **Explain**, whatever else the
@@ -6608,12 +6715,11 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
   sign-in plumbing, not business logic. Then the widgets they ticked, each with its server route
   (\`npx ${cli} integration <name> --stack <their stack>\` for keys and chat; groups is the keys
   route with \`createApiblazeGroups\`).
-- Backend behind a secret: the proxy must send it upstream. That is a dashboard setting
-  (Settings \u2192 Transforms); the CLI has no flag for it yet \u2014 say so, do not invent one. For a
-  local run through the tunnel, the backend can instead accept calls carrying
-  \`x-abz-user-id\`, which the gateway stamps on every call it forwards. Say plainly that while
-  the tunnel runs, \`localhost:<port>\` still answers to the old secret and to anyone who sends
-  that header \u2014 fine on a laptop, not on a server; in prod the proxy is the only caller.
+- Backend behind a secret: the proxy must send it upstream \u2014
+  \`npx ${cli} transform set-header <name> <its header> --value-env <VAR> --secret\`. Until then
+  anyone reaching \`localhost:<port>\` skips the gateway.
+- List routes: check each collection GET filters by owner; if it does not, say so \u2014 the
+  gateway locks single records only.
 - Multi-tenant app \u2192 \`npx ${cli} identified <name> require\`, so no call arrives without a user.
 - Change nothing in their business logic. Report what you changed, file by file.
 
@@ -6628,7 +6734,10 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    login. Their own OAuth app \u2192 \`--apikey --oauth '{"provider":"auth0","clientId":"\u2026","clientSecret":"\u2026"}'\`
    (both doors: keys for tenants, their login for people and agents). Shapes below.
 3. **Local code** \u2192 \`npx ${cli} dev --port <port> --openapi ./openapi.yaml --name <name> --auto <door flags>\`,
-   in the BACKGROUND, left running \u2014 it is the tunnel. **Deployed code** \u2192
+   left running \u2014 it is the tunnel. Start it as its own detached process, never \`cmd &\` inside
+   a shell call that ends: \`nohup npx ${cli} dev \u2026 > ${cli}-dev.log 2>&1 < /dev/null &\`, then
+   read the log. If it stops, re-run the SAME command: the same \`--name\` reattaches and
+   creates nothing. Never pick a new name to get it back \u2014 that is a second proxy. **Deployed code** \u2192
    \`npx ${cli} create --target <url-or-spec> --name <name> --auto <door flags>\`. Both print the
    URL, the MCP URL (the "agents:" line), what is locked, and the bootstrap key ONCE \u2014 that key
    goes in the frontend-server's env, never a browser, a repo or an agent config. The tenant is
@@ -6637,22 +6746,32 @@ ONLY for what the scan could not find \u2014 one short list of questions, not an
    the frontend-server's env (\`.env.local\` for Next.js). Then prove it with three curls and
    say the codes: no key \u2192 401; create as \`X-End-User-Id: ana\` \u2192 201; PATCH that id as
    \`ben\` \u2192 403.
+3b. **Only the proxy reaches the backend.** If the backend checks \`x-target-api-key\`:
+   \`npx ${cli} transform set-header <name> x-target-api-key --value-env TARGET_SERVER_SECRET --secret\`
+   (export the variable from \`.env.local\` first). Prove it: the same list call through the
+   proxy \u2192 200; \`curl localhost:<port>/<collection>\` with no header \u2192 401.
 4. **Prod** (local code only): \`npx ${cli} target <name> --env prod --url <prod-url>\`.
-5. **Limits.** \`npx ${cli} throttle <name> --end-user-rate 10 --quota 10000 --period daily\` \u2014
-   sane defaults; use the user's numbers if they gave any. The CLI echoes \`\u2714 Update throttling
-   {\u2026}\`. Prove it: 15 parallel GETs as one user \u2192 about 10\xD7200 and the rest 429; a different
-   user right after \u2192 200.
+5. **Limits.** Every new proxy already allows 10 requests/s per person and 10,000 a day \u2014
+   say so; that is "throttled". Only for other numbers:
+   \`npx ${cli} throttle <name> --rate <n> --quota <n> --period daily\`. It works logged out;
+   an anonymous workspace is capped at 10/s until claimed. Prove it: 15 parallel GETs as one
+   user \u2192 about 10\xD7200 and the rest 429.
 5b. **Attribution.** \`--auto\` leaves unattributed calls allowed: the bootstrap key with no
    \`X-End-User-Id\` creates rows nobody owns. For a multi-tenant app run
    \`npx ${cli} identified <name> require\` \u2014 then every call must carry \`X-End-User-Id\` or a
-   login token. Say plainly that list routes (GET on a collection) return everyone's rows;
-   only item routes are locked to their creator.
-6. **Admin.** \`npx ${cli} admins add <email> --tenant <tenant>\` \u2014 ask for the email, never guess
-   it. If you cannot ask (a scripted run), skip it and end the report with
-   "Admin \u2014 none yet: what email should administer tenant <tenant>?"
-7. **Report** in the shape below, then ask: "Would you like me to add the self-serve API key
-   widget to your site?" and "Would you like to chat with your API now via your MCP?"
-   (yes \u2192 \`npx ${cli} apichat <name> --install-mcp claude\`).
+   login token. Prove it: the key with no \`X-End-User-Id\` \u2192 403 \`identity_required\`.
+   Lists are the backend's job (it filters by owner); say that the gateway locks records,
+   the backend filters lists.
+6. **Admin.** \`npx ${cli} admins add <email> --tenant <tenant>\` with the email they named. None
+   named \u2192 \`admin@ninopizzas.com\`, the demo admin (works before that person ever logs in);
+   say so, and that they can \`admins add\` their own email and \`admins remove\` that one.
+7. **Report** in the shape below, then hand it over \u2014 they try it, you do not:
+   - the full curl with the real key and URL, ready to paste:
+     \`curl <APIBLAZE_URL>/<collection> -H "X-API-Key: <APIBLAZE_SERVER_KEY>" -H "X-End-User-Id: ana"\`
+     (say the key is the server key \u2014 for trying it here, never for a browser or an agent);
+   - the command to chat with their API: \`npx ${cli} apichat <name>\` (add
+     \`--xenduserid ana\` when \xA75b is on).
+   Then ask once: "Would you like me to add the self-serve API key widget to your site?"
 
 ## Report like this
 
@@ -6665,9 +6784,15 @@ Use the real values the CLI printed. Never invent a URL, a key, a rule or a limi
       API     https://<name>.abz.run/1.0.0/dev          your tenants, with API keys
                 /dev  \u2192 localhost:<port>                tunnelled from this machine \u2014 leave it running
                 /prod \u2192 <prod-url>                      your deploy
-              Try it: curl https://<name>.abz.run/1.0.0/dev/<collection> -H "X-API-Key: <key>" -H "X-End-User-Id: you"
       MCP     <the "agents:" URL the CLI printed>       agents, signing in with <provider>
-      Limits  10 requests/s per user \xB7 10,000 a day
+      Limits  10 requests/s per person \xB7 10,000 a day
+      Backend answers only to the proxy (x-target-api-key) \xB7 lists filtered by owner
+      Admin   <email>
+
+    Try it yourself:
+      curl <APIBLAZE_URL>/<collection> -H "X-API-Key: <APIBLAZE_SERVER_KEY>" -H "X-End-User-Id: ana"
+    Chat with it:
+      npx ${cli} apichat <name> --xenduserid ana
 
 ## Sign-in shapes \u2014 the only ones \`--oauth\` accepts; never invent fields
 
@@ -6689,9 +6814,10 @@ key. Mint it with \`npx ${cli} apikeys mint --desc "keys widget"\` (no \`--tenan
 \`--tenant\` you get a consumer key, which is the wrong kind).
 Edit ONLY the frontend and the frontend-server. A key per TENANT comes from that widget \u2014 each
 of your customers mints their own, in their own tenant; the bootstrap key is only for your
-frontend-server. A key bound to one person (an agent, a CI job):
-\`npx ${cli} apikeys mint --tenant <tenant> --for <email>\`. That names a person by email,
-which is a DIFFERENT identity from a bare \`X-End-User-Id\` string: rows created as "ana" via
+frontend-server. Three kinds of key for a tenant, one flag each: \`apikeys mint --tenant <tenant>\` +
+\`--backend\` (a server that names the user with \`X-End-User-Id\`), \`--client\` (cannot name a
+user) or \`--for <email>\` (bound to one person \u2014 an agent, a CI job). \`--for\` names a person by
+email, which is a DIFFERENT identity from a bare \`X-End-User-Id\` string: rows created as "ana" via
 the header are not owned by ana@example.com's key.
 
 ## Never
@@ -6702,13 +6828,16 @@ the header are not owned by ana@example.com's key.
 - Put ownership or tenancy checks into business logic. The gateway enforces them.
 - Ask for team ids, tenant ids or project ids the CLI already knows.
 - Delete anything. Deletion stays with the user: \`npx ${cli} delete <name>\` (interactive;
-  \`--yes\` skips the prompt). Its impact banner lists tenant-scoped counts even when the tenant
+  \`--yes\` skips the prompt; logged in only \u2014 an unclaimed workspace is removed after 30 days). Its impact banner lists tenant-scoped counts even when the tenant
   is shared \u2014 those are lost only if this is the tenant's LAST proxy.
 
 ## Later
 
 - \`npx ${cli} rule <name>\` reviews or changes the rules; \`npx ${cli} config <name> authorization.enforce_authorization false\` turns enforcement off without losing them.
 - \`npx ${cli} apichat <name>\` chats with the API again; \`--install-mcp claude\` connects an agent.
+- \`npx ${cli} throttle <name> --rate <n>\` \xB7 \`identified <name> require|allow-anon\` \xB7
+  \`transform <name> list|set-header|remove\` \xB7 \`target <name> --env prod --url <url>\` \u2014 all work
+  logged out. \`npx ${cli} <command> --help\` for the flags; \`--verbose\` prints the API calls.
 
 ## No shell? The control-plane MCP
 
@@ -6724,14 +6853,14 @@ async function runSkill(opts = {}) {
     process.stdout.write(md);
     return;
   }
-  const target = import_path2.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
-  if (import_fs3.default.existsSync(target) && !opts.force) {
+  const target2 = import_path2.default.resolve(process.cwd(), SKILL_RELATIVE_PATH);
+  if (import_fs3.default.existsSync(target2) && !opts.force) {
     console.error(import_chalk20.default.yellow(`${SKILL_RELATIVE_PATH} already exists \u2014 re-run with --force to overwrite it.`));
     process.exit(1);
   }
-  import_fs3.default.mkdirSync(import_path2.default.dirname(target), { recursive: true });
-  import_fs3.default.writeFileSync(target, md, "utf8");
-  console.log(`${import_chalk20.default.green("\u2713")} Installed the ${import_chalk20.default.bold(SKILL_NAME)} skill: ${import_chalk20.default.bold(target)}`);
+  import_fs3.default.mkdirSync(import_path2.default.dirname(target2), { recursive: true });
+  import_fs3.default.writeFileSync(target2, md, "utf8");
+  console.log(`${import_chalk20.default.green("\u2713")} Installed the ${import_chalk20.default.bold(SKILL_NAME)} skill: ${import_chalk20.default.bold(target2)}`);
   console.log(import_chalk20.default.dim(`  Claude Code picks it up in this project. Say "ship this API" and it runs npx ${B.cli} dev / create for you.`));
 }
 
@@ -6822,12 +6951,12 @@ async function runLogout(opts = {}) {
     console.log(import_chalk22.default.yellow("You were not logged in."));
     return;
   }
-  let target;
-  if (opts.all) target = "all";
-  else if (opts.producer) target = "producer";
-  else if (opts.consumer) target = "consumer";
-  else if (creds && !consumer2) target = "producer";
-  else if (consumer2 && !creds) target = "consumer";
+  let target2;
+  if (opts.all) target2 = "all";
+  else if (opts.producer) target2 = "producer";
+  else if (opts.consumer) target2 = "consumer";
+  else if (creds && !consumer2) target2 = "producer";
+  else if (consumer2 && !creds) target2 = "consumer";
   else {
     const { default: inquirer3 } = await import("inquirer");
     const { chosen } = await inquirer3.prompt([
@@ -6842,13 +6971,13 @@ async function runLogout(opts = {}) {
         ]
       }
     ]);
-    target = chosen;
+    target2 = chosen;
   }
-  if (target === "producer" || target === "all") {
+  if (target2 === "producer" || target2 === "all") {
     clearCredentials();
     console.log(import_chalk22.default.green(`\u2714 Logged out of API Producer${creds?.githubHandle ? ` (${creds.githubHandle})` : ""}.`));
   }
-  if (target === "consumer" || target === "all") {
+  if (target2 === "consumer" || target2 === "all") {
     clearConsumer();
     console.log(import_chalk22.default.green(`\u2714 Logged out of API Consumer${consumer2?.tenant ? ` (${consumer2.tenant})` : ""}.`));
   }
@@ -7861,17 +7990,17 @@ async function runExport(projectArg, versionArg, opts) {
   const match = await resolveProject(teamId, projectArg, versionArg);
   const projectId = match.projectId;
   const version2 = versionArg || match.apiVersion;
-  const target = opts.kong ? "kong" : "data";
+  const target2 = opts.kong ? "kong" : "data";
   const q = new URLSearchParams();
   if (opts.secrets) q.set("include_secrets", "1");
   if (opts.noConsumers) q.set("include_consumers", "0");
   if (opts.keys) q.set("keys", opts.keys);
   const qs = q.toString() ? `?${q.toString()}` : "";
-  console.log(import_chalk36.default.dim(`Queuing ${target} export of ${projectId}@${version2}\u2026`));
+  console.log(import_chalk36.default.dim(`Queuing ${target2} export of ${projectId}@${version2}\u2026`));
   const job = await admin({
-    path: `/projects/${projectId}/${version2}/export/${target}${qs}`,
+    path: `/projects/${projectId}/${version2}/export/${target2}${qs}`,
     method: "GET",
-    summary: `export ${projectId} (${target})`
+    summary: `export ${projectId} (${target2})`
   });
   if (!job?.job_id) throw new Error("Failed to queue export.");
   const statusPath = `/projects/${projectId}/${version2}/export/jobs/${job.job_id}`;
@@ -7890,7 +8019,7 @@ async function runExport(projectArg, versionArg, opts) {
     }
   }
   process.stdout.write("\n");
-  const outFile = opts.out || `apiblaze-export-${projectId}-${version2}-${target}.zip`;
+  const outFile = opts.out || `apiblaze-export-${projectId}-${version2}-${target2}.zip`;
   const res = await fetch(`${DASHBOARD_BASE5}/api/cli/admin/download`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
@@ -7902,7 +8031,7 @@ async function runExport(projectArg, versionArg, opts) {
   console.log(import_chalk36.default.green(`\u2713 Saved ${outFile} (${(buf.length / 1024).toFixed(0)} KB)`));
   if (job.decryption_key) console.log(import_chalk36.default.yellow(`Decryption key (shown once): ${job.decryption_key}`));
   console.log(import_chalk36.default.dim("Read MIGRATION-REPORT.json inside the zip for the full fidelity ledger."));
-  if (target === "kong") console.log(import_chalk36.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
+  if (target2 === "kong") console.log(import_chalk36.default.dim("Kong: unzip, then `cd kong && docker compose up` (see kong/README.md)."));
 }
 
 // src/commands/recipe-search.ts
@@ -8281,8 +8410,8 @@ async function runRecipeInstall(nameArg, opts) {
   let reinstall = false;
   if (opts.into) {
     reinstall = true;
-    const target = normalizeName3(opts.into);
-    const proj2 = await resolveProjectVia(caller, teamId, target, opts.apiversion);
+    const target2 = normalizeName3(opts.into);
+    const proj2 = await resolveProjectVia(caller, teamId, target2, opts.apiversion);
     project = proj2.projectId;
     apiVersion = proj2.apiVersion;
     tenant2 = await resolveReinstallTenant(caller, project, apiVersion);
@@ -8365,14 +8494,14 @@ function buildSteps(inp) {
       label: `creating ${project}`,
       skip: reinstall,
       run: async () => {
-        const target = firstUpstream(recipe);
-        if (!target) throw new Error("this recipe carries no upstream URL, so there is nothing to create a proxy against");
+        const target2 = firstUpstream(recipe);
+        if (!target2) throw new Error("this recipe carries no upstream URL, so there is nothing to create a proxy against");
         const out = await producer(caller, {
           method: "POST",
           path: "/projects",
           body: {
             name: project,
-            target,
+            target: target2,
             tenant: tenant2,
             product_slug: project,
             api_version: apiVersion,
@@ -10089,14 +10218,16 @@ async function runConsumerLogsList(opts) {
 // src/commands/config.ts
 var import_chalk43 = __toESM(require("chalk"));
 var import_ora15 = __toESM(require("ora"));
-init_admin();
-init_resolve();
+init_caller();
+init_paging();
+var resolveCallerMode = () => resolveCaller()?.mode ?? null;
 async function patchConfig(project, opts, body, summary) {
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
   const spinner = (0, import_ora15.default)(summary + "...").start();
   try {
-    const out = await admin({
+    const out = await producer(caller, {
       method: "PATCH",
       path: `/projects/${proj2.projectId}/${proj2.apiVersion}`,
       body,
@@ -10114,13 +10245,47 @@ async function runTargetSet(project, opts) {
     console.error(import_chalk43.default.red("--url is required."));
     process.exit(1);
   }
-  const body = opts.env ? { environments: { [opts.env]: { target: opts.url } } } : { target_url: opts.url };
-  await patchConfig(project, opts, body, `Set target${opts.env ? ` for env ${opts.env}` : ""} \u2192 ${opts.url}`);
+  if (!opts.env) {
+    await patchConfig(project, opts, { target_url: opts.url }, `Set target \u2192 ${opts.url}`);
+    return;
+  }
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const listing = await pageAll(
+    (cursor) => producer(caller, {
+      method: "GET",
+      path: withPage(`/projects?team_id=${encodeURIComponent(teamId)}`, cursor),
+      summary: `Read environments for ${proj2.projectName}`
+    }),
+    (b) => b?.projects
+  );
+  const row = listing.items.find((r) => r.project_id === proj2.projectId && r.api_version === proj2.apiVersion);
+  const current = row?.config?.environments;
+  const existing = current && typeof current === "object" && !Array.isArray(current) ? current : {};
+  const prev = existing[opts.env];
+  const environments = {
+    ...existing,
+    [opts.env]: { ...prev && typeof prev === "object" ? prev : {}, target: opts.url }
+  };
+  await patchConfig(project, opts, { environments }, `Set target for env ${opts.env} \u2192 ${opts.url}`);
 }
 async function runThrottleSet(project, opts) {
   const throttling = {};
-  if (opts.rate !== void 0) throttling.userRateLimit = Number(opts.rate);
-  if (opts.endUserRate !== void 0) throttling.endUserRateLimit = Number(opts.endUserRate);
+  const rate = opts.rate ?? opts.endUserRate;
+  if (opts.rate !== void 0 && opts.endUserRate !== void 0 && opts.rate !== opts.endUserRate) {
+    console.error(import_chalk43.default.red("--rate and --end-user-rate are the same limit now; pass one of them."));
+    process.exit(1);
+  }
+  if (rate !== void 0) {
+    const n = Number(rate);
+    if (!Number.isFinite(n) || n <= 0) {
+      console.error(import_chalk43.default.red("--rate must be a positive number of requests per second."));
+      process.exit(1);
+    }
+    throttling.userRateLimit = n;
+    throttling.endUserRateLimit = n;
+  }
   if (opts.quota !== void 0) throttling.proxyQuota = Number(opts.quota);
   if (opts.period !== void 0) {
     if (!["daily", "weekly", "monthly"].includes(opts.period)) {
@@ -10134,6 +10299,11 @@ async function runThrottleSet(project, opts) {
     process.exit(1);
   }
   await patchConfig(project, opts, { throttling }, `Update throttling ${JSON.stringify(throttling)}`);
+  if (resolveCallerMode() === "anon" && !opts.json) {
+    console.log(import_chalk43.default.dim(
+      "  Anonymous workspace: the rate is capped at 10 requests/s per person and the quota at the default until you claim it (`apiblaze login`, then `apiblaze claim`)."
+    ));
+  }
 }
 async function runRename(project, opts) {
   if (!opts.displayName) {
@@ -10143,55 +10313,192 @@ async function runRename(project, opts) {
   await patchConfig(project, opts, { display_name: opts.displayName }, `Rename \u2192 "${opts.displayName}"`);
 }
 
+// src/commands/transform.ts
+var import_chalk44 = __toESM(require("chalk"));
+var import_ora16 = __toESM(require("ora"));
+init_caller();
+var HEADER_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var ruleNameFor = (header) => `set header ${header.toLowerCase()}`;
+async function target(project, opts) {
+  const caller = requireCaller();
+  const { teamId } = await resolveActingTeam(caller, opts.team);
+  const proj2 = await resolveProjectVia(caller, teamId, project, opts.apiversion);
+  const base2 = `/projects/${encodeURIComponent(proj2.projectId)}/${encodeURIComponent(proj2.apiVersion)}/transforms`;
+  return { caller, proj: proj2, base: base2 };
+}
+async function listRules(t) {
+  const out = await producer(t.caller, {
+    method: "GET",
+    path: t.base,
+    summary: `List transforms for ${t.proj.projectName}`
+  });
+  return out?.rules ?? [];
+}
+function describe(r) {
+  const a = r.action ?? { type: "?" };
+  if (a.type === "hardcode") {
+    const secret = !a.value || /^abzsec:|^__ABZSEC_|^•+$/.test(a.value);
+    return `set ${a.destination} = ${secret ? "(secret)" : a.value}`;
+  }
+  if (a.type === "remove") return `remove ${a.field}`;
+  return a.type;
+}
+async function runTransformList(project, opts) {
+  const t = await target(project, opts);
+  const rules = await listRules(t);
+  if (opts.json) {
+    console.log(JSON.stringify(rules, null, 2));
+    return;
+  }
+  if (!rules.length) {
+    console.log(import_chalk44.default.dim(`No transforms on ${t.proj.projectName} v${t.proj.apiVersion}.`));
+    return;
+  }
+  for (const r of rules) {
+    console.log(`${r.enabled ? import_chalk44.default.green("\u25CF") : import_chalk44.default.gray("\u25CB")} ${import_chalk44.default.bold(r.name)} ${import_chalk44.default.dim(`[${r.phase}] ${r.id}`)}`);
+    console.log(`    ${describe(r)}`);
+  }
+}
+async function runTransformSetHeader(project, header, opts) {
+  if (!HEADER_NAME.test(header)) throw new Error(`"${header}" is not a valid header name.`);
+  if (opts.value === void 0 === (opts.valueEnv === void 0)) {
+    throw new Error("Pass exactly one of --value <value> or --value-env <VAR> (reads the value from that environment variable, so it stays out of your shell history).");
+  }
+  const value = opts.value ?? process.env[opts.valueEnv];
+  if (!value) throw new Error(`Environment variable ${opts.valueEnv} is empty or not set.`);
+  const t = await target(project, opts);
+  const name = ruleNameFor(header);
+  const action2 = {
+    type: "hardcode",
+    destination: `header:${header}`,
+    value,
+    // Encrypted at rest and masked on every read; main-proxy decrypts it only
+    // on the way to the upstream.
+    ...opts.secret ? { value_secret: true } : {}
+  };
+  const existing = (await listRules(t)).find((r) => r.name === name && r.phase === "request");
+  const summary = `${existing ? "Update" : "Add"} transform: send ${header} to the upstream`;
+  const spinner = opts.json ? null : (0, import_ora16.default)(summary + "...").start();
+  try {
+    const out = await producer(t.caller, existing ? { method: "PUT", path: `${t.base}/${encodeURIComponent(existing.id)}`, body: { action: action2, enabled: true }, summary } : { method: "POST", path: t.base, body: { name, action: action2, phase: "request", enabled: true }, summary });
+    spinner?.succeed(`${summary} \u2014 ${t.proj.projectName} v${t.proj.apiVersion}${opts.secret ? " (stored encrypted)" : ""}.`);
+    if (opts.json) console.log(JSON.stringify(out ?? { ok: true }));
+    else console.log(import_chalk44.default.dim(`  Every call the proxy forwards now carries ${header}. Your backend can reject calls without it.`));
+  } catch (err) {
+    spinner?.fail(summary + " failed.");
+    throw err;
+  }
+}
+async function runTransformRemove(project, nameOrId, opts) {
+  const t = await target(project, opts);
+  const rules = await listRules(t);
+  const want = nameOrId.toLowerCase();
+  const rule = rules.find((r) => r.id === nameOrId || r.name.toLowerCase() === want || r.name === ruleNameFor(nameOrId));
+  if (!rule) {
+    throw new Error(`No transform "${nameOrId}" on ${t.proj.projectName}.` + (rules.length ? ` Transforms: ${rules.map((r) => r.name).join(", ")}` : ""));
+  }
+  await producer(t.caller, {
+    method: "DELETE",
+    path: `${t.base}/${encodeURIComponent(rule.id)}`,
+    summary: `Remove transform "${rule.name}"`
+  });
+  if (opts.json) console.log(JSON.stringify({ ok: true, removed: rule.id }));
+  else console.log(`${import_chalk44.default.green("\u2713")} Removed transform ${import_chalk44.default.bold(rule.name)} from ${t.proj.projectName}.`);
+}
+
 // src/commands/config-browse.ts
-var import_chalk52 = __toESM(require("chalk"));
-var import_ora23 = __toESM(require("ora"));
+var import_chalk53 = __toESM(require("chalk"));
+var import_ora24 = __toESM(require("ora"));
 init_admin();
 init_paging();
 init_auth();
 init_resolve();
 
 // src/commands/domain.ts
-var import_chalk44 = __toESM(require("chalk"));
-var import_ora16 = __toESM(require("ora"));
+var import_chalk45 = __toESM(require("chalk"));
+var import_ora17 = __toESM(require("ora"));
 init_admin();
 init_resolve();
+var KINDS = ["api", "mcp", "portal", "auth"];
+var TENANT_KINDS = ["portal", "auth"];
+async function scopeFor(project, opts) {
+  const { teamId } = await resolveTeam(opts.team);
+  if (project) {
+    const proj2 = await resolveProject(teamId, project, opts.apiversion);
+    return { kind: "project", base: `/projects/${proj2.projectId}/domains`, label: `${proj2.projectName} v${proj2.apiVersion}`, apiVersion: proj2.apiVersion };
+  }
+  if (!opts.tenant) {
+    console.error(import_chalk45.default.red("Give a <project> (api / mcp domains) or --tenant <slug> (portal / auth domains)."));
+    process.exit(1);
+  }
+  const tenant2 = opts.tenant.toLowerCase();
+  return {
+    kind: "tenant",
+    base: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/domains`,
+    label: `tenant ${tenant2}`
+  };
+}
+function describeKind(d) {
+  return d?.target ? `${d.kind ?? "api"} \u2192 stands in for ${d.target}` : d?.kind ?? "api";
+}
+function statusColor2(s) {
+  if (s === "active") return import_chalk45.default.green(s);
+  if (s === "failed" || s === "missing" || s === "suspended") return import_chalk45.default.red(s);
+  return import_chalk45.default.yellow(s ?? "unknown");
+}
 async function runDomainAdd(project, opts) {
   if (!opts.domain) {
-    console.error(import_chalk44.default.red("--domain is required."));
+    console.error(import_chalk45.default.red("--domain is required."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora16.default)(`Registering ${opts.domain}...`).start();
+  const kind = (opts.kind ?? (project ? "api" : "")).toLowerCase();
+  if (!KINDS.includes(kind)) {
+    console.error(import_chalk45.default.red(`--kind must be one of ${KINDS.join(", ")}${project ? "" : " (portal or auth for a --tenant)"}.`));
+    process.exit(1);
+  }
+  const tenantKind = TENANT_KINDS.includes(kind);
+  if (tenantKind && project) {
+    console.error(import_chalk45.default.red(`A ${kind} domain belongs to a tenant, not a proxy: apiblaze domain add --tenant <slug> --kind ${kind} --domain ${opts.domain}`));
+    process.exit(1);
+  }
+  if (tenantKind && !opts.tenant) {
+    console.error(import_chalk45.default.red(`--tenant <slug> is required for a ${kind} domain.`));
+    process.exit(1);
+  }
+  if (!tenantKind && !project) {
+    console.error(import_chalk45.default.red(`A ${kind} domain belongs to a proxy: apiblaze domain add <project> --kind ${kind} --domain ${opts.domain}`));
+    process.exit(1);
+  }
+  const scope = await scopeFor(project, opts);
+  const spinner = (0, import_ora17.default)(`Registering ${opts.domain}...`).start();
   try {
+    const body = scope.kind === "project" ? { hostname: opts.domain, api_version: scope.apiVersion, kind, ...opts.tenant ? { tenant_name: opts.tenant.toLowerCase() } : {} } : { hostname: opts.domain, kind };
     const out = await admin({
       method: "POST",
-      path: `/projects/${proj2.projectId}/domains`,
-      // --tenant binds the domain to one of the project's tenants (per-tenant scope).
-      body: { hostname: opts.domain, api_version: proj2.apiVersion, ...opts.tenant ? { tenant_name: opts.tenant } : {} },
-      summary: `Add custom domain ${opts.domain} to ${proj2.projectName} v${proj2.apiVersion}${opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
+      path: scope.base,
+      body,
+      summary: `Add custom ${kind} domain ${opts.domain} to ${scope.label}${scope.kind === "project" && opts.tenant ? ` (tenant ${opts.tenant})` : ""}`
     });
-    spinner.succeed(`Registered ${opts.domain}. Add these DNS records, then run \`apiblaze domain status\`:`);
+    spinner.succeed(`Registered ${out?.hostname ?? opts.domain} (${describeKind(out)}). Add these DNS records, then run \`apiblaze domain status\`:`);
     if (opts.json) {
       console.log(JSON.stringify(out));
       return;
     }
-    if (out?.cnameRecord) console.log(`  ${import_chalk44.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value ?? out.cnameRecord.target}`);
-    if (out?.dcv) console.log(`  ${import_chalk44.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
-    if (out?.id) console.log(import_chalk44.default.dim(`  domain id: ${out.id}`));
+    if (out?.cnameRecord) console.log(`  ${import_chalk45.default.cyan("CNAME")}  ${out.cnameRecord.name ?? opts.domain}  \u2192  ${out.cnameRecord.value}`);
+    if (out?.dcv) console.log(`  ${import_chalk45.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    if (typeof out?.monthlyCents === "number") console.log(import_chalk45.default.dim(`  billed $${(out.monthlyCents / 100).toFixed(2)}/month (first month pro rata)`));
+    if (out?.id) console.log(import_chalk45.default.dim(`  domain id: ${out.id}`));
   } catch (err) {
     spinner.fail("Domain registration failed.");
     throw err;
   }
 }
 async function runDomainList(project, opts) {
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const scope = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/domains?api_version=${encodeURIComponent(proj2.apiVersion)}`,
-    summary: `List custom domains for ${proj2.projectName} v${proj2.apiVersion}`
+    path: scope.kind === "project" ? `${scope.base}?api_version=${encodeURIComponent(scope.apiVersion)}` : scope.base,
+    summary: `List custom domains for ${scope.label}`
   });
   const domains = out?.domains ?? [];
   if (opts.json) {
@@ -10199,40 +10506,53 @@ async function runDomainList(project, opts) {
     return;
   }
   if (!domains.length) {
-    console.log(import_chalk44.default.yellow("No custom domains."));
+    console.log(import_chalk45.default.yellow("No custom domains."));
     return;
   }
-  for (const d of domains) console.log(`  ${import_chalk44.default.bold(d.hostname)}  ${import_chalk44.default.dim(d.status ?? "")}  ${import_chalk44.default.dim(d.id ?? "")}`);
+  for (const d of domains) {
+    const pin = scope.kind === "project" && d.tenant ? import_chalk45.default.dim(` tenant ${d.tenant}`) : "";
+    console.log(`  ${import_chalk45.default.bold(d.hostname)}  ${statusColor2(d.status)}  ${import_chalk45.default.dim(describeKind(d))}${pin}  ${import_chalk45.default.dim(d.id ?? "")}`);
+  }
 }
 async function runDomainStatus(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk44.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk45.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
+  const scope = await scopeFor(project, opts);
   const out = await admin({
     method: "GET",
-    path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}/status`,
+    path: `${scope.base}/${encodeURIComponent(opts.id)}/status`,
     summary: `Check custom-domain status`
   });
-  console.log(opts.json ? JSON.stringify(out) : `  ${import_chalk44.default.bold(out?.hostname ?? opts.id)}: ${import_chalk44.default.cyan(out?.status ?? "unknown")}`);
+  if (opts.json) {
+    console.log(JSON.stringify(out));
+    return;
+  }
+  console.log(`  ${import_chalk45.default.bold(out?.hostname ?? opts.id)}: ${statusColor2(out?.status)}  ${import_chalk45.default.dim(describeKind(out))}`);
+  if (out?.status !== "active") {
+    if (out?.status === "suspended") console.log(import_chalk45.default.red("  Suspended for non-payment \u2014 add credit to restore it."));
+    else if (out?.status === "missing") console.log(import_chalk45.default.red("  No longer registered at Cloudflare \u2014 remove it and add it again."));
+    else {
+      if (out?.cnameRecord) console.log(`  ${import_chalk45.default.cyan("CNAME")}  ${out.cnameRecord.name}  \u2192  ${out.cnameRecord.value}`);
+      if (out?.dcv) console.log(`  ${import_chalk45.default.cyan("TXT")}    ${out.dcv.name}  =  ${out.dcv.value}`);
+    }
+  }
 }
 async function runDomainRemove(project, opts) {
   if (!opts.id) {
-    console.error(import_chalk44.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
+    console.error(import_chalk45.default.red("--id <domainId> is required (see `apiblaze domain list`)."));
     process.exit(1);
   }
-  const { teamId } = await resolveTeam(opts.team);
-  const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora16.default)("Removing domain...").start();
+  const scope = await scopeFor(project, opts);
+  const spinner = (0, import_ora17.default)("Removing domain...").start();
   try {
     await admin({
       method: "DELETE",
-      path: `/projects/${proj2.projectId}/domains/${encodeURIComponent(opts.id)}`,
+      path: `${scope.base}/${encodeURIComponent(opts.id)}`,
       summary: `Remove custom domain ${opts.id}`
     });
-    spinner.succeed("Removed.");
+    spinner.succeed("Removed. Billing for it stops now.");
   } catch (err) {
     spinner.fail("Remove failed.");
     throw err;
@@ -10242,7 +10562,7 @@ async function runDomainSetBase(project, opts) {
   const env = opts.env ?? "prod";
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora16.default)("Setting base domain...").start();
+  const spinner = (0, import_ora17.default)("Setting base domain...").start();
   try {
     await admin({
       method: "PUT",
@@ -10258,8 +10578,8 @@ async function runDomainSetBase(project, opts) {
 }
 
 // src/commands/tenant.ts
-var import_chalk47 = __toESM(require("chalk"));
-var import_ora19 = __toESM(require("ora"));
+var import_chalk48 = __toESM(require("chalk"));
+var import_ora20 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -10268,20 +10588,20 @@ init_paging();
 async function runTenantUse(query, opts) {
   const creds = loadCredentials();
   if (!creds) {
-    console.error(import_chalk47.default.red("Not logged in. Run `apiblaze login` first."));
+    console.error(import_chalk48.default.red("Not logged in. Run `apiblaze login` first."));
     process.exit(1);
   }
   if (opts.clear) {
     delete creds.activeTenant;
     saveCredentials(creds);
-    console.log(import_chalk47.default.green("Tenant scope cleared."));
+    console.log(import_chalk48.default.green("Tenant scope cleared."));
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
   const slug = await pickTenant(teamId, { message: "Scope future commands to which tenant?", initialQuery: query });
   if (!slug) process.exit(1);
   saveCredentials({ ...creds, activeTenant: slug });
-  console.log(import_chalk47.default.green(`Tenant scope set to ${import_chalk47.default.bold(slug)}.`) + import_chalk47.default.dim("  (clear with `apiblaze tenant use --clear`)"));
+  console.log(import_chalk48.default.green(`Tenant scope set to ${import_chalk48.default.bold(slug)}.`) + import_chalk48.default.dim("  (clear with `apiblaze tenant use --clear`)"));
 }
 async function runTenantList(opts) {
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -10305,26 +10625,26 @@ async function runTenantList(opts) {
     return;
   }
   if (!tenants.length) {
-    console.log(import_chalk47.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
+    console.log(import_chalk48.default.yellow(opts.q ? `No tenants matching "${opts.q}".` : "No tenants."));
     return;
   }
   for (const t of tenants) {
     const name = typeof t === "string" ? t : t.tenant_name;
-    const display = typeof t === "string" ? "" : import_chalk47.default.dim(`  ${t.display_name ?? ""}`);
-    console.log(`  ${import_chalk47.default.bold(name)}${display}`);
+    const display = typeof t === "string" ? "" : import_chalk48.default.dim(`  ${t.display_name ?? ""}`);
+    console.log(`  ${import_chalk48.default.bold(name)}${display}`);
   }
   const total = out?.total ?? tenants.length;
   if (total > tenants.length) {
-    console.log(import_chalk47.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
+    console.log(import_chalk48.default.dim(`  \u2026 showing ${tenants.length} of ${total} \u2014 narrow with --q <search>`));
   }
 }
 async function runTenantCreate(opts) {
   if (!opts.name) {
-    console.error(import_chalk47.default.red("--name (display name) is required."));
+    console.error(import_chalk48.default.red("--name (display name) is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora19.default)("Creating tenant...").start();
+  const spinner = (0, import_ora20.default)("Creating tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -10332,7 +10652,7 @@ async function runTenantCreate(opts) {
       body: { display_name: opts.name, ...opts.slug ? { tenant_name: opts.slug } : {} },
       summary: `Create tenant "${opts.name}"`
     });
-    spinner.succeed(`Created tenant ${import_chalk47.default.bold(out?.tenant_name ?? opts.name)}.`);
+    spinner.succeed(`Created tenant ${import_chalk48.default.bold(out?.tenant_name ?? opts.name)}.`);
     if (opts.json) console.log(JSON.stringify(out));
   } catch (err) {
     spinner.fail("Tenant create failed.");
@@ -10341,12 +10661,12 @@ async function runTenantCreate(opts) {
 }
 async function runTenantAttach(project, opts) {
   if (!opts.tenant) {
-    console.error(import_chalk47.default.red("--tenant <slug> is required."));
+    console.error(import_chalk48.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora19.default)("Attaching tenant...").start();
+  const spinner = (0, import_ora20.default)("Attaching tenant...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -10375,11 +10695,11 @@ async function runTenantDelete(slug, opts) {
       }
     ]);
     if (!confirm2) {
-      console.log(import_chalk47.default.dim("Aborted."));
+      console.log(import_chalk48.default.dim("Aborted."));
       return;
     }
   }
-  const spinner = (0, import_ora19.default)(hard ? "Trashing tenant..." : "Deleting tenant...").start();
+  const spinner = (0, import_ora20.default)(hard ? "Trashing tenant..." : "Deleting tenant...").start();
   try {
     await admin({
       method: "DELETE",
@@ -10403,7 +10723,7 @@ async function runTenantDelete(slug, opts) {
       summary: `Purge tenant ${slug} (full cascade)`
     });
   } catch (err) {
-    console.log(import_chalk47.default.red("\u2716 Tenant purge failed to start."));
+    console.log(import_chalk48.default.red("\u2716 Tenant purge failed to start."));
     throw err;
   }
   const job = await settleDelete(accepted, {
@@ -10419,18 +10739,18 @@ async function runTenantDelete(slug, opts) {
       ...accepted?.job_id ? { job_id: accepted.job_id, job_status: job?.status ?? "queued" } : {}
     }));
   } else if (opts.wait !== false) {
-    console.log(import_chalk47.default.green(`\u2714 Deleted tenant ${slug}.`));
+    console.log(import_chalk48.default.green(`\u2714 Deleted tenant ${slug}.`));
   }
 }
 async function runTenantCors(opts) {
   if (!opts.tenant) {
-    console.error(import_chalk47.default.red("--tenant <slug> is required."));
+    console.error(import_chalk48.default.red("--tenant <slug> is required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const origins = (opts.origins ?? "").split(",").map((s) => s.trim()).filter(Boolean);
   const cors = origins.length ? { allowed_origins: origins } : null;
-  const spinner = (0, import_ora19.default)("Updating CORS...").start();
+  const spinner = (0, import_ora20.default)("Updating CORS...").start();
   try {
     await admin({
       method: "PUT",
@@ -10446,8 +10766,8 @@ async function runTenantCors(opts) {
 }
 
 // src/commands/tenant-drill.ts
-var import_chalk48 = __toESM(require("chalk"));
-var import_ora20 = __toESM(require("ora"));
+var import_chalk49 = __toESM(require("chalk"));
+var import_ora21 = __toESM(require("ora"));
 var import_crypto = require("crypto");
 init_admin();
 init_auth();
@@ -10477,17 +10797,17 @@ async function validScopedTenant(teamId, query) {
   const next = { ...creds };
   delete next.activeTenant;
   saveCredentials2(next);
-  console.log(import_chalk48.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
+  console.log(import_chalk49.default.yellow(`Tenant scope "${scoped}" no longer exists in this team \u2014 cleared.`));
   return void 0;
 }
 async function tenantHome(teamId, tenant2) {
   const { default: inquirer3 } = await import("inquirer");
   const base2 = `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}`;
-  console.log(import_chalk48.default.bold(`
+  console.log(import_chalk49.default.bold(`
 Tenant ${tenant2}`));
-  console.log(import_chalk48.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
+  console.log(import_chalk49.default.dim("Tenant auth/settings are SHARED: changes apply to every proxy this tenant serves.\n"));
   for (; ; ) {
-    const spinner = (0, import_ora20.default)("Reading tenant state...").start();
+    const spinner = (0, import_ora21.default)("Reading tenant state...").start();
     const [iam, cors, emails, issuers, opaque, clients] = await Promise.all([
       admin({ method: "GET", path: `${base2}/iam`, summary: "Read IAM toggle" }).catch(() => null),
       admin({ method: "GET", path: `${base2}/cors`, summary: "Read tenant CORS" }).catch(() => null),
@@ -10501,18 +10821,18 @@ Tenant ${tenant2}`));
     const nClients = Array.isArray(clients) ? clients.length : 0;
     const nOpaque = opaque?.opaque?.endpoint ? 1 : 0;
     const nLogin = nClients + nIssuers + nOpaque;
-    const onOff = (b) => b ? import_chalk48.default.green("on") : import_chalk48.default.dim("off");
+    const onOff = (b) => b ? import_chalk49.default.green("on") : import_chalk49.default.dim("off");
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
       message: `Tenant ${tenant2}:`,
       pageSize: 12,
       choices: [
-        { name: `Login methods (${nLogin})  ${import_chalk48.default.dim("how your consumers sign in")}`, value: "login" },
-        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk48.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
-        { name: `Portal admins (${nEmails})  ${import_chalk48.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
-        new inquirer3.Separator(import_chalk48.default.dim("  Settings")),
-        { name: `CORS: ${cors?.cors ? import_chalk48.default.cyan(JSON.stringify(cors.cors)) : import_chalk48.default.dim("(unset)")}  ${import_chalk48.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
+        { name: `Login methods (${nLogin})  ${import_chalk49.default.dim("how your consumers sign in")}`, value: "login" },
+        { name: `Users & groups: ${onOff(iam?.iam_enabled)}  ${import_chalk49.default.dim(`identity & key management (iam.apiblaze.com)`)}`, value: "iam" },
+        { name: `Portal admins (${nEmails})  ${import_chalk49.default.dim("emails allowed to administer this tenant's portal")}`, value: "emails" },
+        new inquirer3.Separator(import_chalk49.default.dim("  Settings")),
+        { name: `CORS: ${cors?.cors ? import_chalk49.default.cyan(JSON.stringify(cors.cors)) : import_chalk49.default.dim("(unset)")}  ${import_chalk49.default.dim("browser origins allowed to call this tenant")}`, value: "cors" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -10525,7 +10845,7 @@ Tenant ${tenant2}`));
       case "iam": {
         const { v } = await inquirer3.prompt([{ type: "confirm", name: "v", message: "Enable Users & groups?", default: !!iam?.iam_enabled }]);
         await admin({ method: "PATCH", path: `${base2}/iam`, body: { enabled: v }, summary: `IAM enforcement \u2192 ${v ? "on" : "off"}` });
-        console.log(import_chalk48.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
+        console.log(import_chalk49.default.green(`  Users & groups ${v ? "enabled" : "disabled"}.`));
         break;
       }
       case "cors": {
@@ -10538,11 +10858,11 @@ Tenant ${tenant2}`));
         if (v === "") break;
         const parsed = v === "null" ? null : safeJson(v);
         if (parsed === void 0) {
-          console.log(import_chalk48.default.yellow("  Not valid JSON \u2014 unchanged."));
+          console.log(import_chalk49.default.yellow("  Not valid JSON \u2014 unchanged."));
           break;
         }
         await admin({ method: "PUT", path: `${base2}/cors`, body: { cors: parsed }, summary: "Set tenant CORS" });
-        console.log(import_chalk48.default.green("  CORS updated."));
+        console.log(import_chalk49.default.green("  CORS updated."));
         break;
       }
       case "emails":
@@ -10554,7 +10874,7 @@ Tenant ${tenant2}`));
 async function loginMethodsMenu(teamId, tenant2, base2) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora20.default)("Loading login methods...").start();
+    const spinner = (0, import_ora21.default)("Loading login methods...").start();
     const [rawClients, rawIssuers, rawOpaque] = await Promise.all([
       admin({ method: "GET", path: `${base2}/app-clients`, summary: "List APIblaze-hosted logins" }).catch(() => []),
       admin({ method: "GET", path: `${base2}/external-issuers`, summary: "List your-own-JWT logins" }).catch(() => null),
@@ -10566,15 +10886,15 @@ async function loginMethodsMenu(teamId, tenant2, base2) {
     const choices = [];
     for (const c of appClients) {
       const nP = (c.providers ?? []).length || c.providers_count || 0;
-      choices.push({ name: `${import_chalk48.default.cyan("APIblaze-hosted")}  ${import_chalk48.default.bold(c.name ?? c.clientId)}  ${import_chalk48.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk48.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
+      choices.push({ name: `${import_chalk49.default.cyan("APIblaze-hosted")}  ${import_chalk49.default.bold(c.name ?? c.clientId)}  ${import_chalk49.default.dim(`${c.clientId}${nP ? ` \xB7 ${nP} provider${nP === 1 ? "" : "s"}` : import_chalk49.default.yellow(" \xB7 needs a provider")}`)}`, value: { kind: "client", item: c } });
     }
     for (const i of issuers) {
-      choices.push({ name: `${import_chalk48.default.cyan("Your own \u2014 JWT ")}  ${import_chalk48.default.bold(i.iss)}  ${import_chalk48.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
+      choices.push({ name: `${import_chalk49.default.cyan("Your own \u2014 JWT ")}  ${import_chalk49.default.bold(i.iss)}  ${import_chalk49.default.dim(`aud=${i.aud}`)}`, value: { kind: "issuer", item: i } });
     }
     if (opaque?.endpoint) {
-      choices.push({ name: `${import_chalk48.default.cyan("Your own \u2014 opaque")}  ${import_chalk48.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
+      choices.push({ name: `${import_chalk49.default.cyan("Your own \u2014 opaque")}  ${import_chalk49.default.bold(opaque.endpoint)}`, value: { kind: "opaque", item: opaque } });
     }
-    if (!choices.length) console.log(import_chalk48.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
+    if (!choices.length) console.log(import_chalk49.default.dim("\n  No login methods yet \u2014 consumers cannot sign in until you add one."));
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
       name: "pick",
@@ -10614,9 +10934,9 @@ async function addLoginMethod(teamId, tenant2, base2) {
     message: "How do people log in?",
     pageSize: 8,
     choices: [
-      { name: `APIblaze hosted login page  ${import_chalk48.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
-      { name: `Your own hosted login \u2014 JWT  ${import_chalk48.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
-      { name: `Your own login \u2014 opaque token  ${import_chalk48.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
+      { name: `APIblaze hosted login page  ${import_chalk49.default.dim("we host login; pick a provider (GitHub/Google/\u2026) \u2014 easiest")}`, value: "apiblaze" },
+      { name: `Your own hosted login \u2014 JWT  ${import_chalk49.default.dim("your identity provider issues JWTs; we trust them")}`, value: "jwt" },
+      { name: `Your own login \u2014 opaque token  ${import_chalk49.default.dim("we validate your opaque tokens via an introspection endpoint")}`, value: "opaque" },
       { name: "\u2190 Back", value: null }
     ]
   }]);
@@ -10640,8 +10960,8 @@ function safeJson(s) {
 async function emailsMenu(base2, emails) {
   const { default: inquirer3 } = await import("inquirer");
   console.log();
-  if (!emails.length) console.log(import_chalk48.default.dim("  No consumer-admin emails."));
-  for (const e of emails) console.log(`  ${import_chalk48.default.bold(e.email ?? e)}  ${import_chalk48.default.dim(e.status ?? "")}`);
+  if (!emails.length) console.log(import_chalk49.default.dim("  No consumer-admin emails."));
+  for (const e of emails) console.log(`  ${import_chalk49.default.bold(e.email ?? e)}  ${import_chalk49.default.dim(e.status ?? "")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
@@ -10656,7 +10976,7 @@ async function emailsMenu(base2, emails) {
   if (act === "add") {
     const { email } = await inquirer3.prompt([{ type: "input", name: "email", message: "Email:", validate: (s) => /.+@.+\..+/.test(s) || "not an email" }]);
     await admin({ method: "POST", path: `${base2}/admin-emails`, body: { email }, summary: `Add consumer-admin ${email}` });
-    console.log(import_chalk48.default.green(`  ${email} added.`));
+    console.log(import_chalk49.default.green(`  ${email} added.`));
   } else {
     const { e } = await inquirer3.prompt([{
       type: "list",
@@ -10666,7 +10986,7 @@ async function emailsMenu(base2, emails) {
     }]);
     if (!e) return;
     await admin({ method: "DELETE", path: `${base2}/admin-emails/${encodeURIComponent(e)}`, summary: `Remove consumer-admin ${e}` });
-    console.log(import_chalk48.default.green(`  ${e} removed.`));
+    console.log(import_chalk49.default.green(`  ${e} removed.`));
   }
 }
 async function addIssuer(base2) {
@@ -10687,19 +11007,19 @@ async function addIssuer(base2) {
     body: { iss: a.iss.trim(), aud: a.aud.trim(), jwks_url: a.jwks.trim() || null, sub_semantics: a.sem, ...claim ? { claim_name: claim } : {} },
     summary: `Add external issuer ${a.iss.trim()}`
   });
-  console.log(import_chalk48.default.green("  JWT login method saved."));
+  console.log(import_chalk49.default.green("  JWT login method saved."));
 }
 async function issuerHome(base2, issuer) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk48.default.bold(issuer.iss)}  ${import_chalk48.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
+  ${import_chalk49.default.bold(issuer.iss)}  ${import_chalk49.default.dim(`aud=${issuer.aud} \xB7 ${issuer.sub_semantics ?? ""}`)}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This JWT login method:",
     choices: [
       { name: "Replace it (re-enter details)", value: "edit" },
-      { name: import_chalk48.default.red("Delete it"), value: "rm" },
+      { name: import_chalk49.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -10715,7 +11035,7 @@ async function issuerHome(base2, issuer) {
     path: `${base2}/external-issuers?iss=${encodeURIComponent(issuer.iss)}&aud=${encodeURIComponent(issuer.aud)}`,
     summary: `Delete issuer ${issuer.iss}`
   });
-  console.log(import_chalk48.default.green("  Deleted."));
+  console.log(import_chalk49.default.green("  Deleted."));
 }
 async function setOpaque(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
@@ -10724,19 +11044,19 @@ async function setOpaque(base2, cur) {
     { type: "list", name: "method", message: "HTTP method:", choices: ["GET", "POST"], default: cur?.method ?? "GET" }
   ]);
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: { endpoint: a.endpoint, method: a.method } }, summary: "Set opaque validator" });
-  console.log(import_chalk48.default.green("  Opaque login method set."));
+  console.log(import_chalk49.default.green("  Opaque login method set."));
 }
 async function opaqueHome(base2, cur) {
   const { default: inquirer3 } = await import("inquirer");
   console.log(`
-  ${import_chalk48.default.bold(cur.endpoint)}  ${import_chalk48.default.dim(cur.method ?? "GET")}`);
+  ${import_chalk49.default.bold(cur.endpoint)}  ${import_chalk49.default.dim(cur.method ?? "GET")}`);
   const { act } = await inquirer3.prompt([{
     type: "list",
     name: "act",
     message: "This opaque login method:",
     choices: [
       { name: "Replace it", value: "edit" },
-      { name: import_chalk48.default.red("Delete it"), value: "rm" },
+      { name: import_chalk49.default.red("Delete it"), value: "rm" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -10746,14 +11066,14 @@ async function opaqueHome(base2, cur) {
     return;
   }
   await admin({ method: "PUT", path: `${base2}/opaque`, body: { opaque: null }, summary: "Clear opaque validator" });
-  console.log(import_chalk48.default.green("  Deleted."));
+  console.log(import_chalk49.default.green("  Deleted."));
 }
 async function clientHome(base2, summary) {
   const { default: inquirer3 } = await import("inquirer");
   const id = summary.clientId ?? summary.client_id;
   const cBase = `${base2}/app-clients/${encodeURIComponent(id)}`;
   for (; ; ) {
-    const spinner = (0, import_ora20.default)("Reading app client...").start();
+    const spinner = (0, import_ora21.default)("Reading app client...").start();
     const c = await admin({ method: "GET", path: cBase, summary: `Read app client ${id}` }).catch(() => summary);
     spinner.stop();
     const cb = c.authorizedCallbackUrls ?? c.authorized_callback_urls ?? [];
@@ -10765,13 +11085,13 @@ async function clientHome(base2, summary) {
       message: `${c.name ?? id}:`,
       pageSize: 12,
       choices: [
-        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk48.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
-        { name: `Callback URLs: ${cb.length ? import_chalk48.default.cyan(cb.join(", ")) : import_chalk48.default.dim("(none)")}`, value: "callbacks" },
-        { name: `Scopes: ${scopes.length ? import_chalk48.default.cyan(scopes.join(" ")) : import_chalk48.default.dim("(defaults)")}`, value: "scopes" },
+        { name: `Login providers${nProviders ? ` (${nProviders})` : ""}  ${import_chalk49.default.dim("google/github/microsoft/\u2026 \u2014 how consumers sign in")}`, value: "providers" },
+        { name: `Callback URLs: ${cb.length ? import_chalk49.default.cyan(cb.join(", ")) : import_chalk49.default.dim("(none)")}`, value: "callbacks" },
+        { name: `Scopes: ${scopes.length ? import_chalk49.default.cyan(scopes.join(" ")) : import_chalk49.default.dim("(defaults)")}`, value: "scopes" },
         { name: `Token expiries: access ${c.accessTokenExpiry ?? 3600}s \xB7 id ${c.idTokenExpiry ?? 3600}s \xB7 refresh ${c.refreshTokenExpiry ?? 2592e3}s`, value: "expiries" },
         { name: "Reveal client secret", value: "secret" },
         { name: "Rotate client secret", value: "rotate" },
-        { name: import_chalk48.default.red("Delete this app client"), value: "delete" },
+        { name: import_chalk49.default.red("Delete this app client"), value: "delete" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -10784,13 +11104,13 @@ async function clientHome(base2, summary) {
       case "callbacks": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Callback URLs (comma-separated):", default: cb.join(", ") }]);
         await admin({ method: "PATCH", path: cBase, body: { authorizedCallbackUrls: parseList(v) }, summary: "Update callback URLs" });
-        console.log(import_chalk48.default.green("  Callbacks updated."));
+        console.log(import_chalk49.default.green("  Callbacks updated."));
         break;
       }
       case "scopes": {
         const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: "Scopes (space/comma-separated):", default: scopes.join(" ") }]);
         await admin({ method: "PATCH", path: cBase, body: { scopes: v.split(/[\s,]+/).filter(Boolean) }, summary: "Update scopes" });
-        console.log(import_chalk48.default.green("  Scopes updated."));
+        console.log(import_chalk49.default.green("  Scopes updated."));
         break;
       }
       case "expiries": {
@@ -10805,14 +11125,14 @@ async function clientHome(base2, summary) {
           body: { accessTokenExpiry: Number(a.access), idTokenExpiry: Number(a.id), refreshTokenExpiry: Number(a.refresh) },
           summary: "Update token expiries"
         });
-        console.log(import_chalk48.default.green("  Expiries updated."));
+        console.log(import_chalk49.default.green("  Expiries updated."));
         break;
       }
       case "secret": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: "Print the client secret to this terminal?", default: false }]);
         if (!sure) break;
         const s = await admin({ method: "GET", path: `${cBase}/secret`, summary: "Reveal client secret" });
-        console.log(`  ${import_chalk48.default.bold("client_secret")}: ${import_chalk48.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk49.default.bold("client_secret")}: ${import_chalk49.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
         break;
       }
       case "rotate": {
@@ -10820,14 +11140,14 @@ async function clientHome(base2, summary) {
         if (!sure) break;
         const fresh = randomSecret();
         await admin({ method: "PATCH", path: cBase, body: { clientSecret: fresh }, summary: "Rotate client secret" });
-        console.log(`  New ${import_chalk48.default.bold("client_secret")}: ${import_chalk48.default.green(fresh)}  ${import_chalk48.default.dim("(store it now)")}`);
+        console.log(`  New ${import_chalk49.default.bold("client_secret")}: ${import_chalk49.default.green(fresh)}  ${import_chalk49.default.dim("(store it now)")}`);
         break;
       }
       case "delete": {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Delete app client "${c.name ?? id}"? Consumers logged in through it will lose access.`, default: false }]);
         if (!sure) break;
         await admin({ method: "DELETE", path: cBase, summary: `Delete app client ${id}` });
-        console.log(import_chalk48.default.green("  App client deleted."));
+        console.log(import_chalk49.default.green("  App client deleted."));
         return;
       }
     }
@@ -10848,15 +11168,15 @@ var DEFAULT_SCOPES2 = {
 async function providersMenu(cBase, clientLabel) {
   const { default: inquirer3 } = await import("inquirer");
   for (; ; ) {
-    const spinner = (0, import_ora20.default)("Loading providers...").start();
+    const spinner = (0, import_ora21.default)("Loading providers...").start();
     const raw = await admin({ method: "GET", path: `${cBase}/providers`, summary: "List login providers" }).catch(() => []);
     spinner.stop();
     const providers = Array.isArray(raw) ? raw : [];
     console.log();
     for (const p of providers) {
-      console.log(`  ${import_chalk48.default.bold(p.type)}  ${import_chalk48.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
+      console.log(`  ${import_chalk49.default.bold(p.type)}  ${import_chalk49.default.dim(`${p.clientId || "(managed)"} \xB7 identity=${p.tokenType ?? "apiblaze"} \xB7 to-upstream=${p.targetServerToken ?? "apiblaze"}${p.isApiblazeDefault ? " \xB7 apiblaze-managed" : ""}`)}`);
     }
-    if (!providers.length) console.log(import_chalk48.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
+    if (!providers.length) console.log(import_chalk49.default.dim("  No login providers \u2014 consumers cannot sign in to this client yet."));
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
@@ -10914,23 +11234,23 @@ async function providersMenu(cBase, clientLabel) {
         body.targetServerToken = routing;
       }
       await admin({ method: "POST", path: `${cBase}/providers`, body, summary: `Add ${type} login provider` });
-      console.log(import_chalk48.default.green(`  ${type} provider added.`));
+      console.log(import_chalk49.default.green(`  ${type} provider added.`));
     } else {
       const { p } = await inquirer3.prompt([{
         type: "list",
         name: "p",
         message: act === "rm" ? "Remove which provider?" : "Reveal which secret?",
-        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk48.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
+        choices: [...providers.map((x) => ({ name: `${x.type} ${import_chalk49.default.dim(x.clientId || "(managed)")}`, value: x })), { name: "\u2190 Back", value: null }]
       }]);
       if (!p) continue;
       if (act === "rm") {
         const { sure } = await inquirer3.prompt([{ type: "confirm", name: "sure", message: `Remove the ${p.type} provider? Consumers using it can no longer sign in.`, default: false }]);
         if (!sure) continue;
         await admin({ method: "DELETE", path: `${cBase}/providers/${encodeURIComponent(p.id)}`, summary: `Remove ${p.type} provider` });
-        console.log(import_chalk48.default.green(`  ${p.type} removed.`));
+        console.log(import_chalk49.default.green(`  ${p.type} removed.`));
       } else {
         const s = await admin({ method: "GET", path: `${cBase}/providers/${encodeURIComponent(p.id)}/secret`, summary: `Reveal ${p.type} provider secret` });
-        console.log(`  ${import_chalk48.default.bold("client_secret")}: ${import_chalk48.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
+        console.log(`  ${import_chalk49.default.bold("client_secret")}: ${import_chalk49.default.green(s?.clientSecret ?? s?.client_secret ?? JSON.stringify(s))}`);
       }
     }
   }
@@ -10938,8 +11258,8 @@ async function providersMenu(cBase, clientLabel) {
 
 // src/commands/spec.ts
 var fs12 = __toESM(require("fs"));
-var import_chalk49 = __toESM(require("chalk"));
-var import_ora21 = __toESM(require("ora"));
+var import_chalk50 = __toESM(require("chalk"));
+var import_ora22 = __toESM(require("ora"));
 init_admin();
 init_api();
 init_resolve();
@@ -10955,19 +11275,19 @@ async function runSpecGet(project, opts) {
 }
 async function runSpecSet(project, opts) {
   if (!opts.file) {
-    console.error(import_chalk49.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
+    console.error(import_chalk50.default.red("--file <path> is required (OpenAPI JSON or YAML)."));
     process.exit(1);
   }
   let specContent;
   try {
     specContent = fs12.readFileSync(opts.file, "utf-8");
   } catch {
-    console.error(import_chalk49.default.red(`Cannot read file: ${opts.file}`));
+    console.error(import_chalk50.default.red(`Cannot read file: ${opts.file}`));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora21.default)("Uploading spec...").start();
+  const spinner = (0, import_ora22.default)("Uploading spec...").start();
   try {
     const out = await admin({
       method: "POST",
@@ -10991,28 +11311,28 @@ async function runSpecSet(project, opts) {
 function printSpecChangeReport(report, projectName) {
   const r = report.routes;
   if (r) {
-    for (const a of r.added) console.log(import_chalk49.default.green(`  + ${a}`));
-    for (const d of r.removed) console.log(import_chalk49.default.red(`  \u2212 ${d}`));
-    for (const rn of r.renamed ?? []) console.log(import_chalk49.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
-    for (const m of r.modified ?? []) console.log(import_chalk49.default.dim(`  \xB1 ${m} (params/schema changed)`));
+    for (const a of r.added) console.log(import_chalk50.default.green(`  + ${a}`));
+    for (const d of r.removed) console.log(import_chalk50.default.red(`  \u2212 ${d}`));
+    for (const rn of r.renamed ?? []) console.log(import_chalk50.default.yellow(`  ~ ${rn.from} \u2192 ${rn.to}`));
+    for (const m of r.modified ?? []) console.log(import_chalk50.default.dim(`  \xB1 ${m} (params/schema changed)`));
   }
-  if (report.applied?.mcp_regenerated) console.log(import_chalk49.default.dim("  MCP catalogue regenerated."));
-  if (report.applied?.candidates_cleared) console.log(import_chalk49.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
+  if (report.applied?.mcp_regenerated) console.log(import_chalk50.default.dim("  MCP catalogue regenerated."));
+  if (report.applied?.candidates_cleared) console.log(import_chalk50.default.dim(`  ${report.applied.candidates_cleared} route candidate(s) now documented \u2014 cleared.`));
   for (const item of report.attention ?? []) {
-    console.log(import_chalk49.default.yellow(`  \u26A0 ${item.detail}`));
+    console.log(import_chalk50.default.yellow(`  \u26A0 ${item.detail}`));
     if (item.suggestion?.carry_from && item.suggestion.carry_to) {
-      console.log(import_chalk49.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
+      console.log(import_chalk50.default.dim(`    Fix: apiblaze spec carry ${projectName} --method ${item.suggestion.method} --from "${item.suggestion.carry_from}" --to "${item.suggestion.carry_to}"`));
     }
   }
 }
 async function runSpecCarry(project, opts) {
   if (!opts.method || !opts.from || !opts.to) {
-    console.error(import_chalk49.default.red("--method, --from and --to are required."));
+    console.error(import_chalk50.default.red("--method, --from and --to are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
-  const spinner = (0, import_ora21.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
+  const spinner = (0, import_ora22.default)(`Carrying rules ${opts.from} \u2192 ${opts.to}...`).start();
   const res = await agentCall(`/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/carry`, "POST", {
     method: opts.method.toUpperCase(),
     from_resource: opts.from,
@@ -11029,13 +11349,13 @@ async function runSpecCarry(project, opts) {
 }
 async function runSpecDeleteRule(project, opts) {
   if (!opts.method || !opts.route) {
-    console.error(import_chalk49.default.red("--method and --route are required."));
+    console.error(import_chalk50.default.red("--method and --route are required."));
     process.exit(1);
   }
   const { teamId } = await resolveTeam(opts.team);
   const proj2 = await resolveProject(teamId, project, opts.apiversion);
   const encoded = opts.route.replace(/\{/g, "%7B").replace(/\}/g, "%7D");
-  const spinner = (0, import_ora21.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
+  const spinner = (0, import_ora22.default)(`Deleting rules for ${opts.method.toUpperCase()} ${opts.route}...`).start();
   const res = await agentCall(
     `/projects/${proj2.projectId}/${proj2.apiVersion}/policies/route/${opts.method.toUpperCase()}${encoded.startsWith("/") ? encoded : `/${encoded}`}`,
     "DELETE"
@@ -11049,14 +11369,14 @@ async function runSpecDeleteRule(project, opts) {
 }
 
 // src/commands/agent.ts
-var import_chalk51 = __toESM(require("chalk"));
-var import_ora22 = __toESM(require("ora"));
+var import_chalk52 = __toESM(require("chalk"));
+var import_ora23 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
 
 // src/lib/tools.ts
-var import_chalk50 = __toESM(require("chalk"));
+var import_chalk51 = __toESM(require("chalk"));
 init_admin();
 init_api();
 init_resolve();
@@ -11087,15 +11407,15 @@ var TOOLS = [
       const key = keys.dev ?? Object.values(keys)[0];
       const url = `https://${a.name}.abz.run/${version2}/dev`;
       const tryIt = buildTryItCurl(url, auth, key, res.tenant);
-      const lines = [`  ${import_chalk50.default.dim("Proxy URL:")}  ${import_chalk50.default.bold(url)}`];
-      if (res.devPortal) lines.push(`  ${import_chalk50.default.dim("Dev portal:")} ${res.devPortal}`);
+      const lines = [`  ${import_chalk51.default.dim("Proxy URL:")}  ${import_chalk51.default.bold(url)}`];
+      if (res.devPortal) lines.push(`  ${import_chalk51.default.dim("Dev portal:")} ${res.devPortal}`);
       const envs = Object.keys(keys);
       if (envs.length) {
-        lines.push("", `  ${import_chalk50.default.bold("API keys")} ${import_chalk50.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
+        lines.push("", `  ${import_chalk51.default.bold("API keys")} ${import_chalk51.default.dim("(bootstrapped \u2014 send as the X-API-Key header; shown once):")}`);
         const w = Math.max(...envs.map((e) => e.length));
-        for (const env of envs) lines.push(`    ${import_chalk50.default.cyan(env.padEnd(w))}  ${import_chalk50.default.green(keys[env])}`);
+        for (const env of envs) lines.push(`    ${import_chalk51.default.cyan(env.padEnd(w))}  ${import_chalk51.default.green(keys[env])}`);
       }
-      if (tryIt) lines.push("", `  ${import_chalk50.default.dim("Try it:")}`, `    ${import_chalk50.default.cyan(tryIt)}`);
+      if (tryIt) lines.push("", `  ${import_chalk51.default.dim("Try it:")}`, `    ${import_chalk51.default.cyan(tryIt)}`);
       return { ...res, proxy_url: url, keys, ...tryIt ? { try_it: tryIt } : {}, display: lines.join("\n") };
     }
   },
@@ -11264,23 +11584,23 @@ function truncate(value, max = 1500) {
 }
 function printCost(resp) {
   const line = formatBilling(resp.billing);
-  if (line) console.log(import_chalk51.default.magenta(`  ${line}`) + import_chalk51.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
+  if (line) console.log(import_chalk52.default.magenta(`  ${line}`) + import_chalk52.default.dim(`  (${resp.llm.model}, ${resp.llm.total_tokens} tok)`));
 }
 async function runAgent(opts) {
   requireAuth();
   const { teamId, teamName } = await resolveTeam(opts.team);
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk51.default.bold("APIblaze agent") + import_chalk51.default.dim(`  \xB7 team ${teamName ?? teamId}`));
-  console.log(import_chalk51.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
+  console.log(import_chalk52.default.bold("APIblaze agent") + import_chalk52.default.dim(`  \xB7 team ${teamName ?? teamId}`));
+  console.log(import_chalk52.default.dim('Ask me to create/delete/configure proxies, tenants, keys, domains, specs. Type "exit" to quit.\n'));
   const history = [];
   while (true) {
-    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk51.default.cyan("you") + " \u203A" }]);
+    const { input } = await inquirer3.prompt([{ type: "input", name: "input", message: import_chalk52.default.cyan("you") + " \u203A" }]);
     const text = (input ?? "").trim();
     if (!text) continue;
     if (["exit", "quit", ":q"].includes(text.toLowerCase())) break;
     history.push({ role: "user", content: text });
     for (let step = 0; step < MAX_TOOL_STEPS; step++) {
-      const spinner = (0, import_ora22.default)({ text: "thinking...", color: "magenta" }).start();
+      const spinner = (0, import_ora23.default)({ text: "thinking...", color: "magenta" }).start();
       let resp;
       try {
         resp = await callAgent(history, teamId);
@@ -11288,21 +11608,21 @@ async function runAgent(opts) {
       } catch (err) {
         spinner.stop();
         if (err instanceof ApiError && err.status === 402) {
-          console.log(import_chalk51.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
+          console.log(import_chalk52.default.yellow("  Insufficient credits \u2014 top up to keep using the agent."));
           break;
         }
         throw err;
       }
       history.push({ role: "assistant", content: resp.raw });
       printCost(resp);
-      if (resp.reply) console.log(import_chalk51.default.green("agent") + " \u203A " + resp.reply);
+      if (resp.reply) console.log(import_chalk52.default.green("agent") + " \u203A " + resp.reply);
       if (!resp.action) break;
       const tool = findTool(resp.action.tool);
       if (!tool) {
         history.push({ role: "user", content: `TOOL_RESULT ${resp.action.tool}: error \u2014 unknown tool` });
         continue;
       }
-      const runSpinner = (0, import_ora22.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
+      const runSpinner = (0, import_ora23.default)({ text: `running ${tool.name}...`, color: "cyan" }).start();
       try {
         const result = await tool.run(resp.action.args, { teamId });
         runSpinner.succeed(`${tool.name} \u2713`);
@@ -11320,11 +11640,11 @@ async function runAgent(opts) {
       }
       renderTrace();
       if (step === MAX_TOOL_STEPS - 1) {
-        console.log(import_chalk51.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
+        console.log(import_chalk52.default.dim("  (paused after several steps \u2014 tell me how to continue)"));
       }
     }
   }
-  console.log(import_chalk51.default.dim("\nBye."));
+  console.log(import_chalk52.default.dim("\nBye."));
 }
 
 // src/commands/config-browse.ts
@@ -11632,11 +11952,11 @@ function dig(blob, dotted) {
 }
 var readSetting = (s, cfg) => s.read ? s.read(cfg) : dig(cfg, s.key);
 function show(v) {
-  if (v === void 0) return import_chalk52.default.dim("(unset)");
-  if (v === null) return import_chalk52.default.dim("null");
-  if (typeof v === "object") return import_chalk52.default.cyan(JSON.stringify(v));
-  if (typeof v === "boolean") return v ? import_chalk52.default.green("on") : import_chalk52.default.red("off");
-  return import_chalk52.default.cyan(String(v));
+  if (v === void 0) return import_chalk53.default.dim("(unset)");
+  if (v === null) return import_chalk53.default.dim("null");
+  if (typeof v === "object") return import_chalk53.default.cyan(JSON.stringify(v));
+  if (typeof v === "boolean") return v ? import_chalk53.default.green("on") : import_chalk53.default.red("off");
+  return import_chalk53.default.cyan(String(v));
 }
 function parseValue(raw) {
   if (raw === "true") return true;
@@ -11671,7 +11991,7 @@ async function patchSetting(proj2, s, value, cfg) {
     if (!tenant2) throw new Error(`Could not tell which tenant ${proj2.projectName} serves \u2014 pass it via \`apiblaze config ${proj2.projectName} --tenant <slug>\` is not supported yet; run \`apiblaze projects\` and check the project has a tenant.`);
     body.tenant = tenant2;
   }
-  const spinner = (0, import_ora23.default)(`Set ${s.key}...`).start();
+  const spinner = (0, import_ora24.default)(`Set ${s.key}...`).start();
   try {
     await admin({
       method: "PATCH",
@@ -11686,10 +12006,10 @@ async function patchSetting(proj2, s, value, cfg) {
   }
 }
 var loginFirst = (what) => {
-  console.log(import_chalk52.default.yellow(`
+  console.log(import_chalk53.default.yellow(`
   Log in first to ${what}.`));
-  console.log(import_chalk52.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
-  console.log(import_chalk52.default.dim("  anonymously and want to bring it into your account.\n"));
+  console.log(import_chalk53.default.dim("  Run `npx apiblaze login` \u2014 or `npx apiblaze claim` if you created this proxy"));
+  console.log(import_chalk53.default.dim("  anonymously and want to bring it into your account.\n"));
 };
 async function runConfig(project, key, value, opts) {
   const creds = loadCredentials();
@@ -11706,9 +12026,9 @@ async function runConfig(project, key, value, opts) {
   }
   const setting = SETTINGS.find((s) => s.key === key);
   if (!setting) {
-    console.error(import_chalk52.default.red(`Unknown setting "${key}".`));
-    console.error(import_chalk52.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
-    console.error(import_chalk52.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
+    console.error(import_chalk53.default.red(`Unknown setting "${key}".`));
+    console.error(import_chalk53.default.dim("  Known: " + SETTINGS.map((s) => s.key).join(", ")));
+    console.error(import_chalk53.default.dim("  (Features like transforms/domains/tenants live in the menu: `apiblaze config <project>`.)"));
     process.exit(1);
   }
   if (value === void 0) {
@@ -11723,7 +12043,7 @@ async function pickProject(teamId) {
   const { getProjects: getProjects2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const projects = await getProjects2(teamId).catch(() => []);
   if (!projects.length) {
-    console.error(import_chalk52.default.red("No projects in this team. Create one: `npx apiblaze create`."));
+    console.error(import_chalk53.default.red("No projects in this team. Create one: `npx apiblaze create`."));
     process.exit(1);
   }
   const { default: inquirer3 } = await import("inquirer");
@@ -11731,7 +12051,7 @@ async function pickProject(teamId) {
     type: "list",
     name: "picked",
     message: "Which project?",
-    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk52.default.dim("v" + p.apiVersion)}`, value: p }))
+    choices: projects.map((p) => ({ name: `${p.projectName} ${import_chalk53.default.dim("v" + p.apiVersion)}`, value: p }))
   }]);
   return { projectId: picked.projectId, projectName: picked.projectName, apiVersion: picked.apiVersion, teamId, tenant: picked.tenant };
 }
@@ -11742,25 +12062,25 @@ function printAll(proj2, cfg, json) {
     console.log(JSON.stringify(out, null, 2));
     return;
   }
-  console.log(import_chalk52.default.bold(`
+  console.log(import_chalk53.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 settings
 `));
   for (const group2 of SETTING_GROUPS) {
-    console.log(import_chalk52.default.bold(group2));
+    console.log(import_chalk53.default.bold(group2));
     for (const s of SETTINGS.filter((x) => x.group === group2)) {
-      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk52.default.dim(s.desc)}`);
+      console.log(`  ${s.key.padEnd(32)} ${show(readSetting(s, cfg))}  ${import_chalk53.default.dim(s.desc)}`);
     }
     console.log();
   }
-  console.log(import_chalk52.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
+  console.log(import_chalk53.default.dim("Change one:  apiblaze config " + proj2.projectName + " <key> <value>   (add --verbose for the API call)"));
 }
 async function discoveryMenu(project) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk52.default.bold(`
+  console.log(import_chalk53.default.bold(`
 APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
 `));
-  console.log(import_chalk52.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
-  console.log(import_chalk52.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
+  console.log(import_chalk53.default.dim("You are not logged in \u2014 browsing what's configurable. Everything below works"));
+  console.log(import_chalk53.default.dim("from this menu once you log in (`npx apiblaze login`).\n"));
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
       type: "list",
@@ -11768,13 +12088,13 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
       message: "Explore:",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk52.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk53.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({
-          name: `${g}  ${import_chalk52.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
+          name: `${g}  ${import_chalk53.default.dim(SETTINGS.filter((s) => s.group === g).map((s) => s.label).join(", "))}`,
           value: { kind: "settings", g }
         })),
-        new inquirer3.Separator(import_chalk52.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk52.default.dim(f.desc)}`, value: { kind: "feature", f } })),
+        new inquirer3.Separator(import_chalk53.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk53.default.dim(f.desc)}`, value: { kind: "feature", f } })),
         new inquirer3.Separator(),
         { name: "Exit", value: { kind: "exit" } }
       ]
@@ -11783,24 +12103,24 @@ APIblaze proxy configuration${project ? ` \u2014 ${project}` : ""}
     if (pick2.kind === "settings") {
       console.log();
       for (const s of SETTINGS.filter((x) => x.group === pick2.g)) {
-        console.log(`  ${import_chalk52.default.bold(s.label.padEnd(28))} ${import_chalk52.default.dim(s.desc)}`);
-        console.log(`  ${import_chalk52.default.dim("  key: " + s.key)}`);
+        console.log(`  ${import_chalk53.default.bold(s.label.padEnd(28))} ${import_chalk53.default.dim(s.desc)}`);
+        console.log(`  ${import_chalk53.default.dim("  key: " + s.key)}`);
       }
       loginFirst("view or change these settings");
     } else {
       const f = pick2.f;
       console.log(`
-  ${import_chalk52.default.bold(f.label)} \u2014 ${f.desc}`);
+  ${import_chalk53.default.bold(f.label)} \u2014 ${f.desc}`);
       loginFirst(`use ${f.label.toLowerCase()}`);
     }
   }
 }
 async function navigator(proj2, cfg, opts) {
   const { default: inquirer3 } = await import("inquirer");
-  console.log(import_chalk52.default.bold(`
+  console.log(import_chalk53.default.bold(`
 ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
 `));
-  console.log(import_chalk52.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
+  console.log(import_chalk53.default.dim("Tip: every change is one API call \u2014 add --verbose to see the curl equivalent.\n"));
   let blob = cfg;
   for (; ; ) {
     const { pick: pick2 } = await inquirer3.prompt([{
@@ -11809,10 +12129,10 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
       message: "Where to?",
       pageSize: 20,
       choices: [
-        new inquirer3.Separator(import_chalk52.default.bold("\u2014 Settings \u2014")),
+        new inquirer3.Separator(import_chalk53.default.bold("\u2014 Settings \u2014")),
         ...SETTING_GROUPS.map((g) => ({ name: g, value: { kind: "settings", g } })),
-        new inquirer3.Separator(import_chalk52.default.bold("\u2014 Features \u2014")),
-        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk52.default.dim(f.desc)}`, value: { kind: f.go } })),
+        new inquirer3.Separator(import_chalk53.default.bold("\u2014 Features \u2014")),
+        ...FEATURES.map((f) => ({ name: `${f.label}  ${import_chalk53.default.dim(f.desc)}`, value: { kind: f.go } })),
         new inquirer3.Separator(),
         { name: "Show all settings", value: { kind: "list" } },
         { name: "Exit", value: { kind: "exit" } }
@@ -11852,7 +12172,7 @@ ${proj2.projectName} v${proj2.apiVersion} \u2014 configuration
         }
       }
     } catch (err) {
-      console.error(import_chalk52.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
+      console.error(import_chalk53.default.red(`  ${err instanceof Error ? err.message : String(err)}`));
     }
   }
 }
@@ -11866,7 +12186,7 @@ async function settingsGroup(proj2, cfg, group2) {
       message: group2 + ":",
       pageSize: 16,
       choices: [
-        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk52.default.dim(s2.desc)}`, value: s2 })),
+        ...items.map((s2) => ({ name: `${s2.label.padEnd(30)} ${show(readSetting(s2, cfg))}  ${import_chalk53.default.dim(s2.desc)}`, value: s2 })),
         new inquirer3.Separator(),
         { name: "\u2190 Back", value: null }
       ]
@@ -11884,7 +12204,7 @@ async function settingsGroup(proj2, cfg, group2) {
     } else if (s.type === "number") {
       const { v } = await inquirer3.prompt([{ type: "input", name: "v", message: `${s.label} (number):`, default: readSetting(s, cfg) }]);
       if (v === "" || Number.isNaN(Number(v))) {
-        console.log(import_chalk52.default.yellow("  Not a number \u2014 unchanged."));
+        console.log(import_chalk53.default.yellow("  Not a number \u2014 unchanged."));
         continue;
       }
       value = Number(v);
@@ -11965,7 +12285,7 @@ async function buildCondition(phase) {
   const items = [];
   for (; ; ) {
     const a = await inquirer3.prompt([
-      { type: "input", name: "source", message: `Condition field ${import_chalk52.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
+      { type: "input", name: "source", message: `Condition field ${import_chalk53.default.dim(srcHint)}:`, validate: (s) => !!s || "required" },
       { type: "list", name: "operator", message: "Operator:", choices: [
         "eq",
         "neq",
@@ -11996,7 +12316,7 @@ async function buildCondition(phase) {
 function showCondition(cond) {
   if (!Array.isArray(cond) || !cond.length) return "";
   const s = cond.map((c) => `${c.source} ${c.operator}${c.value !== void 0 ? ` "${c.value}"` : ""}${c.logicOp ? ` ${c.logicOp}` : ""}`).join(" ");
-  return import_chalk52.default.dim(`  when ${s}`);
+  return import_chalk53.default.dim(`  when ${s}`);
 }
 async function transformsMenu(proj2) {
   const { default: inquirer3 } = await import("inquirer");
@@ -12005,12 +12325,12 @@ async function transformsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List transform rules" });
     const rules = out?.rules ?? [];
     console.log();
-    if (!rules.length) console.log(import_chalk52.default.dim("  No transform rules yet."));
+    if (!rules.length) console.log(import_chalk53.default.dim("  No transform rules yet."));
     for (const r of rules) {
       const a = r.action ?? {};
       const fns = [...a.source_fns ?? [], ...a.dest_fns ?? []].map((f) => f.fn);
-      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk52.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
-      console.log(`  ${r.enabled ? import_chalk52.default.green("\u25CF") : import_chalk52.default.dim("\u25CB")} ${import_chalk52.default.bold(r.name)}  ${import_chalk52.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
+      const what = a.type === "hardcode" ? `${a.destination} = "${a.value}"` : a.type === "remove" ? `remove ${a.field}` : `${a.source} \u2192 ${a.destination}${a.lookup ? " (mapped)" : ""}${fns.length ? import_chalk53.default.dim(` via ${fns.join("\u2192")}`) : ""}`;
+      console.log(`  ${r.enabled ? import_chalk53.default.green("\u25CF") : import_chalk53.default.dim("\u25CB")} ${import_chalk53.default.bold(r.name)}  ${import_chalk53.default.dim(`[${r.phase ?? "request"}]`)}  ${what}${showCondition(r.condition)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -12022,7 +12342,7 @@ async function transformsMenu(proj2) {
           { name: "Enable/disable a rule", value: "toggle" },
           { name: "Delete a rule", value: "delete" }
         ] : [],
-        { name: import_chalk52.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
+        { name: import_chalk53.default.dim("Add from raw JSON (grouped conditions, lookup tables, \u2026)"), value: "raw" },
         { name: "\u2190 Back", value: "back" }
       ]
     }]);
@@ -12035,11 +12355,11 @@ async function transformsMenu(proj2) {
       }]);
       const body = parseValue(raw);
       if (!body || typeof body !== "object" || Array.isArray(body)) {
-        console.log(import_chalk52.default.yellow("  Not a JSON object \u2014 skipped."));
+        console.log(import_chalk53.default.yellow("  Not a JSON object \u2014 skipped."));
         continue;
       }
       await admin({ method: "POST", path: base2, body, summary: "Create transform rule (raw JSON)" });
-      console.log(import_chalk52.default.green("  Rule created."));
+      console.log(import_chalk53.default.green("  Rule created."));
       continue;
     }
     if (act === "add") {
@@ -12055,7 +12375,7 @@ async function transformsMenu(proj2) {
           { name: "Remove a field", value: "remove" }
         ] }
       ]);
-      const fieldHint = import_chalk52.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
+      const fieldHint = import_chalk53.default.dim("(e.g. header:x-api-version, param:limit, bodyvar:user.id)");
       let action2;
       if (ans.kind === "hardcode") {
         const a = await inquirer3.prompt([
@@ -12084,7 +12404,7 @@ async function transformsMenu(proj2) {
         };
       }
       const condition = await buildCondition(ans.phase);
-      const spinner = (0, import_ora23.default)("Creating rule...").start();
+      const spinner = (0, import_ora24.default)("Creating rule...").start();
       try {
         await admin({
           method: "POST",
@@ -12102,16 +12422,16 @@ async function transformsMenu(proj2) {
         type: "list",
         name: "rule",
         message: act === "toggle" ? "Which rule?" : "Delete which rule?",
-        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk52.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
+        choices: [...rules.map((r) => ({ name: `${r.name} ${import_chalk53.default.dim(`[${r.phase ?? "request"}]`)}`, value: r })), { name: "\u2190 Back", value: null }]
       }]);
       if (!rule) continue;
       if (act === "toggle") {
         const flipped = { ...rule, enabled: rule.enabled === false };
         await admin({ method: "PUT", path: `${base2}/${rule.id}`, body: flipped, summary: `${flipped.enabled ? "Enable" : "Disable"} transform "${rule.name}"` });
-        console.log(import_chalk52.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
+        console.log(import_chalk53.default.green(`  ${rule.name} \u2192 ${flipped.enabled ? "enabled" : "disabled"}`));
       } else {
         await admin({ method: "DELETE", path: `${base2}/${rule.id}`, summary: `Delete transform "${rule.name}"` });
-        console.log(import_chalk52.default.green(`  ${rule.name} deleted.`));
+        console.log(import_chalk53.default.green(`  ${rule.name} deleted.`));
       }
     }
   }
@@ -12123,9 +12443,9 @@ async function mappingsMenu(proj2) {
     const out = await admin({ method: "GET", path: base2, summary: "List mapping tables" });
     const tables = out?.mappings ?? out?.tables ?? [];
     console.log();
-    if (!tables.length) console.log(import_chalk52.default.dim("  No mapping tables yet."));
+    if (!tables.length) console.log(import_chalk53.default.dim("  No mapping tables yet."));
     for (const t of tables) {
-      console.log(`  ${import_chalk52.default.bold(t.name)}  ${import_chalk52.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
+      console.log(`  ${import_chalk53.default.bold(t.name)}  ${import_chalk53.default.dim(`${t.entries?.length ?? "?"} entries${t.hide_map_values ? ", hidden" : ""}${t.encrypt_values ? ", encrypted" : ""}`)}`);
     }
     const { act } = await inquirer3.prompt([{
       type: "list",
@@ -12145,11 +12465,11 @@ async function mappingsMenu(proj2) {
       ]);
       const entries2 = parseValue(a.entries);
       if (!Array.isArray(entries2)) {
-        console.log(import_chalk52.default.yellow("  Entries must be a JSON array \u2014 not created."));
+        console.log(import_chalk53.default.yellow("  Entries must be a JSON array \u2014 not created."));
         continue;
       }
       await admin({ method: "POST", path: base2, body: { name: a.name, entries: entries2 }, summary: `Create mapping table "${a.name}"` });
-      console.log(import_chalk52.default.green(`  Table "${a.name}" created.`));
+      console.log(import_chalk53.default.green(`  Table "${a.name}" created.`));
     } else {
       const { table } = await inquirer3.prompt([{
         type: "list",
@@ -12159,7 +12479,7 @@ async function mappingsMenu(proj2) {
       }]);
       if (!table) continue;
       await admin({ method: "DELETE", path: `${base2}/${table.id}`, summary: `Delete mapping table "${table.name}"` });
-      console.log(import_chalk52.default.green(`  ${table.name} deleted.`));
+      console.log(import_chalk53.default.green(`  ${table.name} deleted.`));
     }
   }
 }
@@ -12170,14 +12490,14 @@ async function tenantsMenu(proj2, opts) {
     const out = await admin({ method: "GET", path: base2, summary: "List attached tenants" });
     const tenants = out?.tenants ?? [];
     console.log();
-    if (!tenants.length) console.log(import_chalk52.default.dim("  No tenants attached (consumers use the default tenant)."));
-    for (const t of tenants) console.log(`  ${import_chalk52.default.bold(t.tenant_name ?? t.name)}  ${import_chalk52.default.dim(t.display_name ?? "")}`);
+    if (!tenants.length) console.log(import_chalk53.default.dim("  No tenants attached (consumers use the default tenant)."));
+    for (const t of tenants) console.log(`  ${import_chalk53.default.bold(t.tenant_name ?? t.name)}  ${import_chalk53.default.dim(t.display_name ?? "")}`);
     const { act } = await inquirer3.prompt([{
       type: "list",
       name: "act",
       message: "Tenants:",
       choices: [
-        { name: `Manage a tenant\u2026  ${import_chalk52.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
+        { name: `Manage a tenant\u2026  ${import_chalk53.default.dim("settings, login app clients, providers, issuers \u2014 affects EVERY proxy the tenant serves")}`, value: "manage" },
         { name: "Attach a tenant to this project", value: "attach" },
         ...tenants.length ? [{ name: "Detach a tenant from this project", value: "detach" }] : [],
         { name: "\u2190 Back", value: "back" }
@@ -12200,7 +12520,7 @@ async function tenantsMenu(proj2, opts) {
       }]);
       if (!t) continue;
       await admin({ method: "DELETE", path: `${base2}/${encodeURIComponent(t.tenant_name ?? t.name)}`, summary: `Detach tenant ${t.tenant_name ?? t.name}` });
-      console.log(import_chalk52.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
+      console.log(import_chalk53.default.green(`  Detached ${t.tenant_name ?? t.name}.`));
     }
   }
 }
@@ -12243,7 +12563,7 @@ async function specMenu(proj2, opts) {
     choices: [
       { name: "Print the stored spec", value: "get" },
       { name: "Refresh the spec from its source", value: "refresh" },
-      { name: import_chalk52.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
+      { name: import_chalk53.default.dim("Build the spec by chatting over real traffic \u2192 agent"), value: "agent" },
       { name: "\u2190 Back", value: "back" }
     ]
   }]);
@@ -12251,7 +12571,7 @@ async function specMenu(proj2, opts) {
   if (act === "get") await runSpecGet(proj2.projectName, { team: opts.team, apiversion: proj2.apiVersion });
   else if (act === "refresh") {
     await admin({ method: "POST", path: `/projects/${proj2.projectId}/${proj2.apiVersion}/refresh-spec`, summary: "Refresh spec from source" });
-    console.log(import_chalk52.default.green("  Spec refresh triggered."));
+    console.log(import_chalk53.default.green("  Spec refresh triggered."));
   } else await runOpenapi(proj2.projectName, proj2.apiVersion);
 }
 async function agentsMenu(proj2, opts) {
@@ -12276,8 +12596,8 @@ async function agentsMenu(proj2, opts) {
 }
 
 // src/commands/group.ts
-var import_chalk53 = __toESM(require("chalk"));
-var import_ora24 = __toESM(require("ora"));
+var import_chalk54 = __toESM(require("chalk"));
+var import_ora25 = __toESM(require("ora"));
 init_auth();
 init_admin();
 init_resolve();
@@ -12377,7 +12697,7 @@ async function userByRefOrCreate(t, ref) {
     if (!ref.includes("@")) throw e;
     const created = await t.call("/v1/admin/users", "POST", { email: ref.trim().toLowerCase() });
     if (!created?.abz_sub) throw e;
-    console.log(import_chalk53.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
+    console.log(import_chalk54.default.dim(`  ${ref} wasn't a user yet \u2014 created.`));
     return { abz_sub: created.abz_sub, email: created.email ?? ref, display_name: null };
   }
 }
@@ -12385,11 +12705,11 @@ async function runGroupList(opts) {
   const t = await resolveTransport(opts);
   const groups = await listGroups(t);
   if (opts.json) return void console.log(JSON.stringify(groups));
-  if (!groups.length) return void console.log(import_chalk53.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
-  console.log(import_chalk53.default.dim(`Tenant ${t.tenant}:`));
+  if (!groups.length) return void console.log(import_chalk54.default.yellow(`No groups in ${t.tenant}. Create one: apiblaze group create <name>`));
+  console.log(import_chalk54.default.dim(`Tenant ${t.tenant}:`));
   for (const g of groups) {
-    const sealed = g.name === "apiblaze_admins" ? import_chalk53.default.dim("  (admins \u2014 managed by allowlist)") : "";
-    console.log(`  ${import_chalk53.default.bold(g.name)}  ${import_chalk53.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
+    const sealed = g.name === "apiblaze_admins" ? import_chalk54.default.dim("  (admins \u2014 managed by allowlist)") : "";
+    console.log(`  ${import_chalk54.default.bold(g.name)}  ${import_chalk54.default.dim(`${g.member_count ?? 0} member(s)`)}${sealed}`);
   }
 }
 async function runGroupCreate(name, opts) {
@@ -12414,10 +12734,10 @@ async function runGroupCreate(name, opts) {
       }
     }
   }
-  const spinner = (0, import_ora24.default)(`Creating group ${name}...`).start();
+  const spinner = (0, import_ora25.default)(`Creating group ${name}...`).start();
   try {
     await t.call("/v1/admin/groups", "POST", { name, admins: [adminSub] });
-    spinner.succeed(`Group ${import_chalk53.default.bold(name)} created in ${t.tenant}.`);
+    spinner.succeed(`Group ${import_chalk54.default.bold(name)} created in ${t.tenant}.`);
   } catch (e) {
     spinner.fail("Create failed.");
     throw e;
@@ -12426,10 +12746,10 @@ async function runGroupCreate(name, opts) {
 async function runGroupDelete(name, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, name);
-  const spinner = (0, import_ora24.default)(`Deleting group ${name}...`).start();
+  const spinner = (0, import_ora25.default)(`Deleting group ${name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}`, "DELETE");
-    spinner.succeed(`Group ${import_chalk53.default.bold(name)} deleted.`);
+    spinner.succeed(`Group ${import_chalk54.default.bold(name)} deleted.`);
   } catch (e) {
     spinner.fail("Delete failed.");
     throw e;
@@ -12448,21 +12768,21 @@ async function runGroupMembers(name, opts) {
     return void console.log(JSON.stringify({ ...detail, members: walkedMembers.items, subgroups: subs?.subgroups ?? [] }));
   }
   const members = walkedMembers.items;
-  console.log(import_chalk53.default.bold(`${g.name}`) + import_chalk53.default.dim(`  (${t.tenant})`));
-  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk53.default.cyan("group-admin") : import_chalk53.default.dim("member")}`);
-  if (!members.length) console.log(import_chalk53.default.dim("  no members"));
+  console.log(import_chalk54.default.bold(`${g.name}`) + import_chalk54.default.dim(`  (${t.tenant})`));
+  for (const m of members) console.log(`  ${label2(m)}  ${m.role === "admin" ? import_chalk54.default.cyan("group-admin") : import_chalk54.default.dim("member")}`);
+  if (!members.length) console.log(import_chalk54.default.dim("  no members"));
   const sg = subs?.subgroups ?? [];
-  if (sg.length) console.log(import_chalk53.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
+  if (sg.length) console.log(import_chalk54.default.dim(`  subgroups: ${sg.map((s) => s.name).join(", ")}`));
 }
 async function runGroupAddUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const g = await groupByName(t, groupName);
   const u = await userByRefOrCreate(t, userRef);
   const role = opts.role === "admin" ? "admin" : "member";
-  const spinner = (0, import_ora24.default)(`Adding ${label2(u)} to ${g.name}...`).start();
+  const spinner = (0, import_ora25.default)(`Adding ${label2(u)} to ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members`, "POST", { abz_sub: u.abz_sub, role });
-    spinner.succeed(`${import_chalk53.default.bold(label2(u))} added to ${import_chalk53.default.bold(g.name)} as ${role}.`);
+    spinner.succeed(`${import_chalk54.default.bold(label2(u))} added to ${import_chalk54.default.bold(g.name)} as ${role}.`);
   } catch (e) {
     spinner.fail("Add failed.");
     throw e;
@@ -12471,10 +12791,10 @@ async function runGroupAddUser(userRef, groupName, opts) {
 async function runGroupRemoveUser(userRef, groupName, opts) {
   const t = await resolveTransport(opts);
   const [g, u] = [await groupByName(t, groupName), await userByRef(t, userRef)];
-  const spinner = (0, import_ora24.default)(`Removing ${label2(u)} from ${g.name}...`).start();
+  const spinner = (0, import_ora25.default)(`Removing ${label2(u)} from ${g.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(g.id)}/members/_?abz_sub=${encodeURIComponent(u.abz_sub)}`, "DELETE");
-    spinner.succeed(`${import_chalk53.default.bold(label2(u))} removed from ${import_chalk53.default.bold(g.name)}.`);
+    spinner.succeed(`${import_chalk54.default.bold(label2(u))} removed from ${import_chalk54.default.bold(g.name)}.`);
   } catch (e) {
     spinner.fail("Remove failed.");
     throw e;
@@ -12483,10 +12803,10 @@ async function runGroupRemoveUser(userRef, groupName, opts) {
 async function runGroupAddGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora24.default)(`Nesting ${child.name} under ${parent.name}...`).start();
+  const spinner = (0, import_ora25.default)(`Nesting ${child.name} under ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups`, "POST", { child_group_id: child.id });
-    spinner.succeed(`${import_chalk53.default.bold(child.name)} is now a subgroup of ${import_chalk53.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk54.default.bold(child.name)} is now a subgroup of ${import_chalk54.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Nest failed.");
     throw e;
@@ -12495,10 +12815,10 @@ async function runGroupAddGroup(childName, parentName, opts) {
 async function runGroupRemoveGroup(childName, parentName, opts) {
   const t = await resolveTransport(opts);
   const [child, parent] = [await groupByName(t, childName), await groupByName(t, parentName)];
-  const spinner = (0, import_ora24.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
+  const spinner = (0, import_ora25.default)(`Un-nesting ${child.name} from ${parent.name}...`).start();
   try {
     await t.call(`/v1/admin/groups/${encodeURIComponent(parent.id)}/subgroups/${encodeURIComponent(child.id)}`, "DELETE");
-    spinner.succeed(`${import_chalk53.default.bold(child.name)} un-nested from ${import_chalk53.default.bold(parent.name)}.`);
+    spinner.succeed(`${import_chalk54.default.bold(child.name)} un-nested from ${import_chalk54.default.bold(parent.name)}.`);
   } catch (e) {
     spinner.fail("Un-nest failed.");
     throw e;
@@ -12509,13 +12829,13 @@ async function runGroupUsers(opts) {
   const users = await listUsers(t);
   const observed = await t.call("/v1/admin/observed-identities").catch(() => ({ identities: [] }));
   if (opts.json) return void console.log(JSON.stringify({ users, observed: observed?.identities ?? [] }));
-  console.log(import_chalk53.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
-  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk53.default.dim(u.abz_sub)}`);
-  if (!users.length) console.log(import_chalk53.default.dim("  no users yet"));
+  console.log(import_chalk54.default.dim(`Tenant ${t.tenant} \u2014 user directory:`));
+  for (const u of users) console.log(`  ${label2(u)}  ${import_chalk54.default.dim(u.abz_sub)}`);
+  if (!users.length) console.log(import_chalk54.default.dim("  no users yet"));
   const fresh = (observed?.identities ?? []).filter((o) => !o.provisioned);
   if (fresh.length) {
-    console.log(import_chalk53.default.dim("Seen in traffic (not yet users):"));
-    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk53.default.dim(o.source_label ?? "")}`);
+    console.log(import_chalk54.default.dim("Seen in traffic (not yet users):"));
+    for (const o of fresh) console.log(`  ${o.email || o.abz_sub}  ${import_chalk54.default.dim(o.source_label ?? "")}`);
   }
 }
 
@@ -12524,22 +12844,22 @@ init_iam();
 init_admins();
 
 // src/commands/preapprove.ts
-var import_chalk54 = __toESM(require("chalk"));
-var import_ora25 = __toESM(require("ora"));
+var import_chalk55 = __toESM(require("chalk"));
+var import_ora26 = __toESM(require("ora"));
 async function runPreapprove(who, opts) {
   const tenant2 = await resolveProducerTenant(opts.tenant);
   if (opts.list) {
     const rules = await listPreapprovalRules(tenant2);
     if (opts.json) return void console.log(JSON.stringify(rules, null, 2));
     if (!rules.length) {
-      console.log(import_chalk54.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
-      console.log(import_chalk54.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
+      console.log(import_chalk55.default.dim(`No pre-approval rules in ${tenant2}. Anyone who signs in can access (unless access is restricted).`));
+      console.log(import_chalk55.default.dim(`Add one:  apiblaze preapprove someone@acme.com`));
       return;
     }
-    console.log(import_chalk54.default.dim(`Pre-approved for ${import_chalk54.default.bold(tenant2)}:`));
+    console.log(import_chalk55.default.dim(`Pre-approved for ${import_chalk55.default.bold(tenant2)}:`));
     for (const r of rules) {
-      const tag = r.kind === "domain" ? import_chalk54.default.cyan("@" + r.value + " (whole domain)") : r.value;
-      const grp = r.groups?.length ? import_chalk54.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
+      const tag = r.kind === "domain" ? import_chalk55.default.cyan("@" + r.value + " (whole domain)") : r.value;
+      const grp = r.groups?.length ? import_chalk55.default.dim(`  \u2192 groups: ${r.groups.join(", ")}`) : "";
       console.log(`  ${tag}${grp}`);
     }
     return;
@@ -12548,19 +12868,19 @@ async function runPreapprove(who, opts) {
     throw new Error("Who? Pass an email or a domain: `apiblaze preapprove someone@acme.com` (or `apiblaze preapprove --list`).");
   }
   if (opts.remove) {
-    const spinner2 = (0, import_ora25.default)(`Removing ${who} from ${tenant2}\u2026`).start();
+    const spinner2 = (0, import_ora26.default)(`Removing ${who} from ${tenant2}\u2026`).start();
     const { removed, value } = await removePreapprovalRule(tenant2, who);
-    if (removed) spinner2.succeed(`${import_chalk54.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
-    else spinner2.warn(`No pre-approval rule for ${import_chalk54.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
+    if (removed) spinner2.succeed(`${import_chalk55.default.bold(value)} is no longer pre-approved for ${tenant2}.`);
+    else spinner2.warn(`No pre-approval rule for ${import_chalk55.default.bold(value)} in ${tenant2} \u2014 nothing to remove.`);
     return;
   }
-  const spinner = (0, import_ora25.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
+  const spinner = (0, import_ora26.default)(`Pre-approving ${who} for ${tenant2}\u2026`).start();
   try {
     const { kind, value } = await addPreapprovalRule(tenant2, who, opts.group);
     const what = kind === "domain" ? `Anyone @${value}` : value;
-    spinner.succeed(`${import_chalk54.default.bold(what)} can now sign in to ${import_chalk54.default.bold(tenant2)}.`);
-    if (opts.group?.length) console.log(import_chalk54.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
-    console.log(import_chalk54.default.dim(`  See the full list:  apiblaze preapprove --list`));
+    spinner.succeed(`${import_chalk55.default.bold(what)} can now sign in to ${import_chalk55.default.bold(tenant2)}.`);
+    if (opts.group?.length) console.log(import_chalk55.default.dim(`  They'll join group(s) ${opts.group.join(", ")} on first sign-in.`));
+    console.log(import_chalk55.default.dim(`  See the full list:  apiblaze preapprove --list`));
   } catch (err) {
     spinner.fail("Could not add the rule.");
     throw err;
@@ -12568,8 +12888,8 @@ async function runPreapprove(who, opts) {
 }
 
 // src/commands/consumer.ts
-var import_chalk55 = __toESM(require("chalk"));
-var import_ora26 = __toESM(require("ora"));
+var import_chalk56 = __toESM(require("chalk"));
+var import_ora27 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_caller();
@@ -12591,7 +12911,7 @@ async function consumerFetch(creds, suffix, init) {
 function requireConsumer2() {
   const c = loadConsumer();
   if (!c) {
-    console.error(import_chalk55.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
+    console.error(import_chalk56.default.red("Not logged in as a consumer. Run `apiblaze consumer login` first."));
     process.exit(1);
   }
   return c;
@@ -12602,7 +12922,7 @@ async function runConsumerLogin(opts) {
   let clientId = opts.client;
   if (clientId) {
     if (!tenant2) {
-      console.error(import_chalk55.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
+      console.error(import_chalk56.default.red("When using --client, also pass --tenant <slug> (it sets which portal/keys host to use)."));
       process.exit(1);
     }
   } else {
@@ -12614,24 +12934,24 @@ async function runConsumerLogin(opts) {
       if (!picked) process.exit(1);
       tenant2 = picked;
     }
-    const s2 = (0, import_ora26.default)("Finding the login app...").start();
+    const s2 = (0, import_ora27.default)("Finding the login app...").start();
     const clients = await admin({ method: "GET", path: `/teams/${encodeURIComponent(teamId)}/tenants/${encodeURIComponent(tenant2)}/app-clients`, summary: `List app clients for ${tenant2}` }).catch(() => []);
     s2.stop();
     const usable = (Array.isArray(clients) ? clients : []).filter((c) => c && (c.client_id || c.clientId));
     const pick2 = usable.find((c) => c.is_default || c.default) ?? usable.find((c) => c.verified !== false) ?? usable[0];
     if (!pick2) {
-      console.error(import_chalk55.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
+      console.error(import_chalk56.default.red(`Tenant "${tenant2}" has no login app configured. Set one up in the dashboard (or \`apiblaze create\` with auth).`));
       process.exit(1);
     }
     clientId = pick2.client_id ?? pick2.clientId;
   }
-  console.log(`${import_chalk55.default.cyan("\u2192")} Logging in to ${import_chalk55.default.bold(tenant2)} as a consumer...`);
+  console.log(`${import_chalk56.default.cyan("\u2192")} Logging in to ${import_chalk56.default.bold(tenant2)} as a consumer...`);
   const result = await deviceLogin(clientId, DEFAULT_SCOPE, ({ verificationUri, userCode }) => {
     console.log(`
-  Open: ${import_chalk55.default.underline(verificationUri)}`);
-    console.log(`  Code: ${import_chalk55.default.bold(userCode)}
+  Open: ${import_chalk56.default.underline(verificationUri)}`);
+    console.log(`  Code: ${import_chalk56.default.bold(userCode)}
 `);
-    console.log(import_chalk55.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
+    console.log(import_chalk56.default.dim("  (opening your browser\u2026 waiting for you to finish)"));
   });
   const claims = result.idToken && decodeJwt2(result.idToken) || (decodeJwt2(result.accessToken) ?? {});
   const creds = {
@@ -12646,7 +12966,7 @@ async function runConsumerLogin(opts) {
     obtainedAt: Date.now()
   };
   saveConsumer(creds);
-  console.log(import_chalk55.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
+  console.log(import_chalk56.default.green(`\u2714 Logged in as consumer${creds.email ? ` ${creds.email}` : ""} on ${tenant2}.`));
 }
 async function runConsumerTokens(opts) {
   const creds = requireConsumer2();
@@ -12659,28 +12979,28 @@ async function runConsumerTokens(opts) {
     console.log(JSON.stringify({ tenant: fresh.tenant, access_token: fresh.accessToken, refresh_token: fresh.refreshToken, id_token: fresh.idToken, expires_at: new Date(fresh.expiresAt).toISOString() }, null, 2));
     return;
   }
-  console.log(`${import_chalk55.default.cyan("Consumer")} ${import_chalk55.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk55.default.bold(fresh.tenant)}
+  console.log(`${import_chalk56.default.cyan("Consumer")} ${import_chalk56.default.bold(fresh.email ?? fresh.tenant)} on ${import_chalk56.default.bold(fresh.tenant)}
 `);
-  console.log(`${import_chalk55.default.bold("access_token")}  ${import_chalk55.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
+  console.log(`${import_chalk56.default.bold("access_token")}  ${import_chalk56.default.dim("exp " + (exp(fresh.accessToken) ?? "?"))}
   ${fresh.accessToken}
 `);
-  if (fresh.idToken) console.log(`${import_chalk55.default.bold("id_token")}      ${import_chalk55.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
+  if (fresh.idToken) console.log(`${import_chalk56.default.bold("id_token")}      ${import_chalk56.default.dim("exp " + (exp(fresh.idToken) ?? "?"))}
   ${fresh.idToken}
 `);
-  if (fresh.refreshToken) console.log(`${import_chalk55.default.bold("refresh_token")}
+  if (fresh.refreshToken) console.log(`${import_chalk56.default.bold("refresh_token")}
   ${fresh.refreshToken}
 `);
-  console.log(import_chalk55.default.dim("These are your own tokens \u2014 keep them secret."));
+  console.log(import_chalk56.default.dim("These are your own tokens \u2014 keep them secret."));
 }
 async function runConsumerApikeys(opts) {
   const creds = requireConsumer2();
   const { default: inquirer3 } = await import("inquirer");
-  const spinner = (0, import_ora26.default)("Loading your API keys...").start();
+  const spinner = (0, import_ora27.default)("Loading your API keys...").start();
   const list = await consumerFetch(creds, withPage("/apikeys", null));
   if (list.status >= 400) {
     spinner.stop();
-    console.error(import_chalk55.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
-    if (list.status === 401) console.error(import_chalk55.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
+    console.error(import_chalk56.default.red(`Failed to list keys (${list.status}): ${list.data?.error ?? ""}`));
+    if (list.status === 401) console.error(import_chalk56.default.dim("Your consumer session may have expired \u2014 run `apiblaze consumer login` again."));
     process.exit(1);
   }
   let walkCreds = list.creds;
@@ -12709,16 +13029,16 @@ async function runConsumerApikeys(opts) {
   if (opts.json) {
     console.log(JSON.stringify({ keys, revealed: revealMap }, null, 2));
   } else if (!keys.length) {
-    console.log(import_chalk55.default.yellow("No API keys yet."));
+    console.log(import_chalk56.default.yellow("No API keys yet."));
   } else {
     for (const k of keys) {
       const clear = revealMap[k.environment]?.key;
-      const shown = clear ? import_chalk55.default.green(clear) : import_chalk55.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
-      const exp = k.expires_at ? import_chalk55.default.dim(`exp ${k.expires_at}`) : import_chalk55.default.dim("no expiry");
-      console.log(`  ${import_chalk55.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk55.default.dim(k.description ?? "")}`);
+      const shown = clear ? import_chalk56.default.green(clear) : import_chalk56.default.dim(`${k.key_prefix ?? ""}\u2026${k.key_suffix ?? ""}`);
+      const exp = k.expires_at ? import_chalk56.default.dim(`exp ${k.expires_at}`) : import_chalk56.default.dim("no expiry");
+      console.log(`  ${import_chalk56.default.bold(k.environment ?? "")}  ${shown}  ${exp}  ${import_chalk56.default.dim(k.description ?? "")}`);
     }
     if (Object.keys(revealMap).length === 0 && keys.some((k) => !k.expires_at)) {
-      console.log(import_chalk55.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
+      console.log(import_chalk56.default.dim("\n(Only expiring keys can be shown in clear; non-expiring keys show a prefix only.)"));
     }
   }
   if (opts.json) return;
@@ -12732,7 +13052,7 @@ async function runConsumerApikeys(opts) {
   const body = { environment: answers.environment };
   if (answers.description) body.description = answers.description;
   if (answers.expiresDays) body.expires_in_seconds = Number(answers.expiresDays) * 86400;
-  const s2 = (0, import_ora26.default)("Creating key...").start();
+  const s2 = (0, import_ora27.default)("Creating key...").start();
   const created = await consumerFetch(list.creds, "/apikeys", { method: "POST", body: JSON.stringify(body) });
   if (created.status >= 400) {
     s2.fail(`Create failed (${created.status}): ${created.data?.error ?? ""}`);
@@ -12740,13 +13060,13 @@ async function runConsumerApikeys(opts) {
   }
   s2.succeed("Key created.");
   const key = created.data?.key ?? created.data?.fullKey;
-  if (key) console.log(`  ${import_chalk55.default.green(key)}  ${import_chalk55.default.dim("(shown once \u2014 store it now)")}`);
-  else console.log(import_chalk55.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
+  if (key) console.log(`  ${import_chalk56.default.green(key)}  ${import_chalk56.default.dim("(shown once \u2014 store it now)")}`);
+  else console.log(import_chalk56.default.dim("  Key created; run `apiblaze consumer apikeys` to reveal it if it expires."));
 }
 
 // src/commands/sidecar.ts
-var import_chalk56 = __toESM(require("chalk"));
-var import_ora27 = __toESM(require("ora"));
+var import_chalk57 = __toESM(require("chalk"));
+var import_ora28 = __toESM(require("ora"));
 var fs13 = __toESM(require("fs"));
 var path10 = __toESM(require("path"));
 init_admin();
@@ -12788,18 +13108,18 @@ function upsertEnvLocal(root, token) {
 }
 function installSidecarPackage(root) {
   if (fs13.existsSync(path10.join(root, "node_modules", "apiblaze", "package.json"))) {
-    console.log(`  ${import_chalk56.default.green("\u2713")} apiblaze package already installed`);
+    console.log(`  ${import_chalk57.default.green("\u2713")} apiblaze package already installed`);
     return;
   }
   const has = (f) => fs13.existsSync(path10.join(root, f));
   const pm = has("bun.lockb") || has("bun.lock") ? { cmd: "bun", add: "add" } : has("pnpm-lock.yaml") ? { cmd: "pnpm", add: "add" } : has("yarn.lock") ? { cmd: "yarn", add: "add" } : { cmd: "npm", add: "install" };
-  const spinner = (0, import_ora27.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
+  const spinner = (0, import_ora28.default)(`Installing the apiblaze package (${pm.cmd})\u2026`).start();
   try {
     const { execSync } = require("child_process");
     execSync(`${pm.cmd} ${pm.add} apiblaze`, { cwd: root, stdio: "ignore" });
     spinner.succeed("Installed apiblaze (the sidecar runtime).");
   } catch {
-    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk56.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk56.default.cyan("npm run dev")}.`);
+    spinner.warn(`Couldn't auto-install \u2014 run ${import_chalk57.default.cyan(`${pm.cmd} ${pm.add} apiblaze`)} yourself before ${import_chalk57.default.cyan("npm run dev")}.`);
   }
 }
 function readEnvKey(root) {
@@ -12938,7 +13258,7 @@ async function runAnonymousInit(root, router, opts) {
   const { sidecarInitAnonymous: sidecarInitAnonymous2 } = await Promise.resolve().then(() => (init_api(), api_exports));
   const { saveAnonCred: saveAnonCred2, clearAnonCred: clearAnonCred2 } = await Promise.resolve().then(() => (init_anon_cred(), anon_cred_exports));
   if (opts.newSession) clearAnonCred2();
-  const spinner = (0, import_ora27.default)("Setting up a sidecar (no login needed)...").start();
+  const spinner = (0, import_ora28.default)("Setting up a sidecar (no login needed)...").start();
   let out;
   try {
     out = await sidecarInitAnonymous2();
@@ -12950,29 +13270,29 @@ async function runAnonymousInit(root, router, opts) {
   if (out.cp_key && out.team_id) saveAnonCred2(out.cp_key, out.team_id, out.claim_code);
   const envState = upsertEnvLocal(root, out.token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk56.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
-  console.log(`  ${import_chalk56.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+  console.log(`  ${import_chalk57.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk57.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, router);
-    if (inspectorPath) console.log(`  ${import_chalk56.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk57.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk56.default.bold("Done (no account needed). What happens next:"));
-  console.log(`  1. ${import_chalk56.default.cyan("npm run dev")} and use your app.`);
+  console.log(import_chalk57.default.bold("Done (no account needed). What happens next:"));
+  console.log(`  1. ${import_chalk57.default.cyan("npm run dev")} and use your app.`);
   console.log(`  2. Each external origin your app calls is logged in the console \u2014 approve one with:`);
-  console.log(`       ${import_chalk56.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
+  console.log(`       ${import_chalk57.default.cyan("apiblaze sidecar approve api.stripe.com")}   (no login needed)`);
   console.log("");
-  console.log(import_chalk56.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
-  console.log(`       ${import_chalk56.default.cyan("apiblaze login")}  then  ${import_chalk56.default.cyan("apiblaze claim")}   ${import_chalk56.default.dim("(no code needed here)")}`);
-  console.log(import_chalk56.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
+  console.log(import_chalk57.default.bold("  \u{1F511} Keep your setup \u2014 claim it into an account:"));
+  console.log(`       ${import_chalk57.default.cyan("apiblaze login")}  then  ${import_chalk57.default.cyan("apiblaze claim")}   ${import_chalk57.default.dim("(no code needed here)")}`);
+  console.log(import_chalk57.default.dim(`     From another machine: apiblaze claim ${out.claim_code}  \xB7  expires in 30 days`));
 }
 async function runSidecar(opts) {
   const root = path10.resolve(opts.dir ?? process.cwd());
   const detected2 = detectNextProject(root);
   if (!detected2.found) {
-    console.log(import_chalk56.default.yellow(`No Next.js project detected in ${root}.`));
+    console.log(import_chalk57.default.yellow(`No Next.js project detected in ${root}.`));
     console.log("Create one (e.g. `npx create-next-app`) and re-run `apiblaze init` inside it.");
     return;
   }
@@ -12983,10 +13303,10 @@ async function runSidecar(opts) {
   if (!loadCredentials()) {
     upsertEnvLocal(root, readEnvKey(root));
     ensureGitignored(root);
-    console.log(`  ${import_chalk56.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
-    console.log(`  ${import_chalk56.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
+    console.log(`  ${import_chalk57.default.green("\u2713")} .env.local present (APIBLAZE_API_KEY) \u2014 reusing`);
+    console.log(`  ${import_chalk57.default.green("\u2713")} instrumentation.ts ${wireInstrumentation(root)}`);
     installSidecarPackage(root);
-    console.log(import_chalk56.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
+    console.log(import_chalk57.default.dim("  Log in and run `apiblaze claim <code>` to keep this setup, or `apiblaze login` to manage it."));
     return;
   }
   const { teamId, teamName } = await resolveTeam(opts.team);
@@ -12995,7 +13315,7 @@ async function runSidecar(opts) {
   const mustMint = !existingKey || opts.rotate || switchingTeam;
   let token = existingKey ?? "";
   if (mustMint) {
-    const spinner = (0, import_ora27.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
+    const spinner = (0, import_ora28.default)(existingKey ? "Re-establishing the sidecar (minting a fresh invoke key)..." : "Setting up the sidecar (tenant + non-expiring invoke key)...").start();
     try {
       const out = await admin({
         method: "POST",
@@ -13009,39 +13329,39 @@ async function runSidecar(opts) {
       throw err;
     }
   } else {
-    console.log(import_chalk56.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
+    console.log(import_chalk57.default.dim(`  Reusing the existing APIBLAZE_API_KEY (run with --rotate to mint a fresh one, or --team <name> to switch teams).`));
   }
   const envState = upsertEnvLocal(root, token);
   ensureGitignored(root);
-  console.log(`  ${import_chalk56.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
+  console.log(`  ${import_chalk57.default.green("\u2713")} .env.local ${envState} (APIBLAZE_API_KEY) \u2014 gitignored`);
   const wireState = wireInstrumentation(root);
-  console.log(`  ${import_chalk56.default.green("\u2713")} instrumentation.ts ${wireState}`);
+  console.log(`  ${import_chalk57.default.green("\u2713")} instrumentation.ts ${wireState}`);
   installSidecarPackage(root);
   let inspectorPath = null;
   if (!opts.noInspector) {
     inspectorPath = generateInspector(root, detected2.router);
-    if (inspectorPath) console.log(`  ${import_chalk56.default.green("\u2713")} inspector at ${inspectorPath}`);
+    if (inspectorPath) console.log(`  ${import_chalk57.default.green("\u2713")} inspector at ${inspectorPath}`);
   }
   console.log("");
-  console.log(import_chalk56.default.bold("Done. What happens next:"));
-  console.log(`  1. ${import_chalk56.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
-  console.log(`  2. The origins your app calls appear as ${import_chalk56.default.bold("candidates")} \u2014 list them:  ${import_chalk56.default.cyan("apiblaze sidecar")}`);
-  console.log(`  3. Approve the ones to route:  ${import_chalk56.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
+  console.log(import_chalk57.default.bold("Done. What happens next:"));
+  console.log(`  1. ${import_chalk57.default.cyan("npm run dev")} and use your app \u2014 it works exactly as before (all calls go direct).`);
+  console.log(`  2. The origins your app calls appear as ${import_chalk57.default.bold("candidates")} \u2014 list them:  ${import_chalk57.default.cyan("apiblaze sidecar")}`);
+  console.log(`  3. Approve the ones to route:  ${import_chalk57.default.cyan("apiblaze sidecar approve api.stripe.com")}  (or in the dashboard)`);
   console.log(`     \u2026within ~5 min your app starts routing that origin through APIblaze.`);
-  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk56.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path10.dirname(inspectorPath)} before shipping)`);
-  if (switchingTeam) console.log(import_chalk56.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
+  if (inspectorPath) console.log(`  \u2022  Try it now: open ${import_chalk57.default.underline("http://localhost:3000/abz-inspector")} (dev only; rm ${path10.dirname(inspectorPath)} before shipping)`);
+  if (switchingTeam) console.log(import_chalk57.default.dim(`  \u2022  Approved origins are per-team \u2014 re-approve them on ${teamName ?? teamId} with \`apiblaze sidecar approve <origin>\`.`));
   console.log("");
-  console.log(import_chalk56.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
-  console.log(import_chalk56.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
-  console.log(import_chalk56.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
+  console.log(import_chalk57.default.dim("  Manage:  apiblaze sidecar            (list/approve/deny/remove)"));
+  console.log(import_chalk57.default.dim("  Rotate:  apiblaze init --rotate      \xB7  Switch team:  apiblaze init --team <name>"));
+  console.log(import_chalk57.default.dim("  Turn off: set APIBLAZE_SIDECAR=off in .env.local (flip back to on anytime; key stays put)."));
   console.log("");
-  console.log(import_chalk56.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
-  console.log(import_chalk56.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
+  console.log(import_chalk57.default.yellow("  \u26A0 APIBLAZE_API_KEY is long-lived and lets a holder call your team's proxies. Never commit it."));
+  console.log(import_chalk57.default.dim("  Your control-plane login stays in ~/.apiblaze \u2014 it never entered this project."));
 }
 
 // src/commands/origins.ts
-var import_chalk57 = __toESM(require("chalk"));
-var import_ora28 = __toESM(require("ora"));
+var import_chalk58 = __toESM(require("chalk"));
+var import_ora29 = __toESM(require("ora"));
 init_admin();
 init_resolve();
 init_auth();
@@ -13051,7 +13371,7 @@ async function runOriginsList(opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.log(import_chalk57.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
+      console.log(import_chalk58.default.yellow("No anonymous workspace here. Run `apiblaze init` first."));
       return;
     }
     out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/candidates`, { method: "GET" });
@@ -13069,30 +13389,30 @@ async function runOriginsList(opts) {
   }
   const routed = out.routed ?? [];
   const candidates = out.candidates ?? [];
-  console.log(import_chalk57.default.bold(`
+  console.log(import_chalk58.default.bold(`
 Routed through APIblaze (${routed.length})`));
-  if (!routed.length) console.log(import_chalk57.default.dim("  none yet"));
-  for (const r of routed) console.log(`  ${import_chalk57.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk57.default.dim(`\u2192 ${r.project_id}`)}`);
-  console.log(import_chalk57.default.bold(`
+  if (!routed.length) console.log(import_chalk58.default.dim("  none yet"));
+  for (const r of routed) console.log(`  ${import_chalk58.default.green("\u25CF")} ${r.sidecar_origin}  ${import_chalk58.default.dim(`\u2192 ${r.project_id}`)}`);
+  console.log(import_chalk58.default.bold(`
 Candidates \u2014 going direct, not yet approved (${candidates.length})`));
-  if (!candidates.length) console.log(import_chalk57.default.dim("  none \u2014 run your app to discover the origins it calls"));
+  if (!candidates.length) console.log(import_chalk58.default.dim("  none \u2014 run your app to discover the origins it calls"));
   for (const c of candidates) {
-    console.log(`  ${import_chalk57.default.yellow("\u25CB")} ${c.origin}  ${import_chalk57.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
+    console.log(`  ${import_chalk58.default.yellow("\u25CB")} ${c.origin}  ${import_chalk58.default.dim(`seen ${c.request_count}\xD7, last ${c.last_seen}`)}`);
   }
   if (candidates.length) {
-    console.log(import_chalk57.default.dim(`
+    console.log(import_chalk58.default.dim(`
   Approve:  apiblaze sidecar approve ${candidates[0].origin.replace("https://", "")}`));
-    console.log(import_chalk57.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
+    console.log(import_chalk58.default.dim(`  Dismiss:  apiblaze sidecar deny ${candidates[0].origin.replace("https://", "")}`));
   }
 }
 async function runOriginsApprove(origin, opts) {
   if (!loadCredentials()) {
     const cred = loadAnonCred();
     if (!cred) {
-      console.error(import_chalk57.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
+      console.error(import_chalk58.default.red("Not logged in and no anonymous workspace. Run `apiblaze init` first."));
       process.exit(1);
     }
-    const spinner2 = (0, import_ora28.default)(`Approving ${origin} (anonymous)...`).start();
+    const spinner2 = (0, import_ora29.default)(`Approving ${origin} (anonymous)...`).start();
     try {
       const out = await cpFetch(cred.cp_key, `/teams/${encodeURIComponent(cred.team_id)}/sidecar/approve`, { method: "POST", body: JSON.stringify({ origin }) });
       spinner2.succeed(`Approved ${origin} \u2192 proxy ${out.project_id}. Routing within ~5 min.`);
@@ -13103,7 +13423,7 @@ async function runOriginsApprove(origin, opts) {
     return;
   }
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora28.default)(`Approving ${origin}...`).start();
+  const spinner = (0, import_ora29.default)(`Approving ${origin}...`).start();
   try {
     const out = await admin({
       method: "POST",
@@ -13120,7 +13440,7 @@ async function runOriginsApprove(origin, opts) {
 }
 async function runOriginsDeny(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora28.default)(`Dismissing ${origin}...`).start();
+  const spinner = (0, import_ora29.default)(`Dismissing ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/dismiss`, body: { origin }, summary: `Dismiss sidecar origin ${origin}` });
     spinner.succeed(`Dismissed ${origin}. It won't be suggested again.`);
@@ -13131,7 +13451,7 @@ async function runOriginsDeny(origin, opts) {
 }
 async function runOriginsRemove(origin, opts) {
   const { teamId } = await resolveTeam(opts.team);
-  const spinner = (0, import_ora28.default)(`Removing the proxy for ${origin}...`).start();
+  const spinner = (0, import_ora29.default)(`Removing the proxy for ${origin}...`).start();
   try {
     await admin({ method: "POST", path: `/teams/${encodeURIComponent(teamId)}/sidecar/remove`, body: { origin }, summary: `Un-route sidecar origin ${origin}` });
     spinner.succeed(`Removed ${origin}. Your app will stop routing it (goes direct) within ~5 min.`);
@@ -13142,7 +13462,7 @@ async function runOriginsRemove(origin, opts) {
 }
 
 // src/commands/op.ts
-var import_chalk62 = __toESM(require("chalk"));
+var import_chalk63 = __toESM(require("chalk"));
 init_auth();
 
 // src/lib/op-call.ts
@@ -13171,7 +13491,7 @@ async function opCall(call2) {
 }
 
 // src/commands/op-billing.ts
-var import_chalk58 = __toESM(require("chalk"));
+var import_chalk59 = __toESM(require("chalk"));
 init_admin();
 var SANDBOX = {
   teamId: "team_1782844865835_zujrf",
@@ -13230,7 +13550,7 @@ async function rowsForRays(project, version2, tenant2, rays) {
 }
 function printDoors(data) {
   const checks = [];
-  console.log(import_chalk58.default.bold("\n  Doors \u2014 is every way in metered?\n"));
+  console.log(import_chalk59.default.bold("\n  Doors \u2014 is every way in metered?\n"));
   const doors = data?.doors ?? [];
   const metered = doors.filter((d) => d.verdict === "metered");
   const allowed = doors.filter((d) => d.verdict === "allowed-free");
@@ -13239,29 +13559,29 @@ function printDoors(data) {
   const errs = data?.errors ?? [];
   const routeAuditBroke = errs.some((e) => e.startsWith("zone "));
   const devAuditBroke = errs.some((e) => e.startsWith("workers.dev audit"));
-  console.log(import_chalk58.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
-  for (const d of metered) console.log(import_chalk58.default.green(`      \u2713 ${d.pattern}`));
-  console.log(import_chalk58.default.dim(`
+  console.log(import_chalk59.default.dim(`    ${metered.length} route(s) behind main-proxy (metered)`));
+  for (const d of metered) console.log(import_chalk59.default.green(`      \u2713 ${d.pattern}`));
+  console.log(import_chalk59.default.dim(`
     ${allowed.length} route(s) free ON PURPOSE`));
   for (const d of allowed) {
-    console.log(import_chalk58.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk58.default.dim(` \u2192 ${d.script}`));
-    console.log(import_chalk58.default.dim(`        ${d.why}`));
+    console.log(import_chalk59.default.cyan(`      \u2022 ${d.pattern}`) + import_chalk59.default.dim(` \u2192 ${d.script}`));
+    console.log(import_chalk59.default.dim(`        ${d.why}`));
   }
   if (known.length) {
-    console.log(import_chalk58.default.yellow(`
+    console.log(import_chalk59.default.yellow(`
     ${known.length} route(s) KNOWN OPEN \u2014 unmetered, not yet closed`));
     for (const d of known) {
-      console.log(import_chalk58.default.yellow(`      ! ${d.pattern}`) + import_chalk58.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk58.default.dim(`        ${d.why}`));
+      console.log(import_chalk59.default.yellow(`      ! ${d.pattern}`) + import_chalk59.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk59.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no known-open doors", status: "KNOWN", detail: `${known.length} unmetered route(s) still open \u2014 see above` });
   }
   if (stray.length) {
-    console.log(import_chalk58.default.red(`
+    console.log(import_chalk59.default.red(`
     ${stray.length} STRAY route(s) \u2014 not main-proxy, not on the allowlist`));
     for (const d of stray) {
-      console.log(import_chalk58.default.red(`      \u2717 ${d.pattern}`) + import_chalk58.default.dim(` \u2192 ${d.script}`));
-      console.log(import_chalk58.default.dim(`        ${d.why}`));
+      console.log(import_chalk59.default.red(`      \u2717 ${d.pattern}`) + import_chalk59.default.dim(` \u2192 ${d.script}`));
+      console.log(import_chalk59.default.dim(`        ${d.why}`));
     }
     checks.push({ name: "no stray routes", status: "FAIL", detail: `${stray.length}: ${stray.map((s) => s.pattern).join(", ")}` });
   } else if (routeAuditBroke) {
@@ -13272,22 +13592,22 @@ function printDoors(data) {
   const wd = data?.workers_dev ?? {};
   const open = wd.enabled ?? [];
   if (open.length) {
-    console.log(import_chalk58.default.red(`
+    console.log(import_chalk59.default.red(`
     ${open.length} of ${wd.total} worker(s) reachable on *.workers.dev`));
-    for (const s of open) console.log(import_chalk58.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk58.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
-    console.log(import_chalk58.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
+    for (const s of open) console.log(import_chalk59.default.red(`      \u2717 ${s.script}.workers.dev`) + import_chalk59.default.dim(`  (enabled=${s.enabled} previews=${s.previews})`));
+    console.log(import_chalk59.default.dim("        A workers.dev hostname bypasses every CF route, WAF rule and the credit gate."));
     checks.push({ name: "no workers.dev doors", status: "FAIL", detail: `${open.length} script(s) publicly reachable: ${open.map((s) => s.script).join(", ")}` });
   } else if (devAuditBroke || !wd.total) {
     checks.push({ name: "no workers.dev doors", status: "SKIP", detail: "script enumeration failed \u2014 NOT a pass, no subdomain was ever read. Needs a CF token with Workers Scripts:Read." });
   } else {
-    console.log(import_chalk58.default.green(`
+    console.log(import_chalk59.default.green(`
     \u2713 0 of ${wd.total} workers reachable on *.workers.dev`));
     checks.push({ name: "no workers.dev doors", status: "PASS", detail: `all ${wd.total} scripts have workers.dev + previews disabled` });
   }
-  if (data?.how_to_fix) console.log(import_chalk58.default.yellow(`
-    ${data.reason}`) + import_chalk58.default.dim(`
+  if (data?.how_to_fix) console.log(import_chalk59.default.yellow(`
+    ${data.reason}`) + import_chalk59.default.dim(`
     ${data.how_to_fix}`));
-  else for (const e of errs) console.log(import_chalk58.default.red(`
+  else for (const e of errs) console.log(import_chalk59.default.red(`
     audit error: ${e}`));
   if (errs.length) {
     checks.push({ name: "audit completeness", status: "FAIL", detail: `${errs.length} part(s) of the audit could not run \u2014 coverage is INCOMPLETE, and the checks they would have covered are SKIP above` });
@@ -13297,9 +13617,9 @@ function printDoors(data) {
 async function runMeter(readLedger, opts) {
   const checks = [];
   const N = Math.max(1, Math.min(10, opts.count ?? 3));
-  console.log(import_chalk58.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
+  console.log(import_chalk59.default.bold("\n  Meter \u2014 is 1 request charged exactly 1 request?\n"));
   const snap = await readLedger();
-  console.log(import_chalk58.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
+  console.log(import_chalk59.default.dim(`    wallet ${snap.billing_account_id} \xB7 band count ${snap.band_count} \xB7 next request ${snap.next_request_cents}\xA2
 `));
   const url = `https://${dpHost}/${SANDBOX.version}/${SANDBOX.environment}/`;
   const headers = opts.key ? { "X-API-Key": opts.key } : {};
@@ -13381,27 +13701,27 @@ async function runMeter(readLedger, opts) {
   return checks;
 }
 function printChecks(checks) {
-  console.log(import_chalk58.default.bold("\n  Results\n"));
-  const mark = { PASS: import_chalk58.default.green("  PASS"), FAIL: import_chalk58.default.red("  FAIL"), SKIP: import_chalk58.default.dim("  SKIP"), KNOWN: import_chalk58.default.yellow(" KNOWN") };
+  console.log(import_chalk59.default.bold("\n  Results\n"));
+  const mark = { PASS: import_chalk59.default.green("  PASS"), FAIL: import_chalk59.default.red("  FAIL"), SKIP: import_chalk59.default.dim("  SKIP"), KNOWN: import_chalk59.default.yellow(" KNOWN") };
   for (const ch of checks) {
-    console.log(`  ${mark[ch.status]}  ${import_chalk58.default.bold(ch.name)}`);
-    console.log(import_chalk58.default.dim(`          ${ch.detail}`));
+    console.log(`  ${mark[ch.status]}  ${import_chalk59.default.bold(ch.name)}`);
+    console.log(import_chalk59.default.dim(`          ${ch.detail}`));
   }
   const fails = checks.filter((c) => c.status === "FAIL").length;
   const skips = checks.filter((c) => c.status === "SKIP").length;
   const known = checks.filter((c) => c.status === "KNOWN").length;
   console.log("");
   const passes = checks.filter((c) => c.status === "PASS").length;
-  if (fails) console.log(import_chalk58.default.red(`  ${fails} check(s) FAILED.`));
-  else if (passes) console.log(import_chalk58.default.green(`  ${passes} check(s) passed, 0 failed.`));
-  else console.log(import_chalk58.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
-  if (known) console.log(import_chalk58.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
-  if (skips) console.log(import_chalk58.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
+  if (fails) console.log(import_chalk59.default.red(`  ${fails} check(s) FAILED.`));
+  else if (passes) console.log(import_chalk59.default.green(`  ${passes} check(s) passed, 0 failed.`));
+  else console.log(import_chalk59.default.yellow("  NOTHING WAS VERIFIED \u2014 every check was skipped."));
+  if (known) console.log(import_chalk59.default.yellow(`  ${known} known-open issue(s) still outstanding.`));
+  if (skips) console.log(import_chalk59.default.dim(`  ${skips} check(s) NOT RUN (see SKIP above) \u2014 those invariants are unverified.`));
   console.log("");
 }
 
 // src/commands/op-test.ts
-var import_chalk59 = __toESM(require("chalk"));
+var import_chalk60 = __toESM(require("chalk"));
 init_auth();
 init_types();
 var DASHBOARD_BASE9 = process.env.APIBLAZE_DASHBOARD_BASE || "https://dashboard.apiblaze.com";
@@ -13426,10 +13746,10 @@ async function scrubSandboxKeys(timeoutS = 150) {
   try {
     const r = await runnerCall({ action: "gut", id: TEARDOWN_GUT_ID }, timeoutS);
     const first = r.results?.[0]?.detail ?? r.error ?? "";
-    log(import_chalk59.default.dim(`teardown: ${first || (r.ok ? "sandbox fixture keys scrubbed" : "scrub reported a problem")}`));
+    log(import_chalk60.default.dim(`teardown: ${first || (r.ok ? "sandbox fixture keys scrubbed" : "scrub reported a problem")}`));
     return r.ok;
   } catch (e) {
-    log(import_chalk59.default.dim(`teardown: sandbox key scrub skipped (${e instanceof Error ? e.message : String(e)}) \u2014 leftovers expire within 14 days; scripts/purge-test-keys.mjs reaps them`));
+    log(import_chalk60.default.dim(`teardown: sandbox key scrub skipped (${e instanceof Error ? e.message : String(e)}) \u2014 leftovers expire within 14 days; scripts/purge-test-keys.mjs reaps them`));
     return false;
   }
 }
@@ -13451,23 +13771,23 @@ async function runOpTest(o = {}) {
   const guts = o.skipGuts ? [] : listing.guts.filter((g) => g.id !== TEARDOWN_GUT_ID && matches(g.id, void 0, { ...o, group: void 0 }));
   const total = specs.length + guts.length;
   if (total === 0) {
-    log(import_chalk59.default.yellow("nothing matched"));
+    log(import_chalk60.default.yellow("nothing matched"));
     process.exitCode = 2;
     return;
   }
-  log(import_chalk59.default.bold(`apiblaze op test \u2014 ${specs.length} spec(s) + ${guts.length} gut check(s) on sandbox ${listing.sandbox_team}`));
+  log(import_chalk60.default.bold(`apiblaze op test \u2014 ${specs.length} spec(s) + ${guts.length} gut check(s) on sandbox ${listing.sandbox_team}`));
   const results = [];
   let failed = 0;
   const started = Date.now();
   const record = (r) => {
     results.push(r);
     if (!r.ok) failed += 1;
-    const mark = r.ok ? import_chalk59.default.green("PASS") : import_chalk59.default.red("FAIL");
+    const mark = r.ok ? import_chalk60.default.green("PASS") : import_chalk60.default.red("FAIL");
     log(`[${mark}] ${r.id} \u2014 ${r.label} (${ms(r.duration_ms)})`);
     if (!r.ok) {
-      if (r.kind === "spec") for (const c of r.cases.filter((c2) => !c2.ok)) log(import_chalk59.default.red(`   \u2717 ${c.name}: ${c.detail}`));
-      else if (r.error) log(import_chalk59.default.red(`   \u2717 ${r.error}`));
-      else for (const x of r.results.filter((x2) => x2 && x2.ok === false)) log(import_chalk59.default.red(`   \u2717 ${x.name ?? ""}: ${x.detail ?? JSON.stringify(x)}`));
+      if (r.kind === "spec") for (const c of r.cases.filter((c2) => !c2.ok)) log(import_chalk60.default.red(`   \u2717 ${c.name}: ${c.detail}`));
+      else if (r.error) log(import_chalk60.default.red(`   \u2717 ${r.error}`));
+      else for (const x of r.results.filter((x2) => x2 && x2.ok === false)) log(import_chalk60.default.red(`   \u2717 ${x.name ?? ""}: ${x.detail ?? JSON.stringify(x)}`));
     }
   };
   try {
@@ -13498,13 +13818,13 @@ async function runOpTest(o = {}) {
   }
   const summary = { ran: results.length, passed: results.length - failed, failed, duration_ms: Date.now() - started, sandbox_team: listing.sandbox_team };
   log("");
-  log(failed ? import_chalk59.default.red(`${summary.passed}/${summary.ran} passed, ${failed} failed (${ms(summary.duration_ms)})`) : import_chalk59.default.green(`${summary.passed}/${summary.ran} passed (${ms(summary.duration_ms)})`));
+  log(failed ? import_chalk60.default.red(`${summary.passed}/${summary.ran} passed, ${failed} failed (${ms(summary.duration_ms)})`) : import_chalk60.default.green(`${summary.passed}/${summary.ran} passed (${ms(summary.duration_ms)})`));
   if (o.json) process.stdout.write(JSON.stringify({ ...summary, results }, null, 2) + "\n");
   if (failed) process.exitCode = 1;
 }
 
 // src/commands/op-consumer.ts
-var import_chalk60 = __toESM(require("chalk"));
+var import_chalk61 = __toESM(require("chalk"));
 var SANDBOX_TENANT = "portalteststenant";
 var SANDBOX_PROXY = "portaltestproxypreapproved@2.7.0";
 function proxyUrlFor(spec2, path11 = "/get") {
@@ -13546,9 +13866,9 @@ async function runOpConsumer(o = {}) {
   const creds = loadConsumer();
   const done = (r) => {
     const out = { kind: "consumer", id: "consumer-door", label: "Consumer door: the stored consumer token opens its tenant's OAuth-door proxy", duration_ms: Date.now() - t0, ...r };
-    const mark = out.skipped ? import_chalk60.default.yellow("SKIP") : out.ok ? import_chalk60.default.green("PASS") : import_chalk60.default.red("FAIL");
+    const mark = out.skipped ? import_chalk61.default.yellow("SKIP") : out.ok ? import_chalk61.default.green("PASS") : import_chalk61.default.red("FAIL");
     log2(`[${mark}] ${out.id} \u2014 ${out.label}${out.tenant ? ` (tenant ${out.tenant})` : ""}${out.url ? ` \u2192 ${out.url}` : ""}`);
-    for (const c of out.cases) if (!c.ok || out.skipped) log2((c.ok ? import_chalk60.default.dim : import_chalk60.default.red)(`   ${c.ok ? "ok  " : "\u2717"} ${c.name}: ${c.detail}`));
+    for (const c of out.cases) if (!c.ok || out.skipped) log2((c.ok ? import_chalk61.default.dim : import_chalk61.default.red)(`   ${c.ok ? "ok  " : "\u2717"} ${c.name}: ${c.detail}`));
     if (o.json) process.stdout.write(JSON.stringify(out, null, 2) + "\n");
     if (!out.ok && !out.skipped) process.exitCode = 1;
     if (out.skipped) process.exitCode = 2;
@@ -13588,7 +13908,7 @@ async function runOpConsumer(o = {}) {
 }
 
 // src/commands/op-perf.ts
-var import_chalk61 = __toESM(require("chalk"));
+var import_chalk62 = __toESM(require("chalk"));
 var RPS_DEFAULT = 100;
 var RPS_CAP = 300;
 var SECONDS_DEFAULT = 60;
@@ -13772,10 +14092,10 @@ async function readGateway(proxy, sent, signal) {
     }
     const left = deadline - Date.now();
     if (left <= 0) {
-      log3(import_chalk61.default.yellow(`  gateway: not available \u2014 Analytics Engine had ${lastSeen}/${sent} rows for ${proxy} after ${GATEWAY_WAIT_MS / 1e3}s${lastErr ? ` (last error: ${lastErr})` : ""}`));
+      log3(import_chalk62.default.yellow(`  gateway: not available \u2014 Analytics Engine had ${lastSeen}/${sent} rows for ${proxy} after ${GATEWAY_WAIT_MS / 1e3}s${lastErr ? ` (last error: ${lastErr})` : ""}`));
       return null;
     }
-    log3(import_chalk61.default.dim(`  waiting for the latency ledger\u2026 ${lastSeen}/${sent} rows for ${proxy}${lastErr ? ` (${lastErr})` : ""}`));
+    log3(import_chalk62.default.dim(`  waiting for the latency ledger\u2026 ${lastSeen}/${sent} rows for ${proxy}${lastErr ? ` (${lastErr})` : ""}`));
     await sleep2(Math.min(GATEWAY_POLL_MS, left), signal);
   }
 }
@@ -13784,7 +14104,7 @@ async function runOpPerf(o = {}) {
   const thresholds = thresholdsFrom(o);
   const ctrl = new AbortController();
   const onSigint = () => {
-    log3(import_chalk61.default.yellow("\ninterrupted \u2014 stopping the load and tearing down the fixture"));
+    log3(import_chalk62.default.yellow("\ninterrupted \u2014 stopping the load and tearing down the fixture"));
     ctrl.abort();
   };
   process.once("SIGINT", onSigint);
@@ -13793,7 +14113,7 @@ async function runOpPerf(o = {}) {
     if (!o.key) throw new Error("--url needs --key (the fixture proxy's API key)");
     fixture = { url: o.url, key: o.key, proxy: proxyFromUrl(o.url), provisioned: false };
   } else {
-    log3(import_chalk61.default.dim("provisioning the perf fixture through the runner\u2026"));
+    log3(import_chalk62.default.dim("provisioning the perf fixture through the runner\u2026"));
     const f = await runnerCall({ action: "perf-fixture" }, 120);
     if (!f?.url || !f?.key) throw new Error(`perf-fixture returned no url/key: ${JSON.stringify(f).slice(0, 200)}`);
     fixture = { url: f.url, key: f.key, proxy: f.proxy || proxyFromUrl(f.url), team: f.team, provisioned: true };
@@ -13801,7 +14121,7 @@ async function runOpPerf(o = {}) {
   try {
     const total = Math.round(rps * seconds);
     const intervalMs = 1e3 / rps;
-    log3(import_chalk61.default.bold(`apiblaze op test --perf \u2014 ${rps} rps \xD7 ${seconds}s (${total} requests) against ${fixture.url}${fixture.team ? ` (sandbox ${fixture.team})` : ""}`));
+    log3(import_chalk62.default.bold(`apiblaze op test --perf \u2014 ${rps} rps \xD7 ${seconds}s (${total} requests) against ${fixture.url}${fixture.team ? ` (sandbox ${fixture.team})` : ""}`));
     const samples = [];
     const inflight = /* @__PURE__ */ new Set();
     let fired = 0;
@@ -13809,7 +14129,7 @@ async function runOpPerf(o = {}) {
     const progress = setInterval(() => {
       const m = summarize(samples, Date.now() - t0);
       const secs = (Date.now() - t0) / 1e3;
-      log3(import_chalk61.default.dim(`  ${Math.round(secs)}s  sent ${fired}  ok ${m.ok}  err ${m.errors}  p50 ${fmtMs(m.p50)}  p95 ${fmtMs(m.p95)}  (${(fired / secs).toFixed(1)} rps)`));
+      log3(import_chalk62.default.dim(`  ${Math.round(secs)}s  sent ${fired}  ok ${m.ok}  err ${m.errors}  p50 ${fmtMs(m.p50)}  p95 ${fmtMs(m.p95)}  (${(fired / secs).toFixed(1)} rps)`));
     }, PROGRESS_EVERY_MS);
     const { sent, elapsedMs } = await schedule({
       total,
@@ -13823,21 +14143,21 @@ async function runOpPerf(o = {}) {
       }
     });
     clearInterval(progress);
-    if (inflight.size) log3(import_chalk61.default.dim(`  load sent; waiting for ${inflight.size} in-flight response(s) (\u2264 ${REQUEST_TIMEOUT_MS / 1e3}s)\u2026`));
+    if (inflight.size) log3(import_chalk62.default.dim(`  load sent; waiting for ${inflight.size} in-flight response(s) (\u2264 ${REQUEST_TIMEOUT_MS / 1e3}s)\u2026`));
     await Promise.all([...inflight]);
     const client = summarize(samples, elapsedMs);
     log3("");
-    log3(`  ${import_chalk61.default.bold("client ")}  p50 ${fmtMs(client.p50).padStart(7)}  p95 ${fmtMs(client.p95).padStart(7)}  p99 ${fmtMs(client.p99).padStart(7)}   errors ${client.error_rate_pct.toFixed(2)}% (${client.errors}/${client.sent}: ${client.non2xx} non-2xx, ${client.timeouts} timeouts, ${client.network} network)   achieved ${client.rps_achieved} rps of ${rps}`);
+    log3(`  ${import_chalk62.default.bold("client ")}  p50 ${fmtMs(client.p50).padStart(7)}  p95 ${fmtMs(client.p95).padStart(7)}  p99 ${fmtMs(client.p99).padStart(7)}   errors ${client.error_rate_pct.toFixed(2)}% (${client.errors}/${client.sent}: ${client.non2xx} non-2xx, ${client.timeouts} timeouts, ${client.network} network)   achieved ${client.rps_achieved} rps of ${rps}`);
     const gateway = ctrl.signal.aborted ? null : await readGateway(fixture.proxy, sent, ctrl.signal);
     if (gateway) {
       const extras = [
         gateway.kv_per_req !== void 0 ? `kv/req ${gateway.kv_per_req}` : "",
         gateway.redis_per_req !== void 0 ? `redis/req ${gateway.redis_per_req}` : ""
       ].filter(Boolean).join("  ");
-      log3(`  ${import_chalk61.default.bold("gateway")}  p50 ${fmtMs(gateway.p50).padStart(7)}  p95 ${fmtMs(gateway.p95).padStart(7)}${gateway.p99 !== void 0 ? `  p99 ${fmtMs(gateway.p99).padStart(7)}` : ""}   ${import_chalk61.default.dim(`(${gateway.requests} ledger rows${extras ? `, ${extras}` : ""})`)}`);
-      for (const b of gateway.blame ?? []) log3(import_chalk61.default.dim(`           ${(b.share * 100).toFixed(1).padStart(5)}%  p95 ${fmtMs(b.p95_ms).padStart(6)}  ${b.feature} \u2192 ${b.dep}`));
+      log3(`  ${import_chalk62.default.bold("gateway")}  p50 ${fmtMs(gateway.p50).padStart(7)}  p95 ${fmtMs(gateway.p95).padStart(7)}${gateway.p99 !== void 0 ? `  p99 ${fmtMs(gateway.p99).padStart(7)}` : ""}   ${import_chalk62.default.dim(`(${gateway.requests} ledger rows${extras ? `, ${extras}` : ""})`)}`);
+      for (const b of gateway.blame ?? []) log3(import_chalk62.default.dim(`           ${(b.share * 100).toFixed(1).padStart(5)}%  p95 ${fmtMs(b.p95_ms).padStart(6)}  ${b.feature} \u2192 ${b.dep}`));
     } else {
-      log3(`  ${import_chalk61.default.bold("gateway")}  ${import_chalk61.default.yellow("not available")} ${import_chalk61.default.dim("(gateway thresholds not evaluated)")}`);
+      log3(`  ${import_chalk62.default.bold("gateway")}  ${import_chalk62.default.yellow("not available")} ${import_chalk62.default.dim("(gateway thresholds not evaluated)")}`);
     }
     const breaches = evaluate(client, gateway, thresholds);
     const aborted = ctrl.signal.aborted;
@@ -13845,7 +14165,7 @@ async function runOpPerf(o = {}) {
     log3("");
     const row = (metric, value, limit, unit) => {
       const hit = breaches.find((b) => b.metric === metric);
-      log3(`[${hit ? import_chalk61.default.red("FAIL") : import_chalk61.default.green("PASS")}] ${metric.padEnd(11)} ${String(value)}${unit} ${hit ? ">" : "\u2264"} ${limit}${unit}`);
+      log3(`[${hit ? import_chalk62.default.red("FAIL") : import_chalk62.default.green("PASS")}] ${metric.padEnd(11)} ${String(value)}${unit} ${hit ? ">" : "\u2264"} ${limit}${unit}`);
     };
     row("client_p50", client.p50, thresholds.p50_ms, "ms");
     row("client_p95", client.p95, thresholds.p95_ms, "ms");
@@ -13854,12 +14174,12 @@ async function runOpPerf(o = {}) {
       row("gateway_p50", gateway.p50, thresholds.gateway_p50_ms, "ms");
       row("gateway_p95", gateway.p95, thresholds.gateway_p95_ms, "ms");
     } else {
-      log3(`[${import_chalk61.default.yellow("SKIP")}] gateway_p50 / gateway_p95 \u2014 ledger rows not available`);
+      log3(`[${import_chalk62.default.yellow("SKIP")}] gateway_p50 / gateway_p95 \u2014 ledger rows not available`);
     }
     log3("");
-    if (aborted) log3(import_chalk61.default.red(`FAIL \u2014 interrupted after ${sent}/${total} requests`));
-    else if (ok) log3(import_chalk61.default.green(`PASS \u2014 ${client.sent} requests at ${client.rps_achieved} rps, no threshold breached`));
-    else log3(import_chalk61.default.red(`FAIL \u2014 ${breaches.length} threshold(s) breached: ${breaches.map((b) => `${b.metric} ${b.value} > ${b.limit}`).join(", ")}`));
+    if (aborted) log3(import_chalk62.default.red(`FAIL \u2014 interrupted after ${sent}/${total} requests`));
+    else if (ok) log3(import_chalk62.default.green(`PASS \u2014 ${client.sent} requests at ${client.rps_achieved} rps, no threshold breached`));
+    else log3(import_chalk62.default.red(`FAIL \u2014 ${breaches.length} threshold(s) breached: ${breaches.map((b) => `${b.metric} ${b.value} > ${b.limit}`).join(", ")}`));
     if (o.json) {
       const doc = {
         kind: "perf",
@@ -13897,9 +14217,9 @@ async function runOpPerf(o = {}) {
     if (fixture.provisioned) {
       try {
         await runnerCall({ action: "perf-teardown", proxy: fixture.proxy }, 120);
-        log3(import_chalk61.default.dim(`fixture ${fixture.proxy} torn down`));
+        log3(import_chalk62.default.dim(`fixture ${fixture.proxy} torn down`));
       } catch (e) {
-        log3(import_chalk61.default.red(`teardown of ${fixture.proxy} failed: ${e instanceof Error ? e.message : String(e)} \u2014 run \`apiblaze op residue\` / clean the sandbox`));
+        log3(import_chalk62.default.red(`teardown of ${fixture.proxy} failed: ${e instanceof Error ? e.message : String(e)} \u2014 run \`apiblaze op residue\` / clean the sandbox`));
         process.exitCode = 1;
       }
       await scrubSandboxKeys(120);
@@ -13933,93 +14253,93 @@ var OP_COMMANDS = [
 function renderOpCommands() {
   const width = Math.max(...OP_COMMANDS.map((c) => c.cmd.length)) + 10;
   const lines = OP_COMMANDS.map((c) => {
-    const left = `  ${import_chalk62.default.cyan(`apiblaze ${c.cmd}`)}`;
+    const left = `  ${import_chalk63.default.cyan(`apiblaze ${c.cmd}`)}`;
     const pad = " ".repeat(Math.max(1, width - c.cmd.length));
-    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk62.default.dim(`(${c.extra})`) : ""}`;
+    return `${left}${pad}${c.blurb}${c.extra ? " " + import_chalk63.default.dim(`(${c.extra})`) : ""}`;
   });
   return [
-    import_chalk62.default.bold("Operator commands"),
+    import_chalk63.default.bold("Operator commands"),
     ...lines,
     "",
-    import_chalk62.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
-    import_chalk62.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
-    import_chalk62.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
+    import_chalk63.default.dim("  Operators only. The gate is server-side (dashboard /api/cli/op checks the"),
+    import_chalk63.default.dim("  signed-in email, admin-api re-checks with operatorGate) \u2014 a patched CLI just"),
+    import_chalk63.default.dim("  gets 403s. Every op call is read-only except `op sweep`."),
     "",
-    import_chalk62.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
-    import_chalk62.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
-    import_chalk62.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
+    import_chalk63.default.dim("  Not a CLI command: to prune all non-CP data run scripts/nuke-but-cp.sh --apply --sweep"),
+    import_chalk63.default.dim("  in the repo. Operator dashboards (dlq, thresholds, throttling, pricing, billing,"),
+    import_chalk63.default.dim("  agent-spend, teams, tests, leak-detection, lifecycle) live at /operator/* in the app.")
   ].join("\n");
 }
 function printResidue(report, applied) {
   const up = report?.upstash ?? {};
   const fga = report?.fga ?? {};
   const ghosts = report?.ghosts ?? {};
-  console.log(import_chalk62.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
-  console.log(import_chalk62.default.bold("\n  Upstash"));
+  console.log(import_chalk63.default.bold(applied ? "\nExternal-residue sweep" : "\nExternal residue (dry-run \u2014 nothing deleted)"));
+  console.log(import_chalk63.default.bold("\n  Upstash"));
   const orphans = up.orphans ?? [];
-  if (orphans.length === 0) console.log(import_chalk62.default.green("    no orphaned keys"));
-  for (const o of orphans) console.log(`    ${import_chalk62.default.yellow(o.key)} ${import_chalk62.default.dim(`\u2014 ${o.reason}`)}`);
-  console.log(import_chalk62.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
+  if (orphans.length === 0) console.log(import_chalk63.default.green("    no orphaned keys"));
+  for (const o of orphans) console.log(`    ${import_chalk63.default.yellow(o.key)} ${import_chalk63.default.dim(`\u2014 ${o.reason}`)}`);
+  console.log(import_chalk63.default.dim(`    kept (live principals): ${up.kept ?? 0} \xB7 anon wallets (untouched): ${up.anon_wallets ?? 0}`));
   if (up.anon_wallet_detail) {
     const d = up.anon_wallet_detail;
-    console.log(import_chalk62.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
+    console.log(import_chalk63.default.dim(`    anon wallets: ${d.count} ($${(d.total_cents / 100).toFixed(2)}), ${d.no_ttl} with NO TTL${d.no_ttl ? " \u26A0" : " (all self-expire)"}`));
   }
   if (up.keyspace_census) {
     const census = Object.entries(up.keyspace_census).map(([k, v]) => `${k}=${v}`).join(" \xB7 ");
-    console.log(import_chalk62.default.dim(`    keyspace: ${census}`));
+    console.log(import_chalk63.default.dim(`    keyspace: ${census}`));
   }
-  if (up.unknown?.length) console.log(import_chalk62.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
-  if (applied) console.log(`    ${import_chalk62.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
-  for (const e of up.errors ?? []) console.log(import_chalk62.default.red(`    error: ${e}`));
-  console.log(import_chalk62.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
+  if (up.unknown?.length) console.log(import_chalk63.default.dim(`    unknown (never deleted): ${up.unknown.join(", ")}`));
+  if (applied) console.log(`    ${import_chalk63.default.bold(String(up.deleted ?? 0))} key(s) deleted`);
+  for (const e of up.errors ?? []) console.log(import_chalk63.default.red(`    error: ${e}`));
+  console.log(import_chalk63.default.bold("\n  OpenFGA / Neon \u2014 orphan stores"));
   if (applied) {
     const swept = fga?.swept ?? [];
-    if (swept.length === 0) console.log(import_chalk62.default.green("    no orphaned stores"));
+    if (swept.length === 0) console.log(import_chalk63.default.green("    no orphaned stores"));
     for (const s of swept) {
       console.log(
-        `    ${import_chalk62.default.yellow(s.store_id)} ${import_chalk62.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
+        `    ${import_chalk63.default.yellow(s.store_id)} ${import_chalk63.default.dim(`\u2014 store ${s.openfga_deleted ? "deleted" : "DEFERRED"}, ${s.neon_deleted} Neon tuple(s) purged`)}`
       );
     }
-    if (fga?.remaining) console.log(import_chalk62.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
+    if (fga?.remaining) console.log(import_chalk63.default.yellow(`    ${fga.remaining} more orphan store(s) \u2014 re-run to drain`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk62.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
+    if (st) console.log(import_chalk63.default.dim(`    Neon side-tables purged: ${st.soft_deleted_stores} store records, ${st.orphan_models} models, ${st.orphan_changelog} changelog rows${st.error ? ` (${st.error})` : ""}`));
   } else {
     const fgaOrphans = fga?.orphans ?? [];
-    if (fgaOrphans.length === 0) console.log(import_chalk62.default.green("    no orphaned stores"));
+    if (fgaOrphans.length === 0) console.log(import_chalk63.default.green("    no orphaned stores"));
     for (const s of fgaOrphans) {
       const src = s.in_openfga ? "live in OpenFGA" : "Neon tuples only";
-      console.log(`    ${import_chalk62.default.yellow(s.store_id)} ${import_chalk62.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
+      console.log(`    ${import_chalk63.default.yellow(s.store_id)} ${import_chalk63.default.dim(`\u2014 ${src}${s.name ? ` (${s.name})` : ""}, ${s.neon_tuples} Neon tuple(s)`)}`);
     }
-    console.log(import_chalk62.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
+    console.log(import_chalk63.default.dim(`    kept stores: ${(fga?.kept_store_ids ?? []).length}`));
     const st = fga?.side_tables;
-    if (st) console.log(import_chalk62.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
+    if (st) console.log(import_chalk63.default.dim(`    Neon side-table residue: ${st.soft_deleted_stores} soft-deleted store records, ${st.orphan_models} orphan models, ${st.orphan_changelog} orphan changelog rows`));
   }
-  for (const e of fga?.errors ?? []) console.log(import_chalk62.default.red(`    error: ${e}`));
-  console.log(import_chalk62.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
+  for (const e of fga?.errors ?? []) console.log(import_chalk63.default.red(`    error: ${e}`));
+  console.log(import_chalk63.default.bold("\n  OpenFGA \u2014 ghost tuples in surviving stores"));
   if (applied) {
-    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk62.default.green("    no ghost tuples"));
-    else console.log(`    ${import_chalk62.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk62.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
+    if ((ghosts?.ghost_count ?? 0) === 0) console.log(import_chalk63.default.green("    no ghost tuples"));
+    else console.log(`    ${import_chalk63.default.bold(String(ghosts.deleted ?? 0))} ghost tuple(s) deleted ${import_chalk63.default.dim(`(of ${ghosts.ghost_count} found, ${ghosts.scanned_tuples} scanned across ${ghosts.live_stores} live stores)`)}`);
   } else {
     const n = ghosts?.ghost_count ?? 0;
-    if (n === 0) console.log(import_chalk62.default.green(`    no ghost tuples ${import_chalk62.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
+    if (n === 0) console.log(import_chalk63.default.green(`    no ghost tuples ${import_chalk63.default.dim(`(${ghosts.scanned_tuples ?? 0} scanned across ${ghosts.live_stores ?? 0} live stores)`)}`));
     else {
-      console.log(import_chalk62.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
+      console.log(import_chalk63.default.yellow(`    ${n} ghost tuple(s) referencing entities absent from D1:`));
       for (const g of (ghosts.ghosts ?? []).slice(0, 20)) {
-        console.log(import_chalk62.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
+        console.log(import_chalk63.default.dim(`      ${g.object_type}:${g.object_id} ${g.relation} ${g._user}`));
       }
-      if (n > 20) console.log(import_chalk62.default.dim(`      \u2026 and ${n - 20} more`));
+      if (n > 20) console.log(import_chalk63.default.dim(`      \u2026 and ${n - 20} more`));
     }
   }
-  for (const e of ghosts?.errors ?? []) console.log(import_chalk62.default.red(`    error: ${e}`));
+  for (const e of ghosts?.errors ?? []) console.log(import_chalk63.default.red(`    error: ${e}`));
   console.log();
 }
 async function runOp(sub, opts = {}, view) {
   if (!loadCredentials()) {
-    console.log(import_chalk62.default.dim("Not logged in. Run `apiblaze login`."));
+    console.log(import_chalk63.default.dim("Not logged in. Run `apiblaze login`."));
     return;
   }
   if (!isOperatorLogin()) {
-    console.log(import_chalk62.default.dim("`apiblaze op` is only available to platform operators."));
+    console.log(import_chalk63.default.dim("`apiblaze op` is only available to platform operators."));
     return;
   }
   switch (sub) {
@@ -14075,17 +14395,17 @@ async function runOp(sub, opts = {}, view) {
       const nSide = (st.soft_deleted_stores ?? 0) + (st.orphan_models ?? 0) + (st.orphan_changelog ?? 0);
       printResidue(report, false);
       if (nUp + nFga + nGhost + nSide === 0) {
-        console.log(import_chalk62.default.green("Nothing to sweep."));
+        console.log(import_chalk63.default.green("Nothing to sweep."));
         return;
       }
       if (!opts.yes) {
         const readline3 = await import("readline/promises");
         const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
         const answer = await rl.question(
-          import_chalk62.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
+          import_chalk63.default.red(`Delete ${nUp} Upstash key(s) + ${nFga} OpenFGA store(s) + ${nGhost} ghost tuple(s) + ${nSide} Neon side-table row(s)? Type 'sweep' to confirm: `)
         );
         rl.close();
-        if (answer.trim() !== "sweep") return void console.log(import_chalk62.default.dim("Aborted."));
+        if (answer.trim() !== "sweep") return void console.log(import_chalk63.default.dim("Aborted."));
       }
       const result = await opCall({ method: "POST", path: "/operator/external-residue/sweep", summary: "external residue sweep" });
       if (opts.json) return void console.log(JSON.stringify(result, null, 2));
@@ -14095,25 +14415,25 @@ async function runOp(sub, opts = {}, view) {
     case "mark": {
       const label3 = (view ?? "").trim();
       if (!label3) {
-        console.log(import_chalk62.default.red("Give the change a name:") + import_chalk62.default.cyan(' apiblaze op mark "cached tenant count"'));
+        console.log(import_chalk63.default.red("Give the change a name:") + import_chalk63.default.cyan(' apiblaze op mark "cached tenant count"'));
         return;
       }
       const res = await opCall({ method: "POST", path: "/operator/latency/mark", body: { label: label3 }, summary: "record change marker" });
       const ts = new Date(res?.marker?.ts ?? Date.now()).toISOString();
-      console.log(import_chalk62.default.green(`
-  Marked: `) + import_chalk62.default.bold(label3));
-      console.log(import_chalk62.default.dim(`  ${ts}`));
-      console.log(import_chalk62.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk62.default.cyan("apiblaze op latency compare") + "\n");
+      console.log(import_chalk63.default.green(`
+  Marked: `) + import_chalk63.default.bold(label3));
+      console.log(import_chalk63.default.dim(`  ${ts}`));
+      console.log(import_chalk63.default.dim(`  Once traffic has run on both sides, compare with: `) + import_chalk63.default.cyan("apiblaze op latency compare") + "\n");
       return;
     }
     case "credits": {
       const data = await opCall({ method: "GET", path: "/operator/credits", summary: "list credit wallets" });
       if (opts.json) return void console.log(JSON.stringify(data, null, 2));
       const accounts = data?.accounts ?? [];
-      if (accounts.length === 0) return void console.log(import_chalk62.default.dim("No credit wallets."));
+      if (accounts.length === 0) return void console.log(import_chalk63.default.dim("No credit wallets."));
       for (const a of accounts) {
         const bal = typeof a.balance_cents === "number" ? `$${(a.balance_cents / 100).toFixed(2)}` : "?";
-        console.log(`  ${import_chalk62.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk62.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk62.default.dim(" \u2014 anon") : ""}`);
+        console.log(`  ${import_chalk63.default.bold(bal.padStart(9))}  ${a.walletId}${a.owner_email ? import_chalk63.default.dim(` \u2014 ${a.owner_email}`) : a.anon ? import_chalk63.default.dim(" \u2014 anon") : ""}`);
       }
       return;
     }
@@ -14124,7 +14444,7 @@ async function runOp(sub, opts = {}, view) {
     case "billing": {
       const which = (view ?? "").trim().toLowerCase();
       if (which && which !== "doors" && which !== "meter") {
-        return void console.log(import_chalk62.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
+        return void console.log(import_chalk63.default.red(`Unknown: apiblaze op billing ${which}. Use 'doors', 'meter', or neither for both.`));
       }
       const checks = [];
       let doorsData = null;
@@ -14193,29 +14513,29 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/grades${q}`, summary: "latency grades" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const t = data.thresholds_ms;
-        console.log(import_chalk62.default.bold("\nHow good was apiblaze itself?") + import_chalk62.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
-        console.log(import_chalk62.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
+        console.log(import_chalk63.default.bold("\nHow good was apiblaze itself?") + import_chalk63.default.dim("  (our overhead only \u2014 a slow customer API never counts against us)"));
+        console.log(import_chalk63.default.dim(`  excellent <${t.excellent.replace("<", "")}ms \xB7 okay ${t.okay}ms \xB7 bad ${t.bad}ms \xB7 terrible ${t.terrible.replace(">=", "")}ms+
 `));
-        console.log(import_chalk62.default.dim("  date         reqs   excellent      okay       bad  terrible"));
+        console.log(import_chalk63.default.dim("  date         reqs   excellent      okay       bad  terrible"));
         for (const d of data.days ?? []) {
           const p = d.pct;
-          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk62.default.dim(`${String(v).padStart(5)}%`);
+          const cell = (v, colour) => v > 0 ? colour(`${String(v).padStart(5)}%`) : import_chalk63.default.dim(`${String(v).padStart(5)}%`);
           console.log(
-            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk62.default.green)}  ${cell(p.okay, import_chalk62.default.cyan)}  ${cell(p.bad, import_chalk62.default.yellow)}  ${cell(p.terrible, import_chalk62.default.red)}`
+            `  ${d.date}  ${String(d.total).padStart(5)}   ${cell(p.excellent, import_chalk63.default.green)}  ${cell(p.okay, import_chalk63.default.cyan)}  ${cell(p.bad, import_chalk63.default.yellow)}  ${cell(p.terrible, import_chalk63.default.red)}`
           );
         }
         const cul = data.culprits ?? [];
         if (cul.length) {
-          console.log(import_chalk62.default.bold("\n  Who caused the bad and terrible ones\n"));
-          console.log(import_chalk62.default.dim("     bad  terrible  feature \u2192 dependency"));
+          console.log(import_chalk63.default.bold("\n  Who caused the bad and terrible ones\n"));
+          console.log(import_chalk63.default.dim("     bad  terrible  feature \u2192 dependency"));
           for (const r of cul.slice(0, 12)) {
             if (!r.bad && !r.terrible) continue;
             console.log(
-              `  ${String(r.bad).padStart(6)}  ${import_chalk62.default.red(String(r.terrible).padStart(8))}  ${import_chalk62.default.yellow(r.feature)} ${import_chalk62.default.dim("\u2192")} ${import_chalk62.default.cyan(r.dep)}`
+              `  ${String(r.bad).padStart(6)}  ${import_chalk63.default.red(String(r.terrible).padStart(8))}  ${import_chalk63.default.yellow(r.feature)} ${import_chalk63.default.dim("\u2192")} ${import_chalk63.default.cyan(r.dep)}`
             );
           }
         }
-        if (data.caveat) console.log(import_chalk62.default.dim(`
+        if (data.caveat) console.log(import_chalk63.default.dim(`
   \u26A0 ${data.caveat}
 `));
         return;
@@ -14224,24 +14544,24 @@ async function runOp(sub, opts = {}, view) {
         const data = await opCall({ method: "GET", path: `/operator/latency/compare${q}`, summary: "latency before/after" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const b = data.before, a = data.after, d = data.delta;
-        console.log(import_chalk62.default.bold(`
-Before vs after: `) + import_chalk62.default.cyan(data.marker.label));
-        console.log(import_chalk62.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
+        console.log(import_chalk63.default.bold(`
+Before vs after: `) + import_chalk63.default.cyan(data.marker.label));
+        console.log(import_chalk63.default.dim(`  marked ${new Date(data.marker.ts).toISOString()} \xB7 ${data.window_hours}h either side
 `));
         const row = (name, before, after, delta) => {
           const arrow = delta === 0 ? "=" : delta < 0 ? "\u2193" : "\u2191";
           const txt = `${String(before).padStart(6)}ms  \u2192${String(after).padStart(7)}ms   ${arrow}${Math.abs(delta)}ms`;
-          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk62.default.green(txt) : import_chalk62.default.red(txt) : import_chalk62.default.dim(txt)}`);
+          console.log(`  ${name.padEnd(22)}${data.trustworthy ? delta <= 0 ? import_chalk63.default.green(txt) : import_chalk63.default.red(txt) : import_chalk63.default.dim(txt)}`);
         };
-        console.log(import_chalk62.default.dim("  metric                 before        after      change"));
+        console.log(import_chalk63.default.dim("  metric                 before        after      change"));
         row("total p50", b.total_p50, a.total_p50, d.total_p50);
         row("total p95", b.total_p95, a.total_p95, d.total_p95);
         row("apiblaze overhead p50", b.gw_p50, a.gw_p50, d.gw_p50);
         row("apiblaze overhead p95", b.gw_p95, a.gw_p95, d.gw_p95);
-        console.log(import_chalk62.default.dim(`
+        console.log(import_chalk63.default.dim(`
   requests: ${b.requests} before \xB7 ${a.requests} after`));
         for (const w of data.warnings ?? []) {
-          console.log((data.trustworthy ? import_chalk62.default.dim : import_chalk62.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
+          console.log((data.trustworthy ? import_chalk63.default.dim : import_chalk63.default.yellow)(`  ${data.trustworthy ? "\xB7" : "\u26A0"} ${w}`));
         }
         console.log("");
         return;
@@ -14250,19 +14570,19 @@ Before vs after: `) + import_chalk62.default.cyan(data.marker.label));
         const data = await opCall({ method: "GET", path: `/operator/latency/slow${q}`, summary: "slowest requests" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk62.default.dim("No requests over the threshold in that window."));
-        console.log(import_chalk62.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk63.default.dim("No requests over the threshold in that window."));
+        console.log(import_chalk63.default.bold(`
 Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
 `));
-        console.log(import_chalk62.default.dim("  total   ours   theirs  blame                 request id"));
+        console.log(import_chalk63.default.dim("  total   ours   theirs  blame                 request id"));
         for (const r of rows2.slice(0, 30)) {
           console.log(
-            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk62.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk62.default.dim(r.request_id || "")}`
+            `  ${String(Math.round(r.duration_ms)).padStart(6)}  ${String(Math.round(r.gateway_ms)).padStart(5)}  ${String(Math.round(r.upstream_ttfb_ms)).padStart(6)}  ${import_chalk63.default.yellow(`${r.slow_gw_feature || "-"}\u2192${r.slow_dep || "-"}`.padEnd(20))}  ${import_chalk63.default.dim(r.request_id || "")}`
           );
         }
-        console.log(import_chalk62.default.dim(`
+        console.log(import_chalk63.default.dim(`
   The last column is the request id (Cloudflare calls it a "cf-ray"). Look one up with`));
-        console.log(import_chalk62.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
+        console.log(import_chalk63.default.dim(`  \`apiblaze logs\` for that request's exact per-feature breakdown \u2014 unsampled, unlike the table above.
 `));
         return;
       }
@@ -14270,18 +14590,18 @@ Slowest requests \u2014 last ${data.window_hours}h, over ${data.min_ms}ms
         const data = await opCall({ method: "GET", path: `/operator/latency/llm${q}`, summary: "llm latency" });
         if (opts.json) return void console.log(JSON.stringify(data, null, 2));
         const rows2 = data?.rows ?? [];
-        if (!rows2.length) return void console.log(import_chalk62.default.dim("No LLM traffic in that window."));
-        console.log(import_chalk62.default.bold(`
+        if (!rows2.length) return void console.log(import_chalk63.default.dim("No LLM traffic in that window."));
+        console.log(import_chalk63.default.bold(`
 LLM timing \u2014 last ${data.window_hours}h
 `));
-        console.log(import_chalk62.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
+        console.log(import_chalk63.default.dim("     turns   turn p95   ttfc p95   gen p95   reserve p95   in/out tokens p95   model"));
         for (const r of rows2) {
           const n = r.turns ?? r.requests ?? 0;
           console.log(
             `  ${String(Math.round(n)).padStart(8)}   ${String(Math.round(r.turn_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.ttfc_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.gen_p95_ms ?? 0)).padStart(6)}ms   ${String(Math.round(r.reserve_p95_ms ?? 0)).padStart(9)}ms   ${String(Math.round(r.input_tokens_p95 ?? 0)).padStart(6)}/${String(Math.round(r.output_tokens_p95 ?? 0)).padEnd(6)}   ${r.model || "-"}`
           );
         }
-        console.log(import_chalk62.default.dim(`
+        console.log(import_chalk63.default.dim(`
   ${data.note}
 `));
         return;
@@ -14292,26 +14612,26 @@ LLM timing \u2014 last ${data.window_hours}h
       ]);
       if (opts.json) return void console.log(JSON.stringify({ blame, summary }, null, 2));
       const ov = summary?.apiblaze_overhead_ms ?? {};
-      console.log(import_chalk62.default.bold(`
+      console.log(import_chalk63.default.bold(`
 Latency \u2014 last ${summary?.window_hours ?? "?"}h, ${Number(summary?.requests ?? 0).toLocaleString()} requests
 `));
-      console.log(`  ${import_chalk62.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk62.default.dim("\u2190 ours")}`);
-      console.log(`  ${import_chalk62.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk62.default.dim("\u2190 theirs")}`);
-      console.log(import_chalk62.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
+      console.log(`  ${import_chalk63.default.bold("apiblaze overhead")}  p50 ${String(ov.p50 ?? 0).padStart(5)}ms   p95 ${String(ov.p95 ?? 0).padStart(6)}ms   p99 ${String(ov.p99 ?? 0).padStart(6)}ms   ${import_chalk63.default.dim("\u2190 ours")}`);
+      console.log(`  ${import_chalk63.default.bold("upstream ttfb    ")}  ${" ".repeat(24)}p95 ${String(summary?.upstream_ttfb_p95_ms ?? 0).padStart(6)}ms   ${import_chalk63.default.dim("\u2190 theirs")}`);
+      console.log(import_chalk63.default.dim(`  (per-request percentiles \u2014 never subtract one from the other)
 `));
       const rows = blame?.blame ?? [];
-      if (!rows.length) return void console.log(import_chalk62.default.dim("No latency rows in that window."));
-      console.log(import_chalk62.default.bold("  Which feature ate the time, and what inside it\n"));
-      console.log(import_chalk62.default.dim("   share   p95      feature \u2192 dependency"));
+      if (!rows.length) return void console.log(import_chalk63.default.dim("No latency rows in that window."));
+      console.log(import_chalk63.default.bold("  Which feature ate the time, and what inside it\n"));
+      console.log(import_chalk63.default.dim("   share   p95      feature \u2192 dependency"));
       for (const r of rows.slice(0, 15)) {
         const share = `${(r.share * 100).toFixed(1)}%`;
-        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk62.default.yellow(r.feature)} ${import_chalk62.default.dim("\u2192")} ${import_chalk62.default.cyan(r.dep)}`);
+        console.log(`   ${share.padStart(6)}  ${String(r.p95_ms).padStart(6)}ms  ${import_chalk63.default.yellow(r.feature)} ${import_chalk63.default.dim("\u2192")} ${import_chalk63.default.cyan(r.dep)}`);
       }
       console.log("");
       return;
     }
     default:
-      console.log(import_chalk62.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
+      console.log(import_chalk63.default.red(`Unknown op subcommand '${sub}'. Run \`apiblaze op\` for the menu.`));
   }
 }
 
@@ -14362,8 +14682,8 @@ agent.command("openapi").description("Chat to build your API spec from real traf
 agent.command("mcp").description("Chat to build an MCP server for an API").argument("<project>", "Project name or id").argument("[apiVersion]", "API version (defaults to the project's)").option("--environment <env>", "Environment to publish (default: prod)").action(action((project, apiVersion, opts) => runMcp(project, apiVersion, opts)));
 program.command("apichat [project]").description("Turn any API into a chat: point at an OpenAPI spec \u2014 or chat an EXISTING proxy by name (no login needed)").option("--target <url|file>", "What to chat with \u2014 pass ANY of: a target server base URL (spec auto-discovered at /openapi.json etc.), a local OpenAPI file (./openapi.yaml), or a remote OpenAPI URL (https://acme.com/openapi.yaml)").addOption(new import_commander.Option("--openapi <file|url>", "Deprecated alias \u2014 --target now detects spec files/URLs itself").hideHelp()).addOption(new import_commander.Option("--openapispec <file|url>", "Deprecated alias for --openapi").hideHelp()).option("--name <name>", "Proxy name (defaults to the target host)").option("--apiversion <version>", "API version to create (e.g. 1.0.0)").option("--environment <env>", "Environment to chat against (default: prod anonymous / dev logged-in)").option("--access <mode>", 'Who can call this API once connected (e.g. via Claude): "open" = anyone who signs in, "invite" = only you + emails you pre-approve. Default: invite when logged in, open when anonymous.').option("--target-auth-env <ENV_VAR>", "Read the upstream credential from this env var (CI-safe; required when there is no TTY and the API needs auth)").option("--force", "Proceed even if the API uses oauth2/openIdConnect target auth (you configure target auth yourself later)").option("-y, --yes", "Skip confirmation prompts").option("--tenant <slug>", "Tenant (consumer namespace: portal, login, users) for the new proxy; omit to be asked").option("--apikey <key>", "Use this API key for the proxy's door (api_key proxies). Without it, apichat detects the door and asks \u2014 or runs the consumer login for OAuth doors.").option("--xenduserid <id>", "Assert this end-user id (X-End-User-Id) \u2014 required by proxies with identified/pre-approved enforcement; you are asked for one when the proxy demands it.").option("--verbose", "Show the per-turn proxy curl trace (hidden by default)").option("-p, --prompt <question>", "One-shot question: answered through the external agent CLI after an MCP install, or by apichat itself (exits after answering when there is no TTY)").option("--install-mcp <cli>", "Install this proxy's MCP into an external agent CLI without asking: claude | codex. Also re-offers after an earlier decline.").option("--remove-mcp <cli>", "Disconnect this proxy from an external agent CLI (claude | codex): removes the MCP server and the standing instruction").action(action((project, opts) => {
   const looksLikeSource = !!project && (/^https?:\/\//i.test(project) || /\.(ya?ml|json)$/i.test(project) || import_fs5.default.existsSync(project));
-  const target = opts.target ?? (looksLikeSource ? project : void 0);
-  return runApichat({ ...opts, target, project: looksLikeSource ? void 0 : project, openapispec: opts.openapispec ?? opts.openapi });
+  const target2 = opts.target ?? (looksLikeSource ? project : void 0);
+  return runApichat({ ...opts, target: target2, project: looksLikeSource ? void 0 : project, openapispec: opts.openapispec ?? opts.openapi });
 }));
 var llm = program.command("llm").description("Manage a local LLM provider key for chat (optional \u2014 lifts model quality, bills your key)");
 llm.command("set-key").description("Store an LLM provider key locally (OpenRouter/Anthropic/DeepSeek/OpenAI)").argument("[key]", "The API key (omit to enter it hidden at a prompt)").option("--model <id>", "Model id to use with this key (e.g. anthropic/claude-haiku-4.5)").action(action((key, opts) => runLlmSetKey(key, opts)));
@@ -14381,7 +14701,7 @@ program.command("dev").description(`Put the code running on this machine behind
   try {
     const resolved = parseInt(port ?? opts.port, 10);
     if (Number.isNaN(resolved)) {
-      console.error(import_chalk63.default.red(`Invalid port: ${port ?? opts.port}`));
+      console.error(import_chalk64.default.red(`Invalid port: ${port ?? opts.port}`));
       process.exit(1);
     }
     await runDev({ ...opts, port: resolved });
@@ -14444,13 +14764,25 @@ var logs = program.command("logs").description("API Producer view \u2014 stream
 logs.command("list").description("API Producer view \u2014 browse EVERY caller's past requests by day, then open one to see its 4 views").argument("<project>", "Project name or id").argument("[version]", "API version (defaults to the first match)").option("--tenant <slug>", "Tenant to read (auto when one is attached; prompted otherwise)").option("--errors-only", "Only show 4xx/5xx responses").option("--json", "Emit ALL matching rows as NDJSON, newest first (non-interactive)").option("--plain", "Print day-grouped rows instead of prompting (automatic when piped)").option("--team <id|name>", "Team the project is in (defaults to active team)").action(action((project, version2, _o, cmd) => runLogsList(project, version2, cmd.optsWithGlobals())));
 program.command("config").description("Browse and change every proxy setting & feature (interactive; git-config-style get/set)").argument("[project]", "Project name or id (omit to pick interactively)").argument("[key]", "Setting key, e.g. throttling.proxyQuota (omit for the menu)").argument("[value]", "New value (omit to read the current value)").option("--list", "Print every setting and its current value").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Machine-readable output (with --list or a key read)").action(action((project, key, value, opts) => runConfig(project, key, value, opts)));
 program.command("target").description("Change where a proxy forwards requests").argument("<project>", "Project name or id").requiredOption("--url <url>", "Target URL to forward to").option("--env <env>", "Environment to scope the target to (e.g. prod, dev)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version (defaults to the first match)").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTargetSet(project, opts)));
-program.command("throttle").description("Set rate limits and quotas for a proxy").argument("<project>", "Project name or id").option("--rate <n>", "User rate limit (requests/sec)").option("--end-user-rate <n>", "Per-end-user rate limit (requests/sec)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
+program.command("throttle").description("Set rate limits and quotas for a proxy (works in an anonymous workspace too; new proxies start at 10/s per person and 10,000/day)").argument("<project>", "Project name or id").option("--rate <n>", "Requests/sec per person (or per key when a call names no person). Anonymous workspaces: at most 10").option("--end-user-rate <n>", "Same as --rate (kept for older scripts)").option("--quota <n>", "Proxy quota (requests/period)").option("--period <p>", "Quota period: daily | weekly | monthly").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runThrottleSet(project, opts)));
+var transform = program.command("transform").description("Change requests on their way to your backend \u2014 e.g. send it a secret header so it only answers to the proxy");
+transform.command("list").description("List a proxy's transforms").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runTransformList(project, opts)));
+transform.command("set-header").description("Send a header with a fixed value to the upstream on every call (replaces the value if already set)").argument("<project>", "Project name or id").argument("<header>", "Header name, e.g. x-target-api-key").option("--value <value>", "The header value").option("--value-env <VAR>", "Read the value from this environment variable (keeps secrets out of shell history)").option("--secret", "Store the value encrypted and never show it again").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").addHelpText("after", `
+Example \u2014 lock your backend to the proxy:
+  export TARGET_SERVER_SECRET=$(openssl rand -hex 24)   # also give it to your backend
+  apiblaze transform set-header shop x-target-api-key --value-env TARGET_SERVER_SECRET --secret`).action(action((project, header, opts) => runTransformSetHeader(project, header, opts)));
+transform.command("remove").description("Remove a transform by name, id, or header name").argument("<project>", "Project name or id").argument("<rule>", "Rule name, id, or the header a set-header rule sets").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, rule, opts) => runTransformRemove(project, rule, opts)));
 program.command("rename").description("Change a proxy's display name").argument("<project>", "Project name or id").requiredOption("--display-name <name>", "New human-friendly display name").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runRename(project, opts)));
-var domain = program.command("domain").description("Use your own domain for a proxy");
-domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("<project>", "Project name or id").requiredOption("--domain <host>", "Custom hostname to add").option("--tenant <slug>", "Bind the domain to one of the project's tenants (per-tenant scope)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainAdd(project, opts)));
-domain.command("list").description("List custom domains for a proxy").argument("<project>", "Project name or id").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
-domain.command("status").description("Check a custom domain's validation status").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
-domain.command("rm").description("Remove a custom domain").argument("<project>", "Project name or id").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
+var domain = program.command("domain").description("Use your own domain for your API, MCP server, developer portal or login pages (billed monthly)");
+domain.command("add").description("Add your own domain (shows the DNS records to set)").argument("[project]", "Project name or id (for api / mcp domains; omit with --tenant for portal / auth)").requiredOption("--domain <host>", "Custom hostname to add, e.g. api.example.com").option("--kind <kind>", "api (default) | mcp \u2014 on a project; portal | auth \u2014 on a --tenant").option("--tenant <slug>", "portal/auth: the tenant the domain belongs to. api/mcp: pin the domain to one of the project's tenants").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").addHelpText("after", `
+Examples:
+  apiblaze domain add shop --domain api.acme.com                       # the API
+  apiblaze domain add shop --domain mcp.acme.com --kind mcp            # the MCP server
+  apiblaze domain add --tenant acme --kind portal --domain developers.acme.com
+  apiblaze domain add --tenant acme --kind auth --domain login.acme.com`).action(action((project, opts) => runDomainAdd(project, opts)));
+domain.command("list").description("List a project's custom domains, or a tenant's portal/login domains").argument("[project]", "Project name or id (omit with --tenant)").option("--tenant <slug>", "List the tenant's portal / auth domains").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainList(project, opts)));
+domain.command("status").description("Check a custom domain's validation status (and show the DNS records still needed)").argument("[project]", "Project name or id (omit with --tenant)").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--tenant <slug>", "The tenant, for a portal / auth domain").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runDomainStatus(project, opts)));
+domain.command("rm").description("Remove a custom domain (billing for it stops)").argument("[project]", "Project name or id (omit with --tenant)").requiredOption("--id <domainId>", "Domain id (see `domain list`)").option("--tenant <slug>", "The tenant, for a portal / auth domain").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainRemove(project, opts)));
 domain.command("set-base").description("Choose which version/environment your main URL serves").argument("<project>", "Project name or id").option("--env <env>", "Environment (default: prod)").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runDomainSetBase(project, opts)));
 var group = program.command("group").description("Manage a tenant's users & groups \u2014 bare command lists groups").action(action(() => runGroupList({})));
 group.command("list").description("List groups").option("--tenant <slug>", "Tenant").option("--json", "Machine-readable output").action(action((opts) => runGroupList(opts)));
@@ -14480,11 +14812,11 @@ admins.command("remove").description("Remove a tenant admin").argument("<email>"
 program.addCommand(admins);
 program.command("iam").description("Turn users & groups on/off for a proxy's tenant (identified calls get their user's groups applied)").argument("<project>", "Project name or id").argument("<state>", "on | off").option("--tenant <name>", "Tenant to toggle (defaults to the project's tenant)").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, state, opts) => runIamToggle(project, state, opts)));
 program.command("identified").description("Require calls to identify their end user (X-End-User-Id from a backend key, or a login token \u2014 a client key alone cannot) \u2014 or allow unattributed calls again").argument("<project>", "Project name or id").argument("<mode>", "require | allow-anon").option("--team <id|name>", "Team (defaults to active team, or your anonymous workspace)").option("--apiversion <version>", "API version (defaults to the first)").option("--json", "Output machine-readable JSON").action(action((project, mode, opts) => runIdentifiedToggle(project, mode, opts)));
-var apikeys = new import_commander.Command("apikeys").description("Producer control-plane API keys (list, then offer to create one)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
+var apikeys = new import_commander.Command("apikeys").description("API keys \u2014 for your team (control plane), or with `mint --tenant` for your API's callers: a backend key, a client key (--client) or a key bound to one person (--for)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts) => runApikeysMenu(opts)));
 apikeys.command("list").description("List control-plane API keys in your team").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyList({ ...cmd.parent?.opts(), ...opts })));
 apikeys.command("mint").description("Create a control-plane API key (secret shown once) \u2014 or, with --tenant, a consumer key in that tenant: a backend key (default), a client key (--client) or a person-bound key (--for)").option("--desc <text>", "Description").option("--expires-days <n>", "Expiry in days (default 90 server-side)").option("--tenant <slug>", "Mint a CONSUMER key in this tenant instead of a control-plane key").option("--backend", `Backend key (default). ${HOLDER_HELP.backend}`).option("--client", `Client key. ${HOLDER_HELP.client} Needs --tenant.`).option("--for <email|id>", "Issue this key to a named person \u2014 calls made with it count as that person, and ownership rules trust it. The Users & Groups widget's admin lane accepts only such a key, one per admin. Needs --tenant.").option("--env <name>", "Environment the consumer key is valid for (with --tenant; default dev)").option("--team <id|name>", "Team (defaults to active team)").option("--json", "Output machine-readable JSON").action(action((opts, cmd) => runKeyMint({ ...cmd.parent?.opts(), ...opts })));
 apikeys.command("revoke").description("Revoke a control-plane API key").argument("<keyId>", "Key id (see `apikeys list`)").option("--team <id|name>", "Team (defaults to active team)").action(action((keyId, opts, cmd) => runKeyRevoke(keyId, { ...cmd.parent?.opts(), ...opts })));
-program.addCommand(apikeys, { hidden: true });
+program.addCommand(apikeys);
 var op = new import_commander.Command("op").description("Operator menu (platform operators only)").argument("[action]", "latency | billing | mark | credits | residue | sweep | test | perf (omit for the menu)").argument("[view]", "for `latency`: slow | llm | compare | grades \xB7 for `billing`: doors | meter \xB7 for `mark`: the change name, quoted").option("-y, --yes", "Skip the sweep confirmation prompt").option("--json", "Output machine-readable JSON").option("--hours <n>", "Look-back window in hours (default 1)").option("--team <id>", "Filter to one team").option("--only <ids>", "for `test`: comma-separated spec/gut ids or prefixes").option("--group <name>", "for `test`: only specs whose group matches").option("--skip-guts", "for `test`: contract specs only").option("--guts-only", "for `test`: server-side gut checks only").option("--fail-fast", "for `test`: stop at the first failure").option("--timeout <s>", "for `test`: seconds to wait per check (default 150)").option("--perf", "for `test`: run the performance gate instead of the suite (fixed-rate load on a sandbox proxy)").option("--consumer", "for `test`: probe the data plane with the stored `consumer login` token instead of the suite").option("--path <p>", "for `test --consumer`: request path on the proxy (default /get)").option("--proxy <name@version>", "for `test --consumer`: the OAuth-door proxy to knock on (default: the sandbox proxy for a sandbox-tenant session)").option("--rps <n>", "for `test --perf`: requests per second (default 100, max 300)").option("--seconds <n>", "for `test --perf`: how long to send for (default 60, max 300)").option("--url <url>", "for `test --perf`: load this fixture URL instead of provisioning one (with --key; nothing is torn down)").option("--max-p50 <ms>", "for `test --perf`: client p50 threshold (default 250)").option("--max-p95 <ms>", "for `test --perf`: client p95 threshold (default 800)").option("--max-error-rate <pct>", "for `test --perf`: error-rate threshold in percent (default 0.5)").option("--max-gateway-p50 <ms>", "for `test --perf`: apiblaze-overhead p50 threshold (default 60)").option("--max-gateway-p95 <ms>", "for `test --perf`: apiblaze-overhead p95 threshold (default 250)").option("--project <name>", "Filter to one proxy").option("--api-version <v>", "Filter to one API version").option("--tenant <name>", "Filter to one tenant").option("--route <path>", "Filter to one route").option("--environment <env>", "Filter to one environment").option("--status-class <c>", "Filter to a status class (2xx/4xx/5xx)").option("--min-ms <n>", "For `latency slow`: minimum duration (default 1000)").option("--days <n>", "For `latency grades`: how many days back (default 7)").option("--excellent <ms>", "Grade threshold: under this is excellent (default 250)").option("--okay <ms>", "Grade threshold: under this is okay (default 500)").option("--bad <ms>", "Grade threshold: under this is bad, at/over is terrible (default 1000)").option("--key <key>", "For `billing meter`: a data-plane API key for the sandbox proxy (without it the served-request checks are SKIPPED) \xB7 for `test --perf --url`: the fixture's API key").option("--count <n>", "For `billing meter`: requests per check (default 3, max 10)").option("--mcp-host <host>", "For `billing meter`: an MCP host to check tools/call is charged once").action(action((sub, view, opts) => runOp(sub, opts, view))).addHelpText("after", () => `
 ${renderOpCommands()}
 `);
@@ -14495,10 +14827,10 @@ spec.command("set").description("Replace the stored OpenAPI spec from a local fi
 spec.command("carry").description("Copy a route's saved rules to the path a spec rename moved traffic to").argument("<project>", "Project name or id").requiredOption("--method <method>", "HTTP method of the route (GET, POST, ...)").requiredOption("--from <path>", "Old route path, e.g. /owners/{ownerId}").requiredOption("--to <path>", "New route path, e.g. /customers/{customerId}").option("--delete-source", "Also delete the old rules after carrying").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").option("--json", "Output machine-readable JSON").action(action((project, opts) => runSpecCarry(project, opts)));
 spec.command("delete-rule").description("Delete the saved rules for a route (e.g. an orphan left by a spec change)").argument("<project>", "Project name or id").requiredOption("--method <method>", "HTTP method of the route").requiredOption("--route <path>", "Route path, e.g. /owners/{ownerId}").option("--team <id|name>", "Team the project is in").option("--apiversion <version>", "API version").action(action((project, opts) => runSpecDeleteRule(project, opts)));
 var HELP_GROUPS = [
-  { title: "Chat", commands: ["docs", "apichat", "agent"] },
-  { title: "Setup", commands: ["dev", "create", "integration", "skill", "login", "init", "sidecar", "claim", "team", "whoami", "logout"] },
+  { title: "Chat", commands: ["docs", "apichat", "agent", "llm"] },
+  { title: "Setup", commands: ["dev", "create", "integration", "skill", "login", "init", "sidecar", "claim", "team", "whoami", "logout", "flush"] },
   { title: "Recipes \u2014 install a working setup, or publish yours", commands: ["search", "show", "install", "publish", "withdraw"] },
-  { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "iam", "identified", "preapprove", "rule", "domain", "delete", "target", "throttle", "rename", "spec", "export"] },
+  { title: "Control plane commands", commands: ["config", "projects", "logs", "tenant", "group", "admins", "apikeys", "iam", "identified", "preapprove", "allowoauthregistration", "rule", "domain", "delete", "job", "target", "throttle", "transform", "rename", "spec", "export"] },
   { title: "Data plane commands", commands: [
     { parent: "consumer", sub: "login" },
     { parent: "consumer", sub: "apikeys" },
@@ -14524,7 +14856,7 @@ function groupedCommandHelp() {
       const sub = byName.get(e.parent)?.commands.find((s) => s.name() === e.sub);
       return sub ? `  ${helpLabel(e).padEnd(width)}${sub.description()}` : "";
     }).filter(Boolean).join("\n");
-    return `${import_chalk63.default.bold(g.title)}
+    return `${import_chalk64.default.bold(g.title)}
 ${rows}`;
   }).join("\n\n");
 }
@@ -14535,7 +14867,7 @@ program.configureHelp({
   }
 });
 program.addHelpText("after", () => `
-${import_chalk63.default.bold("Don't like reading docs?")} Run ${import_chalk63.default.bgCyan.black.bold(` npx ${B.cli} docs `)} ${import_chalk63.default.cyan(`\u2014 ask an AI chatbot about ${B.product}, and let it act on your account.`)}
+${import_chalk64.default.bold("Don't like reading docs?")} Run ${import_chalk64.default.bgCyan.black.bold(` npx ${B.cli} docs `)} ${import_chalk64.default.cyan(`\u2014 ask an AI chatbot about ${B.product}, and let it act on your account.`)}
 
 ${groupedCommandHelp()}
 
@@ -14571,14 +14903,14 @@ async function recoverStaleTeam() {
     const { resolveLinkedTeam: resolveLinkedTeam2 } = await Promise.resolve().then(() => (init_team(), team_exports));
     const linked = await resolveLinkedTeam2({ preferredId: creds.teamId, interactive: !!process.stdin.isTTY });
     if (!linked) {
-      console.error(import_chalk63.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
+      console.error(import_chalk64.default.yellow("Your account has no teams anymore (deleted?). Run `apiblaze login` or `apiblaze create` to get a workspace."));
       return;
     }
     if (linked.teamId === creds.teamId) return;
     const next = { ...creds, teamId: linked.teamId, teamName: linked.teamName };
     delete next.activeTenant;
     saveCredentials(next);
-    console.error(import_chalk63.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk63.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
+    console.error(import_chalk64.default.yellow(`Your previous team no longer exists \u2014 relinked to ${import_chalk64.default.bold(linked.teamName ?? linked.teamId)}. Re-run your command.`));
   } catch {
   }
 }
@@ -14586,16 +14918,33 @@ async function printError(err) {
   if (err instanceof ApiError) {
     const data = err.body;
     const extra = [data?.body?.reason, data?.body?.details, data?.details, data?.body?.error].find((x) => typeof x === "string" && x && x !== err.message);
-    console.error(import_chalk63.default.red(`
+    console.error(import_chalk64.default.red(`
 API error (${err.status}): ${err.message}${extra ? ` \u2014 ${extra}` : ""}`));
     if (err.status === 403 || err.status === 404) {
       await recoverStaleTeam();
     }
   } else if (err instanceof Error) {
-    console.error(import_chalk63.default.red(`
+    console.error(import_chalk64.default.red(`
 Error: ${err.message}`));
   } else {
-    console.error(import_chalk63.default.red("\nUnknown error"));
+    console.error(import_chalk64.default.red("\nUnknown error"));
   }
 }
+function hintStaleCacheOnUnknownOption(cmd) {
+  cmd.exitOverride((err) => {
+    if (err.code === "commander.unknownOption") {
+      console.error(import_chalk64.default.yellow(
+        `
+This is ${B.cli} v${version}. If that option is documented but this build
+does not have it, your npx cache is serving an older copy \u2014 re-run as:
+`
+      ));
+      console.error(import_chalk64.default.cyan(`  npx ${B.cli}@latest ${process.argv.slice(2).join(" ")}
+`));
+    }
+    process.exit(err.exitCode);
+  });
+  for (const sub of cmd.commands) hintStaleCacheOnUnknownOption(sub);
+}
+hintStaleCacheOnUnknownOption(program);
 program.parse(process.argv);