@lukoweb/apitogo 0.2.2 → 0.2.10

package/dist/cli/cli.js

@@ -836,7 +836,7 @@ import { stat as stat4 } from "node:fs/promises";
 var fileExists;
 var init_file_exists = __esm({
   "src/config/file-exists.ts"() {
-    fileExists = (path95) => stat4(path95).then(() => true).catch(() => false);
+    fileExists = (path100) => stat4(path100).then(() => true).catch(() => false);
   }
 });
 
@@ -5809,24 +5809,24 @@ init_package_json();
 import yargs from "yargs/yargs";
 
 // src/cli/services/handler.ts
-import path48 from "node:path";
+import path49 from "node:path";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/config/v2/errors.ts
 init_invariant();
-function formatConfigIssue(issue2) {
-  const hint = issue2.hint ? ` ${issue2.hint}` : "";
-  const rest = issue2.message.slice(issue2.path.length);
-  const startsWithPath = issue2.path !== "" && issue2.message.startsWith(issue2.path) && (rest === "" || /^[\s:]/.test(rest));
-  const text = startsWithPath ? issue2.message : `${issue2.path === "" ? "(root)" : issue2.path}: ${issue2.message}`;
-  return `${text}${hint} [${issue2.code}]`;
+function formatConfigIssue(issue3) {
+  const hint = issue3.hint ? ` ${issue3.hint}` : "";
+  const rest = issue3.message.slice(issue3.path.length);
+  const startsWithPath = issue3.path !== "" && issue3.message.startsWith(issue3.path) && (rest === "" || /^[\s:]/.test(rest));
+  const text = startsWithPath ? issue3.message : `${issue3.path === "" ? "(root)" : issue3.path}: ${issue3.message}`;
+  return `${text}${hint} [${issue3.code}]`;
 }
 var ConfigError = class extends ApitogoError {
   issues;
   constructor(file, issues) {
     super(
       `${file} has ${issues.length} problem${issues.length === 1 ? "" : "s"}:
-${issues.map((issue2) => `  - ${formatConfigIssue(issue2)}`).join("\n")}`,
+${issues.map((issue3) => `  - ${formatConfigIssue(issue3)}`).join("\n")}`,
       { title: "Invalid apitogo config" }
     );
     this.name = "ConfigError";
@@ -6055,13 +6055,24 @@ var GatewayOriginSchema = z.strictObject({
   runtime: z.enum(["nodejs", "python", "dotnet"]).optional(),
   runtimeVersion: nonEmpty.optional(),
   exclude: pathList.optional(),
-  url: httpsUrl.optional()
+  url: httpsUrl.optional(),
+  /** Path the platform probes to check the origin, for example `/health`. */
+  healthPath: z.string().regex(/^\/(?!\/)/, { error: 'must start with a single "/"' }).optional(),
+  timeoutSeconds: z.int().min(1).max(120).optional(),
+  /** What the gateway sends to the origin as credential. The value is always a secret reference. */
+  auth: z.strictObject({
+    type: z.enum(["none", "header", "mtls"]),
+    name: nonEmpty.optional(),
+    value: secretRef.optional()
+  }).optional()
 });
 var GatewaySchema = z.strictObject({
   enabled,
   provider: nonEmpty.optional(),
   origin: GatewayOriginSchema,
   specs: z.array(path4).min(1, { error: "needs at least one OpenAPI file" }),
+  /** Who may read the OpenAPI file the platform publishes for this gateway. Default: public. */
+  export: z.strictObject({ access: z.enum(["public", "authenticated"]).optional() }).optional(),
   auth: z.strictObject({
     mode: z.enum(["identity", "oidc"]),
     metadataUrl: httpsUrl.optional(),
@@ -6069,15 +6080,27 @@ var GatewaySchema = z.strictObject({
     audiences: z.array(nonEmpty).optional()
   }).optional(),
   policies: z.strictObject({
+    access: z.strictObject({
+      jwt: z.boolean().optional(),
+      apiKey: z.boolean().optional(),
+      apiKeyHeader: nonEmpty.optional(),
+      bindKeyToToken: z.boolean().optional()
+    }).optional(),
     rateLimit: z.strictObject({
       calls: z.int().positive(),
-      periodSeconds: z.int().positive()
+      periodSeconds: z.int().positive(),
+      scope: z.enum(["key", "entitlement"]).optional()
     }).optional(),
     quota: z.strictObject({
       calls: z.int().positive(),
-      periodDays: z.int().min(1)
+      periodDays: z.int().min(1),
+      scope: z.enum(["key", "entitlement"]).optional()
     }).optional(),
-    cors: z.array(z.url()).optional()
+    cors: z.array(z.url()).optional(),
+    operations: z.strictObject({
+      public: z.array(nonEmpty).optional(),
+      deny: z.array(nonEmpty).optional()
+    }).optional()
   }).optional()
 });
 var connectionId = z.string().regex(/^[a-z0-9-]{1,32}$/, {
@@ -6166,8 +6189,8 @@ var ConfigV2Schema = z.strictObject({
 var REMOVED_KEYS = {
   "plans.provider": "plans.provider was removed. Only plans.billing.provider (stripe or none) is selectable."
 };
-function pathToString(path95) {
-  return path95.reduce(
+function pathToString(path100) {
+  return path100.reduce(
     (acc, segment) => typeof segment === "number" ? `${acc}[${segment}]` : acc === "" ? String(segment) : `${acc}.${String(segment)}`,
     ""
   );
@@ -6187,9 +6210,9 @@ function step(schema2, segment) {
   }
   return void 0;
 }
-function knownKeysAt(path95) {
+function knownKeysAt(path100) {
   let current = ConfigV2Schema;
-  for (const segment of path95) {
+  for (const segment of path100) {
     if (!current) return [];
     current = step(current, segment);
   }
@@ -6224,37 +6247,37 @@ function unknownKeyHint(fullPath, key, known) {
   if (closest) return `Did you mean "${closest.candidate}"?`;
   return known.length > 0 ? `Allowed keys: ${known.join(", ")}.` : void 0;
 }
-function mapIssue(issue2) {
-  const path95 = pathToString(issue2.path);
-  switch (issue2.code) {
+function mapIssue(issue3) {
+  const path100 = pathToString(issue3.path);
+  switch (issue3.code) {
     case "unrecognized_keys":
-      return issue2.keys.map((key) => {
-        const fullPath = pathToString([...issue2.path, key]);
+      return issue3.keys.map((key) => {
+        const fullPath = pathToString([...issue3.path, key]);
         return {
           code: "CONFIG_UNKNOWN_KEY",
           path: fullPath,
           message: `Unknown key "${key}".`,
-          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue2.path))
+          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue3.path))
         };
       });
     case "invalid_value":
       return [
         {
           code: "CONFIG_INVALID_VALUE",
-          path: path95,
-          message: `must be one of: ${issue2.values.map((v) => JSON.stringify(v)).join(", ")}.`
+          path: path100,
+          message: `must be one of: ${issue3.values.map((v) => JSON.stringify(v)).join(", ")}.`
         }
       ];
     case "custom": {
-      const code = typeof issue2.params?.code === "string" ? issue2.params.code : "CONFIG_INVALID_VALUE";
-      return [{ code, path: path95, message: issue2.message ?? "is invalid." }];
+      const code = typeof issue3.params?.code === "string" ? issue3.params.code : "CONFIG_INVALID_VALUE";
+      return [{ code, path: path100, message: issue3.message ?? "is invalid." }];
     }
     case "invalid_type":
       return [
-        /received undefined/.test(issue2.message) ? { code: "CONFIG_MISSING_FIELD", path: path95, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path95, message: issue2.message }
+        /received undefined/.test(issue3.message) ? { code: "CONFIG_MISSING_FIELD", path: path100, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path100, message: issue3.message }
       ];
     default:
-      return [{ code: "CONFIG_INVALID_VALUE", path: path95, message: issue2.message }];
+      return [{ code: "CONFIG_INVALID_VALUE", path: path100, message: issue3.message }];
   }
 }
 function isRecord(value) {
@@ -6564,6 +6587,7 @@ function resolveConfigV2(config2, configPath) {
       },
       specs: gateway.specs.map((spec) => path7.resolve(configDir, spec)),
       auth: gateway.auth,
+      export: gateway.export,
       policies: gateway.policies ?? {}
     };
   }
@@ -6703,7 +6727,7 @@ function dependencyRules(config2, resolved, out) {
 function checkDependencies(config2, resolved) {
   const issues = [];
   dependencyRules(config2, resolved, {
-    error: (issue2) => void issues.push(issue2),
+    error: (issue3) => void issues.push(issue3),
     warn: () => void 0
   });
   return issues;
@@ -6801,10 +6825,55 @@ async function docsContentRule(config2, patterns, resolved, out) {
 function isIpLiteral(hostname) {
   return /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || hostname.startsWith("[");
 }
+function originAuthRules(origin, out) {
+  const auth = origin.auth;
+  if (!auth) return;
+  const base = "gateway.origin.auth";
+  if (auth.type === "header") {
+    if (!auth.name)
+      out.error({
+        code: "GATEWAY_ORIGIN_INCOMPLETE",
+        path: `${base}.name`,
+        message: "origin.auth.type is header, so origin.auth.name is required.",
+        hint: 'For example: "X-Origin-Key".'
+      });
+    if (!auth.value)
+      out.error({
+        code: "GATEWAY_ORIGIN_INCOMPLETE",
+        path: `${base}.value`,
+        message: "origin.auth.type is header, so origin.auth.value is required.",
+        hint: 'A secret reference, for example "secret:ORIGIN_KEY". Store it with `apitogo secrets set ORIGIN_KEY`.'
+      });
+  } else if (auth.type === "none" && (auth.name || auth.value)) {
+    out.error({
+      code: "GATEWAY_ORIGIN_INVALID",
+      path: base,
+      message: "origin.auth.type is none, but a name or value is set.",
+      hint: 'Remove them, or set the type to "header".'
+    });
+  } else if (auth.type === "mtls") {
+    out.error({
+      code: "GATEWAY_CAPABILITY_UNSUPPORTED",
+      path: `${base}.type`,
+      message: "Client certificates (mtls) for the origin are not available yet.",
+      hint: 'Use type "header" with a secret.'
+    });
+  }
+}
 async function gatewayRules(resolved, out) {
   const gateway = resolved.gateway;
   if (!gateway?.enabled) return;
   const origin = gateway.origin;
+  (gateway.policies.cors ?? []).forEach((site, index) => {
+    const { pathname, search, hash: hash2 } = new URL(site);
+    if (pathname === "/" && !search && !hash2 && !site.endsWith("/")) return;
+    out.error({
+      code: "GATEWAY_CORS_ORIGIN_INVALID",
+      path: `gateway.policies.cors[${index}]`,
+      message: `"${site}" is not a browser origin: it has a path, a query or a trailing slash.`,
+      hint: `Use only scheme and host, for example "${new URL(site).origin}".`
+    });
+  });
   if (origin.mode === "managed") {
     for (const field of ["source", "runtime", "runtimeVersion"]) {
       if (!origin[field]) {
@@ -6881,6 +6950,15 @@ async function gatewayRules(resolved, out) {
       }
     }
   }
+  originAuthRules(origin, out);
+  if (gateway.specs.length > 1) {
+    out.warn({
+      code: "GATEWAY_SPEC_INVALID",
+      path: "gateway.specs",
+      message: "gateway.specs lists several files, but the platform takes one OpenAPI file per gateway, so deploy will refuse it.",
+      hint: "Merge them into one file."
+    });
+  }
   for (const [index, spec] of gateway.specs.entries())
     await specRule(spec, index, resolved, out);
   authRule(resolved, out);
@@ -7119,8 +7197,8 @@ async function checkConfigV2(config2, resolved, context = {}) {
     "online rules were not run (provider capabilities, origin reachability, OIDC discovery, tier limits)"
   ];
   const out = {
-    error: (issue2) => errors.push(issue2),
-    warn: (issue2) => warnings.push(issue2)
+    error: (issue3) => errors.push(issue3),
+    warn: (issue3) => warnings.push(issue3)
   };
   dependencyRules(config2, resolved, out);
   secretRules(config2, context, out, skipped);
@@ -7223,7 +7301,7 @@ var ServiceManifestSchema = z3.looseObject({
     }).optional()
   }).default({})
 });
-var issue = (code, path95, message, hint) => ({ code, path: path95, message, hint });
+var issue = (code, path100, message, hint) => ({ code, path: path100, message, hint });
 function parseManifest(raw, file = "services.json") {
   const version = typeof raw === "object" && raw !== null && "schemaVersion" in raw ? raw.schemaVersion : void 0;
   if (typeof version === "number" && version > SUPPORTED_MANIFEST_SCHEMA) {
@@ -7351,6 +7429,34 @@ function withPortalEntry(existing, info) {
     }
   };
 }
+function withGatewayEntry(existing, info) {
+  const base = existing ?? parseManifest({
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    project: { name: info.projectName }
+  });
+  const baseUrl = info.baseUrl.replace(/\/+$/, "");
+  return {
+    ...base,
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    generatedAt: (info.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    preview: void 0,
+    project: { ...base.project, id: info.projectId, name: info.projectName },
+    services: {
+      ...base.services,
+      gateway: {
+        ...base.services.gateway,
+        provider: info.provider,
+        status: "ready",
+        baseUrl,
+        audience: baseUrl,
+        capabilities: info.capabilities,
+        ...info.openapiUrl ? { openapiUrl: info.openapiUrl } : {},
+        ...info.openapiHash ? { openapiHash: info.openapiHash } : {},
+        ...info.keyHeaderName ? { keyHeaderName: info.keyHeaderName } : {}
+      }
+    }
+  };
+}
 async function writeManifest(state, manifest) {
   const file = manifestPathFor(state);
   await mkdir3(path10.dirname(file), { recursive: true });
@@ -7368,6 +7474,78 @@ async function writeManifest(state, manifest) {
     throw error;
   }
 }
+async function removeServicesFromManifest(state, names) {
+  const existing = await readManifest(state);
+  if (!existing) return;
+  const services = Object.fromEntries(
+    Object.entries(existing.services).filter(
+      ([name]) => !names.includes(name)
+    )
+  );
+  if (Object.keys(services).length === 0) {
+    await rm(manifestPathFor(state), { force: true });
+    return;
+  }
+  await writeManifest(state, { ...existing, services });
+}
+
+// src/config/v2/gateway-request.ts
+function derivedCorsSites(sites) {
+  const originOf = (url2) => {
+    if (!url2) return void 0;
+    try {
+      const { protocol, origin } = new URL(url2);
+      return protocol === "https:" ? origin : void 0;
+    } catch {
+      return void 0;
+    }
+  };
+  const found = [
+    { origin: originOf(sites.docsUrl), source: "docs" },
+    { origin: originOf(sites.portalUrl), source: "portal" }
+  ].flatMap((site) => site.origin ? [{ ...site, origin: site.origin }] : []);
+  const seen = /* @__PURE__ */ new Set();
+  return found.filter((site) => !seen.has(site.origin) && seen.add(site.origin)).sort((a, b) => a.origin < b.origin ? -1 : a.origin > b.origin ? 1 : 0);
+}
+var defined = (value) => Object.fromEntries(
+  Object.entries(value).filter(([, item]) => item !== void 0)
+);
+function gatewayConfigBody(gateway, derivedCors = []) {
+  const { origin, auth, policies } = gateway;
+  const body = {
+    provider: gateway.provider,
+    origin: defined({
+      mode: origin.mode,
+      url: origin.url,
+      healthPath: origin.healthPath,
+      timeoutSeconds: origin.timeoutSeconds,
+      auth: origin.auth ? defined({ ...origin.auth }) : void 0
+    })
+  };
+  if (auth) body.auth = defined({ ...auth });
+  if (gateway.export) body.export = defined({ ...gateway.export });
+  if (derivedCors.length > 0) body.corsDerived = derivedCors;
+  if (Object.keys(policies).length > 0) {
+    body.policies = defined({
+      access: policies.access ? defined({ ...policies.access }) : void 0,
+      rateLimit: policies.rateLimit ? defined({ ...policies.rateLimit }) : void 0,
+      quota: policies.quota ? defined({ ...policies.quota }) : void 0,
+      cors: policies.cors,
+      operations: policies.operations ? defined({ ...policies.operations }) : void 0
+    });
+  }
+  return body;
+}
+function stableJson(value) {
+  return JSON.stringify(
+    value,
+    (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(
+      Object.entries(item).sort(
+        ([a], [b]) => a < b ? -1 : a > b ? 1 : 0
+      )
+    ) : item
+  );
+}
 
 // src/config/v2/wrapper.ts
 import { mkdir as mkdir4, readFile as readFile4, rename as rename2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
@@ -8030,12 +8208,12 @@ async function planAddService(service, options) {
       )
     );
     const added = dependencyProblems(next, resolved.configPath).filter(
-      (issue2) => !before.has(issue2.code + issue2.path)
+      (issue3) => !before.has(issue3.code + issue3.path)
     );
     if (added.length > 0) {
       throw new ServiceEditError(
-        added.map((issue2) => issue2.message).join(" "),
-        added.map((issue2) => issue2.hint).filter(Boolean).join(" ") || "Add the missing service first."
+        added.map((issue3) => issue3.message).join(" "),
+        added.map((issue3) => issue3.hint).filter(Boolean).join(" ") || "Add the missing service first."
       );
     }
   }
@@ -8064,11 +8242,11 @@ async function planRemoveService(service, options) {
     dependencyProblems(config2, resolved.configPath).map((i) => i.code + i.path)
   );
   const caused = dependencyProblems(next, resolved.configPath).filter(
-    (issue2) => !before.has(issue2.code + issue2.path)
+    (issue3) => !before.has(issue3.code + issue3.path)
   );
   if (caused.length > 0) {
     throw new ServiceEditError(
-      `${service} cannot be removed while something depends on it: ${caused.map((issue2) => issue2.message).join(" ")}`,
+      `${service} cannot be removed while something depends on it: ${caused.map((issue3) => issue3.message).join(" ")}`,
       "Remove or change the dependent service first."
     );
   }
@@ -8139,6 +8317,18 @@ async function setProjectId(dir, projectId) {
   await writeConfig(resolved.configPath, next);
   return true;
 }
+async function clearProjectId(dir, projectId) {
+  const { config: config2, resolved } = loadConfigV2(dir);
+  if (config2.project?.id !== projectId) return false;
+  const { id: _id, ...project } = config2.project;
+  const { project: _old, ...rest } = config2;
+  const next = reparse(resolved.configPath, {
+    ...rest,
+    ...Object.keys(project).length > 0 ? { project } : {}
+  });
+  await writeConfig(resolved.configPath, next);
+  return true;
+}
 
 // src/config/v2/ledger.ts
 init_invariant();
@@ -8273,13 +8463,24 @@ async function runPipeline(state, service, steps, options = {}) {
   }
   return outcomes;
 }
+async function clearServices(state, services) {
+  const ledger = await readLedger(state);
+  const remaining = Object.fromEntries(
+    Object.entries(ledger.services).filter(
+      ([name]) => !services.includes(name)
+    )
+  );
+  if (Object.keys(remaining).length === Object.keys(ledger.services).length)
+    return;
+  await writeLedger(state, { ...ledger, services: remaining });
+}
 
 // src/cli/services/handler.ts
 init_invariant();
 
 // src/cli/check/v2.ts
 init_apitogo_config_core();
-import { readFile as readFile11 } from "node:fs/promises";
+import { readFile as readFile12 } from "node:fs/promises";
 import path46 from "node:path";
 
 // src/cli/platform/client/platform-api.ts
@@ -8393,8 +8594,8 @@ var PlatformApiClient = class {
   constructor(config2) {
     this.config = config2;
   }
-  url(path95) {
-    return `${this.config.apiUrl}${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  url(path100) {
+    return `${this.config.apiUrl}${path100.startsWith("/") ? path100 : `/${path100}`}`;
   }
   headers(extra) {
     return {
@@ -8404,9 +8605,9 @@ var PlatformApiClient = class {
       ...extra
     };
   }
-  async request(method, path95, init4) {
+  async request(method, path100, init4) {
     const response = await fetchWithRetry(
-      this.url(path95),
+      this.url(path100),
       {
         method,
         ...init4,
@@ -8621,6 +8822,92 @@ var PlatformApiClient = class {
     }
     return await response.json();
   }
+  /** Uploads the OpenAPI file of the gateway. The same file twice changes nothing. */
+  async putGatewaySpec(projectId, content) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/gateway/spec`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: content
+      }
+    );
+  }
+  /** Sends the wanted gateway state. The platform checks it all at once and answers with a ticket to poll. */
+  putGatewayConfig(projectId, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/gateway/config`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  getGatewayReconciliation(projectId, reconciliationId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/gateway/reconciliations/${reconciliationId}`
+    );
+  }
+  getGatewayStatus(projectId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/gateway/status`
+    );
+  }
+  /** The OpenAPI file as the gateway serves it (servers, security and denied operations already applied). */
+  async getGatewayOpenApi(projectId) {
+    const response = await fetchWithRetry(
+      this.url(`/api/v1/projects/${projectId}/gateway/openapi.json`),
+      { method: "GET", headers: this.headers() },
+      {
+        method: "GET",
+        retryMutatingOnServerError: false,
+        maxRetries: MAX_RETRIES
+      }
+    );
+    if (!response.ok) throw await parseErrorResponse(response);
+    return response.text();
+  }
+  getGatewayCapabilities(projectId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/gateway/capabilities`
+    );
+  }
+  /**
+   * The online rules of `check`: origin address, OIDC discovery, plan capabilities, secrets and the OpenAPI text.
+   * Changes nothing on the platform and always answers with the list of problems.
+   */
+  checkGateway(projectId, body) {
+    return this.request(
+      "POST",
+      `/api/v1/projects/${projectId}/gateway/check`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** The dry run of a deploy: what the gateway would change. The platform changes nothing. */
+  planGateway(projectId, body) {
+    return this.request(
+      "POST",
+      `/api/v1/projects/${projectId}/gateway/plan`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** Asks the platform to remove the gateway. Answers with a ticket; the platform revokes keys and frees the unit. */
+  deleteGateway(projectId) {
+    return this.request(
+      "DELETE",
+      `/api/v1/projects/${projectId}/gateway`
+    );
+  }
   getDevPortalBackend(projectId) {
     return this.request(
       "GET",
@@ -8683,15 +8970,15 @@ var PlatformApiClient = class {
       }
     );
   }
-  deleteDevPortalPage(projectId, path95) {
-    const query = new URLSearchParams({ path: path95 });
+  deleteDevPortalPage(projectId, path100) {
+    const query = new URLSearchParams({ path: path100 });
     return this.request(
       "DELETE",
       `/api/v1/projects/${projectId}/dev-portal/pages/files?${query.toString()}`
     );
   }
-  renameDevPortalPage(projectId, path95, newName) {
-    const query = new URLSearchParams({ path: path95 });
+  renameDevPortalPage(projectId, path100, newName) {
+    const query = new URLSearchParams({ path: path100 });
     return this.request(
       "POST",
       `/api/v1/projects/${projectId}/dev-portal/pages/files/rename?${query.toString()}`,
@@ -8807,8 +9094,8 @@ var PlatformApiClient = class {
    * the project-less endpoint is used; `planTier` overrides the tier used for paid-plan checks.
    */
   validateGatewayPlans(plans, options = {}) {
-    const path95 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
-    return this.request("POST", path95, {
+    const path100 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
+    return this.request("POST", path100, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ plans, planTier: options.planTier })
     });
@@ -8909,8 +9196,8 @@ var PlatformApiClient = class {
   }
 };
 async function readFileBytes(filePath) {
-  const { readFile: readFile27 } = await import("node:fs/promises");
-  const buffer = await readFile27(filePath);
+  const { readFile: readFile29 } = await import("node:fs/promises");
+  const buffer = await readFile29(filePath);
   const arrayBuffer = new ArrayBuffer(buffer.byteLength);
   new Uint8Array(arrayBuffer).set(buffer);
   return arrayBuffer;
@@ -9164,7 +9451,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.2",
+  version: "0.2.10",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -9946,14 +10233,14 @@ var flattenAllOf = (schema2) => {
 };
 
 // src/lib/util/traverse.ts
-var traverse = (specification, transform, path95 = []) => {
-  const transformed = transform(specification, path95);
+var traverse = (specification, transform, path100 = []) => {
+  const transformed = transform(specification, path100);
   if (typeof transformed !== "object" || transformed === null) {
     return transformed;
   }
   const result = Array.isArray(transformed) ? [] : {};
   for (const [key, value] of Object.entries(transformed)) {
-    const currentPath = [...path95, key];
+    const currentPath = [...path100, key];
     if (Array.isArray(value)) {
       result[key] = value.map(
         (item, index) => typeof item === "object" && item != null ? traverse(item, transform, [...currentPath, index.toString()]) : item
@@ -9981,9 +10268,9 @@ var resolveLocalRef = (schema2, ref) => {
   if (schemaCache?.has(ref)) {
     return schemaCache.get(ref);
   }
-  const path95 = ref.split("/").slice(1);
+  const path100 = ref.split("/").slice(1);
   let current = schema2;
-  for (const segment of path95) {
+  for (const segment of path100) {
     if (!current || typeof current !== "object") {
       current = null;
     }
@@ -10002,7 +10289,7 @@ var dereference = async (schema2, resolvers = []) => {
   }
   const cloned = structuredClone(schema2);
   const visited = /* @__PURE__ */ new Set();
-  const resolve = async (current, path95) => {
+  const resolve = async (current, path100) => {
     if (isIndexableObject(current)) {
       if (visited.has(current)) {
         return CIRCULAR_REF;
@@ -10010,7 +10297,7 @@ var dereference = async (schema2, resolvers = []) => {
       visited.add(current);
       if (Array.isArray(current)) {
         for (let index = 0; index < current.length; index++) {
-          current[index] = await resolve(current[index], `${path95}/${index}`);
+          current[index] = await resolve(current[index], `${path100}/${index}`);
         }
       } else {
         if ("$ref" in current && typeof current.$ref === "string") {
@@ -10021,13 +10308,13 @@ var dereference = async (schema2, resolvers = []) => {
           for (const resolver of resolvers) {
             const resolved = await resolver($ref);
             if (resolved) {
-              result2 = await resolve(resolved, path95);
+              result2 = await resolve(resolved, path100);
               break;
             }
           }
           if (result2 === void 0) {
             const resolved = await resolveLocalRef(cloned, $ref);
-            result2 = await resolve(resolved, path95);
+            result2 = await resolve(resolved, path100);
           }
           if (hasSiblings) {
             if (result2 === CIRCULAR_REF) {
@@ -10040,7 +10327,7 @@ var dereference = async (schema2, resolvers = []) => {
           return result2;
         }
         for (const key in current) {
-          current[key] = await resolve(current[key], `${path95}/${key}`);
+          current[key] = await resolve(current[key], `${path100}/${key}`);
         }
       }
       visited.delete(current);
@@ -10079,9 +10366,9 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (sub, path95) => {
+  schema2 = traverse(schema2, (sub, path100) => {
     if (sub.example !== void 0) {
-      if (isSchemaPath(path95 ?? [])) {
+      if (isSchemaPath(path100 ?? [])) {
         sub.examples = [sub.example];
       } else {
         sub.examples = {
@@ -10094,11 +10381,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
+  schema2 = traverse(schema2, (schema3, path100) => {
     if (schema3.type === "object" && schema3.properties !== void 0) {
-      const parentPath = path95?.slice(0, -1);
+      const parentPath = path100?.slice(0, -1);
       const isMultipart = parentPath?.some((segment, index) => {
-        return segment === "content" && path95?.[index + 1] === "multipart/form-data";
+        return segment === "content" && path100?.[index + 1] === "multipart/form-data";
       });
       if (isMultipart) {
         const entries = Object.entries(schema3.properties);
@@ -10112,8 +10399,8 @@ var upgradeSchema = (schema2) => {
     }
     return schema3;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
-    if (path95?.includes("content") && path95.includes("application/octet-stream")) {
+  schema2 = traverse(schema2, (schema3, path100) => {
+    if (path100?.includes("content") && path100.includes("application/octet-stream")) {
       return {};
     }
     if (schema3.type === "string" && schema3.format === "binary") {
@@ -10139,11 +10426,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
+  schema2 = traverse(schema2, (schema3, path100) => {
     if (schema3.type === "string" && schema3.format === "byte") {
-      const parentPath = path95?.slice(0, -1);
+      const parentPath = path100?.slice(0, -1);
       const contentMediaType = parentPath?.find(
-        (_, index) => path95?.[index - 1] === "content"
+        (_, index) => path100?.[index - 1] === "content"
       );
       return {
         type: "string",
@@ -10155,7 +10442,7 @@ var upgradeSchema = (schema2) => {
   });
   return schema2;
 };
-function isSchemaPath(path95) {
+function isSchemaPath(path100) {
   const schemaLocations = [
     ["components", "schemas"],
     "properties",
@@ -10168,10 +10455,10 @@ function isSchemaPath(path95) {
   ];
   return schemaLocations.some((location) => {
     if (Array.isArray(location)) {
-      return location.every((segment, index) => path95[index] === segment);
+      return location.every((segment, index) => path100[index] === segment);
     }
-    return path95.includes(location);
-  }) || path95.includes("schema") || path95.some((segment) => segment.endsWith("Schema"));
+    return path100.includes(location);
+  }) || path100.includes("schema") || path100.some((segment) => segment.endsWith("Schema"));
 }
 
 // src/lib/oas/parser/index.ts
@@ -10253,13 +10540,13 @@ var OPENAPI_PROPS = /* @__PURE__ */ new Set([
   "anyOf",
   "oneOf"
 ]);
-var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path95 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
+var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path100 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
   if (obj === null || typeof obj !== "object") return obj;
   const refPath = obj.__$ref;
   const isCircular = currentPath.has(obj) || typeof refPath === "string" && currentRefPaths.has(refPath);
   if (isCircular) {
     if (typeof refPath === "string") return SCHEMA_REF_PREFIX + refPath;
-    const circularProp = path95.find((p) => !OPENAPI_PROPS.has(p)) || path95[0];
+    const circularProp = path100.find((p) => !OPENAPI_PROPS.has(p)) || path100[0];
     return [CIRCULAR_REF, circularProp].filter(Boolean).join(":");
   }
   if (refs.has(obj)) return refs.get(obj);
@@ -10269,7 +10556,7 @@ var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs
     value,
     currentPath,
     refs,
-    [...path95, key],
+    [...path100, key],
     currentRefPaths
   );
   const result = Array.isArray(obj) ? obj.map((item, i) => recurse(item, i.toString())) : Object.fromEntries(
@@ -10304,7 +10591,7 @@ var resolveExtensions = (obj) => Object.fromEntries(
 var getAllTags = (schema2) => {
   const rootTags = schema2.tags ?? [];
   const operations = Object.values(schema2.paths ?? {}).flatMap(
-    (path95) => HttpMethods.map((k) => path95?.[k]).filter((op) => op != null)
+    (path100) => HttpMethods.map((k) => path100?.[k]).filter((op) => op != null)
   );
   const operationTags = new Set(operations.flatMap((op) => op.tags ?? []));
   const hasUntaggedOperations = operations.some(
@@ -10359,7 +10646,7 @@ var getAllSlugs = (ops, schemaTags = []) => {
 var getOperationSlugKey = (op) => [op.path, op.method, op.operationId, op.summary].filter(Boolean).join("-");
 var getAllOperations = (paths) => {
   const operations = Object.entries(paths ?? {}).flatMap(
-    ([path95, value]) => HttpMethods.flatMap((method) => {
+    ([path100, value]) => HttpMethods.flatMap((method) => {
       if (!value?.[method]) return [];
       const operation = value[method];
       const pathParameters = value.parameters ?? [];
@@ -10379,7 +10666,7 @@ var getAllOperations = (paths) => {
       return {
         ...operation,
         method,
-        path: path95,
+        path: path100,
         parameters,
         servers,
         tags: operation.tags ?? []
@@ -10737,8 +11024,8 @@ var Schema = builder.objectRef("Schema").implement({
     }),
     paths: t.field({
       type: [PathItem],
-      resolve: (root) => Object.entries(root.paths ?? {}).map(([path95, value]) => ({
-        path: path95,
+      resolve: (root) => Object.entries(root.paths ?? {}).map(([path100, value]) => ({
+        path: path100,
         // biome-ignore lint/style/noNonNullAssertion: value is guaranteed to be defined
         methods: Object.keys(value)
       }))
@@ -10903,7 +11190,7 @@ init_joinUrl();
 
 // src/vite/api/schema-codegen.ts
 var unescapeJsonPointer = (uri) => decodeURIComponent(uri.replace(/~1/g, "/").replace(/~0/g, "~"));
-var getSegmentsFromPath = (path95) => path95.split("/").slice(1).map(unescapeJsonPointer);
+var getSegmentsFromPath = (path100) => path100.split("/").slice(1).map(unescapeJsonPointer);
 var createLocalRefMap = (obj) => {
   const refMap = /* @__PURE__ */ new Map();
   const siblingsMap = /* @__PURE__ */ new Map();
@@ -10934,16 +11221,16 @@ var replaceMarkers = (code, mergedRefs) => code.replace(/"__refMap:(.*?)"/g, '__
   /"__refMap\+Siblings:(.*?)"/g,
   (_, key) => mergedRefs.get(key) ?? `__refMap["${key}"]`
 );
-var lookup = (schema2, path95, filePath) => {
-  const parts = getSegmentsFromPath(path95);
+var lookup = (schema2, path100, filePath) => {
+  const parts = getSegmentsFromPath(path100);
   let val = schema2;
   for (const part of parts) {
     while (val.$ref?.startsWith("#/")) {
-      val = val.$ref === path95 ? val : lookup(schema2, val.$ref, filePath);
+      val = val.$ref === path100 ? val : lookup(schema2, val.$ref, filePath);
     }
     if (val[part] === void 0) {
       throw new Error(
-        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path95}`
+        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path100}`
       );
     }
     val = val[part];
@@ -11188,8 +11475,8 @@ var SchemaManager = class {
       }
     }
   };
-  getLatestSchema = (path95) => this.processedSchemas[path95]?.at(0);
-  getSchemasForPath = (path95) => this.processedSchemas[path95];
+  getLatestSchema = (path100) => this.processedSchemas[path100]?.at(0);
+  getSchemasForPath = (path100) => this.processedSchemas[path100];
   getSchemaImports = () => Object.values(this.processedSchemas).flat().filter((s) => s.importKey);
   getUrlToFilePathMap = () => {
     const map = /* @__PURE__ */ new Map();
@@ -13625,14 +13912,14 @@ async function generateSitemap({
 
 // src/vite/prerender/utils.ts
 init_joinUrl();
-var resolveRoutePath = (path95) => {
-  const segments = path95.split("/");
+var resolveRoutePath = (path100) => {
+  const segments = path100.split("/");
   if (segments.some((s) => s.startsWith(":") && !s.endsWith("?"))) {
     return void 0;
   }
   return segments.filter((s) => !s.startsWith(":")).join("/") || void 0;
 };
-var isSkipped = (path95) => path95.includes("*") || /^\d+$/.test(path95);
+var isSkipped = (path100) => path100.includes("*") || /^\d+$/.test(path100);
 var resolveRoutes = (routes, parentPath = "") => routes.flatMap((route) => {
   if (route.path && isSkipped(route.path)) return [];
   const routePath = route.path ? resolveRoutePath(route.path) : void 0;
@@ -14081,11 +14368,94 @@ async function buildV2(options) {
   return { skipped, buildDir, hash: hash2 };
 }
 
+// src/cli/check/gateway-online.ts
+import { readFile as readFile11 } from "node:fs/promises";
+var SPEC_SEND_LIMIT = 5 * 1024 * 1024 + 64 * 1024;
+var issue2 = (code, path100, message, hint) => ({ code, path: path100, message, hint });
+function capabilityIssues(gateway, answer) {
+  const can = answer.capabilities;
+  const plan2 = `your ${answer.tier} plan`;
+  const found = [];
+  const unsupported = (path100, what, hint) => found.push(
+    issue2(
+      "GATEWAY_CAPABILITY_UNSUPPORTED",
+      path100,
+      `${what} is not available on ${plan2}.`,
+      hint
+    )
+  );
+  if (gateway.origin.mode === "managed" && can.managedOrigin !== true)
+    unsupported(
+      "gateway.origin.mode",
+      "A managed origin",
+      "Use a proxy origin, or change your plan."
+    );
+  if (gateway.origin.mode === "proxy" && can.proxyOrigin !== true)
+    unsupported(
+      "gateway.origin.mode",
+      "A proxy origin",
+      "Use a managed origin, or change your plan."
+    );
+  if (gateway.origin.auth?.type === "mtls" && can.originMtls !== true)
+    unsupported(
+      "gateway.origin.auth.type",
+      "Client certificates (mtls) for the origin",
+      'Use type "header" with a secret.'
+    );
+  if (gateway.policies.access?.bindKeyToToken === true && can.bindKeyToToken !== true)
+    unsupported(
+      "gateway.policies.access.bindKeyToToken",
+      "Binding a key to a token",
+      "Remove bindKeyToToken."
+    );
+  for (const [name, scope] of [
+    ["rateLimit", gateway.policies.rateLimit?.scope],
+    ["quota", gateway.policies.quota?.scope]
+  ])
+    if (scope === "entitlement" && can.quotaPerEntitlement !== true)
+      unsupported(
+        `gateway.policies.${name}.scope`,
+        "Counting per entitlement",
+        'Use scope "key".'
+      );
+  return found;
+}
+async function onlineGatewayRules(gateway, projectId, api, derivedCors = []) {
+  let spec;
+  const specFile = gateway.specs[0];
+  if (specFile) {
+    try {
+      const text = await readFile11(specFile, "utf8");
+      if (text.length <= SPEC_SEND_LIMIT) spec = text;
+    } catch {
+    }
+  }
+  try {
+    const capabilities = await api.capabilities(projectId);
+    const result = await api.check(projectId, {
+      config: gatewayConfigBody(gateway, derivedCors),
+      ...spec === void 0 ? {} : { spec }
+    });
+    const fromPlatform = result.issues.map(
+      (item) => issue2(item.code, item.field, item.message, item.hint)
+    );
+    return {
+      issues: [...capabilityIssues(gateway, capabilities), ...fromPlatform]
+    };
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    return {
+      issues: [],
+      skipped: `the gateway's online rules were not run: the platform could not be asked (${reason})`
+    };
+  }
+}
+
 // src/cli/check/v2.ts
 async function isConfigV2(dir) {
   try {
     return /"version"\s*:\s*2\b/.test(
-      await readFile11(path46.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
+      await readFile12(path46.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
     );
   } catch {
     return false;
@@ -14104,6 +14474,46 @@ async function fetchSecretNames(config2, configuredProjectId, args, deps) {
     };
   }
 }
+async function addGatewayOnlineRules(report, resolved, args, deps) {
+  const gateway = resolved.gateway;
+  if (args.offline || !deps.gateway || !gateway?.enabled) return;
+  const projectId = resolved.project.id || deps.envProjectId?.trim();
+  if (!projectId) {
+    report.skipped.push(
+      "the gateway's online rules were not run: this folder is not linked to a project (run `apitogo project create`)"
+    );
+    return;
+  }
+  const manifest = await readManifest(resolved.state);
+  const result = await onlineGatewayRules(
+    gateway,
+    projectId,
+    deps.gateway,
+    derivedCorsSites({
+      portalUrl: manifest?.services.portal?.url,
+      docsUrl: resolved.portal?.docs.provider === "external" ? resolved.portal.docs.url : void 0
+    })
+  );
+  if (result.skipped) {
+    report.skipped.push(result.skipped);
+    return;
+  }
+  const seen = new Set(
+    [...report.errors, ...report.warnings].map((i) => `${i.code}|${i.path}`)
+  );
+  for (const item of result.issues) {
+    const key = `${item.code}|${item.path}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    report.errors.push(item);
+  }
+  report.skipped = report.skipped.filter(
+    (note) => !note.startsWith("online rules were not run")
+  );
+  report.skipped.unshift(
+    "online rules ran for the gateway only; the other services have none yet"
+  );
+}
 async function validatePortalBuild(dir) {
   try {
     await buildV2({ dir, force: true, jsonOnly: true });
@@ -14113,7 +14523,7 @@ async function validatePortalBuild(dir) {
       return {
         code: error.issues[0]?.code ?? "PORTAL_BUILD_FAILED",
         path: error.issues[0]?.path ?? "portal",
-        message: error.issues.map((issue2) => issue2.message).join(" "),
+        message: error.issues.map((issue3) => issue3.message).join(" "),
         hint: error.issues[0]?.hint
       };
     }
@@ -14142,6 +14552,7 @@ async function runCheckV2(dir, args = {}, deps = {}) {
       knownSecrets: online.names
     });
     if (online.failure) report.skipped.push(online.failure);
+    await addGatewayOnlineRules(report, resolved, args, deps);
   } catch (error) {
     if (!(error instanceof ConfigError)) throw error;
     report = {
@@ -14168,11 +14579,11 @@ async function runCheckV2(dir, args = {}, deps = {}) {
     ...report
   };
 }
-var line = (label, issue2) => `${label}: ${formatConfigIssue(issue2)}`;
+var line = (label, issue3) => `${label}: ${formatConfigIssue(issue3)}`;
 function formatCheckV2(output4) {
   const lines = [
-    ...output4.errors.map((issue2) => line("error", issue2)),
-    ...output4.warnings.map((issue2) => line("warning", issue2)),
+    ...output4.errors.map((issue3) => line("error", issue3)),
+    ...output4.warnings.map((issue3) => line("warning", issue3)),
     ...output4.skipped.map((note) => `not checked: ${note}`)
   ];
   const errors = `${output4.errors.length} error${output4.errors.length === 1 ? "" : "s"}`;
@@ -14189,7 +14600,11 @@ function platformDependencies(args) {
     const client = new PlatformApiClient(config2);
     return {
       envProjectId: config2.defaultProjectId,
-      listSecrets: async (projectId) => (await client.listSecrets(projectId)).secrets.map((s) => s.name)
+      listSecrets: async (projectId) => (await client.listSecrets(projectId)).secrets.map((s) => s.name),
+      gateway: {
+        check: (projectId, body) => client.checkGateway(projectId, body),
+        capabilities: (projectId) => client.getGatewayCapabilities(projectId)
+      }
     };
   } catch {
     return {};
@@ -14205,6 +14620,9 @@ async function checkV2(dir, args, deps = platformDependencies(args)) {
   if (output4.status === "failed") process.exitCode = 1;
 }
 
+// src/cli/services/handler.ts
+init_package_json();
+
 // src/cli/init/v2-handler.ts
 import path47 from "node:path";
 import { createInterface } from "node:readline/promises";
@@ -14339,7 +14757,7 @@ async function initV2(argv) {
       `Created ${path47.basename(plan2.configPath)} (config version 2, ${plan2.layout} layout) in ${dir}.`
     );
     printHintToConsole(
-      "Config version 2 is a preview: check, run and build read it; deploy still reads the version 1 config."
+      "Config version 2 is a preview: add, remove, check, run, build, plan, status, deploy and secrets read it."
     );
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -14361,6 +14779,81 @@ async function initV2(argv) {
   }
 }
 
+// src/cli/services/packages.ts
+import { spawn } from "node:child_process";
+import { existsSync as existsSync5 } from "node:fs";
+import path48 from "node:path";
+var USER_PANEL_PACKAGE = "@lukoweb/apitogo-module-user-panel";
+var BILLING_PLUGIN_PACKAGE = "@lukoweb/apitogo-plugin-dev-portal-billing";
+function packagesForConfig(config2) {
+  const portal = config2.portal;
+  if (!portal || portal.enabled === false || portal.console?.enabled === false)
+    return [];
+  const identity = config2.identity && config2.identity.enabled !== false;
+  const plans = config2.plans && config2.plans.enabled !== false;
+  return [
+    ...identity || plans ? [USER_PANEL_PACKAGE] : [],
+    ...plans ? [BILLING_PLUGIN_PACKAGE] : []
+  ];
+}
+function isInstalled(dir, name) {
+  for (let current = path48.resolve(dir); ; current = path48.dirname(current)) {
+    if (existsSync5(path48.join(current, "node_modules", name, "package.json")))
+      return true;
+    if (path48.dirname(current) === current) return false;
+  }
+}
+function missingPackages(dir, names) {
+  return names.filter((name) => !isInstalled(dir, name));
+}
+function detectPackageManager(dir) {
+  if (existsSync5(path48.join(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync5(path48.join(dir, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function installCommand(manager, names, version) {
+  const specs = names.map((name) => `${name}@${version}`);
+  return manager === "npm" ? { command: "npm", args: ["install", ...specs] } : { command: manager, args: ["add", ...specs] };
+}
+var runInstaller = (dir, { command: command2, args }) => new Promise((resolve, reject) => {
+  const child = spawn(command2, args, {
+    cwd: dir,
+    stdio: "inherit",
+    shell: process.platform === "win32"
+  });
+  child.on("error", reject);
+  child.on(
+    "exit",
+    (code) => code === 0 ? resolve() : reject(
+      new Error(
+        `${command2} ${args.join(" ")} failed with exit code ${code}.`
+      )
+    )
+  );
+});
+async function installMissingPackages(dir, config2, version, options) {
+  const missing = missingPackages(dir, packagesForConfig(config2));
+  if (missing.length === 0) return void 0;
+  const command2 = installCommand(detectPackageManager(dir), missing, version);
+  const shown = `${command2.command} ${command2.args.join(" ")}`;
+  if (!options.install)
+    return {
+      status: "skipped",
+      packages: missing,
+      reason: "--no-install was given",
+      command: shown
+    };
+  if (!existsSync5(path48.join(dir, "package.json")))
+    return {
+      status: "skipped",
+      packages: missing,
+      reason: "there is no package.json here",
+      command: shown
+    };
+  await (options.installer ?? runInstaller)(dir, command2);
+  return { status: "installed", packages: missing, command: shown };
+}
+
 // src/cli/services/handler.ts
 var list = (value) => {
   const items = (Array.isArray(value) ? value : value === void 0 ? [] : [value]).filter(
@@ -14369,7 +14862,7 @@ var list = (value) => {
   return items.length > 0 ? items : void 0;
 };
 function addOptionsFromArguments(service, argv) {
-  const dir = path48.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path49.resolve(process.cwd(), argv.dir ?? ".");
   const issuers = list(argv.issuer);
   return {
     dir,
@@ -14428,12 +14921,12 @@ function describe(edit, dir) {
   return {
     service: edit.service,
     action: edit.action,
-    willCreate: edit.files.map((file) => path48.relative(dir, file.path)),
-    keep: edit.keep.map((file) => path48.relative(dir, file)),
+    willCreate: edit.files.map((file) => path49.relative(dir, file.path)),
+    keep: edit.keep.map((file) => path49.relative(dir, file)),
     notes: edit.notes
   };
 }
-async function run(action, argv, plan2) {
+async function run(action, argv, plan2, deps = {}) {
   const json = argv.json === true;
   try {
     if (!isServiceName(argv.service)) {
@@ -14442,7 +14935,7 @@ async function run(action, argv, plan2) {
         `Choose one of ${SERVICES.join(", ")}.`
       );
     }
-    const dir = path48.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path49.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${action} works with a config version 2 project, and there is none in ${dir}.`,
@@ -14450,9 +14943,13 @@ async function run(action, argv, plan2) {
       );
     }
     const edit = await plan2(argv.service);
-    if (!json)
+    const needed = action === "add" ? missingPackages(dir, packagesForConfig(edit.config)) : [];
+    if (!json) {
       for (const line2 of formatServiceEdit(edit))
         printDiagnosticsToConsole(line2);
+      if (needed.length > 0 && argv.install !== false)
+        printDiagnosticsToConsole(`Will install: ${needed.join(", ")}`);
+    }
     if (argv.dryRun) {
       if (json)
         console.log(
@@ -14478,13 +14975,15 @@ async function run(action, argv, plan2) {
       }
     }
     const { created } = await applyServiceEdit(edit);
+    const install = action === "add" ? await installPackages(dir, edit, argv, deps, json) : void 0;
     if (json) {
       console.log(
         JSON.stringify(
           {
             status: action === "add" ? "added" : "removed",
             ...describe(edit, dir),
-            created: created.map((file) => path48.relative(dir, file))
+            created: created.map((file) => path49.relative(dir, file)),
+            ...install ? { packages: install } : {}
           },
           null,
           2
@@ -14493,7 +14992,7 @@ async function run(action, argv, plan2) {
       return;
     }
     printResultToConsole(
-      `${action === "add" ? "Added" : "Removed"} ${edit.service} in ${path48.basename(edit.configPath)}.`
+      `${action === "add" ? "Added" : "Removed"} ${edit.service} in ${path49.basename(edit.configPath)}.`
     );
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -14514,16 +15013,44 @@ async function run(action, argv, plan2) {
     );
   }
 }
-var addService = (argv) => run(
+async function installPackages(dir, edit, argv, deps, json) {
+  try {
+    const outcome = await installMissingPackages(
+      dir,
+      edit.config,
+      deps.version ?? getZudokuPackageJson().version,
+      { install: argv.install !== false, installer: deps.installer }
+    );
+    if (outcome?.status === "skipped" && !json)
+      printDiagnosticsToConsole(
+        `Not installed (${outcome.reason}). Run: ${outcome.command}`
+      );
+    if (outcome?.status === "installed" && !json)
+      printDiagnosticsToConsole(`Installed: ${outcome.packages.join(", ")}`);
+    return outcome;
+  } catch (error) {
+    const reason = error instanceof Error ? error.message : String(error);
+    if (!json)
+      printDiagnosticsToConsole(
+        `The packages could not be installed (${reason}). The service was added; install them yourself before you build.`
+      );
+    return {
+      status: "failed",
+      reason
+    };
+  }
+}
+var addService = (argv, deps = {}) => run(
   "add",
   argv,
-  (service) => planAddService(service, addOptionsFromArguments(service, argv))
+  (service) => planAddService(service, addOptionsFromArguments(service, argv)),
+  deps
 );
 var removeService = (argv) => run(
   "remove",
   argv,
   (service) => planRemoveService(service, {
-    dir: path48.resolve(process.cwd(), argv.dir ?? ".")
+    dir: path49.resolve(process.cwd(), argv.dir ?? ".")
   })
 );
 
@@ -14558,6 +15085,10 @@ var add_default = {
     type: "boolean",
     default: false,
     describe: "Print a JSON result on stdout"
+  }).option("install", {
+    type: "boolean",
+    default: true,
+    describe: "Install the plugin packages the service needs (use --no-install to skip)"
   }).option("name", { type: "string", describe: "portal: display name" }).option("docs", {
     type: "string",
     array: true,
@@ -14667,16 +15198,16 @@ var add_default = {
 };
 
 // src/cli/build/handler.ts
-import path50 from "node:path";
+import path51 from "node:path";
 init_logger();
 init_package_json();
 
 // src/cli/preview/handler.ts
-import path49 from "node:path";
+import path50 from "node:path";
 import { preview as vitePreview } from "vite";
 var DEFAULT_PREVIEW_PORT = 4e3;
 async function preview(argv) {
-  const dir = path49.resolve(process.cwd(), argv.dir);
+  const dir = path50.resolve(process.cwd(), argv.dir);
   const viteConfig = await getViteConfig(dir, {
     command: "serve",
     mode: "production",
@@ -14719,7 +15250,7 @@ async function build(argv) {
     printDiagnosticsToConsole("");
     printDiagnosticsToConsole("");
   }
-  const dir = path50.resolve(process.cwd(), argv.dir);
+  const dir = path51.resolve(process.cwd(), argv.dir);
   try {
     if (await isConfigV2(dir)) {
       const result = await buildV2({ dir, jsonOnly });
@@ -14784,10 +15315,10 @@ var build_default = {
 };
 
 // src/cli/check/handler.ts
-import path57 from "node:path";
+import path58 from "node:path";
 
 // src/cli/platform/tools/check-publish-readiness.ts
-import path56 from "node:path";
+import path57 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-backend.ts
 function deriveProvisioningState(backend) {
@@ -14870,12 +15401,12 @@ function formatDevPortalBackendResponse(projectId, backend) {
 
 // src/cli/platform/helpers/dev-portal-manifest.ts
 init_gateway_limits();
-import { existsSync as existsSync5 } from "node:fs";
-import { access as access5, mkdir as mkdir13, readFile as readFile12, writeFile as writeFile14 } from "node:fs/promises";
-import path52 from "node:path";
+import { existsSync as existsSync6 } from "node:fs";
+import { access as access5, mkdir as mkdir13, readFile as readFile13, writeFile as writeFile14 } from "node:fs/promises";
+import path53 from "node:path";
 
 // src/cli/make-config/json-config.ts
-import path51 from "node:path";
+import path52 from "node:path";
 
 // src/cli/make-config/branding-assets.ts
 var LOGO_LIGHT = '<svg xmlns="http://www.w3.org/2000/svg" width="201.57" height="72.66" viewBox="-0.09 -46.99 201.57 72.66">\n  <path d="M13.5 0.39Q8.03 0.39 4.76 -2.09Q1.48 -4.57 1.41 -9.61H8.03Q8.14 -7.48 9.6 -6.41Q11.05 -5.33 13.42 -5.33Q15.57 -5.33 16.8 -6.2Q18.03 -7.07 18.03 -8.46Q18.03 -9.71 16.87 -10.44Q15.7 -11.17 13.32 -11.72L10.23 -12.44Q6.46 -13.3 4.32 -15.25Q2.17 -17.21 2.17 -20.49Q2.17 -23.18 3.62 -25.21Q5.08 -27.23 7.64 -28.36Q10.2 -29.49 13.5 -29.49Q16.88 -29.49 19.36 -28.35Q21.84 -27.21 23.2 -25.17Q24.57 -23.12 24.61 -20.43H17.99Q17.85 -22.01 16.7 -22.89Q15.55 -23.77 13.48 -23.77Q11.41 -23.77 10.35 -22.97Q9.3 -22.17 9.3 -20.96Q9.3 -19.61 10.47 -18.88Q11.64 -18.14 13.59 -17.71L16.11 -17.13Q20.33 -16.19 22.67 -14.06Q25 -11.93 25 -8.44Q25 -4.3 21.95 -1.95Q18.91 0.39 13.5 0.39Z M32.97 0.39Q29.82 0.39 27.8 -1.21Q25.78 -2.81 25.78 -6.05Q25.78 -8.48 26.89 -9.9Q28 -11.33 29.85 -12.01Q31.7 -12.7 33.9 -12.89Q36.68 -13.12 37.88 -13.47Q39.08 -13.81 39.08 -14.82V-14.9Q39.08 -16.04 38.29 -16.65Q37.5 -17.27 36.11 -17.27Q34.68 -17.27 33.77 -16.66Q32.85 -16.05 32.58 -15.02L26.4 -15.82Q27.05 -18.61 29.56 -20.36Q32.07 -22.11 36.17 -22.11Q38.88 -22.11 41.08 -21.27Q43.28 -20.43 44.58 -18.8Q45.88 -17.17 45.88 -14.82V0H39.47V-3.07H39.29Q37.48 0.39 32.97 0.39ZM35.04 -4.12Q36.75 -4.12 37.95 -5.14Q39.14 -6.15 39.14 -7.77V-9.86Q38.55 -9.55 37.44 -9.34Q36.33 -9.12 35.37 -8.96Q32.22 -8.5 32.22 -6.37Q32.22 -5.27 33.01 -4.7Q33.81 -4.12 35.04 -4.12Z M48.59 0V-21.84H54.86L55.17 -17.5Q56.07 -19.96 57.78 -21.04Q59.49 -22.13 61.46 -22.13Q63.53 -22.13 64.91 -20.94Q66.28 -19.75 67.08 -17.07Q68.08 -19.77 70.02 -20.95Q71.97 -22.13 74.17 -22.13Q77.24 -22.13 79.2 -20.16Q81.17 -18.18 81.17 -14.73V0H74.37V-13.18Q74.37 -14.84 73.5 -15.7Q72.63 -16.56 71.28 -16.56Q69.84 -16.56 69 -15.62Q68.16 -14.67 68.16 -13.11V0H61.61V-13.28Q61.61 -14.79 60.77 -15.67Q59.92 -16.56 58.57 -16.56Q57.18 -16.56 56.29 -15.62Q55.4 -14.69 55.4 -12.97V0Z M83.88 8.16V-21.84H90.62V-18.09H90.85Q91.26 -19.06 92.04 -19.99Q92.82 -20.92 94.05 -21.51Q95.28 -22.11 97.02 -22.11Q99.33 -22.11 101.31 -20.9Q103.29 -19.69 104.51 -17.21Q105.73 -14.73 105.73 -10.9Q105.73 -7.19 104.55 -4.7Q103.37 -2.21 101.39 -0.95Q99.4 0.31 96.98 0.31Q94.48 0.31 92.99 -0.87Q91.49 -2.05 90.85 -3.54H90.69V8.16ZM94.66 -5Q96.63 -5 97.68 -6.62Q98.72 -8.24 98.72 -10.9Q98.72 -13.55 97.68 -15.17Q96.63 -16.78 94.66 -16.78Q92.71 -16.78 91.62 -15.2Q90.54 -13.61 90.54 -10.9Q90.54 -8.22 91.62 -6.61Q92.71 -5 94.66 -5Z M114.4 -29.1V0H107.59V-29.1Z M127.29 0.41Q122.15 0.41 119.21 -2.59Q116.27 -5.59 116.27 -10.84Q116.27 -14.2 117.59 -16.74Q118.91 -19.28 121.33 -20.69Q123.75 -22.11 127.04 -22.11Q130.1 -22.11 132.47 -20.83Q134.85 -19.55 136.21 -17.06Q137.56 -14.57 137.56 -10.98V-9.26H122.97Q123.07 -6.89 124.27 -5.71Q125.47 -4.53 127.41 -4.53Q128.77 -4.53 129.77 -5.11Q130.77 -5.68 131.18 -6.78L137.25 -5.78Q136.43 -2.95 133.84 -1.27Q131.25 0.41 127.29 0.41ZM123.01 -13.22H131.1Q130.9 -15.08 129.89 -16.12Q128.87 -17.17 127.09 -17.17Q125.3 -17.17 124.25 -16.1Q123.21 -15.04 123.01 -13.22Z" fill="#202633"/>\n  <path d="M138.48 0 148.19 -29.1H157.43L167.43 0H159.69L157.72 -6.19H148.03L146.14 0ZM149.65 -11.46H156.04L155.65 -12.71Q154.89 -15.21 154.16 -17.95Q153.44 -20.68 152.74 -23.61Q152.07 -20.66 151.42 -17.93Q150.77 -15.2 150.04 -12.71Z M168.81 0V-29.1H180.72Q184 -29.1 186.39 -27.83Q188.77 -26.56 190.05 -24.3Q191.33 -22.03 191.33 -19.04Q191.33 -16.04 190.02 -13.8Q188.71 -11.56 186.29 -10.32Q183.87 -9.08 180.53 -9.08H175.7V0ZM175.7 -14.53H179.28Q181.7 -14.53 182.94 -15.77Q184.18 -17.01 184.18 -19.04Q184.18 -21.09 182.93 -22.3Q181.68 -23.52 179.26 -23.52H175.7Z M199.98 -29.1V0H193.08V-29.1Z" fill="#008A7D"/>\n</svg>\n';
@@ -15345,9 +15876,9 @@ function openapiInputForConfig(specRelativePosix) {
   return `./${specRelativePosix}`;
 }
 function toRelativeOpenApiInput(projectDir, inputPath) {
-  const resolved = path51.isAbsolute(inputPath) ? inputPath : path51.resolve(projectDir, inputPath);
-  const relative = path51.relative(projectDir, resolved);
-  const posix = relative.split(path51.sep).join(path51.posix.sep);
+  const resolved = path52.isAbsolute(inputPath) ? inputPath : path52.resolve(projectDir, inputPath);
+  const relative = path52.relative(projectDir, resolved);
+  const posix = relative.split(path52.sep).join(path52.posix.sep);
   if (!posix) {
     throw new Error("OpenAPI path must point to a file.");
   }
@@ -15627,7 +16158,7 @@ function isPlanFree(plan2) {
   return (plan2.priceAmount ?? 0) <= 0;
 }
 function manifestFilePath(siteDirectory) {
-  return path52.join(path52.resolve(siteDirectory), APITOGO_CONFIG_FILENAME2);
+  return path53.join(path53.resolve(siteDirectory), APITOGO_CONFIG_FILENAME2);
 }
 var STORED_MANIFEST_KEYS = [
   "authentication",
@@ -16100,39 +16631,39 @@ function resolveBackendSourceDirectory(siteDirectory, sourceDirectory) {
   if (!trimmed) {
     return void 0;
   }
-  return path52.resolve(siteDirectory, trimmed);
+  return path53.resolve(siteDirectory, trimmed);
 }
 function resolveBackendOpenApiPath(openApiPath, options) {
   const trimmed = openApiPath?.trim();
   if (!trimmed) {
     return void 0;
   }
-  if (path52.isAbsolute(trimmed)) {
+  if (path53.isAbsolute(trimmed)) {
     return trimmed;
   }
-  const siteResolved = path52.resolve(options.siteDirectory, trimmed);
-  if (existsSync5(siteResolved)) {
+  const siteResolved = path53.resolve(options.siteDirectory, trimmed);
+  if (existsSync6(siteResolved)) {
     return siteResolved;
   }
   const backendDir = options.backendSourceDirectory?.trim();
   if (backendDir) {
-    const backendResolved = path52.resolve(backendDir, trimmed);
-    if (existsSync5(backendResolved)) {
+    const backendResolved = path53.resolve(backendDir, trimmed);
+    if (existsSync6(backendResolved)) {
       return backendResolved;
     }
   }
   return siteResolved;
 }
 function toSiteRelativeOpenApiInput(siteDirectory, openApiAbsolutePath) {
-  const relative = path52.relative(
-    path52.resolve(siteDirectory),
-    path52.resolve(openApiAbsolutePath)
+  const relative = path53.relative(
+    path53.resolve(siteDirectory),
+    path53.resolve(openApiAbsolutePath)
   );
-  const posix = relative.split(path52.sep).join("/");
+  const posix = relative.split(path53.sep).join("/");
   if (!posix || posix === ".") {
     return "./";
   }
-  if (path52.isAbsolute(posix) || posix.startsWith("..")) {
+  if (path53.isAbsolute(posix) || posix.startsWith("..")) {
     return posix;
   }
   return posix.startsWith("./") ? posix : `./${posix}`;
@@ -16171,7 +16702,7 @@ function applyOpenApiToSiteConfig(config2, options) {
 async function readManifest2(siteDirectory) {
   const filePath = manifestFilePath(siteDirectory);
   if (await pathExists(filePath)) {
-    const raw = await readFile12(filePath, "utf8");
+    const raw = await readFile13(filePath, "utf8");
     const config2 = JSON.parse(raw);
     return extractManifestFromConfig(config2);
   }
@@ -16179,10 +16710,10 @@ async function readManifest2(siteDirectory) {
 }
 async function writeManifest2(siteDirectory, manifest) {
   const filePath = manifestFilePath(siteDirectory);
-  await mkdir13(path52.dirname(filePath), { recursive: true });
+  await mkdir13(path53.dirname(filePath), { recursive: true });
   let config2 = {};
   if (await pathExists(filePath)) {
-    const raw = await readFile12(filePath, "utf8");
+    const raw = await readFile13(filePath, "utf8");
     config2 = JSON.parse(raw);
   }
   const {
@@ -16201,11 +16732,11 @@ import {
   access as access6,
   appendFile,
   mkdir as mkdir14,
-  readFile as readFile13,
+  readFile as readFile14,
   unlink,
   writeFile as writeFile15
 } from "node:fs/promises";
-import path53 from "node:path";
+import path54 from "node:path";
 var ENV_FILENAME = ".env";
 var COLLAPSED_UPPERCASE_ALIASES2 = {
   SECRETKEY: "secretKey",
@@ -16307,7 +16838,7 @@ function applyEnvOverrides2(config2, env) {
 }
 async function readEnvFile(filePath) {
   try {
-    const raw = await readFile13(filePath, "utf8");
+    const raw = await readFile14(filePath, "utf8");
     const env = {};
     for (const line2 of raw.split("\n")) {
       const trimmed = line2.trim();
@@ -16324,12 +16855,12 @@ async function readEnvFile(filePath) {
   }
 }
 async function loadSiteEnv(siteDirectory) {
-  const resolvedDirectory = path53.resolve(siteDirectory);
+  const resolvedDirectory = path54.resolve(siteDirectory);
   const merged = { ...process.env };
   for (const fileName of [ENV_FILENAME, ".env.local"]) {
     Object.assign(
       merged,
-      await readEnvFile(path53.join(resolvedDirectory, fileName))
+      await readEnvFile(path54.join(resolvedDirectory, fileName))
     );
   }
   return merged;
@@ -16366,7 +16897,7 @@ function buildAuthSecretsJson(secrets2, options) {
   return payload;
 }
 function envFilePath(siteDirectory) {
-  return path53.join(path53.resolve(siteDirectory), ENV_FILENAME);
+  return path54.join(path54.resolve(siteDirectory), ENV_FILENAME);
 }
 function createEnvContent() {
   return [
@@ -16430,7 +16961,7 @@ function validateSecretsForPublish(manifest, secrets2, emailOptions) {
 }
 async function siteEnvFileHasEntries(siteDirectory) {
   for (const fileName of [ENV_FILENAME, ".env.local"]) {
-    const loaded = await readEnvFile(path53.join(siteDirectory, fileName));
+    const loaded = await readEnvFile(path54.join(siteDirectory, fileName));
     if (Object.keys(loaded).length > 0) {
       return true;
     }
@@ -16438,7 +16969,7 @@ async function siteEnvFileHasEntries(siteDirectory) {
   return false;
 }
 async function resolvePublishConfig(siteDirectory, emailOptions) {
-  const resolvedDirectory = path53.resolve(siteDirectory);
+  const resolvedDirectory = path54.resolve(siteDirectory);
   const manifestRaw = await readManifest2(resolvedDirectory);
   if (!manifestRaw) {
     throw new Error("apitogo.config.json not found in sourceDirectory.");
@@ -16471,7 +17002,7 @@ function envFileHasActiveAssignments(content) {
   });
 }
 async function writeScaffoldEnv(siteDirectory) {
-  const resolvedDirectory = path53.resolve(siteDirectory);
+  const resolvedDirectory = path54.resolve(siteDirectory);
   const filesWritten = [];
   const envPath = envFilePath(resolvedDirectory);
   try {
@@ -16482,9 +17013,9 @@ async function writeScaffoldEnv(siteDirectory) {
     filesWritten.push(ENV_FILENAME);
   }
   for (const legacyName of [".env.example"]) {
-    const legacyPath = path53.join(resolvedDirectory, legacyName);
+    const legacyPath = path54.join(resolvedDirectory, legacyName);
     try {
-      const legacy = await readFile13(legacyPath, "utf8");
+      const legacy = await readFile14(legacyPath, "utf8");
       if (!envFileHasActiveAssignments(legacy)) {
         await unlink(legacyPath);
         filesWritten.push(`removed:${legacyName}`);
@@ -16492,10 +17023,10 @@ async function writeScaffoldEnv(siteDirectory) {
     } catch {
     }
   }
-  const gitignorePath = path53.join(resolvedDirectory, ".gitignore");
+  const gitignorePath = path54.join(resolvedDirectory, ".gitignore");
   let gitignore = "";
   try {
-    gitignore = await readFile13(gitignorePath, "utf8");
+    gitignore = await readFile14(gitignorePath, "utf8");
   } catch {
     gitignore = "";
   }
@@ -16527,13 +17058,13 @@ var SECRETS_COLLECTION_INSTRUCTION = "For go-live, plans must already be in apit
 
 // src/cli/platform/helpers/dev-portal-site-validation.ts
 init_gateway_limits();
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import { createRequire as createRequire3 } from "node:module";
-import path54 from "node:path";
+import path55 from "node:path";
 var cachedFallbackTs;
 async function loadTypeScriptForSite(sourceDirectory) {
   const require2 = createRequire3(
-    path54.join(path54.resolve(sourceDirectory), "package.json")
+    path55.join(path55.resolve(sourceDirectory), "package.json")
   );
   try {
     return require2("typescript");
@@ -16580,7 +17111,7 @@ async function referencedFileExists(sourceDirectory, reference) {
     return true;
   }
   return pathExists(
-    path54.resolve(sourceDirectory, reference.replace(/^\.\//, ""))
+    path55.resolve(sourceDirectory, reference.replace(/^\.\//, ""))
   );
 }
 async function validateSiteConfigStructure(config2, sourceDirectory) {
@@ -16695,17 +17226,17 @@ var DEFAULT_TSX_CANDIDATES = [
   "landing/LandingPage.tsx"
 ];
 async function validateDevPortalSiteConfig(sourceDirectory, options) {
-  const resolvedDir = path54.resolve(sourceDirectory);
+  const resolvedDir = path55.resolve(sourceDirectory);
   const issues = [];
   const checkedFiles = [];
   const skippedChecks = [];
-  const jsonPath = path54.join(resolvedDir, APITOGO_CONFIG_FILENAME2);
+  const jsonPath = path55.join(resolvedDir, APITOGO_CONFIG_FILENAME2);
   if (await pathExists(jsonPath)) {
     checkedFiles.push(APITOGO_CONFIG_FILENAME2);
     let parsed;
     let parseFailed = false;
     try {
-      parsed = JSON.parse(await readFile14(jsonPath, "utf8"));
+      parsed = JSON.parse(await readFile15(jsonPath, "utf8"));
     } catch (error) {
       parseFailed = true;
       issues.push({
@@ -16731,7 +17262,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
   );
   const existingTsxFiles = [];
   for (const relativeFile of tsxFiles) {
-    if (await pathExists(path54.join(resolvedDir, relativeFile))) {
+    if (await pathExists(path55.join(resolvedDir, relativeFile))) {
       existingTsxFiles.push(relativeFile);
     }
   }
@@ -16744,8 +17275,8 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     } else {
       for (const relativeFile of existingTsxFiles) {
         checkedFiles.push(relativeFile);
-        const content = await readFile14(
-          path54.join(resolvedDir, relativeFile),
+        const content = await readFile15(
+          path55.join(resolvedDir, relativeFile),
           "utf8"
         );
         issues.push(
@@ -16765,7 +17296,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
   };
 }
 function formatSiteValidationErrors(result) {
-  return result.issues.map((issue2) => `${issue2.file}: ${issue2.message}`).join("; ");
+  return result.issues.map((issue3) => `${issue3.file}: ${issue3.message}`).join("; ");
 }
 function buildSiteValidationResponseFields(result) {
   if (result.valid) {
@@ -16781,9 +17312,9 @@ function buildSiteValidationResponseFields(result) {
 }
 
 // src/cli/platform/helpers/npm-build.ts
-import { spawn } from "node:child_process";
-import { access as access7, readFile as readFile15 } from "node:fs/promises";
-import path55 from "node:path";
+import { spawn as spawn2 } from "node:child_process";
+import { access as access7, readFile as readFile16 } from "node:fs/promises";
+import path56 from "node:path";
 var BUILD_LOG_TAIL_BYTES = 8192;
 var MIN_NODE_MAJOR = 20;
 var NpmBuildError = class extends Error {
@@ -16832,7 +17363,7 @@ async function pathExists2(filePath) {
 }
 function runCommand(command2, args, cwd, env) {
   return new Promise((resolve, reject) => {
-    const child = spawn(command2, args, {
+    const child = spawn2(command2, args, {
       cwd,
       env: env ? { ...process.env, ...env } : process.env,
       shell: process.platform === "win32"
@@ -16850,13 +17381,13 @@ function runCommand(command2, args, cwd, env) {
 }
 async function runNpmInstall(sourceDirectory, options) {
   assertNodeVersion(options?.nodeVersion);
-  const cwd = path55.resolve(sourceDirectory);
-  const packageJsonPath = path55.join(cwd, "package.json");
+  const cwd = path56.resolve(sourceDirectory);
+  const packageJsonPath = path56.join(cwd, "package.json");
   if (!await pathExists2(packageJsonPath)) {
     throw new Error(`package.json not found in sourceDirectory: ${cwd}`);
   }
   const startedAt = Date.now();
-  const lockPath = path55.join(cwd, "package-lock.json");
+  const lockPath = path56.join(cwd, "package-lock.json");
   const installArgs = await pathExists2(lockPath) ? ["ci"] : ["install"];
   const install = await runCommand("npm", installArgs, cwd);
   const installLog = install.output;
@@ -16874,8 +17405,8 @@ async function runNpmInstall(sourceDirectory, options) {
 }
 async function runNpmBuild(sourceDirectory, options) {
   assertNodeVersion(options?.nodeVersion);
-  const cwd = path55.resolve(sourceDirectory);
-  const packageJsonPath = path55.join(cwd, "package.json");
+  const cwd = path56.resolve(sourceDirectory);
+  const packageJsonPath = path56.join(cwd, "package.json");
   if (!await pathExists2(packageJsonPath)) {
     throw new Error(`package.json not found in sourceDirectory: ${cwd}`);
   }
@@ -16892,8 +17423,8 @@ async function runNpmBuild(sourceDirectory, options) {
       build2.exitCode
     );
   }
-  const distPath = path55.join(cwd, "dist");
-  const indexPath = path55.join(distPath, "index.html");
+  const distPath = path56.join(cwd, "dist");
+  const indexPath = path56.join(distPath, "index.html");
   if (!await pathExists2(indexPath)) {
     throw new NpmBuildError(
       `Build completed but dist/index.html was not found at ${indexPath}`,
@@ -17277,7 +17808,7 @@ function validateManifestForPlatformPublish(manifest) {
 
 // src/cli/platform/tools/check-publish-readiness.ts
 async function checkPublishReadiness(client, _config, args) {
-  const sourceDirectory = path56.resolve(args.sourceDirectory);
+  const sourceDirectory = path57.resolve(args.sourceDirectory);
   const manifest = await readManifest2(sourceDirectory) ?? createScaffoldManifest();
   const emailOptions = await resolveEmailOptionsForPublish(
     client,
@@ -17297,7 +17828,7 @@ async function checkPublishReadiness(client, _config, args) {
   const mergedPrerequisites = mergePublishPrerequisitesWithPlatformValidation(
     publishPrerequisites,
     platformValidation.issues.map(
-      (issue2) => `${issue2.field}: ${issue2.message}`
+      (issue3) => `${issue3.field}: ${issue3.message}`
     )
   );
   const siteValidation = await validateDevPortalSiteConfig(sourceDirectory);
@@ -17355,7 +17886,7 @@ async function checkPublishReadiness(client, _config, args) {
 
 // src/cli/check/handler.ts
 async function check(argv) {
-  const sourceDirectory = path57.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path58.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(sourceDirectory)) {
     await checkV2(sourceDirectory, argv);
     return;
@@ -17404,7 +17935,7 @@ var check_default = {
     default: false
   }).option("offline", {
     type: "boolean",
-    describe: "Config version 2: do not ask the platform anything (secret names are then not checked)",
+    describe: "Config version 2: do not ask the platform anything (secret names and the gateway's online rules are then not checked)",
     default: false
   }).option("json", {
     type: "boolean",
@@ -17419,14 +17950,14 @@ var check_default = {
 
 // src/cli/make-config/handler.ts
 import { constants as constants2 } from "node:fs";
-import { access as access12, mkdir as mkdir17, readFile as readFile20, writeFile as writeFile20 } from "node:fs/promises";
-import path67 from "node:path";
+import { access as access12, mkdir as mkdir17, readFile as readFile21, writeFile as writeFile20 } from "node:fs/promises";
+import path68 from "node:path";
 import { stdin as input2 } from "node:process";
 import { glob as glob7 } from "glob";
 
 // src/cli/platform/helpers/openapi-action-keys.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
-import path58 from "node:path";
+import { existsSync as existsSync7, readFileSync as readFileSync4 } from "node:fs";
+import path59 from "node:path";
 import YAML from "yaml";
 var HTTP_METHODS = [
   "get",
@@ -17495,7 +18026,7 @@ function extractGatewayActionKeysFromOpenApiDocument(document) {
 function extractGatewayActionKeysFromOpenApiFile(filePath) {
   try {
     const raw = readFileSync4(filePath, "utf8");
-    const ext = path58.extname(filePath).toLowerCase();
+    const ext = path59.extname(filePath).toLowerCase();
     const parsed = ext === ".json" ? JSON.parse(raw) : YAML.parse(raw);
     return extractGatewayActionKeysFromOpenApiDocument(parsed);
   } catch {
@@ -17516,8 +18047,8 @@ function resolveConfigOpenApiFilePath(siteDirectory, config2) {
     }
   }
   for (const candidate of candidates) {
-    const resolved = path58.isAbsolute(candidate) ? candidate : path58.resolve(siteDirectory, candidate);
-    if (existsSync6(resolved)) {
+    const resolved = path59.isAbsolute(candidate) ? candidate : path59.resolve(siteDirectory, candidate);
+    if (existsSync7(resolved)) {
       return resolved;
     }
   }
@@ -17531,8 +18062,8 @@ function loadOpenApiActionKeysForSite(siteDirectory, config2) {
   return extractGatewayActionKeysFromOpenApiFile(filePath);
 }
 function loadOpenApiActionKeysFromSiteDirectory(siteDirectory) {
-  const configPath = path58.join(siteDirectory, "apitogo.config.json");
-  if (!existsSync6(configPath)) {
+  const configPath = path59.join(siteDirectory, "apitogo.config.json");
+  if (!existsSync7(configPath)) {
     return [];
   }
   try {
@@ -17559,8 +18090,8 @@ function withDefaultIncludedActionKeys(plan2, actionKeys) {
 }
 
 // src/cli/scaffold/dev-portal-config-pages.ts
-import { access as access8, readFile as readFile16, rename as rename7, rm as rm9, writeFile as writeFile16 } from "node:fs/promises";
-import path59 from "node:path";
+import { access as access8, readFile as readFile17, rename as rename7, rm as rm9, writeFile as writeFile16 } from "node:fs/promises";
+import path60 from "node:path";
 async function writeConfigAtomically(filePath, content) {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
@@ -17573,7 +18104,7 @@ async function writeConfigAtomically(filePath, content) {
 }
 async function resolveApitogoConfigPath(sourceDirectory) {
   for (const filename of ["apitogo.config.tsx", "apitogo.config.jsx"]) {
-    const configPath = path59.join(sourceDirectory, filename);
+    const configPath = path60.join(sourceDirectory, filename);
     try {
       await access8(configPath);
       return configPath;
@@ -18324,7 +18855,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
   if (!configPath) {
     return { updated: false };
   }
-  const original = await readFile16(configPath, "utf8");
+  const original = await readFile17(configPath, "utf8");
   const patched = patchApitogoConfigForNewPage(original, slug, label, {
     typescript: configPath.endsWith(".tsx")
   });
@@ -18336,18 +18867,18 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
 }
 
 // src/cli/scaffold/wire-openapi.ts
-import { access as access10, readFile as readFile18, writeFile as writeFile18 } from "node:fs/promises";
-import path64 from "node:path";
+import { access as access10, readFile as readFile19, writeFile as writeFile18 } from "node:fs/promises";
+import path65 from "node:path";
 
 // src/cli/platform/helpers/openapi.ts
 import { promises as fs6 } from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 import SwaggerParser from "@apidevtools/swagger-parser";
 import YAML2 from "yaml";
 
 // src/cli/scaffold/discover-openapi-files.ts
 import { promises as fs5 } from "node:fs";
-import path60 from "node:path";
+import path61 from "node:path";
 var OPENAPI_BASENAMES = [
   "openapi.yaml",
   "openapi.yml",
@@ -18369,13 +18900,13 @@ var SKIP_OPENAPI_SEARCH_DIRS = /* @__PURE__ */ new Set([
   ".apitogo"
 ]);
 async function collectFromDir(dir, searchedDirectories, candidates) {
-  const resolved = path60.resolve(dir);
+  const resolved = path61.resolve(dir);
   if (searchedDirectories.includes(resolved)) {
     return;
   }
   searchedDirectories.push(resolved);
   for (const name of OPENAPI_BASENAMES) {
-    const candidate = path60.join(resolved, name);
+    const candidate = path61.join(resolved, name);
     try {
       await fs5.access(candidate);
       candidates.push(candidate);
@@ -18390,8 +18921,8 @@ async function collectSiteOpenApiFiles(siteDirectory) {
   return { candidates: [...new Set(candidates)], searchedDirectories };
 }
 async function collectNearbyOpenApiFiles(siteDirectory) {
-  const site = path60.resolve(siteDirectory);
-  const parent = path60.dirname(site);
+  const site = path61.resolve(siteDirectory);
+  const parent = path61.dirname(site);
   const searchedDirectories = [];
   const candidates = [];
   if (parent && parent !== site) {
@@ -18402,8 +18933,8 @@ async function collectNearbyOpenApiFiles(siteDirectory) {
         if (!entry.isDirectory() || SKIP_OPENAPI_SEARCH_DIRS.has(entry.name)) {
           continue;
         }
-        const sibling = path60.join(parent, entry.name);
-        if (path60.resolve(sibling) === site) {
+        const sibling = path61.join(parent, entry.name);
+        if (path61.resolve(sibling) === site) {
           continue;
         }
         await collectFromDir(sibling, searchedDirectories, candidates);
@@ -18431,7 +18962,7 @@ function parseOpenApiObject(doc) {
   };
 }
 function liteParseOpenApi(content, filePath) {
-  const ext = path60.extname(filePath).toLowerCase();
+  const ext = path61.extname(filePath).toLowerCase();
   if (ext === ".json") {
     try {
       const parsed = JSON.parse(content);
@@ -18496,9 +19027,9 @@ async function discoverNearbyOpenApi(siteDirectory) {
   };
 }
 async function validateOpenApiFile(filePath) {
-  const resolved = path61.resolve(filePath);
+  const resolved = path62.resolve(filePath);
   const content = await fs6.readFile(resolved, "utf8");
-  const ext = path61.extname(resolved).toLowerCase();
+  const ext = path62.extname(resolved).toLowerCase();
   let parsed;
   try {
     parsed = ext === ".json" ? JSON.parse(content) : YAML2.parse(content);
@@ -18540,8 +19071,8 @@ async function validateOpenApiFile(filePath) {
 }
 
 // src/cli/scaffold/scaffold-dev-portal-site.ts
-import { mkdir as mkdir15, readFile as readFile17, writeFile as writeFile17 } from "node:fs/promises";
-import path63 from "node:path";
+import { mkdir as mkdir15, readFile as readFile18, writeFile as writeFile17 } from "node:fs/promises";
+import path64 from "node:path";
 
 // src/cli/scaffold/apitogo-npm-packages.ts
 var DEFAULT_CREATE_APITOGO_PACKAGE2 = "@lukoweb/create-apitogo@latest";
@@ -18627,9 +19158,9 @@ var DOC_TOOL_LOCAL_PACKAGE_PATHS = {
 };
 
 // src/cli/scaffold/create-apitogo-cli.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn3 } from "node:child_process";
 import { access as access9, rm as rm10 } from "node:fs/promises";
-import path62 from "node:path";
+import path63 from "node:path";
 var SKIP_NEARBY_DISCOVERY_ENV = "APITOGO_SKIP_NEARBY_DISCOVERY";
 var CreateApitogoCliError = class extends Error {
   exitCode;
@@ -18646,9 +19177,9 @@ function resolveDocToolPath(explicit) {
   return value || void 0;
 }
 function splitOutputDirectory(outputDirectory) {
-  const resolvedOutputDirectory = path62.resolve(outputDirectory);
-  const projectName = path62.basename(resolvedOutputDirectory);
-  const parentDirectory = path62.dirname(resolvedOutputDirectory);
+  const resolvedOutputDirectory = path63.resolve(outputDirectory);
+  const projectName = path63.basename(resolvedOutputDirectory);
+  const parentDirectory = path63.dirname(resolvedOutputDirectory);
   if (!projectName || projectName === "." || projectName === "..") {
     throw new Error(
       "outputDirectory must be a named folder (e.g. ./dev-portal-site), not the current directory."
@@ -18674,7 +19205,7 @@ async function directoryHasEntries(dir) {
   }
 }
 function resolveLocalCreateApitogoEntry(docToolPath) {
-  return path62.resolve(docToolPath, "packages/create-zudoku/dist/index.js");
+  return path63.resolve(docToolPath, "packages/create-zudoku/dist/index.js");
 }
 async function resolveCreateApitogoInvocation(options) {
   const docToolPath = resolveDocToolPath(options.docToolPath);
@@ -18701,7 +19232,7 @@ async function resolveCreateApitogoInvocation(options) {
 }
 function runCommand2(command2, args, cwd) {
   return new Promise((resolve, reject) => {
-    const child = spawn2(command2, args, {
+    const child = spawn3(command2, args, {
       cwd,
       env: { ...process.env, [SKIP_NEARBY_DISCOVERY_ENV]: "1" },
       shell: process.platform === "win32"
@@ -18756,7 +19287,7 @@ async function runCreateApitogoDevPortal(options) {
       result.exitCode
     );
   }
-  if (!await pathExists3(path62.join(resolvedOutputDirectory, "package.json"))) {
+  if (!await pathExists3(path63.join(resolvedOutputDirectory, "package.json"))) {
     throw new CreateApitogoCliError(
       `create-apitogo completed but package.json was not found at ${resolvedOutputDirectory}`,
       result.output,
@@ -18815,7 +19346,7 @@ function ensureRequiredApitogoModules(pkg, options) {
     ]
   ]) {
     if (options.docToolPath) {
-      deps[moduleName] = `file:${path63.join(options.docToolPath, localPath)}`;
+      deps[moduleName] = `file:${path64.join(options.docToolPath, localPath)}`;
       continue;
     }
     deps[moduleName] = `npm:${moduleName}@${moduleAliasVersion}`;
@@ -18846,7 +19377,7 @@ function rewritePackageJson(raw, options) {
         DOC_TOOL_LOCAL_PACKAGE_PATHS
       )) {
         if (dep in deps) {
-          deps[dep] = `file:${path63.join(options.docToolPath, relativePath)}`;
+          deps[dep] = `file:${path64.join(options.docToolPath, relativePath)}`;
           linkedWorkspacePackage = true;
         }
       }
@@ -18946,23 +19477,23 @@ function patchDashboardPageConfig(content) {
   );
 }
 async function ensureAccountPlansPage(outputDirectory) {
-  const pagePath = path63.join(outputDirectory, ACCOUNT_PLANS_PAGE_PATH);
+  const pagePath = path64.join(outputDirectory, ACCOUNT_PLANS_PAGE_PATH);
   try {
-    await readFile17(pagePath, "utf8");
+    await readFile18(pagePath, "utf8");
     return void 0;
   } catch {
-    await mkdir15(path63.dirname(pagePath), { recursive: true });
+    await mkdir15(path64.dirname(pagePath), { recursive: true });
     await writeFile17(pagePath, ACCOUNT_PLANS_PAGE);
     return ACCOUNT_PLANS_PAGE_PATH;
   }
 }
 async function ensureDashboardPage(outputDirectory) {
-  const pagePath = path63.join(outputDirectory, DASHBOARD_PAGE_PATH);
+  const pagePath = path64.join(outputDirectory, DASHBOARD_PAGE_PATH);
   try {
-    await readFile17(pagePath, "utf8");
+    await readFile18(pagePath, "utf8");
     return void 0;
   } catch {
-    await mkdir15(path63.dirname(pagePath), { recursive: true });
+    await mkdir15(path64.dirname(pagePath), { recursive: true });
     await writeFile17(pagePath, DASHBOARD_PAGE);
     return DASHBOARD_PAGE_PATH;
   }
@@ -19019,9 +19550,9 @@ function patchApitogoConfig(content, options) {
 async function patchScaffoldedSite(outputDirectory, options) {
   const title = options.branding?.title ?? options.siteName;
   const filesWritten = [];
-  const packageJsonPath = path63.join(outputDirectory, "package.json");
+  const packageJsonPath = path64.join(outputDirectory, "package.json");
   if (options.patchPackageJson !== false) {
-    const packageJson3 = await readFile17(packageJsonPath, "utf8");
+    const packageJson3 = await readFile18(packageJsonPath, "utf8");
     await writeFile17(
       packageJsonPath,
       rewritePackageJson(packageJson3, {
@@ -19032,8 +19563,8 @@ async function patchScaffoldedSite(outputDirectory, options) {
     );
     filesWritten.push("package.json");
   }
-  const configPath = path63.join(outputDirectory, "apitogo.config.tsx");
-  const configContent = await readFile17(configPath, "utf8");
+  const configPath = path64.join(outputDirectory, "apitogo.config.tsx");
+  const configContent = await readFile18(configPath, "utf8");
   await writeFile17(
     configPath,
     patchDashboardPageConfig(
@@ -19127,8 +19658,8 @@ async function discoverOpenApiByMode(siteDirectory, mode) {
   return discoverNearbyOpenApi(siteDirectory);
 }
 async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
-  const resolvedSource = path64.resolve(sourceDirectory);
-  const resolvedOpenApi = path64.resolve(openApiPath);
+  const resolvedSource = path65.resolve(sourceDirectory);
+  const resolvedOpenApi = path65.resolve(openApiPath);
   const input5 = toSiteRelativeOpenApiInput(resolvedSource, resolvedOpenApi);
   const validation = await validateOpenApiFile(resolvedOpenApi);
   if (!validation.valid) {
@@ -19140,7 +19671,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
   }
   const jsonConfigPath = manifestFilePath(resolvedSource);
   if (await pathExists4(jsonConfigPath)) {
-    const raw = await readFile18(jsonConfigPath, "utf8");
+    const raw = await readFile19(jsonConfigPath, "utf8");
     const siteConfig = JSON.parse(raw);
     const updated = applyOpenApiToSiteConfig(siteConfig, {
       input: input5,
@@ -19153,8 +19684,8 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
       "utf8"
     );
   } else {
-    const tsxConfigPath = path64.join(resolvedSource, "apitogo.config.tsx");
-    const configContent = await readFile18(tsxConfigPath, "utf8");
+    const tsxConfigPath = path65.join(resolvedSource, "apitogo.config.tsx");
+    const configContent = await readFile19(tsxConfigPath, "utf8");
     try {
       const patched = patchApitogoConfigOpenApiToFile(configContent, input5);
       await writeFile18(tsxConfigPath, patched);
@@ -19239,7 +19770,7 @@ async function discoverAndWireOpenApi(siteDirectory, mode) {
 }
 
 // src/cli/make-config/interactive.ts
-import path65 from "node:path";
+import path66 from "node:path";
 import { stdin as input, stdout as output } from "node:process";
 import { createInterface as createInterface3 } from "node:readline/promises";
 
@@ -19415,7 +19946,7 @@ async function promptMakeConfigInteractive(options) {
           continue;
         }
         const routePath = `/${slug}`;
-        const relativePath = path65.posix.join(options.pagesDir, `${slug}.tsx`);
+        const relativePath = path66.posix.join(options.pagesDir, `${slug}.tsx`);
         const page = {
           slug,
           title: pageTitle.trim(),
@@ -19510,8 +20041,8 @@ export default function ${componentName}() {
 // src/cli/make-config/scaffold-project.ts
 init_package_json();
 import { constants } from "node:fs";
-import { access as access11, mkdir as mkdir16, readFile as readFile19, writeFile as writeFile19 } from "node:fs/promises";
-import path66 from "node:path";
+import { access as access11, mkdir as mkdir16, readFile as readFile20, writeFile as writeFile19 } from "node:fs/promises";
+import path67 from "node:path";
 import { glob as glob6 } from "glob";
 
 // src/cli/make-config/favicon-png.ts
@@ -19526,9 +20057,9 @@ var OPENAPI_GLOBS = [
   "openapi.yaml",
   "openapi.yml"
 ];
-var toPosix2 = (p) => p.split(path66.sep).join("/");
+var toPosix2 = (p) => p.split(path67.sep).join("/");
 var sanitizePackageName = (dir) => {
-  const base = path66.basename(path66.resolve(dir));
+  const base = path67.basename(path67.resolve(dir));
   const s = base.toLowerCase().replace(/[^a-z0-9-_.]/g, "-").replace(/^-+|-+$/g, "");
   return s || "apitogo-site";
 };
@@ -19538,7 +20069,7 @@ var apitogoVersionRange = () => {
 };
 async function findOpenApiSpecPath(dir) {
   for (const rel2 of OPENAPI_GLOBS) {
-    const full = path66.join(dir, rel2);
+    const full = path67.join(dir, rel2);
     try {
       await access11(full, constants.R_OK);
       return toPosix2(rel2);
@@ -19553,7 +20084,7 @@ async function findOpenApiSpecPath(dir) {
   return extra[0] ? toPosix2(extra[0]) : null;
 }
 async function ensurePackageJson(dir) {
-  const pkgPath = path66.join(dir, "package.json");
+  const pkgPath = path67.join(dir, "package.json");
   const apitogoVer = apitogoVersionRange();
   const baseDeps = {
     react: ">=19.0.0",
@@ -19592,7 +20123,7 @@ async function ensurePackageJson(dir) {
 `, "utf8");
     return true;
   }
-  const raw = await readFile19(pkgPath, "utf8");
+  const raw = await readFile20(pkgPath, "utf8");
   let pkg;
   try {
     pkg = JSON.parse(raw);
@@ -19620,7 +20151,7 @@ async function ensurePackageJson(dir) {
   return false;
 }
 async function ensureTsconfigJson(dir) {
-  const tsPath = path66.join(dir, "tsconfig.json");
+  const tsPath = path67.join(dir, "tsconfig.json");
   try {
     await access11(tsPath, constants.R_OK);
     return false;
@@ -19669,40 +20200,40 @@ var fileExists2 = async (filePath) => {
   }
 };
 async function ensurePortalStubFiles(dir) {
-  const landingPath = path66.join(dir, "landing", "LandingPage.tsx");
+  const landingPath = path67.join(dir, "landing", "LandingPage.tsx");
   if (!await fileExists2(landingPath)) {
-    await mkdir16(path66.join(dir, "landing"), { recursive: true });
+    await mkdir16(path67.join(dir, "landing"), { recursive: true });
     await writeFile19(landingPath, LANDING_PAGE_SOURCE, "utf8");
   }
-  const plansPath = path66.join(dir, "user-panel", "AccountPlansPage.tsx");
+  const plansPath = path67.join(dir, "user-panel", "AccountPlansPage.tsx");
   if (!await fileExists2(plansPath)) {
-    await mkdir16(path66.join(dir, "user-panel"), { recursive: true });
+    await mkdir16(path67.join(dir, "user-panel"), { recursive: true });
     await writeFile19(plansPath, ACCOUNT_PLANS_PAGE_SOURCE, "utf8");
   }
-  const dashboardPath = path66.join(dir, "user-panel", "DashboardPage.tsx");
+  const dashboardPath = path67.join(dir, "user-panel", "DashboardPage.tsx");
   if (!await fileExists2(dashboardPath)) {
-    await mkdir16(path66.join(dir, "user-panel"), { recursive: true });
+    await mkdir16(path67.join(dir, "user-panel"), { recursive: true });
     await writeFile19(dashboardPath, DASHBOARD_PAGE_SOURCE, "utf8");
   }
   await ensurePublicBrandingFiles(dir);
 }
 async function ensurePublicBrandingFiles(dir) {
-  const destDir = path66.join(dir, "public");
+  const destDir = path67.join(dir, "public");
   await mkdir16(destDir, { recursive: true });
   for (const { name, content } of BRANDING_ASSETS) {
-    const dest = path66.join(destDir, name);
+    const dest = path67.join(destDir, name);
     if (await fileExists2(dest)) {
       continue;
     }
     await writeFile19(dest, content, "utf8");
   }
-  const faviconDest = path66.join(destDir, "Icon.png");
+  const faviconDest = path67.join(destDir, "Icon.png");
   if (!await fileExists2(faviconDest)) {
     await writeFile19(faviconDest, Buffer.from(FAVICON_PNG_BASE64, "base64"));
   }
 }
 async function ensureThinConfigTsx(dir) {
-  const tsxPath = path66.join(dir, "apitogo.config.tsx");
+  const tsxPath = path67.join(dir, "apitogo.config.tsx");
   if (await fileExists2(tsxPath)) {
     return false;
   }
@@ -19711,7 +20242,7 @@ async function ensureThinConfigTsx(dir) {
 }
 
 // src/cli/make-config/handler.ts
-var toPosixPath2 = (value) => value.split(path67.sep).join(path67.posix.sep);
+var toPosixPath2 = (value) => value.split(path68.sep).join(path68.posix.sep);
 var fileExists3 = async (filePath) => {
   try {
     await access12(filePath, constants2.F_OK);
@@ -19721,7 +20252,7 @@ var fileExists3 = async (filePath) => {
   }
 };
 var readJsonConfig = async (filePath) => {
-  const raw = await readFile20(filePath, "utf8");
+  const raw = await readFile21(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject3(parsed)) {
     throw new Error(`${APITOGO_JSON_FILENAME} must be a JSON object.`);
@@ -19769,9 +20300,9 @@ async function persistConfig(config2, ctx) {
   };
   await writeFile20(ctx.jsonPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
-  const tsxPath = path67.join(ctx.dir, "apitogo.config.tsx");
+  const tsxPath = path68.join(ctx.dir, "apitogo.config.tsx");
   if (await fileExists3(tsxPath) && tsxRoutes.length > 0) {
-    const tsxSource = await readFile20(tsxPath, "utf8");
+    const tsxSource = await readFile21(tsxPath, "utf8");
     if (isManagedConfigWrapper(tsxSource)) {
       await writeFile20(
         tsxPath,
@@ -19796,7 +20327,7 @@ function mergeBackendFlag(config2, backend) {
   return next;
 }
 async function makeConfig(argv) {
-  const dir = path67.resolve(process.cwd(), argv.dir);
+  const dir = path68.resolve(process.cwd(), argv.dir);
   const pagesDir = toPosixPath2(
     argv.pagesDir.replace(/^[./]+/, "").replace(/\/+$/, "")
   );
@@ -19816,14 +20347,14 @@ async function makeConfig(argv) {
       printSuccessToConsole("Created tsconfig.json.");
     }
     await ensurePortalStubFiles(dir);
-    const jsonPath = path67.join(dir, APITOGO_JSON_FILENAME);
+    const jsonPath = path68.join(dir, APITOGO_JSON_FILENAME);
     let createdJson = false;
     let config2;
     if (await fileExists3(jsonPath)) {
       config2 = await readJsonConfig(jsonPath);
     } else {
       config2 = createDefaultApitogoJsonConfig({
-        title: titleFromDirectoryName(path67.basename(dir)),
+        title: titleFromDirectoryName(path68.basename(dir)),
         pagesDir
       });
       createdJson = true;
@@ -19875,8 +20406,8 @@ async function makeConfig(argv) {
             return;
           }
           if (action2.kind === "page") {
-            const pagePath = path67.join(dir, action2.page.relativePath);
-            await mkdir17(path67.dirname(pagePath), { recursive: true });
+            const pagePath = path68.join(dir, action2.page.relativePath);
+            await mkdir17(path68.dirname(pagePath), { recursive: true });
             await writeFile20(
               pagePath,
               buildStarterDocsPageTsx(action2.page.slug, action2.page.title),
@@ -19943,7 +20474,7 @@ async function makeConfig(argv) {
       if (argv.openapi) {
         const wire = await wireDevPortalOpenApi(
           dir,
-          path67.resolve(dir, argv.openapi)
+          path68.resolve(dir, argv.openapi)
         );
         if (wire.status !== "succeeded") {
           throw new Error(
@@ -19972,7 +20503,7 @@ async function makeConfig(argv) {
         const slug = normalizePageSlug2(argv.pageSlug);
         const pageTemplate = normalizePageTemplate(argv.pageTemplate);
         const relativePagePath = pageComponentRelativePath(slug);
-        const filePath = path67.join(dir, relativePagePath);
+        const filePath = path68.join(dir, relativePagePath);
         const isUpdate = argv.pageUpdate === true;
         if (isUpdate) {
           if (!await fileExists3(filePath)) {
@@ -20005,7 +20536,7 @@ async function makeConfig(argv) {
             argv.pageContent,
             pageTemplate
           );
-          await mkdir17(path67.dirname(filePath), { recursive: true });
+          await mkdir17(path68.dirname(filePath), { recursive: true });
           await writeFile20(filePath, tsx, "utf8");
           const configResult = await wireNewDevPortalPageInConfig(
             dir,
@@ -20018,7 +20549,7 @@ async function makeConfig(argv) {
             pagePath: relativePagePath,
             pageTemplate,
             configUpdated: configResult.updated,
-            configPath: configResult.configPath ? path67.relative(dir, configResult.configPath) : null
+            configPath: configResult.configPath ? path68.relative(dir, configResult.configPath) : null
           };
           changes.push("page_add");
         }
@@ -20143,10 +20674,10 @@ var config_default = {
 };
 
 // src/cli/cmds/deploy.ts
-import path81 from "node:path";
+import path82 from "node:path";
 
 // src/cli/apply/handler.ts
-import path78 from "node:path";
+import path79 from "node:path";
 
 // src/cli/platform/helpers/gateway-plan-validation.ts
 init_gateway_limits();
@@ -20167,15 +20698,15 @@ function buildGatewayPlansValidationRequest(plans) {
     };
   });
 }
-function toConfigIssue(issue2) {
+function toConfigIssue(issue3) {
   return {
-    ...issue2,
-    field: issue2.field.replace(/\.limitsJson$/, ".limits")
+    ...issue3,
+    field: issue3.field.replace(/\.limitsJson$/, ".limits")
   };
 }
-function formatGatewayPlanIssue(issue2) {
-  const sku = issue2.sku ? ` (${issue2.sku})` : "";
-  return `${issue2.field}${sku}: ${issue2.message}`;
+function formatGatewayPlanIssue(issue3) {
+  const sku = issue3.sku ? ` (${issue3.sku})` : "";
+  return `${issue3.field}${sku}: ${issue3.message}`;
 }
 async function checkGatewayPlansOnPlatform(client, args) {
   let result;
@@ -20198,10 +20729,10 @@ async function checkGatewayPlansOnPlatform(client, args) {
 async function assertGatewayPlansValidForPublish(client, args) {
   const localErrors = args.localErrors ?? [];
   const check2 = await checkGatewayPlansOnPlatform(client, args);
-  const localFields = new Set(localErrors.map((issue2) => issue2.field));
+  const localFields = new Set(localErrors.map((issue3) => issue3.field));
   const errors = [
     ...localErrors,
-    ...(check2?.errors ?? []).filter((issue2) => !localFields.has(issue2.field))
+    ...(check2?.errors ?? []).filter((issue3) => !localFields.has(issue3.field))
   ];
   if (errors.length === 0) {
     return { blocked: false };
@@ -20341,11 +20872,11 @@ init_gateway_limits();
 // src/cli/platform/helpers/deploy-artifact-hash.ts
 import { createHash as createHash3 } from "node:crypto";
 import { createReadStream, promises as fs8 } from "node:fs";
-import path69 from "node:path";
+import path70 from "node:path";
 
 // src/cli/platform/helpers/package-files.ts
 import { promises as fs7 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 import ignore from "ignore";
 var DEFAULT_EXCLUDES = /* @__PURE__ */ new Set([
   "node_modules",
@@ -20358,7 +20889,7 @@ var DEFAULT_EXCLUDES = /* @__PURE__ */ new Set([
 async function loadGitignore(rootDir) {
   const ig = ignore();
   ig.add(["node_modules/", ".git/", "dist/", "bin/", "obj/"]);
-  const gitignorePath = path68.join(rootDir, ".gitignore");
+  const gitignorePath = path69.join(rootDir, ".gitignore");
   try {
     const content = await fs7.readFile(gitignorePath, "utf8");
     ig.add(content);
@@ -20367,11 +20898,11 @@ async function loadGitignore(rootDir) {
   return ig;
 }
 async function collectFiles(rootDir, relativeDir, ig, files) {
-  const absDir = path68.join(rootDir, relativeDir);
+  const absDir = path69.join(rootDir, relativeDir);
   const entries = await fs7.readdir(absDir, { withFileTypes: true });
   for (const entry of entries) {
-    const rel2 = relativeDir ? path68.join(relativeDir, entry.name) : entry.name;
-    const relPosix = rel2.split(path68.sep).join("/");
+    const rel2 = relativeDir ? path69.join(relativeDir, entry.name) : entry.name;
+    const relPosix = rel2.split(path69.sep).join("/");
     if (DEFAULT_EXCLUDES.has(entry.name) && !relativeDir) {
       continue;
     }
@@ -20386,7 +20917,7 @@ async function collectFiles(rootDir, relativeDir, ig, files) {
   }
 }
 async function collectPackageableFiles(sourceDirectory) {
-  const resolved = path68.resolve(sourceDirectory);
+  const resolved = path69.resolve(sourceDirectory);
   const stat7 = await fs7.stat(resolved).catch(() => null);
   if (!stat7?.isDirectory()) {
     throw new Error(`sourceDirectory is not a directory: ${resolved}`);
@@ -20412,7 +20943,7 @@ async function sha256File(filePath) {
   return hash2.digest("hex");
 }
 async function hashDirectoryContents(rootDirectory) {
-  const resolved = path69.resolve(rootDirectory);
+  const resolved = path70.resolve(rootDirectory);
   const files = (await collectPackageableFiles(resolved)).sort(
     (a, b) => a.localeCompare(b)
   );
@@ -20420,13 +20951,13 @@ async function hashDirectoryContents(rootDirectory) {
   for (const rel2 of files) {
     hash2.update(rel2);
     hash2.update("\0");
-    hash2.update(await fs8.readFile(path69.join(resolved, rel2)));
+    hash2.update(await fs8.readFile(path70.join(resolved, rel2)));
     hash2.update("\0");
   }
   return hash2.digest("hex");
 }
 async function hashDevPortalSiteSources(siteDirectory, options) {
-  const resolved = path69.resolve(siteDirectory);
+  const resolved = path70.resolve(siteDirectory);
   const hash2 = createHash3("sha256");
   const candidates = [
     "apitogo.config.json",
@@ -20436,7 +20967,7 @@ async function hashDevPortalSiteSources(siteDirectory, options) {
     "zudoku.config.tsx"
   ];
   for (const name of candidates) {
-    const full = path69.join(resolved, name);
+    const full = path70.join(resolved, name);
     try {
       hash2.update(name);
       hash2.update("\0");
@@ -20446,7 +20977,7 @@ async function hashDevPortalSiteSources(siteDirectory, options) {
     }
   }
   for (const dir of ["pages", "landing", "src"]) {
-    const full = path69.join(resolved, dir);
+    const full = path70.join(resolved, dir);
     try {
       const st = await fs8.stat(full);
       if (!st.isDirectory()) continue;
@@ -20675,8 +21206,8 @@ function normalizeActionKey(actionKey) {
   const trimmed = actionKey.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path96 = pathParts.join(":").trim();
-    return `${method2?.toLowerCase()}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
+    const path101 = pathParts.join(":").trim();
+    return `${method2?.toLowerCase()}:${path101.startsWith("/") ? path101 : `/${path101}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -20685,8 +21216,8 @@ function normalizeActionKey(actionKey) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path95 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  const path100 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path100.startsWith("/") ? path100 : `/${path100}`}`;
 }
 async function applyGatewayPublicRoutes(client, projectId, routes, options) {
   const applied = [];
@@ -21164,8 +21695,8 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
 }
 
 // src/cli/platform/helpers/openapi-gateway-servers.ts
-import { mkdir as mkdir18, readFile as readFile21, writeFile as writeFile21 } from "node:fs/promises";
-import path70 from "node:path";
+import { mkdir as mkdir18, readFile as readFile22, writeFile as writeFile21 } from "node:fs/promises";
+import path71 from "node:path";
 import YAML3 from "yaml";
 var GATEWAY_URL_ENV_KEY = "APITOGO_GATEWAY_URL";
 var PUBLISH_OPENAPI_RELATIVE = ".apitogo/openapi-publish.json";
@@ -21196,8 +21727,8 @@ async function resolveProjectGatewayUrl(client, projectId) {
   return null;
 }
 async function readOpenApiDocument(filePath) {
-  const content = await readFile21(filePath, "utf8");
-  const ext = path70.extname(filePath).toLowerCase();
+  const content = await readFile22(filePath, "utf8");
+  const ext = path71.extname(filePath).toLowerCase();
   const parsed = ext === ".json" ? JSON.parse(content) : YAML3.parse(content);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     throw new Error(`OpenAPI document must be an object: ${filePath}`);
@@ -21205,13 +21736,13 @@ async function readOpenApiDocument(filePath) {
   return parsed;
 }
 async function materializePublishOpenApiWithGateway(siteDirectory, sourceOpenApiPath, gatewayUrl) {
-  const site = path70.resolve(siteDirectory);
-  const source = path70.resolve(sourceOpenApiPath);
+  const site = path71.resolve(siteDirectory);
+  const source = path71.resolve(sourceOpenApiPath);
   const relativeInput = PUBLISH_OPENAPI_RELATIVE;
-  const outputPath = path70.join(site, ...relativeInput.split("/"));
+  const outputPath = path71.join(site, ...relativeInput.split("/"));
   const doc = await readOpenApiDocument(source);
   const rewritten = withGatewayServers(doc, gatewayUrl);
-  await mkdir18(path70.dirname(outputPath), { recursive: true });
+  await mkdir18(path71.dirname(outputPath), { recursive: true });
   await writeFile21(
     outputPath,
     `${JSON.stringify(rewritten, null, 2)}
@@ -21221,11 +21752,11 @@ async function materializePublishOpenApiWithGateway(siteDirectory, sourceOpenApi
   return { outputPath, relativeInput };
 }
 async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
-  const configPath = path70.join(
-    path70.resolve(siteDirectory),
+  const configPath = path71.join(
+    path71.resolve(siteDirectory),
     APITOGO_CONFIG_FILENAME2
   );
-  const raw = await readFile21(configPath, "utf8");
+  const raw = await readFile22(configPath, "utf8");
   const config2 = JSON.parse(raw);
   const previousApis = config2.apis;
   const previousBackend = config2.backend;
@@ -21242,7 +21773,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
 `, "utf8");
   return {
     restore: async () => {
-      const currentRaw = await readFile21(configPath, "utf8");
+      const currentRaw = await readFile22(configPath, "utf8");
       const current = JSON.parse(currentRaw);
       if (previousApis === void 0) {
         delete current.apis;
@@ -21264,7 +21795,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
   };
 }
 async function prepareOpenApiServersForGatewayBuild(options) {
-  const siteDirectory = path70.resolve(options.siteDirectory);
+  const siteDirectory = path71.resolve(options.siteDirectory);
   let openApiPath = resolveBackendOpenApiPath(
     options.manifest?.backend?.openApiPath,
     {
@@ -21277,8 +21808,8 @@ async function prepareOpenApiServersForGatewayBuild(options) {
   );
   if (!openApiPath) {
     try {
-      const raw = await readFile21(
-        path70.join(siteDirectory, APITOGO_CONFIG_FILENAME2),
+      const raw = await readFile22(
+        path71.join(siteDirectory, APITOGO_CONFIG_FILENAME2),
         "utf8"
       );
       const config2 = JSON.parse(raw);
@@ -21307,8 +21838,8 @@ function normalizeActionKeyFormat(actionKey) {
   const trimmed = actionKey.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path96 = pathParts.join(":").trim();
-    return `${method2.toLowerCase()}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
+    const path101 = pathParts.join(":").trim();
+    return `${method2.toLowerCase()}:${path101.startsWith("/") ? path101 : `/${path101}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -21317,8 +21848,8 @@ function normalizeActionKeyFormat(actionKey) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path95 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  const path100 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path100.startsWith("/") ? path100 : `/${path100}`}`;
 }
 function normalizePublicRoute(route) {
   const trimmed = route.trim();
@@ -21351,16 +21882,16 @@ function collectManifestPublicActionKeys(gateway) {
 }
 
 // src/cli/platform/helpers/publish-ledger.ts
-import { mkdir as mkdir19, readFile as readFile22, writeFile as writeFile22 } from "node:fs/promises";
-import path71 from "node:path";
+import { mkdir as mkdir19, readFile as readFile23, writeFile as writeFile22 } from "node:fs/promises";
+import path72 from "node:path";
 var PUBLISH_LEDGER_RELATIVE_PATH = ".apitogo/publish-state.json";
 function publishLedgerPath(siteDirectory) {
-  return path71.join(path71.resolve(siteDirectory), PUBLISH_LEDGER_RELATIVE_PATH);
+  return path72.join(path72.resolve(siteDirectory), PUBLISH_LEDGER_RELATIVE_PATH);
 }
 async function readPublishLedger(siteDirectory) {
   const filePath = publishLedgerPath(siteDirectory);
   try {
-    const raw = await readFile22(filePath, "utf8");
+    const raw = await readFile23(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || !Array.isArray(parsed.steps)) {
       return null;
@@ -21372,7 +21903,7 @@ async function readPublishLedger(siteDirectory) {
 }
 async function writePublishLedger(siteDirectory, ledger) {
   const filePath = publishLedgerPath(siteDirectory);
-  await mkdir19(path71.dirname(filePath), { recursive: true });
+  await mkdir19(path72.dirname(filePath), { recursive: true });
   const next = {
     ...ledger,
     version: 1,
@@ -21891,10 +22422,10 @@ async function createProjectWithWarmPoolRetry(client, body, options) {
 }
 
 // src/cli/platform/helpers/backend-packaging.ts
-import { spawn as spawn3 } from "node:child_process";
+import { spawn as spawn4 } from "node:child_process";
 import { mkdtemp, readdir as readdir2, rm as rm11 } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import path72 from "node:path";
+import path73 from "node:path";
 async function directoryHasRuntimeConfig(dir) {
   if (!await pathExists(dir)) {
     return false;
@@ -21904,7 +22435,7 @@ async function directoryHasRuntimeConfig(dir) {
 }
 function runDotnetPublish(projectDir, outputDir) {
   return new Promise((resolve, reject) => {
-    const child = spawn3(
+    const child = spawn4(
       "dotnet",
       [
         "publish",
@@ -21937,20 +22468,20 @@ function runDotnetPublish(projectDir, outputDir) {
 async function findCsproj(projectDir) {
   const entries = await readdir2(projectDir);
   const csproj = entries.find((name) => name.endsWith(".csproj"));
-  return csproj ? path72.join(projectDir, csproj) : null;
+  return csproj ? path73.join(projectDir, csproj) : null;
 }
 async function prepareBackendPackagingDirectory(args) {
-  const sourceDirectory = path72.resolve(args.sourceDirectory);
+  const sourceDirectory = path73.resolve(args.sourceDirectory);
   if (args.publishDirectory?.trim()) {
     return {
-      directory: path72.resolve(args.publishDirectory),
+      directory: path73.resolve(args.publishDirectory),
       packagingMode: "published"
     };
   }
   if (await directoryHasRuntimeConfig(sourceDirectory)) {
     return { directory: sourceDirectory, packagingMode: "published" };
   }
-  const publishSubdir = path72.join(sourceDirectory, "publish");
+  const publishSubdir = path73.join(sourceDirectory, "publish");
   if (await directoryHasRuntimeConfig(publishSubdir)) {
     return { directory: publishSubdir, packagingMode: "published" };
   }
@@ -21962,9 +22493,9 @@ async function prepareBackendPackagingDirectory(args) {
     return { directory: sourceDirectory, packagingMode: "source" };
   }
   const tempRoot = await mkdtemp(
-    path72.join(tmpdir(), "apitogo-dotnet-publish-")
+    path73.join(tmpdir(), "apitogo-dotnet-publish-")
   );
-  const outputDir = path72.join(tempRoot, "publish");
+  const outputDir = path73.join(tempRoot, "publish");
   const result = await runDotnetPublish(sourceDirectory, outputDir);
   if (result.exitCode !== 0) {
     await rm11(tempRoot, { recursive: true, force: true });
@@ -22010,12 +22541,12 @@ function formatJobStatusResponse(options) {
 // src/cli/platform/helpers/zip.ts
 import { createReadStream as createReadStream2, createWriteStream as createWriteStream2, promises as fs9 } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
-import path73 from "node:path";
+import path74 from "node:path";
 import { ZipArchive } from "archiver";
 async function packageBackendDirectory(sourceDirectory) {
-  const resolved = path73.resolve(sourceDirectory);
+  const resolved = path74.resolve(sourceDirectory);
   const files = await collectPackageableFiles(resolved);
-  const zipPath = path73.join(
+  const zipPath = path74.join(
     tmpdir2(),
     `apitogo-backend-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
   );
@@ -22027,8 +22558,8 @@ async function packageBackendDirectory(sourceDirectory) {
     output4.on("error", reject);
     archive.pipe(output4);
     for (const rel2 of files) {
-      archive.append(createReadStream2(path73.join(resolved, rel2)), {
-        name: rel2.split(path73.sep).join("/")
+      archive.append(createReadStream2(path74.join(resolved, rel2)), {
+        name: rel2.split(path74.sep).join("/")
       });
     }
     void archive.finalize();
@@ -23529,11 +24060,11 @@ async function resolveProjectIdForPublish(client, config2, args, wait, progress,
 }
 
 // src/cli/platform/tools/dev-portal-site-build.ts
-import path77 from "node:path";
+import path78 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-site-api-url.ts
-import { readdir as readdir3, readFile as readFile23, writeFile as writeFile23 } from "node:fs/promises";
-import path74 from "node:path";
+import { readdir as readdir3, readFile as readFile24, writeFile as writeFile23 } from "node:fs/promises";
+import path75 from "node:path";
 var SITE_API_BASE_URL_ENV_KEY = "VITE_APITOGO_AUTHENTICATION_API_BASE_URL";
 var PLACEHOLDER_HOST_MARKERS = [
   "dp-example.azurecontainerapps.io",
@@ -23554,10 +24085,10 @@ function isPlaceholderDevPortalApiUrl(apiBaseUrl) {
   return PLACEHOLDER_HOST_MARKERS.some((marker) => normalized.includes(marker));
 }
 async function readSiteApiBaseUrl(sourceDirectory) {
-  const resolved = path74.resolve(sourceDirectory);
+  const resolved = path75.resolve(sourceDirectory);
   for (const envFile of [".env", ".env.production"]) {
     try {
-      const content = await readFile23(path74.join(resolved, envFile), "utf8");
+      const content = await readFile24(path75.join(resolved, envFile), "utf8");
       const lines = [...content.matchAll(ENV_LINE_GLOBAL_RE)];
       if (lines.length === 0) {
         continue;
@@ -23582,13 +24113,13 @@ async function readSiteApiBaseUrl(sourceDirectory) {
   return null;
 }
 async function patchSiteApiBaseUrl(sourceDirectory, apiBaseUrl) {
-  const resolved = path74.resolve(sourceDirectory);
+  const resolved = path75.resolve(sourceDirectory);
   const line2 = `${SITE_API_BASE_URL_ENV_KEY}=${apiBaseUrl}`;
   let patchedExisting = false;
   for (const envFile of [".env.production", ".env"]) {
-    const envPath = path74.join(resolved, envFile);
+    const envPath = path75.join(resolved, envFile);
     try {
-      const content = await readFile23(envPath, "utf8");
+      const content = await readFile24(envPath, "utf8");
       const withoutAssignments = content.replace(ENV_LINE_GLOBAL_RE, "").replace(/\n{3,}/g, "\n\n").trimEnd();
       const patched = withoutAssignments ? `${withoutAssignments}
 ${line2}
@@ -23600,7 +24131,7 @@ ${line2}
     }
   }
   if (!patchedExisting) {
-    await writeFile23(path74.join(resolved, ".env"), `${line2}
+    await writeFile23(path75.join(resolved, ".env"), `${line2}
 `);
   }
 }
@@ -23608,7 +24139,7 @@ function tryProjectId(explicit, manifestProjectId, config2) {
   return explicit?.trim() || manifestProjectId?.trim() || config2.defaultProjectId?.trim() || void 0;
 }
 async function ensureLiveSiteApiBaseUrlForBuild(_client, config2, args, resolveFromProject) {
-  const sourceDirectory = path74.resolve(args.sourceDirectory);
+  const sourceDirectory = path75.resolve(args.sourceDirectory);
   const explicit = args.apiBaseUrl?.trim();
   if (explicit && !isPlaceholderDevPortalApiUrl(explicit)) {
     await patchSiteApiBaseUrl(sourceDirectory, explicit);
@@ -23644,7 +24175,7 @@ async function* walkFiles(root) {
     return;
   }
   for (const entry of entries) {
-    const full = path74.join(root, entry.name);
+    const full = path75.join(root, entry.name);
     if (entry.isDirectory()) {
       if (entry.name === "node_modules" || entry.name === ".git") {
         continue;
@@ -23656,8 +24187,8 @@ async function* walkFiles(root) {
   }
 }
 async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiBaseUrl) {
-  const dist = path74.resolve(distDirectory);
-  const siteRoot = path74.dirname(dist);
+  const dist = path75.resolve(distDirectory);
+  const siteRoot = path75.dirname(dist);
   const fromEnv = expectedApiBaseUrl?.trim() || await readSiteApiBaseUrl(siteRoot) || await readSiteApiBaseUrl(dist);
   if (!fromEnv || isPlaceholderDevPortalApiUrl(fromEnv)) {
     throw new Error(
@@ -23668,7 +24199,7 @@ async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiB
   let found = false;
   let foundPlaceholder = false;
   for await (const file of walkFiles(dist)) {
-    const content = await readFile23(file, "utf8");
+    const content = await readFile24(file, "utf8");
     if (content.includes(needle)) {
       found = true;
     }
@@ -23693,7 +24224,7 @@ async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiB
 
 // src/cli/platform/tools/dev-portal.ts
 import { promises as fs11 } from "node:fs";
-import path76 from "node:path";
+import path77 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-backend-job.ts
 var DEV_PORTAL_BACKEND_UPDATE_RESOURCE_TYPE = "DevPortalBackendUpdate";
@@ -23803,7 +24334,7 @@ async function snapshotBackendUpdateJobIds(client, projectId) {
 // src/cli/platform/helpers/tarball.ts
 import { createReadStream as createReadStream3, createWriteStream as createWriteStream3, promises as fs10 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import path75 from "node:path";
+import path76 from "node:path";
 import { TarArchive } from "archiver";
 var DEV_PORTAL_DEPLOY_ARCHIVE_ROOT = "dist";
 function normalizeArchiveRoot(archiveRoot) {
@@ -23814,10 +24345,10 @@ function normalizeArchiveRoot(archiveRoot) {
   return `${trimmed}/`;
 }
 async function packageDirectoryAsTarGz(sourceDirectory, options) {
-  const resolved = path75.resolve(sourceDirectory);
+  const resolved = path76.resolve(sourceDirectory);
   const files = await collectPackageableFiles(resolved);
   const entryPrefix = options?.archiveRoot ? normalizeArchiveRoot(options.archiveRoot) : "";
-  const archivePath = path75.join(
+  const archivePath = path76.join(
     tmpdir3(),
     `apitogo-docs-${Date.now()}-${Math.random().toString(36).slice(2)}.tgz`
   );
@@ -23829,8 +24360,8 @@ async function packageDirectoryAsTarGz(sourceDirectory, options) {
     output4.on("error", reject);
     archive.pipe(output4);
     for (const rel2 of files) {
-      const entryName = entryPrefix + rel2.split(path75.sep).join("/");
-      archive.append(createReadStream3(path75.join(resolved, rel2)), {
+      const entryName = entryPrefix + rel2.split(path76.sep).join("/");
+      archive.append(createReadStream3(path76.join(resolved, rel2)), {
         name: entryName
       });
     }
@@ -24072,7 +24603,7 @@ function validateDeployArchiveInput(args) {
 async function resolveDevPortalArchive(args) {
   validateDeployArchiveInput(args);
   if (args.archivePath?.trim()) {
-    const archivePath = path76.resolve(args.archivePath.trim());
+    const archivePath = path77.resolve(args.archivePath.trim());
     const stat7 = await fs11.stat(archivePath).catch(() => null);
     if (!stat7?.isFile()) {
       throw new Error(`archivePath is not a file: ${archivePath}`);
@@ -24137,7 +24668,7 @@ async function handleDeployDevPortal(client, config2, args, progress) {
 // src/cli/platform/tools/dev-portal-site-build.ts
 async function handleBuildDevPortalSite(client, config2, args, progress) {
   const buildProgress = progress?.child("Build dev portal site");
-  const sourceDirectory = path77.resolve(args.sourceDirectory);
+  const sourceDirectory = path78.resolve(args.sourceDirectory);
   await buildProgress?.onStep("Ensuring live portal API URL");
   const apiBaseUrl = await ensureLiveSiteApiBaseUrlForBuild(
     client,
@@ -24353,7 +24884,7 @@ function throwOnManifestIssues(issues) {
     return;
   }
   throw new Error(
-    `apitogo.config.json is not platform-compatible: ${issues.map((issue2) => `${issue2.field}: ${issue2.message}`).join("; ")}`
+    `apitogo.config.json is not platform-compatible: ${issues.map((issue3) => `${issue3.field}: ${issue3.message}`).join("; ")}`
   );
 }
 async function runApplyFromSiteDirectory(client, config2, args, progress) {
@@ -25371,14 +25902,14 @@ function formatBlockedOrFailedResultForHuman(parsed) {
     const lines = [
       typeof parsed.userMessage === "string" ? parsed.userMessage : "Deploy is blocked: apitogo.config.json has errors."
     ];
-    for (const issue2 of Array.isArray(parsed.errors) ? parsed.errors : []) {
-      lines.push(`  - ${formatGatewayPlanIssue(issue2)}`);
+    for (const issue3 of Array.isArray(parsed.errors) ? parsed.errors : []) {
+      lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
     }
     const warnings = Array.isArray(parsed.warnings) ? parsed.warnings : [];
     if (warnings.length > 0) {
       lines.push("", "Warnings:");
-      for (const issue2 of warnings) {
-        lines.push(`  - ${formatGatewayPlanIssue(issue2)}`);
+      for (const issue3 of warnings) {
+        lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
       }
     }
     lines.push(
@@ -25633,7 +26164,7 @@ function resultLooksFailed(payload) {
   return parsed.status === "failed" || parsed.status === "blocked";
 }
 async function apply(argv) {
-  const sourceDirectory = path78.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path79.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -25703,7 +26234,7 @@ async function apply(argv) {
   if (canPromptInteractively && parsed?.status === "blocked" && parsed.reason === "project_not_found") {
     const resolution = await resolveProjectNotFoundInteractively(
       parsed,
-      path78.basename(sourceDirectory)
+      path79.basename(sourceDirectory)
     );
     if (resolution) {
       effectiveProjectId = void 0;
@@ -25723,7 +26254,7 @@ async function apply(argv) {
   while (canPromptInteractively && parsed?.status === "blocked" && parsed.reason === "project_name_exists") {
     const resolution = await resolveProjectNameExistsInteractively(
       parsed,
-      effectiveProjectName ?? path78.basename(sourceDirectory)
+      effectiveProjectName ?? path79.basename(sourceDirectory)
     );
     if (!resolution) {
       break;
@@ -25795,7 +26326,7 @@ async function apply(argv) {
 
 // src/cli/deploy/command.ts
 init_invariant();
-import path80 from "node:path";
+import path81 from "node:path";
 
 // src/cli/deploy/v2.ts
 import { rm as rm12 } from "node:fs/promises";
@@ -25803,7 +26334,245 @@ init_invariant();
 
 // src/cli/portal/report.ts
 import { access as access13 } from "node:fs/promises";
-import path79 from "node:path";
+import path80 from "node:path";
+
+// src/cli/deploy/gateway.ts
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile25 } from "node:fs/promises";
+init_invariant();
+var GatewayDeployError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot deploy the gateway" });
+    this.code = code;
+    this.name = "GatewayDeployError";
+  }
+};
+var sha256 = (text) => createHash4("sha256").update(text).digest("hex");
+function gatewayNotDeployableReason(gateway) {
+  if (gateway.origin.mode === "managed")
+    return "a managed origin cannot be deployed from this CLI version yet; use origin.mode proxy";
+  if (gateway.specs.length > 1)
+    return "the platform takes one OpenAPI file per gateway, but the config lists several";
+  return void 0;
+}
+function assertDeployable(gateway) {
+  if (gateway.origin.mode === "managed")
+    throw new GatewayDeployError(
+      "GATEWAY_MANAGED_ORIGIN_UNSUPPORTED",
+      "A managed origin cannot be deployed from this CLI version yet.",
+      'Set gateway.origin.mode to "proxy" and point gateway.origin.url at your API.'
+    );
+  if (gateway.specs.length > 1)
+    throw new GatewayDeployError(
+      "GATEWAY_MULTIPLE_SPECS",
+      "The platform takes one OpenAPI file per gateway, but gateway.specs lists several.",
+      "Merge them into one file, or list only one."
+    );
+}
+async function readSpec(gateway) {
+  const file = gateway.specs[0];
+  if (!file)
+    throw new GatewayDeployError(
+      "GATEWAY_SPEC_UNREADABLE",
+      "gateway.specs lists no OpenAPI file.",
+      "Add one to gateway.specs in the config."
+    );
+  try {
+    return await readFile25(file);
+  } catch {
+    throw new GatewayDeployError(
+      "GATEWAY_SPEC_UNREADABLE",
+      `Cannot read the OpenAPI file ${file}.`,
+      "Check gateway.specs in the config."
+    );
+  }
+}
+async function gatewayDeployInputs(resolved, projectId) {
+  const gateway = resolved.gateway;
+  if (!gateway) throw new Error("gateway is not configured");
+  const spec = await readSpec(gateway);
+  const manifest = await readManifest(resolved.state);
+  const body = gatewayConfigBody(
+    gateway,
+    derivedCorsSites({
+      portalUrl: manifest?.services.portal?.url,
+      docsUrl: resolved.portal?.docs.provider === "external" ? resolved.portal.docs.url : void 0
+    })
+  );
+  return {
+    gateway,
+    spec,
+    body,
+    specHash: sha256(`${projectId}|${sha256(spec)}`),
+    configHash: sha256(`${projectId}|${stableJson(body)}`)
+  };
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function describePlatformProblem(error) {
+  if (!(error instanceof PlatformApiError) || !error.problem) return [];
+  const errors = error.problem.errors;
+  if (Array.isArray(errors) && errors.length > 0) {
+    return errors.map((item) => {
+      const entry = item;
+      return `${String(entry.field ?? "gateway")}: ${String(entry.message ?? "")} ${String(entry.hint ?? "")} [${String(entry.code ?? "")}]`.replace(
+        /\s+/g,
+        " "
+      );
+    });
+  }
+  const { code, field, hint, detail } = error.problem;
+  return code ? [
+    `${String(field ?? "gateway")}: ${String(detail ?? "")} ${String(hint ?? "")} [${String(code)}]`.replace(
+      /\s+/g,
+      " "
+    )
+  ] : [];
+}
+function rejected(what, error) {
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new GatewayDeployError(
+      "GATEWAY_REJECTED",
+      `The platform refused the ${what}:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the listed problems in apitogo.config.json and run deploy again."
+    );
+  }
+  throw error;
+}
+async function deployGateway(resolved, projectId, deps, options = {}) {
+  const { gateway, spec, body, specHash, configHash } = await gatewayDeployInputs(resolved, projectId);
+  assertDeployable(gateway);
+  const client = deps.client;
+  const sleep5 = deps.sleep ?? defaultSleep;
+  const now = deps.now ?? Date.now;
+  const timeoutMs = deps.reconcileTimeoutMs ?? 18e4;
+  const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const specStep = {
+    name: "spec",
+    hash: () => specHash,
+    run: async () => {
+      try {
+        const uploaded = await client.putGatewaySpec(projectId, spec);
+        return {
+          specSha256: uploaded.sha256,
+          operationCount: String(uploaded.operationCount)
+        };
+      } catch (error) {
+        return rejected("OpenAPI file", error);
+      }
+    }
+  };
+  const ticketOf = async () => stepOf(await readLedger(resolved.state), "gateway", "config")?.output?.reconciliationId;
+  const configStep = {
+    name: "config",
+    hash: () => configHash,
+    run: async () => {
+      try {
+        const accepted = await client.putGatewayConfig(projectId, body);
+        return {
+          reconciliationId: accepted.reconciliationId,
+          desiredHash: accepted.desiredHash
+        };
+      } catch (error) {
+        return rejected("gateway config", error);
+      }
+    },
+    // A reconciliation the platform gave up on is not a result worth keeping.
+    stillValid: async () => {
+      const ticket = await ticketOf();
+      if (!ticket) return false;
+      try {
+        const state = await client.getGatewayReconciliation(projectId, ticket);
+        return state.state !== "Failed" && state.state !== "Superseded";
+      } catch {
+        return false;
+      }
+    }
+  };
+  const reconcileStep = {
+    name: "reconcile",
+    hash: () => configHash,
+    run: async () => {
+      const ticket = await ticketOf();
+      if (!ticket)
+        throw new GatewayDeployError(
+          "GATEWAY_RECONCILE_FAILED",
+          "There is no reconciliation to wait for.",
+          "Run deploy again."
+        );
+      const deadline = now() + timeoutMs;
+      for (; ; ) {
+        const state = await client.getGatewayReconciliation(projectId, ticket);
+        if (state.state === "Succeeded") break;
+        if (state.state === "Failed" || state.state === "Superseded")
+          throw new GatewayDeployError(
+            "GATEWAY_RECONCILE_FAILED",
+            `The platform could not apply the gateway config: ${[state.errorCode, state.errorMessage].filter(Boolean).join(" ") || state.state}.`,
+            "Fix the cause and run deploy again; the config is sent again."
+          );
+        if (now() >= deadline)
+          throw new GatewayDeployError(
+            "GATEWAY_RECONCILE_TIMEOUT",
+            `The platform did not finish within ${Math.round(timeoutMs / 1e3)} seconds (state: ${state.state}).`,
+            "Run deploy again to keep waiting. If it stays Pending, the platform worker that applies gateway configs may not be running yet."
+          );
+        await sleep5(intervalMs);
+      }
+      const status2 = await client.getGatewayStatus(projectId);
+      return {
+        baseUrl: status2.baseUrl,
+        operationCount: String(status2.operationCount),
+        ...status2.specSha256 ? { specSha256: status2.specSha256 } : {}
+      };
+    }
+  };
+  const outcomes = await runPipeline(
+    resolved.state,
+    "gateway",
+    [specStep, configStep, reconcileStep],
+    { force: options.force }
+  );
+  const reconcile = outcomes.find((outcome) => outcome.step === "reconcile");
+  const ran = reconcile !== void 0 && !reconcile.skipped;
+  const known = (await readManifest(resolved.state))?.services.gateway;
+  let baseUrl = reconcile?.output?.baseUrl ?? known?.baseUrl;
+  if (ran || known === void 0) {
+    const status2 = await client.getGatewayStatus(projectId);
+    baseUrl = status2.baseUrl || baseUrl;
+    if (baseUrl) {
+      const capabilities = await client.getGatewayCapabilities(projectId);
+      const previous = known?.baseUrl?.replace(/\/+$/, "");
+      if (baseUrl.replace(/\/+$/, "") !== previous || ran) {
+        await writeManifest(
+          resolved.state,
+          withGatewayEntry(await readManifest(resolved.state), {
+            projectId,
+            projectName: resolved.project.name,
+            provider: status2.provider,
+            baseUrl,
+            capabilities: capabilities.capabilities,
+            openapiUrl: status2.openApiPath ?? void 0,
+            openapiHash: status2.openApiHash ?? status2.specSha256 ?? void 0
+          })
+        );
+      }
+    }
+  }
+  const config2 = outcomes.find((outcome) => outcome.step === "config");
+  return {
+    status: ran ? "deployed" : "unchanged",
+    steps: outcomes.map((outcome) => ({
+      step: outcome.step,
+      skipped: outcome.skipped
+    })),
+    baseUrl,
+    operationCount: reconcile?.output?.operationCount ? Number(reconcile.output.operationCount) : void 0,
+    reconciliationId: config2?.output?.reconciliationId
+  };
+}
+
+// src/cli/portal/report.ts
 var DEPLOY_ORDER = [
   "identity",
   "gateway",
@@ -25844,7 +26613,7 @@ async function planPortalService(resolved, ledger) {
     const hash2 = await portalBuildHash(resolved, prepared);
     const previous = stepOf(ledger, "portal", "build");
     const built = await exists4(
-      path79.join(resolved.state.buildDir, "index.html")
+      path80.join(resolved.state.buildDir, "index.html")
     );
     if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
       return {
@@ -25874,7 +26643,148 @@ async function planPortalService(resolved, ledger) {
     };
   }
 }
-async function planV2(dir, only) {
+function describePolicies(gateway) {
+  const policies = gateway.policies;
+  return [
+    policies.access ? `access: ${[
+      policies.access.jwt === void 0 ? void 0 : `jwt ${policies.access.jwt ? "on" : "off"}`,
+      policies.access.apiKey === void 0 ? void 0 : `api key ${policies.access.apiKey ? "on" : "off"}`
+    ].filter(Boolean).join(", ")}` : void 0,
+    policies.rateLimit ? `rate limit: ${policies.rateLimit.calls} per ${policies.rateLimit.periodSeconds} s` : void 0,
+    policies.quota ? `quota: ${policies.quota.calls} per ${policies.quota.periodDays} day(s)` : void 0,
+    policies.cors ? `cors: ${policies.cors.length} origin(s)` : void 0,
+    policies.operations?.public ? `public operations: ${policies.operations.public.length}` : void 0
+  ].filter((line2) => line2 !== void 0);
+}
+function dryRunLines(dryRun) {
+  const changes = dryRun.changes;
+  if (!changes) return [];
+  const list2 = (label, items) => items.length > 0 ? [`  ${label}: ${items.join(", ")}`] : [];
+  if (changes.wouldCreate)
+    return [
+      "platform dry run: the gateway does not exist yet; everything would be created",
+      ...list2("operations", changes.operationsAdded),
+      ...list2("public", changes.nowPublic),
+      ...list2("denied", changes.nowDenied)
+    ];
+  if (!changes.hasChanges)
+    return ["platform dry run: the gateway already matches this config"];
+  return [
+    "platform dry run: the gateway would change",
+    ...list2("operations added", changes.operationsAdded),
+    ...list2("operations removed", changes.operationsRemoved),
+    ...list2("now public", changes.nowPublic),
+    ...list2("now protected", changes.nowProtected),
+    ...list2("now denied", changes.nowDenied),
+    ...changes.originChanged ? ["  origin address changes"] : [],
+    ...changes.policyChanges.map((c) => `  ${c}`),
+    ...dryRun.activeKeys > 0 ? [
+      `  active keys: ${dryRun.activeKeys} (removed or denied operations stop working for them)`
+    ] : []
+  ];
+}
+async function planGatewayService(resolved, ledger, dryRun) {
+  const base = { service: "gateway", issues: [] };
+  const gateway = resolved.gateway;
+  if (!gateway) throw new Error("gateway is not configured");
+  const why = gatewayNotDeployableReason(gateway);
+  if (why)
+    return {
+      ...base,
+      action: "not-deployable-yet",
+      reason: `configured, but ${why}`,
+      details: []
+    };
+  const details = [
+    `origin: proxy ${gateway.origin.url ?? "(no url set)"}`,
+    ...gateway.auth ? [`auth: ${gateway.auth.mode}`] : ["auth: none"],
+    ...describePolicies(gateway)
+  ];
+  const projectId = resolved.project.id;
+  const notAsked = !dryRun ? "platform dry run: not asked, you are not logged in" : !projectId ? "platform dry run: not asked, this folder is not linked to a project" : void 0;
+  let inputs;
+  try {
+    inputs = await gatewayDeployInputs(resolved, resolved.project.id ?? "");
+  } catch (error) {
+    return {
+      ...base,
+      action: "blocked",
+      reason: "cannot deploy until this is fixed",
+      details,
+      issues: [
+        {
+          code: "GATEWAY_SPEC_UNREADABLE",
+          path: "gateway.specs",
+          message: error instanceof Error ? error.message : String(error)
+        }
+      ]
+    };
+  }
+  const issues = [];
+  if (notAsked) {
+    details.push(notAsked);
+  } else if (dryRun && projectId) {
+    try {
+      const answer = await dryRun(projectId, {
+        config: inputs.body,
+        spec: inputs.spec.toString("utf8")
+      });
+      if (!answer.ok)
+        issues.push(
+          ...answer.issues.map((item) => ({
+            code: item.code,
+            path: item.field,
+            message: item.message,
+            hint: item.hint
+          }))
+        );
+      else details.push(...dryRunLines(answer));
+      if (answer.ok && !answer.comparedWithGateway)
+        details.push(
+          "  (the platform has no gateway unit for this project yet, so nothing could be compared)"
+        );
+    } catch (error) {
+      details.push(
+        `platform dry run: not available (${error instanceof Error ? error.message : String(error)})`
+      );
+    }
+  }
+  const step2 = (name) => stepOf(ledger, "gateway", name);
+  const hashes = {
+    spec: inputs.specHash,
+    config: inputs.configHash,
+    reconcile: inputs.configHash
+  };
+  const state = (name) => {
+    const record = step2(name);
+    if (!record) return "not done yet";
+    if (record.status === "failed")
+      return `failed last time (${record.error ?? "no message"})`;
+    if (record.status === "running") return "did not finish last time";
+    return record.hash === hashes[name] ? "done, unchanged" : "inputs changed";
+  };
+  const lines = [
+    `step spec (upload the OpenAPI file): ${state("spec")}`,
+    `step config (send the wanted state): ${state("config")}`,
+    `step reconcile (wait until the platform applied it): ${state("reconcile")}`
+  ];
+  const allDone = step2("spec")?.status === "succeeded" && step2("spec")?.hash === hashes.spec && step2("config")?.status === "succeeded" && step2("config")?.hash === hashes.config && step2("reconcile")?.status === "succeeded" && step2("reconcile")?.hash === hashes.reconcile;
+  if (issues.length > 0)
+    return {
+      ...base,
+      action: "blocked",
+      reason: "the platform refuses this config; fix these first",
+      details: [...details, ...lines],
+      issues
+    };
+  return {
+    ...base,
+    action: allDone ? "skip" : "deploy",
+    reason: allDone ? "deploy skipped: nothing it depends on has changed" : "will deploy: the wanted state or the OpenAPI file is not applied yet",
+    details: [...details, ...lines]
+  };
+}
+async function planV2(dir, only, options = {}) {
   const { resolved } = loadConfigV2(dir);
   const ledger = await readLedger(resolved.state);
   const services = [];
@@ -25898,6 +26808,10 @@ async function planV2(dir, only) {
       });
     } else if (service === "portal") {
       services.push(await planPortalService(resolved, ledger));
+    } else if (service === "gateway") {
+      services.push(
+        await planGatewayService(resolved, ledger, options.gatewayDryRun)
+      );
     } else {
       services.push({
         service,
@@ -25913,7 +26827,80 @@ async function planV2(dir, only) {
 function entryStatus(manifest, service) {
   return manifest?.services[service];
 }
-async function statusV2(dir, only) {
+function originHealthLines(origin) {
+  if (!origin.lastProbeAtUtc) return ["origin check: not checked yet"];
+  return [
+    `origin check: ${origin.lastProbeAtUtc}${origin.latencyMs != null ? `, ${origin.latencyMs} ms` : ""}`,
+    ...origin.lastErrorCode ? [`origin problem: ${origin.lastErrorCode}`] : [],
+    ...origin.healthChangedAtUtc ? [`origin health changed: ${origin.healthChangedAtUtc}`] : []
+  ];
+}
+function corsLines(platform) {
+  const sites = platform.cors ?? [];
+  return [
+    ...sites.length > 0 ? [
+      "browser origins (CORS):",
+      ...sites.map(
+        (site) => `  ${site.origin} (${site.source})${site.applied ? "" : ", not on the real gateway yet"}`
+      )
+    ] : [],
+    ...platform.openApiPath ? [
+      `openapi: ${platform.openApiPath} (${platform.exportAccess ?? "public"}${platform.openApiHash ? `, ${platform.openApiHash.slice(0, 12)}` : ""})`
+    ] : []
+  ];
+}
+async function gatewayStatus(resolved, ledger, manifest, remote) {
+  const steps = ["spec", "config", "reconcile"].map((name) => ({
+    name,
+    record: stepOf(ledger, "gateway", name)
+  }));
+  const failed = steps.find((step2) => step2.record?.status === "failed");
+  const local = [
+    ...steps.filter((step2) => step2.record).map((step2) => `step ${step2.name}: ${step2.record?.status}`),
+    ...failed ? [`error: ${failed.record?.error ?? "unknown"}`] : []
+  ];
+  const entry = manifest?.services.gateway;
+  const projectId = resolved.project.id ?? manifest?.project.id;
+  let state = entry ? "ready" : "not-deployed";
+  const details = [];
+  if (entry?.baseUrl) details.push(`base url: ${entry.baseUrl}`);
+  if (entry?.provider) details.push(`provider: ${entry.provider}`);
+  if (remote && projectId) {
+    try {
+      const platform = await remote(projectId);
+      details.push(
+        `platform state: ${platform.status}`,
+        platform.inSync ? "drift: none (the real gateway matches the config)" : `drift: the real gateway does not match the config yet (wanted ${platform.desiredHash?.slice(0, 12) ?? "none"}, real ${platform.observedHash?.slice(0, 12) ?? "none"})`,
+        ...platform.origin ? [
+          `origin: ${platform.origin.mode}${platform.origin.url ? ` ${platform.origin.url}` : ""}, health ${platform.origin.health}`,
+          ...originHealthLines(platform.origin)
+        ] : [],
+        `operations: ${platform.operationCount}`,
+        ...corsLines(platform)
+      );
+      const latest = platform.latestReconciliation;
+      if (latest)
+        details.push(
+          `last reconciliation: ${latest.state}${latest.errorCode ? ` (${latest.errorCode})` : ""}`
+        );
+      if (platform.baseUrl && !entry?.baseUrl)
+        details.push(`base url: ${platform.baseUrl}`);
+      if (!platform.inSync && ["Active", "Reconciling", "Failed"].includes(platform.status))
+        state = "drift";
+    } catch (error) {
+      details.push(
+        error instanceof PlatformApiError && error.status === 404 ? "platform: no gateway for this project yet" : `platform: not reachable (${error instanceof Error ? error.message : String(error)}); showing local records only`
+      );
+    }
+  } else if (!projectId) {
+    details.push("platform: not asked, this folder is not linked to a project");
+  } else if (!remote) {
+    details.push("platform: not asked, you are not logged in");
+  }
+  if (failed) state = "deploy-failed";
+  return { service: "gateway", state, details: [...details, ...local] };
+}
+async function statusV2(dir, only, options = {}) {
   const { resolved } = loadConfigV2(dir);
   const ledger = await readLedger(resolved.state);
   const manifest = await readManifest(resolved.state);
@@ -25933,7 +26920,7 @@ async function statusV2(dir, only) {
     if (service === "portal") {
       const build2 = stepOf(ledger, "portal", "build");
       const built = await exists4(
-        path79.join(resolved.state.buildDir, "index.html")
+        path80.join(resolved.state.buildDir, "index.html")
       );
       const state = build2?.status === "failed" ? "build-failed" : build2?.status === "succeeded" && built ? "built" : "not-built";
       services.push({
@@ -25944,13 +26931,19 @@ async function statusV2(dir, only) {
           ...build2?.finishedAt ? [`last build: ${build2.finishedAt}`] : [],
           ...build2?.status === "failed" ? [`error: ${build2.error ?? "unknown"}`] : [],
           ...state === "built" ? [
-            `output: ${path79.relative(resolved.configDir, resolved.state.buildDir)}`
+            `output: ${path80.relative(resolved.configDir, resolved.state.buildDir)}`
           ] : [],
           ...url2 ? [`url: ${url2}`] : ["url: not known (portal is not deployed yet)"]
         ]
       });
       continue;
     }
+    if (service === "gateway") {
+      services.push(
+        await gatewayStatus(resolved, ledger, manifest, options.gatewayRemote)
+      );
+      continue;
+    }
     services.push({
       service,
       state: entry ? "ready" : "not-deployed",
@@ -25975,7 +26968,7 @@ function formatPlan(output4) {
     `${svc.service}: ${svc.reason}`,
     ...svc.details.map((line2) => `  ${line2}`),
     ...svc.issues.map(
-      (issue2) => `  problem: ${issue2.message}${issue2.hint ? ` ${issue2.hint}` : ""} [${issue2.code}]`
+      (issue3) => `  problem: ${issue3.message}${issue3.hint ? ` ${issue3.hint}` : ""} [${issue3.code}]`
     )
   ]);
 }
@@ -26042,7 +27035,7 @@ async function deployV2(options, deps) {
     throw new DeployError(
       "PROJECT_REQUIRED",
       "This folder is not linked to a project yet.",
-      "Pass --project-id <id>, or set APITOGO_DEFAULT_PROJECT_ID. The id is then saved as project.id in apitogo.config.json."
+      "Run `apitogo project create` to make a platform project and link this folder. Or pass --project-id <id> (saved as project.id), or set APITOGO_DEFAULT_PROJECT_ID."
     );
   }
   const results = [];
@@ -26068,12 +27061,16 @@ async function deployV2(options, deps) {
       });
       continue;
     }
+    if (service === "gateway") {
+      results.push(await deployGatewayService(options, deps, projectId, named));
+      continue;
+    }
     if (service !== "portal") {
       if (named)
         throw new DeployError(
           "SERVICE_NOT_DEPLOYABLE",
           `Deploying ${service} is not available in this CLI version yet.`,
-          "Only the portal can be deployed for now."
+          "Only the portal and the gateway can be deployed for now."
         );
       results.push({
         service,
@@ -26094,6 +27091,36 @@ async function deployV2(options, deps) {
   if (!resolved.project.id) await setProjectId(options.dir, projectId);
   return { projectId, services: results };
 }
+async function deployGatewayService(options, deps, projectId, named) {
+  const { resolved } = loadConfigV2(options.dir);
+  const gateway = resolved.gateway;
+  const why = gateway ? gatewayNotDeployableReason(gateway) : void 0;
+  if (why) {
+    if (named)
+      throw new DeployError(
+        "SERVICE_NOT_DEPLOYABLE",
+        `The gateway cannot be deployed: ${why}.`,
+        "Change gateway.origin / gateway.specs in the config, or deploy another service."
+      );
+    return { service: "gateway", status: "skipped", reason: why, steps: [] };
+  }
+  const client = deps.client;
+  if (!client.putGatewaySpec || !client.putGatewayConfig || !client.getGatewayReconciliation || !client.getGatewayStatus || !client.getGatewayCapabilities)
+    throw new Error("The platform client has no gateway calls.");
+  const result = await deployGateway(
+    resolved,
+    projectId,
+    { ...deps.gateway, client },
+    { force: options.force }
+  );
+  return {
+    service: "gateway",
+    status: result.status,
+    steps: result.steps,
+    url: result.baseUrl,
+    operationCount: result.operationCount
+  };
+}
 async function deployPortal(options, deps, projectId) {
   const { resolved, root, prepared } = await preparePortalWorkspace(
     options.dir,
@@ -26154,7 +27181,8 @@ async function deployPortal(options, deps, projectId) {
 function formatDeploy(output4) {
   return output4.services.flatMap((result) => {
     const url2 = result.url ? ` (${result.url})` : "";
-    const head = result.status === "deployed" ? `${result.service}: deployed${result.environment ? ` to ${result.environment}` : ""}${url2}` : result.status === "unchanged" ? `${result.service}: unchanged, nothing to publish${url2}` : `${result.service}: skipped, ${result.reason}`;
+    const ops = result.operationCount !== void 0 ? `, ${result.operationCount} operation(s)` : "";
+    const head = result.status === "deployed" ? `${result.service}: deployed${result.environment ? ` to ${result.environment}` : ""}${url2}${ops}` : result.status === "unchanged" ? `${result.service}: unchanged, nothing to publish${url2}` : `${result.service}: skipped, ${result.reason}`;
     return [
       head,
       ...result.steps.map(
@@ -26171,7 +27199,7 @@ async function deployProject(argv) {
     const config2 = loadConfig();
     const output4 = await deployV2(
       {
-        dir: path80.resolve(process.cwd(), argv.dir),
+        dir: path81.resolve(process.cwd(), argv.dir),
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         projectId: argv.projectId,
         env: argv.env,
@@ -26252,7 +27280,7 @@ var deploy_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo deploy" });
-    if (await isConfigV2(path81.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path82.resolve(process.cwd(), argv.dir))) {
       await deployProject(argv);
       return;
     }
@@ -26260,16 +27288,108 @@ var deploy_default = {
   }
 };
 
+// src/cli/export/handler.ts
+import { mkdir as mkdir20, writeFile as writeFile24 } from "node:fs/promises";
+import path83 from "node:path";
+init_invariant();
+var ExportError = class extends ApitogoError {
+  constructor(message, developerHint) {
+    super(message, { developerHint, title: "Cannot export OpenAPI" });
+    this.name = "ExportError";
+  }
+};
+async function exportOpenApi(args, deps) {
+  if (args.target !== "openapi")
+    throw new ExportError(
+      `Cannot export "${args.target}".`,
+      "Only `apitogo export openapi` exists."
+    );
+  const dir = path83.resolve(process.cwd(), args.dir ?? ".");
+  if (!await isConfigV2(dir))
+    throw new ExportError(
+      "This command needs a config version 2 project.",
+      "Run it in a folder with a version 2 apitogo.config.json."
+    );
+  const { resolved } = loadConfigV2(dir);
+  const projectId = args.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim();
+  if (!projectId)
+    throw new ExportError(
+      "This folder is not linked to a project.",
+      "Run `apitogo project create`, or pass --project-id."
+    );
+  let text;
+  try {
+    text = await deps.client.getGatewayOpenApi(projectId);
+  } catch (error) {
+    if (error instanceof PlatformApiError && error.status === 404)
+      throw new ExportError(
+        "The platform has no OpenAPI file for this project yet.",
+        "Deploy the gateway first with `apitogo deploy --only gateway`."
+      );
+    throw error;
+  }
+  if (!args.out) return { text };
+  const file = path83.resolve(process.cwd(), args.out);
+  await mkdir20(path83.dirname(file), { recursive: true });
+  await writeFile24(file, text);
+  return { text, file };
+}
+async function exportCommand(args) {
+  try {
+    const config2 = loadConfig();
+    const result = await exportOpenApi(args, {
+      client: new PlatformApiClient(config2),
+      envProjectId: config2.defaultProjectId
+    });
+    if (result.file) printDiagnosticsToConsole(`Wrote ${result.file}.`);
+    else printResultToConsole(result.text);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
+    await printCriticalFailureToConsoleAndExit(
+      hint ? `${message} ${hint}` : message
+    );
+  }
+}
+
+// src/cli/cmds/export.ts
+var export_default = {
+  desc: "Print or save the OpenAPI file the platform publishes for your gateway (config version 2)",
+  command: "export <target>",
+  builder: (yargs2) => yargs2.positional("target", {
+    type: "string",
+    choices: ["openapi"],
+    describe: "What to export"
+  }).option("out", {
+    type: "string",
+    describe: "Write to this file instead of printing",
+    normalize: true
+  }).option("dir", {
+    type: "string",
+    describe: "Project directory",
+    default: ".",
+    normalize: true,
+    hidden: true
+  }).option("project-id", {
+    type: "string",
+    describe: "Project id (default: project.id in apitogo.config.json)"
+  }),
+  handler: async (argv) => {
+    await captureEvent({ argv: { dir: argv.dir }, event: "apitogo export" });
+    await exportCommand(argv);
+  }
+};
+
 // src/cli/init/handler.ts
-import path85 from "node:path";
+import path87 from "node:path";
 
 // src/cli/scaffold/run-scaffold-discovery.ts
-import { access as access15, readFile as readFile26, writeFile as writeFile25 } from "node:fs/promises";
-import path84 from "node:path";
+import { access as access15, readFile as readFile28, writeFile as writeFile26 } from "node:fs/promises";
+import path86 from "node:path";
 
 // src/cli/scaffold/detect-backend.ts
-import { readdir as readdir4, readFile as readFile24 } from "node:fs/promises";
-import path82 from "node:path";
+import { readdir as readdir4, readFile as readFile26 } from "node:fs/promises";
+import path84 from "node:path";
 var DEFAULT_RUNTIME_VERSION = {
   dotnet: "DOTNET_10",
   nodejs: "NODE_22_LTS",
@@ -26286,7 +27406,7 @@ async function listFiles(directory) {
 }
 async function readText(filePath) {
   try {
-    return await readFile24(filePath, "utf8");
+    return await readFile26(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -26315,15 +27435,15 @@ function isRunnableNodePackage(pkg) {
   return typeof scripts.start === "string" || typeof pkg.main === "string";
 }
 async function detectParentBackend(siteDirectory) {
-  const site = path82.resolve(siteDirectory);
-  const directory = path82.dirname(site);
+  const site = path84.resolve(siteDirectory);
+  const directory = path84.dirname(site);
   if (directory === site) {
     return void 0;
   }
   const files = await listFiles(directory);
   const toResult = (runtime, runtimeVersion, marker) => ({
     directory,
-    sourceDirectory: path82.relative(site, directory).split(path82.sep).join("/") || ".",
+    sourceDirectory: path84.relative(site, directory).split(path84.sep).join("/") || ".",
     runtime,
     runtimeVersion,
     marker
@@ -26331,7 +27451,7 @@ async function detectParentBackend(siteDirectory) {
   const csproj = files.find((f) => f.endsWith(".csproj"));
   const solution = files.find((f) => /\.slnx?$/.test(f));
   if (csproj || solution) {
-    const content = csproj ? await readText(path82.join(directory, csproj)) : void 0;
+    const content = csproj ? await readText(path84.join(directory, csproj)) : void 0;
     return toResult(
       "dotnet",
       dotnetVersionFromCsproj(content),
@@ -26339,7 +27459,7 @@ async function detectParentBackend(siteDirectory) {
     );
   }
   if (files.includes("package.json")) {
-    const raw = await readText(path82.join(directory, "package.json"));
+    const raw = await readText(path84.join(directory, "package.json"));
     try {
       const pkg = JSON.parse(raw ?? "");
       if (isRunnableNodePackage(pkg)) {
@@ -26354,7 +27474,7 @@ async function detectParentBackend(siteDirectory) {
   }
   const pythonMarker = PYTHON_MARKERS.find((m) => files.includes(m));
   if (pythonMarker) {
-    const versionSource = await readText(path82.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path82.join(directory, pythonMarker)))?.match(
+    const versionSource = await readText(path84.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path84.join(directory, pythonMarker)))?.match(
       /requires-python\s*=\s*"([^"]+)"/
     )?.[1] : void 0);
     return toResult(
@@ -26370,14 +27490,14 @@ async function detectParentBackend(siteDirectory) {
 import {
   access as access14,
   lstat as lstat2,
-  mkdir as mkdir20,
+  mkdir as mkdir21,
   readdir as readdir5,
-  readFile as readFile25,
+  readFile as readFile27,
   readlink,
   symlink as symlink2,
-  writeFile as writeFile24
+  writeFile as writeFile25
 } from "node:fs/promises";
-import path83 from "node:path";
+import path85 from "node:path";
 var DOCS_DIR_WHITELIST = [
   "docs",
   "documents",
@@ -26414,14 +27534,14 @@ async function isDirectory2(filePath) {
   }
 }
 function toPosix3(value) {
-  return value.split(path83.sep).join(path83.posix.sep);
+  return value.split(path85.sep).join(path85.posix.sep);
 }
 function isWhitelistedDirName(name) {
   return DOCS_DIR_WHITELIST.includes(name.toLowerCase());
 }
 function isInside2(parent, child) {
-  const relative = path83.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path83.isAbsolute(relative);
+  const relative = path85.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path85.isAbsolute(relative);
 }
 async function collectMarkdownFiles(dir, excludeDir) {
   const files = [];
@@ -26435,9 +27555,9 @@ async function collectMarkdownFiles(dir, excludeDir) {
     if (entry.name.startsWith(".")) {
       continue;
     }
-    const full = path83.join(dir, entry.name);
+    const full = path85.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path83.resolve(full) === excludeDir) {
+      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path85.resolve(full) === excludeDir) {
         continue;
       }
       files.push(...await collectMarkdownFiles(full, excludeDir));
@@ -26450,11 +27570,11 @@ async function collectMarkdownFiles(dir, excludeDir) {
   return files;
 }
 async function collectSearchRoots(siteDirectory) {
-  const site = path83.resolve(siteDirectory);
-  const parent = path83.dirname(site);
+  const site = path85.resolve(siteDirectory);
+  const parent = path85.dirname(site);
   const roots = [];
   const add = (dir) => {
-    const resolved = path83.resolve(dir);
+    const resolved = path85.resolve(dir);
     if (!roots.includes(resolved)) {
       roots.push(resolved);
     }
@@ -26467,7 +27587,7 @@ async function collectSearchRoots(siteDirectory) {
         if (!entry.isDirectory() || SKIP_SEARCH_DIRS.has(entry.name)) {
           continue;
         }
-        add(path83.join(parent, entry.name));
+        add(path85.join(parent, entry.name));
       }
     } catch {
     }
@@ -26476,13 +27596,13 @@ async function collectSearchRoots(siteDirectory) {
   return roots;
 }
 async function discoverNearbyDocsDirectories(siteDirectory) {
-  const site = path83.resolve(siteDirectory);
-  const sitePages = path83.join(site, PAGES_DIR);
+  const site = path85.resolve(siteDirectory);
+  const sitePages = path85.join(site, PAGES_DIR);
   const searchedDirectories = await collectSearchRoots(site);
   const directories = [];
   const seen = /* @__PURE__ */ new Set();
   const consider = async (dir) => {
-    const resolved = path83.resolve(dir);
+    const resolved = path85.resolve(dir);
     if (resolved === site || seen.has(resolved) || isInside2(sitePages, resolved)) {
       return;
     }
@@ -26499,7 +27619,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
     directories.push({ sourceDirectory: resolved, files });
   };
   for (const root of searchedDirectories) {
-    if (isWhitelistedDirName(path83.basename(root))) {
+    if (isWhitelistedDirName(path85.basename(root))) {
       await consider(root);
     }
     try {
@@ -26511,7 +27631,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
         if (!isWhitelistedDirName(entry.name)) {
           continue;
         }
-        await consider(path83.join(root, entry.name));
+        await consider(path85.join(root, entry.name));
       }
     } catch {
     }
@@ -26530,8 +27650,8 @@ function slugifyDirName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "docs";
 }
 async function allocateLinkName(pagesDir, sourceDirectory, used) {
-  const base = slugifyDirName(path83.basename(sourceDirectory));
-  const parent = slugifyDirName(path83.basename(path83.dirname(sourceDirectory)));
+  const base = slugifyDirName(path85.basename(sourceDirectory));
+  const parent = slugifyDirName(path85.basename(path85.dirname(sourceDirectory)));
   const candidates = [base, `${parent}-${base}`];
   let index = 2;
   while (true) {
@@ -26539,7 +27659,7 @@ async function allocateLinkName(pagesDir, sourceDirectory, used) {
     if (used.has(name)) {
       continue;
     }
-    const target = path83.join(pagesDir, name);
+    const target = path85.join(pagesDir, name);
     if (await pathExists5(target)) {
       const stat7 = await lstat2(target);
       if (!stat7.isDirectory() || !await isManagedLinkDir(target)) {
@@ -26570,8 +27690,8 @@ async function alreadyLinked(linkPath, sourcePath) {
       return false;
     }
     const current = await readlink(linkPath);
-    const resolved = path83.resolve(path83.dirname(linkPath), current);
-    return resolved === path83.resolve(sourcePath);
+    const resolved = path85.resolve(path85.dirname(linkPath), current);
+    return resolved === path85.resolve(sourcePath);
   } catch {
     return false;
   }
@@ -26583,8 +27703,8 @@ async function linkMarkdownFile(sourcePath, linkPath) {
   if (await pathExists5(linkPath)) {
     return "skipped";
   }
-  await mkdir20(path83.dirname(linkPath), { recursive: true });
-  const relativeTarget = path83.relative(path83.dirname(linkPath), sourcePath);
+  await mkdir21(path85.dirname(linkPath), { recursive: true });
+  const relativeTarget = path85.relative(path85.dirname(linkPath), sourcePath);
   await symlink2(
     relativeTarget,
     linkPath,
@@ -26599,11 +27719,11 @@ async function applyDocsNavigation(siteDirectory, routes) {
   if (routes.length === 0) {
     return;
   }
-  const configPath = path83.join(siteDirectory, CONFIG_FILENAME);
+  const configPath = path85.join(siteDirectory, CONFIG_FILENAME);
   if (!await pathExists5(configPath)) {
     return;
   }
-  const raw = await readFile25(configPath, "utf8");
+  const raw = await readFile27(configPath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject5(parsed)) {
     return;
@@ -26612,12 +27732,12 @@ async function applyDocsNavigation(siteDirectory, routes) {
     force: false
   });
   const updated = ensureHeaderDocsNavigation(parsed, routes);
-  await writeFile24(configPath, `${JSON.stringify(updated, null, 2)}
+  await writeFile25(configPath, `${JSON.stringify(updated, null, 2)}
 `, "utf8");
 }
 async function discoverAndWireDocs(siteDirectory) {
-  const site = path83.resolve(siteDirectory);
-  const pagesDir = path83.join(site, PAGES_DIR);
+  const site = path85.resolve(siteDirectory);
+  const pagesDir = path85.join(site, PAGES_DIR);
   const { directories, searchedDirectories } = await discoverNearbyDocsDirectories(site);
   if (directories.length === 0) {
     return {
@@ -26629,7 +27749,7 @@ async function discoverAndWireDocs(siteDirectory) {
       skippedCount: 0
     };
   }
-  await mkdir20(pagesDir, { recursive: true });
+  await mkdir21(pagesDir, { recursive: true });
   const usedNames = /* @__PURE__ */ new Set();
   const sources = [];
   const routes = [];
@@ -26639,15 +27759,15 @@ async function discoverAndWireDocs(siteDirectory) {
       directory.sourceDirectory,
       usedNames
     );
-    const linkDirectory = path83.join(pagesDir, linkName);
+    const linkDirectory = path85.join(pagesDir, linkName);
     const linked = [];
     const skipped = [];
     for (const sourcePath of directory.files) {
       const relativeSource = toPosix3(
-        path83.relative(directory.sourceDirectory, sourcePath)
+        path85.relative(directory.sourceDirectory, sourcePath)
       );
-      const linkPath = path83.join(linkDirectory, relativeSource);
-      const relativeLink = toPosix3(path83.relative(site, linkPath));
+      const linkPath = path85.join(linkDirectory, relativeSource);
+      const relativeLink = toPosix3(path85.relative(site, linkPath));
       const route = toRoutePath(relativeLink, PAGES_DIR);
       if (routes.includes(route)) {
         skipped.push({
@@ -26695,11 +27815,11 @@ async function discoverAndWireDocs(siteDirectory) {
   };
 }
 function siteRelative(siteDirectory, filePath) {
-  const relative = toPosix3(path83.relative(siteDirectory, filePath));
+  const relative = toPosix3(path85.relative(siteDirectory, filePath));
   if (!relative) {
     return ".";
   }
-  if (path83.isAbsolute(relative)) {
+  if (path85.isAbsolute(relative)) {
     return toPosix3(filePath);
   }
   if (relative.startsWith("..")) {
@@ -26787,8 +27907,8 @@ async function pathExists6(filePath) {
 }
 async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   const input5 = toSiteRelativeOpenApiInput(siteDirectory, openApiPath);
-  const jsonConfigPath = path84.join(siteDirectory, "apitogo.config.json");
-  const raw = await readFile26(jsonConfigPath, "utf8");
+  const jsonConfigPath = path86.join(siteDirectory, "apitogo.config.json");
+  const raw = await readFile28(jsonConfigPath, "utf8");
   const siteConfig = JSON.parse(raw);
   const updated = applyOpenApiToSiteConfig(siteConfig, {
     input: input5,
@@ -26796,7 +27916,7 @@ async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   });
   const backend = updated.backend && typeof updated.backend === "object" && !Array.isArray(updated.backend) ? { ...updated.backend } : {};
   updated.backend = { ...backend, openApiPath: input5 };
-  await writeFile25(
+  await writeFile26(
     jsonConfigPath,
     `${JSON.stringify(updated, null, 2)}
 `,
@@ -26815,7 +27935,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
   const invalidCandidates = [];
   let selected;
   for (const candidate of search.candidates) {
-    const content = await readFile26(candidate, "utf8");
+    const content = await readFile28(candidate, "utf8");
     const parsed = liteParseOpenApi(content, candidate);
     if (parsed.valid) {
       selected = {
@@ -26839,7 +27959,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
       wired: false
     };
   }
-  const jsonConfigPath = path84.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path86.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return {
       openApiDiscovery: {
@@ -26889,13 +28009,13 @@ async function discoverAndWireBackend(siteDirectory, mode) {
   if (mode !== "nearby") {
     return { status: "skipped", mode };
   }
-  const jsonConfigPath = path84.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path86.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return { status: "not_found" };
   }
   try {
     const siteConfig = JSON.parse(
-      await readFile26(jsonConfigPath, "utf8")
+      await readFile28(jsonConfigPath, "utf8")
     );
     const existing = siteConfig.backend && typeof siteConfig.backend === "object" && !Array.isArray(siteConfig.backend) ? siteConfig.backend : {};
     if (typeof existing.sourceDirectory === "string" && existing.sourceDirectory.trim()) {
@@ -26916,7 +28036,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
       runtime: detected.runtime,
       runtimeVersion: detected.runtimeVersion
     };
-    await writeFile25(
+    await writeFile26(
       jsonConfigPath,
       `${JSON.stringify(siteConfig, null, 2)}
 `,
@@ -26956,8 +28076,8 @@ function slugifyName2(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "dev-portal-site";
 }
 function resolveInitOutputDirectory(dirArg, name) {
-  const resolved = path85.resolve(process.cwd(), dirArg);
-  const base = path85.basename(resolved);
+  const resolved = path87.resolve(process.cwd(), dirArg);
+  const base = path87.basename(resolved);
   const isDot = dirArg === "." || dirArg === "./" || base === "." || resolved === process.cwd();
   if (isDot) {
     const fromName = name?.trim();
@@ -26967,7 +28087,7 @@ function resolveInitOutputDirectory(dirArg, name) {
       );
     }
     return {
-      outputDirectory: path85.resolve(process.cwd(), slugifyName2(fromName)),
+      outputDirectory: path87.resolve(process.cwd(), slugifyName2(fromName)),
       siteName: fromName
     };
   }
@@ -27111,7 +28231,7 @@ var init_default = {
   }).option("v2", {
     type: "boolean",
     default: false,
-    describe: "Preview: create a config version 2 project (standalone or embedded layout). check, run and build read it; deploy still reads the version 1 config"
+    describe: "Preview: create a config version 2 project (standalone or embedded layout). add, remove, check, run, build, plan, status, deploy and secrets read it"
   }).option("layout", {
     type: "string",
     choices: ["standalone", "embedded"],
@@ -27150,8 +28270,8 @@ import open2 from "open";
 import colors14 from "picocolors";
 
 // src/cli/platform/device-auth.ts
-function url(apiUrl, path95) {
-  return `${apiUrl}${path95.startsWith("/") ? path95 : `/${path95}`}`;
+function url(apiUrl, path100) {
+  return `${apiUrl}${path100.startsWith("/") ? path100 : `/${path100}`}`;
 }
 async function requestDeviceCode(apiUrl) {
   const response = await fetchWithRetry(
@@ -27333,7 +28453,7 @@ var logout_default = {
 };
 
 // src/cli/portal/commands.ts
-import path86 from "node:path";
+import path88 from "node:path";
 init_invariant();
 function parseOnly(value) {
   if (value === void 0) return void 0;
@@ -27350,7 +28470,7 @@ function parseOnly(value) {
 async function run2(command2, argv, compute, format) {
   const json = argv.json === true;
   try {
-    const dir = path86.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path88.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${command2} works with a config version 2 project, and there is none in ${dir}.`,
@@ -27379,8 +28499,34 @@ async function run2(command2, argv, compute, format) {
     );
   }
 }
-var plan = (argv) => run2("plan", argv, planV2, formatPlan);
-var statusOfProject = (argv) => run2("status", argv, statusV2, formatStatus);
+var plan = (argv) => run2(
+  "plan",
+  argv,
+  (dir, only) => planV2(dir, only, { gatewayDryRun: gatewayDryRun() }),
+  formatPlan
+);
+function gatewayRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId) => client.getGatewayStatus(projectId);
+  } catch {
+    return void 0;
+  }
+}
+function gatewayDryRun() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId, body) => client.planGateway(projectId, body);
+  } catch {
+    return void 0;
+  }
+}
+var statusOfProject = (argv) => run2(
+  "status",
+  argv,
+  (dir, only) => statusV2(dir, only, { gatewayRemote: gatewayRemote() }),
+  formatStatus
+);
 
 // src/cli/cmds/plan.ts
 var plan_default = {
@@ -27406,6 +28552,88 @@ var plan_default = {
   }
 };
 
+// src/cli/project/create-handler.ts
+init_invariant();
+import path89 from "node:path";
+
+// src/cli/project/v2.ts
+init_invariant();
+var ProjectCreateError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot create the project" });
+    this.code = code;
+    this.name = "ProjectCreateError";
+  }
+};
+function modulesForConfig(config2) {
+  return [
+    ...config2.portal && config2.portal.enabled !== false ? ["dev-portal"] : [],
+    ...config2.gateway && config2.gateway.enabled !== false ? ["apihub"] : []
+  ];
+}
+async function createProjectV2(options, deps) {
+  const { config: config2, resolved } = loadConfigV2(options.dir);
+  if (resolved.project.id) {
+    throw new ProjectCreateError(
+      "ALREADY_LINKED",
+      `This folder is already linked to project ${resolved.project.id}.`,
+      "Run `apitogo deploy`. To start over, run `apitogo teardown` first."
+    );
+  }
+  const modules = modulesForConfig(config2);
+  if (modules.length === 0) {
+    throw new ProjectCreateError(
+      "NOTHING_TO_HOST",
+      "No enabled service needs hosting.",
+      "Enable the portal or the gateway first (`apitogo add portal`)."
+    );
+  }
+  const name = options.name?.trim() || resolved.project.name;
+  const raw = await deps.bootstrap({
+    name,
+    description: options.description,
+    modules,
+    wait: options.wait !== false
+  });
+  const outcome = parse3(raw);
+  if (outcome.requiresPlatformPlanSelection) {
+    throw new ProjectCreateError(
+      "PLAN_NOT_SELECTED",
+      `A project named "${name}" already exists and has no plan yet.`,
+      "Pick another name with --name, or choose a plan for that project in the web app."
+    );
+  }
+  if (outcome.status === "failed" || outcome.status === "blocked" || !outcome.projectId) {
+    throw new ProjectCreateError(
+      "CREATE_FAILED",
+      `The platform could not create the project: ${outcome.message ?? outcome.status ?? "no answer"}.`,
+      "Nothing was written to this folder. Try again, or check `apitogo status`."
+    );
+  }
+  if (outcome.status === "running" || outcome.status === "pending") {
+    await setProjectId(options.dir, outcome.projectId);
+    throw new ProjectCreateError(
+      "CREATE_FAILED",
+      "The project was created but hosting is still being prepared.",
+      `The folder is linked (project.id ${outcome.projectId}). Wait a few minutes, then run \`apitogo deploy\`.`
+    );
+  }
+  await setProjectId(options.dir, outcome.projectId);
+  return {
+    projectId: outcome.projectId,
+    projectName: name,
+    modules,
+    resumed: outcome.resumed === true
+  };
+}
+function parse3(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return { status: "failed", message: "unreadable answer from the platform" };
+  }
+}
+
 // src/cli/project/create-handler.ts
 function resultLooksFailed2(payload) {
   try {
@@ -27415,7 +28643,71 @@ function resultLooksFailed2(payload) {
     return true;
   }
 }
+async function createLinkedProject(argv, dir) {
+  const json = argv.json === true;
+  try {
+    const config2 = loadConfig();
+    const client = new PlatformApiClient(config2);
+    const progress = createConsoleProgressReporter();
+    const result = await createProjectV2(
+      {
+        dir,
+        name: argv.name,
+        description: argv.description,
+        wait: argv.wait !== false
+      },
+      {
+        bootstrap: (args) => handleBootstrapProject(
+          client,
+          config2,
+          {
+            name: args.name,
+            description: args.description,
+            modules: args.modules,
+            selectFreePlan: true,
+            wait: args.wait,
+            configureGatewayBaseline: false
+          },
+          json ? void 0 : progress
+        )
+      }
+    );
+    progress.stop();
+    if (json) {
+      console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));
+      return;
+    }
+    printDiagnosticsToConsole(
+      `Project ${result.projectName} (${result.projectId}) is ready on the free plan with: ${result.modules.join(", ")}.`
+    );
+    printResultToConsole(
+      "The folder is linked. Run `apitogo deploy` to publish."
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
+    if (json) {
+      console.log(
+        JSON.stringify({
+          status: "failed",
+          error: message,
+          hint: hint ?? null
+        })
+      );
+      process.exitCode = 1;
+      return;
+    }
+    await printCriticalFailureToConsoleAndExit(
+      hint ? `${message} ${hint}` : message
+    );
+  }
+}
 async function createProject(argv) {
+  const dir = path89.resolve(process.cwd(), argv.dir ?? ".");
+  if (await isConfigV2(dir)) {
+    await createLinkedProject(argv, dir);
+    return;
+  }
   const name = argv.name?.trim();
   if (!name) {
     await printCriticalFailureToConsoleAndExit(
@@ -27466,12 +28758,17 @@ async function createProject(argv) {
 
 // src/cli/cmds/project-create.ts
 var project_create_default = {
-  desc: "Create an API ToGo platform project (plan unselected)",
+  desc: "Create an API ToGo platform project. In a config version 2 folder: free plan, hosting for the enabled services, and project.id written into the config",
   command: "project create",
   builder: (yargs2) => yargs2.option("name", {
     type: "string",
-    describe: "Project display name",
-    demandOption: true
+    describe: "Project display name (required for version 1; version 2 defaults to project.name)"
+  }).option("dir", {
+    type: "string",
+    describe: "Project directory",
+    default: ".",
+    normalize: true,
+    hidden: true
   }).option("description", {
     type: "string",
     describe: "Optional project description"
@@ -27530,14 +28827,14 @@ var remove_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path89 from "node:path";
+import path92 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs12 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path88 from "node:path";
+import path91 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -27570,7 +28867,7 @@ init_loader();
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path87 from "node:path";
+import path90 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -27623,7 +28920,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path87.join(vite.config.publicDir, "pagefind");
+  const outputPath = path90.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -27642,9 +28939,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.options;
     const [key, cert, ca] = await Promise.all([
-      fs12.readFile(path88.resolve(dir, config2.https.key)),
-      fs12.readFile(path88.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs12.readFile(path88.resolve(dir, config2.https.ca)) : void 0
+      fs12.readFile(path91.resolve(dir, config2.https.key)),
+      fs12.readFile(path91.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs12.readFile(path91.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -27661,7 +28958,7 @@ var DevServer = class {
     );
     const server = await this.createNodeServer(config2);
     if (config2.search?.type === "pagefind" && viteConfig.publicDir !== false) {
-      const publicRoot = path88.resolve(
+      const publicRoot = path91.resolve(
         this.options.dir,
         typeof viteConfig.publicDir === "string" ? viteConfig.publicDir : "public"
       );
@@ -27678,7 +28975,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "apitogo:entry-client",
           configureServer(server2) {
-            const entryPath = path88.posix.join(
+            const entryPath = path91.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -27843,7 +29140,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson3 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  let dir = path89.resolve(process.cwd(), argv.dir);
+  let dir = path92.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(dir)) {
     const { root, prepared } = await preparePortalWorkspace(dir, "development");
     dir = root;
@@ -27942,7 +29239,7 @@ var run_default = {
 };
 
 // src/cli/secrets/handler.ts
-import path90 from "node:path";
+import path93 from "node:path";
 init_invariant();
 
 // src/cli/secrets/input.ts
@@ -28007,7 +29304,7 @@ var SecretsError = class extends ApitogoError {
 async function resolveProjectId2(argv, deps) {
   const explicit = argv.projectId?.trim();
   if (explicit) return explicit;
-  const dir = path90.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path93.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     const id = loadConfigV2(dir).resolved.project.id;
     if (id) return id;
@@ -28167,12 +29464,12 @@ var secrets_default = {
 };
 
 // src/cli/cmds/status.ts
-import path92 from "node:path";
+import path95 from "node:path";
 
 // src/cli/status/handler.ts
-import path91 from "node:path";
+import path94 from "node:path";
 async function status(argv) {
-  const sourceDirectory = path91.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path94.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -28270,7 +29567,7 @@ var status_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo status" });
-    if (await isConfigV2(path92.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path95.resolve(process.cwd(), argv.dir))) {
       await statusOfProject(argv);
       return;
     }
@@ -28278,8 +29575,287 @@ var status_default = {
   }
 };
 
+// src/cli/cmds/teardown.ts
+import path98 from "node:path";
+
+// src/cli/teardown/command.ts
+init_invariant();
+import path96 from "node:path";
+import { createInterface as createInterface7 } from "node:readline/promises";
+
+// src/cli/teardown/v2.ts
+init_invariant();
+var TeardownError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot tear down" });
+    this.code = code;
+    this.name = "TeardownError";
+  }
+};
+async function teardownV2(options, deps) {
+  if (options.only) {
+    if (options.only.trim() === "gateway")
+      return teardownGateway(options, deps);
+    throw new TeardownError(
+      "PARTIAL_TEARDOWN_UNSUPPORTED",
+      "The platform cannot release the hosting of one service on its own: it is released by deleting the project.",
+      "Run `apitogo teardown` without --only to delete the whole project, or `apitogo teardown --only gateway` to remove just the gateway. Your local files are kept."
+    );
+  }
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = options.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim() || "";
+  if (!projectId) {
+    throw new TeardownError(
+      "PROJECT_REQUIRED",
+      "This folder is not linked to a project, so there is nothing to tear down.",
+      "Pass --project-id <id> to name the project."
+    );
+  }
+  const project = await deps.client.getProject(projectId);
+  const name = project.name;
+  if (options.yes !== true) {
+    if (!deps.isTerminal) {
+      throw new TeardownError(
+        "CONFIRMATION_REQUIRED",
+        "This is not an interactive terminal.",
+        "Pass --yes to delete the project without asking."
+      );
+    }
+    const typed = await deps.askName(
+      `This deletes the project "${name}" (${projectId}) and its hosted site from the platform. Your local files are kept.
+Type the project name to confirm: `
+    );
+    if (typed.trim() !== name) {
+      throw new TeardownError(
+        "CANCELLED",
+        "The name did not match. Nothing was deleted."
+      );
+    }
+  }
+  const raw = await deps.deleteProject(projectId, options.wait !== false);
+  const outcome = parseOutcome(raw);
+  if (outcome.status === "failed" || outcome.status === "blocked") {
+    throw new TeardownError(
+      "DELETE_FAILED",
+      `The platform could not delete the project: ${outcome.message ?? outcome.status}.`,
+      "Nothing local was changed. Try again, or contact support with the project id."
+    );
+  }
+  if (outcome.status !== "succeeded") {
+    return {
+      projectId,
+      projectName: name,
+      status: "pending",
+      cleared: [],
+      message: "Deletion is queued and runs in the background. Local records are kept until it finishes: run `apitogo teardown` again later to clear them."
+    };
+  }
+  const linked = await isLinkedTo(options.dir, projectId);
+  const cleared = linked ? await clearLocalRecords(options.dir, projectId) : [];
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    cleared,
+    message: linked ? "The project was deleted. Your local files are kept." : "The project was deleted. This folder is linked to a different project, so its local records were left as they are."
+  };
+}
+function parseOutcome(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return { status: parsed.status ?? "unknown", message: parsed.message };
+  } catch {
+    return { status: "failed", message: "unreadable answer from the platform" };
+  }
+}
+async function isLinkedTo(dir, projectId) {
+  const { resolved } = loadConfigV2(dir);
+  if (resolved.project.id === projectId) return true;
+  return (await readManifest(resolved.state))?.project.id === projectId;
+}
+async function clearLocalRecords(dir, projectId) {
+  const { resolved } = loadConfigV2(dir);
+  const cleared = [];
+  const ledger = await readLedger(resolved.state);
+  const recorded = DEPLOY_ORDER.filter((service) => ledger.services[service]);
+  if (recorded.length > 0) {
+    await clearServices(resolved.state, recorded);
+    cleared.push("state.json entries");
+  }
+  await removeServicesFromManifest(resolved.state, [...DEPLOY_ORDER]);
+  cleared.push("services.json");
+  if (await clearProjectId(dir, projectId))
+    cleared.push("project.id in the config");
+  return cleared;
+}
+async function teardownGateway(options, deps) {
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = options.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim() || "";
+  if (!projectId) {
+    throw new TeardownError(
+      "PROJECT_REQUIRED",
+      "This folder is not linked to a project, so there is no gateway to remove.",
+      "Pass --project-id <id> to name the project."
+    );
+  }
+  if (!deps.client.deleteGateway || !deps.client.getGatewayReconciliation)
+    throw new Error("The platform client has no gateway calls.");
+  const project = await deps.client.getProject(projectId);
+  const name = project.name;
+  if (options.yes !== true) {
+    if (!deps.isTerminal) {
+      throw new TeardownError(
+        "CONFIRMATION_REQUIRED",
+        "This is not an interactive terminal.",
+        "Pass --yes to remove the gateway without asking."
+      );
+    }
+    const typed = await deps.askName(
+      `This removes the gateway of project "${name}" (${projectId}). Its API keys are revoked and stop working, and the gateway address is released. The project and the portal stay.
+Type the project name to confirm: `
+    );
+    if (typed.trim() !== name) {
+      throw new TeardownError(
+        "CANCELLED",
+        "The name did not match. Nothing was removed."
+      );
+    }
+  }
+  let ticket;
+  try {
+    ticket = await deps.client.deleteGateway(projectId);
+  } catch (error) {
+    if (error instanceof PlatformApiError && error.status === 404)
+      throw new TeardownError(
+        "GATEWAY_NOT_DEPLOYED",
+        "The platform has no gateway for this project.",
+        "There is nothing to remove. Clear stale local records by deleting the gateway entries in the state folder."
+      );
+    throw error;
+  }
+  const sleep5 = deps.gateway?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const deadline = Date.now() + (options.wait === false ? 0 : deps.gateway?.timeoutMs ?? 12e4);
+  for (; ; ) {
+    const state = await deps.client.getGatewayReconciliation(
+      projectId,
+      ticket.reconciliationId
+    );
+    if (state.state === "Succeeded") break;
+    if (state.state === "Failed" || state.state === "Superseded") {
+      throw new TeardownError(
+        "DELETE_FAILED",
+        `The platform could not remove the gateway: ${[state.errorCode, state.errorMessage].filter(Boolean).join(" ") || state.state}.`,
+        "Nothing local was changed. Try again, or contact support with the project id."
+      );
+    }
+    if (Date.now() >= deadline) {
+      return {
+        projectId,
+        projectName: name,
+        status: "pending",
+        cleared: [],
+        message: "The gateway is queued for removal and the platform finishes it in the background. Local records are kept until then: run `apitogo teardown --only gateway` again later to clear them."
+      };
+    }
+    await sleep5(deps.gateway?.pollIntervalMs ?? 2e3);
+  }
+  const cleared = [];
+  const ledger = await readLedger(resolved.state);
+  if (ledger.services.gateway) {
+    await clearServices(resolved.state, ["gateway"]);
+    cleared.push("state.json entries of the gateway");
+  }
+  const manifest = await readManifest(resolved.state);
+  if (manifest?.services.gateway) {
+    await removeServicesFromManifest(resolved.state, ["gateway"]);
+    cleared.push("the gateway entry of services.json");
+  }
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    cleared,
+    message: "The gateway was removed. The project and your local files are kept."
+  };
+}
+
+// src/cli/teardown/command.ts
+async function ask3(prompt) {
+  const rl = createInterface7({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+}
+async function teardownProject(argv) {
+  const json = argv.json === true;
+  try {
+    const config2 = loadConfig();
+    const client = new PlatformApiClient(config2);
+    const progress = createConsoleProgressReporter();
+    const result = await teardownV2(
+      {
+        dir: path96.resolve(process.cwd(), argv.dir),
+        projectId: argv.projectId,
+        only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
+        yes: argv.yes === true,
+        wait: argv.wait !== false
+      },
+      {
+        client,
+        envProjectId: config2.defaultProjectId,
+        isTerminal: process.stdin.isTTY === true && !json,
+        askName: ask3,
+        deleteProject: (projectId, wait) => handleDeleteProject(
+          client,
+          config2,
+          { projectId, wait },
+          json ? void 0 : progress
+        )
+      }
+    );
+    progress.stop();
+    if (json) {
+      console.log(
+        JSON.stringify(
+          { ...result, outcome: result.status, status: "succeeded" },
+          null,
+          2
+        )
+      );
+      return;
+    }
+    printDiagnosticsToConsole(
+      `${result.status === "removed" ? "Deleted" : "Queued deletion of"} project ${result.projectName} (${result.projectId}).`
+    );
+    if (result.cleared.length > 0)
+      printDiagnosticsToConsole(
+        `Cleared locally: ${result.cleared.join(", ")}.`
+      );
+    printResultToConsole(result.message);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
+    if (json) {
+      console.log(
+        JSON.stringify({
+          status: "failed",
+          error: message,
+          hint: hint ?? null
+        })
+      );
+      process.exitCode = 1;
+      return;
+    }
+    await printCriticalFailureToConsoleAndExit(
+      hint ? `${message} ${hint}` : message
+    );
+  }
+}
+
 // src/cli/teardown/handler.ts
-import path93 from "node:path";
+import path97 from "node:path";
 function resultLooksFailed3(payload) {
   try {
     const parsed = JSON.parse(payload);
@@ -28295,7 +29871,7 @@ async function teardown(argv) {
     );
     return;
   }
-  const sourceDirectory = path93.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path97.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -28344,7 +29920,7 @@ async function teardown(argv) {
 
 // src/cli/cmds/teardown.ts
 var teardown_default = {
-  desc: "Delete the linked API ToGo project",
+  desc: "Delete the linked API ToGo project. Config version 2 asks you to type the project name; local files are kept",
   command: "teardown",
   builder: (yargs2) => yargs2.option("dir", {
     type: "string",
@@ -28354,10 +29930,13 @@ var teardown_default = {
   }).option("project-id", {
     type: "string",
     describe: "Override project GUID"
+  }).option("only", {
+    type: "string",
+    describe: "Config version 2: only `gateway` is supported (removes the gateway, keeps the project); other hosting is released only by deleting the whole project"
   }).option("yes", {
     alias: "y",
     type: "boolean",
-    describe: "Confirm teardown (required)",
+    describe: "Confirm without asking (version 1: required)",
     default: false
   }).option("wait", {
     type: "boolean",
@@ -28370,6 +29949,10 @@ var teardown_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo teardown" });
+    if (await isConfigV2(path98.resolve(process.cwd(), argv.dir))) {
+      await teardownProject(argv);
+      return;
+    }
     await teardown(argv);
   }
 };
@@ -28438,42 +30021,42 @@ To fix, run:
 var packageJson = getZudokuPackageJson();
 var command = (module) => module;
 function createApitogoCli(argv) {
-  return yargs(argv).scriptName("apitogo").middleware(warnPackageVersionMismatch).command(command(init_default)).command(command(add_default)).command(command(remove_default)).command(command(config_default)).command(command(run_default)).command(command(build_default)).command(command(check_default)).command(command(plan_default)).command(command(secrets_default)).command(command(project_create_default)).command(command(deploy_default)).command(command(status_default)).command(command(teardown_default)).command(command(login_default)).command(command(logout_default)).demandCommand().strictCommands().version(packageJson?.version).fail(false).help();
+  return yargs(argv).scriptName("apitogo").middleware(warnPackageVersionMismatch).command(command(init_default)).command(command(add_default)).command(command(remove_default)).command(command(config_default)).command(command(run_default)).command(command(build_default)).command(command(check_default)).command(command(plan_default)).command(command(secrets_default)).command(command(project_create_default)).command(command(deploy_default)).command(command(export_default)).command(command(status_default)).command(command(teardown_default)).command(command(login_default)).command(command(logout_default)).demandCommand().strictCommands().version(packageJson?.version).fail(false).help();
 }
 
 // src/cli/local-handoff.ts
-import { spawn as spawn4 } from "node:child_process";
-import { existsSync as existsSync7, realpathSync } from "node:fs";
-import path94 from "node:path";
+import { spawn as spawn5 } from "node:child_process";
+import { existsSync as existsSync8, realpathSync } from "node:fs";
+import path99 from "node:path";
 var LOCAL_HANDOFF_ENV = "APITOGO_LOCAL_CLI";
 var PACKAGE_NAME = "@lukoweb/apitogo";
 var resolveProjectDir = (argv, cwd) => {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const next = argv[i + 1];
-    if (arg === "--dir" && next) return path94.resolve(cwd, next);
+    if (arg === "--dir" && next) return path99.resolve(cwd, next);
     if (arg?.startsWith("--dir=")) {
-      return path94.resolve(cwd, arg.slice("--dir=".length));
+      return path99.resolve(cwd, arg.slice("--dir=".length));
     }
   }
   return cwd;
 };
 var findLocalCli = (projectDir, runningRoot) => {
-  let dir = path94.resolve(projectDir);
+  let dir = path99.resolve(projectDir);
   let localPackageRoot;
   while (!localPackageRoot) {
-    const candidate = path94.join(dir, "node_modules", PACKAGE_NAME);
-    if (existsSync7(path94.join(candidate, "package.json"))) {
+    const candidate = path99.join(dir, "node_modules", PACKAGE_NAME);
+    if (existsSync8(path99.join(candidate, "package.json"))) {
       localPackageRoot = candidate;
-    } else if (dir === path94.dirname(dir)) {
+    } else if (dir === path99.dirname(dir)) {
       return void 0;
     } else {
-      dir = path94.dirname(dir);
+      dir = path99.dirname(dir);
     }
   }
   const localRoot = realpathSync(localPackageRoot);
   if (localRoot === realpathSync(runningRoot)) return void 0;
-  return path94.join(localRoot, "cli.js");
+  return path99.join(localRoot, "cli.js");
 };
 var handoffToLocalCli = async (argv, runningRoot) => {
   if (process.env[LOCAL_HANDOFF_ENV] || process.env.ZUDOKU_ENV === "internal") {
@@ -28485,9 +30068,9 @@ var handoffToLocalCli = async (argv, runningRoot) => {
   );
   if (!localCli) return void 0;
   printDiagnosticsToConsole(
-    `Using the project's local ${PACKAGE_NAME} (${path94.dirname(localCli)})`
+    `Using the project's local ${PACKAGE_NAME} (${path99.dirname(localCli)})`
   );
-  const child = spawn4(process.execPath, [localCli, ...argv], {
+  const child = spawn5(process.execPath, [localCli, ...argv], {
     stdio: "inherit",
     env: { ...process.env, [LOCAL_HANDOFF_ENV]: "1" }
   });