@lukoweb/apitogo 0.2.21 → 0.2.22

package/dist/cli/cli.js

@@ -5814,19 +5814,19 @@ import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/config/v2/errors.ts
 init_invariant();
-function formatConfigIssue(issue3) {
-  const hint = issue3.hint ? ` ${issue3.hint}` : "";
-  const rest = issue3.message.slice(issue3.path.length);
-  const startsWithPath = issue3.path !== "" && issue3.message.startsWith(issue3.path) && (rest === "" || /^[\s:]/.test(rest));
-  const text = startsWithPath ? issue3.message : `${issue3.path === "" ? "(root)" : issue3.path}: ${issue3.message}`;
-  return `${text}${hint} [${issue3.code}]`;
+function formatConfigIssue(issue4) {
+  const hint = issue4.hint ? ` ${issue4.hint}` : "";
+  const rest = issue4.message.slice(issue4.path.length);
+  const startsWithPath = issue4.path !== "" && issue4.message.startsWith(issue4.path) && (rest === "" || /^[\s:]/.test(rest));
+  const text = startsWithPath ? issue4.message : `${issue4.path === "" ? "(root)" : issue4.path}: ${issue4.message}`;
+  return `${text}${hint} [${issue4.code}]`;
 }
 var ConfigError = class extends ApitogoError {
   issues;
   constructor(file, issues) {
     super(
       `${file} has ${issues.length} problem${issues.length === 1 ? "" : "s"}:
-${issues.map((issue3) => `  - ${formatConfigIssue(issue3)}`).join("\n")}`,
+${issues.map((issue4) => `  - ${formatConfigIssue(issue4)}`).join("\n")}`,
       { title: "Invalid apitogo config" }
     );
     this.name = "ConfigError";
@@ -6247,17 +6247,17 @@ function unknownKeyHint(fullPath, key, known) {
   if (closest) return `Did you mean "${closest.candidate}"?`;
   return known.length > 0 ? `Allowed keys: ${known.join(", ")}.` : void 0;
 }
-function mapIssue(issue3) {
-  const path103 = pathToString(issue3.path);
-  switch (issue3.code) {
+function mapIssue(issue4) {
+  const path103 = pathToString(issue4.path);
+  switch (issue4.code) {
     case "unrecognized_keys":
-      return issue3.keys.map((key) => {
-        const fullPath = pathToString([...issue3.path, key]);
+      return issue4.keys.map((key) => {
+        const fullPath = pathToString([...issue4.path, key]);
         return {
           code: "CONFIG_UNKNOWN_KEY",
           path: fullPath,
           message: `Unknown key "${key}".`,
-          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue3.path))
+          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue4.path))
         };
       });
     case "invalid_value":
@@ -6265,19 +6265,19 @@ function mapIssue(issue3) {
         {
           code: "CONFIG_INVALID_VALUE",
           path: path103,
-          message: `must be one of: ${issue3.values.map((v) => JSON.stringify(v)).join(", ")}.`
+          message: `must be one of: ${issue4.values.map((v) => JSON.stringify(v)).join(", ")}.`
         }
       ];
     case "custom": {
-      const code = typeof issue3.params?.code === "string" ? issue3.params.code : "CONFIG_INVALID_VALUE";
-      return [{ code, path: path103, message: issue3.message ?? "is invalid." }];
+      const code = typeof issue4.params?.code === "string" ? issue4.params.code : "CONFIG_INVALID_VALUE";
+      return [{ code, path: path103, message: issue4.message ?? "is invalid." }];
     }
     case "invalid_type":
       return [
-        /received undefined/.test(issue3.message) ? { code: "CONFIG_MISSING_FIELD", path: path103, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path103, message: issue3.message }
+        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path103, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path103, message: issue4.message }
       ];
     default:
-      return [{ code: "CONFIG_INVALID_VALUE", path: path103, message: issue3.message }];
+      return [{ code: "CONFIG_INVALID_VALUE", path: path103, message: issue4.message }];
   }
 }
 function isRecord(value) {
@@ -6727,7 +6727,7 @@ function dependencyRules(config2, resolved, out) {
 function checkDependencies(config2, resolved) {
   const issues = [];
   dependencyRules(config2, resolved, {
-    error: (issue3) => void issues.push(issue3),
+    error: (issue4) => void issues.push(issue4),
     warn: () => void 0
   });
   return issues;
@@ -7197,8 +7197,8 @@ async function checkConfigV2(config2, resolved, context = {}) {
     "online rules were not run (provider capabilities, origin reachability, OIDC discovery, tier limits)"
   ];
   const out = {
-    error: (issue3) => errors.push(issue3),
-    warn: (issue3) => warnings.push(issue3)
+    error: (issue4) => errors.push(issue4),
+    warn: (issue4) => warnings.push(issue4)
   };
   dependencyRules(config2, resolved, out);
   secretRules(config2, context, out, skipped);
@@ -7457,6 +7457,57 @@ function withGatewayEntry(existing, info) {
     }
   };
 }
+function withIdentityEntry(existing, info) {
+  const base = existing ?? parseManifest({
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    project: { name: info.projectName }
+  });
+  return {
+    ...base,
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    generatedAt: (info.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    preview: void 0,
+    project: { ...base.project, id: info.projectId, name: info.projectName },
+    services: {
+      ...base.services,
+      identity: {
+        ...base.services.identity,
+        provider: info.provider ?? "apitogo",
+        status: "ready",
+        issuer: info.issuer.replace(/\/+$/, ""),
+        clientId: info.clientId,
+        scopes: ["openid", "profile", "email"],
+        ...info.audience ? { audience: info.audience } : {},
+        capabilities: { nativeSignup: info.nativeSignup }
+      }
+    }
+  };
+}
+function withPlansEntry(existing, info) {
+  const base = existing ?? parseManifest({
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    project: { name: info.projectName }
+  });
+  return {
+    ...base,
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    generatedAt: (info.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    preview: void 0,
+    project: { ...base.project, id: info.projectId, name: info.projectName },
+    services: {
+      ...base.services,
+      plans: {
+        ...base.services.plans,
+        provider: "apitogo",
+        status: "ready",
+        apiBaseUrl: info.apiBaseUrl.replace(/\/+$/, ""),
+        billing: info.billing,
+        catalogRevision: info.catalogRevision,
+        capabilities: info.capabilities
+      }
+    }
+  };
+}
 async function writeManifest(state, manifest) {
   const file = manifestPathFor(state);
   await mkdir3(path10.dirname(file), { recursive: true });
@@ -8266,7 +8317,8 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        rateLimit: { calls: 10, periodSeconds: 60 },
+        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
+        rateLimit: { calls: 3, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     }
@@ -8277,7 +8329,8 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        rateLimit: { calls: 10, periodSeconds: 60 },
+        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
+        rateLimit: { calls: 3, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     },
@@ -8564,12 +8617,12 @@ async function planAddService(service, options) {
       )
     );
     const added = dependencyProblems(next, resolved.configPath).filter(
-      (issue3) => !before.has(issue3.code + issue3.path)
+      (issue4) => !before.has(issue4.code + issue4.path)
     );
     if (added.length > 0) {
       throw new ServiceEditError(
-        added.map((issue3) => issue3.message).join(" "),
-        added.map((issue3) => issue3.hint).filter(Boolean).join(" ") || "Add the missing service first."
+        added.map((issue4) => issue4.message).join(" "),
+        added.map((issue4) => issue4.hint).filter(Boolean).join(" ") || "Add the missing service first."
       );
     }
   }
@@ -8598,11 +8651,11 @@ async function planRemoveService(service, options) {
     dependencyProblems(config2, resolved.configPath).map((i) => i.code + i.path)
   );
   const caused = dependencyProblems(next, resolved.configPath).filter(
-    (issue3) => !before.has(issue3.code + issue3.path)
+    (issue4) => !before.has(issue4.code + issue4.path)
   );
   if (caused.length > 0) {
     throw new ServiceEditError(
-      `${service} cannot be removed while something depends on it: ${caused.map((issue3) => issue3.message).join(" ")}`,
+      `${service} cannot be removed while something depends on it: ${caused.map((issue4) => issue4.message).join(" ")}`,
       "Remove or change the dependent service first."
     );
   }
@@ -8836,7 +8889,7 @@ init_invariant();
 
 // src/cli/check/v2.ts
 init_apitogo_config_core();
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import path49 from "node:path";
 
 // src/cli/platform/client/platform-api.ts
@@ -9264,6 +9317,52 @@ var PlatformApiClient = class {
       `/api/v1/projects/${projectId}/gateway`
     );
   }
+  /**
+   * Asks for the project's identity. The same request twice changes nothing; a different request for an identity that
+   * exists is refused (409), because its audience and redirect addresses cannot change in place. Answers 200 when it is
+   * already Active and 202 otherwise: read `status` and poll `getProjectIdentity`.
+   */
+  putProjectIdentity(projectId, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/identity`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** The state of the project's identity, or null when it has none. */
+  async getProjectIdentity(projectId) {
+    try {
+      return await this.request(
+        "GET",
+        `/api/v1/projects/${projectId}/identity`
+      );
+    } catch (error) {
+      if (error instanceof PlatformApiError && error.status === 404)
+        return null;
+      throw error;
+    }
+  }
+  /**
+   * Removes the project's identity and DELETES EVERY USER in it, for good. Always sends `confirm=true`: ask the person
+   * before calling. Returns null when there was nothing to remove, otherwise the state to poll until Released.
+   */
+  async deleteProjectIdentity(projectId) {
+    const result = await this.request(
+      "DELETE",
+      `/api/v1/projects/${projectId}/identity?confirm=true`
+    );
+    return result ?? null;
+  }
+  /** Applies the project's identity to its plans backend as the sign-in provider. Queues a job. */
+  linkDevPortalIdentity(projectId) {
+    return this.request(
+      "POST",
+      `/api/v1/projects/${projectId}/dev-portal/identity-link`
+    );
+  }
   getDevPortalBackend(projectId) {
     return this.request(
       "GET",
@@ -9552,8 +9651,8 @@ var PlatformApiClient = class {
   }
 };
 async function readFileBytes(filePath) {
-  const { readFile: readFile31 } = await import("node:fs/promises");
-  const buffer = await readFile31(filePath);
+  const { readFile: readFile32 } = await import("node:fs/promises");
+  const buffer = await readFile32(filePath);
   const arrayBuffer = new ArrayBuffer(buffer.byteLength);
   new Uint8Array(arrayBuffer).set(buffer);
   return arrayBuffer;
@@ -9807,7 +9906,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.21",
+  version: "0.2.22",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -14883,11 +14982,239 @@ async function onlineGatewayRules(gateway, projectId, api, derivedCors = []) {
   }
 }
 
+// src/cli/deploy/plans-file.ts
+init_invariant();
+import { readFile as readFile14 } from "node:fs/promises";
+import { z as z14 } from "zod";
+var PlansFileError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot read the plans file" });
+    this.code = code;
+    this.name = "PlansFileError";
+  }
+};
+var Limits = z14.strictObject({
+  rateLimit: z14.strictObject({
+    calls: z14.int().positive(),
+    periodSeconds: z14.int().positive()
+  }).optional(),
+  quota: z14.strictObject({
+    calls: z14.int().positive(),
+    periodDays: z14.int().positive()
+  }).optional()
+});
+var Plan = z14.strictObject({
+  sku: z14.string().trim().min(1),
+  displayName: z14.string().trim().min(1),
+  /** The plan the portal offers first. The platform has no such flag; the portal reads the file order. */
+  default: z14.boolean().optional(),
+  limits: Limits.optional(),
+  priceAmount: z14.number().min(0).optional(),
+  priceCurrency: z14.string().trim().min(1).optional(),
+  billingInterval: z14.enum(["month", "year"]).optional(),
+  pricingModel: z14.enum(["fixed", "custom"]).optional(),
+  priceLabel: z14.string().optional(),
+  sortOrder: z14.int().optional(),
+  /** Action keys such as `get:/orders`. Left out, the plan includes every action of the gateway. */
+  includedActions: z14.array(z14.string().trim().min(1)).optional()
+});
+var PlansFile = z14.strictObject({
+  version: z14.literal(1),
+  plans: z14.array(Plan)
+});
+var issuesOf = (error) => error.issues.map(
+  (issue4) => `${issue4.path.join(".") || "(file)"}: ${issue4.message}`
+);
+async function readPlansFile(file) {
+  let text;
+  try {
+    text = await readFile14(file, "utf8");
+  } catch {
+    throw new PlansFileError(
+      "PLANS_FILE_UNREADABLE",
+      `The plans file ${file} could not be read.`,
+      "Create it with `apitogo add plans`, or set plans.file in the config."
+    );
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    throw new PlansFileError(
+      "PLANS_FILE_INVALID",
+      `The plans file ${file} is not valid JSON (${error.message}).`
+    );
+  }
+  const parsed = PlansFile.safeParse(raw);
+  if (!parsed.success)
+    throw new PlansFileError(
+      "PLANS_FILE_INVALID",
+      `The plans file ${file} is not valid:
+  ${issuesOf(parsed.error).join("\n  ")}`,
+      'Expected { "version": 1, "plans": [ { "sku", "displayName", "limits": { "rateLimit": { "calls", "periodSeconds" }, "quota": { "calls", "periodDays" } } } ] }.'
+    );
+  const seen = /* @__PURE__ */ new Set();
+  for (const plan2 of parsed.data.plans) {
+    const sku = plan2.sku.toLowerCase();
+    if (seen.has(sku))
+      throw new PlansFileError(
+        "PLANS_FILE_INVALID",
+        `The plans file ${file} names the sku "${plan2.sku}" twice.`,
+        "Every plan needs its own sku."
+      );
+    seen.add(sku);
+  }
+  return parsed.data.plans;
+}
+var BILLING_PERIOD = { month: "monthly", year: "annual" };
+function toPlatformPlans(plans) {
+  return plans.map((plan2, index) => {
+    const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
+    if (paid)
+      throw new PlansFileError(
+        "PLANS_PAID_UNSUPPORTED",
+        `The plan "${plan2.sku}" has a price, and deploying paid plans is not available in this CLI version yet.`,
+        "Remove the plan, or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
+      );
+    const limits = plan2.limits ? {
+      ...plan2.limits.rateLimit ? {
+        rateLimit: {
+          calls: plan2.limits.rateLimit.calls,
+          renewalPeriodSeconds: plan2.limits.rateLimit.periodSeconds
+        }
+      } : {},
+      ...plan2.limits.quota ? {
+        quota: {
+          calls: plan2.limits.quota.calls,
+          renewalPeriodDays: plan2.limits.quota.periodDays
+        }
+      } : {}
+    } : void 0;
+    return {
+      sku: plan2.sku.trim().toLowerCase(),
+      displayName: plan2.displayName,
+      ...limits ? { limitsJson: JSON.stringify(limits) } : {},
+      includedActionKeys: plan2.includedActions ?? null,
+      ...plan2.pricingModel ? { pricingModel: plan2.pricingModel } : {},
+      ...plan2.priceAmount !== void 0 ? { priceAmount: plan2.priceAmount } : {},
+      ...plan2.priceLabel !== void 0 ? { priceLabel: plan2.priceLabel } : {},
+      ...plan2.priceCurrency ? { priceCurrency: plan2.priceCurrency } : {},
+      ...plan2.billingInterval ? { billingPeriod: BILLING_PERIOD[plan2.billingInterval] } : {},
+      sortOrder: plan2.sortOrder ?? index
+    };
+  });
+}
+
+// src/cli/check/services-online.ts
+var issue3 = (code, path103, message, hint) => ({
+  code,
+  path: path103,
+  message,
+  hint
+});
+var trimSlash = (value) => value.replace(/\/+$/, "");
+async function onlineIdentityRules(resolved, manifest, api) {
+  const identity = resolved.identity;
+  if (!identity?.enabled) return { errors: [], warnings: [] };
+  const issuer = manifest?.services.identity?.issuer;
+  if (!issuer)
+    return {
+      errors: [],
+      warnings: [],
+      skipped: "the identity's online rules were not run: identity is not deployed yet (run `apitogo deploy --only identity`)"
+    };
+  let answer;
+  try {
+    answer = await api.discover(issuer);
+  } catch (error) {
+    return {
+      errors: [],
+      warnings: [],
+      skipped: `the identity's online rules were not run: the issuer could not be reached (${error instanceof Error ? error.message : String(error)})`
+    };
+  }
+  if ("status" in answer)
+    return {
+      errors: [
+        issue3(
+          "IDENTITY_ISSUER_NOT_ANSWERING",
+          "identity",
+          `the issuer ${issuer} answered ${answer.status} instead of its discovery document.`,
+          "Run `apitogo status --only identity` to see what the platform says, then deploy identity again."
+        )
+      ],
+      warnings: []
+    };
+  if (!answer.document.issuer || trimSlash(answer.document.issuer) !== trimSlash(issuer))
+    return {
+      errors: [
+        issue3(
+          "IDENTITY_ISSUER_MISMATCH",
+          "identity",
+          `the discovery document of ${issuer} names a different issuer (${answer.document.issuer ?? "none"}).`,
+          "Deploy identity again so services.json is rewritten."
+        )
+      ],
+      warnings: []
+    };
+  return { errors: [], warnings: [] };
+}
+async function plansFileProblem(resolved) {
+  const plans = resolved.plans;
+  if (!plans?.enabled) return { wanted: [] };
+  try {
+    return { wanted: toPlatformPlans(await readPlansFile(plans.file)) };
+  } catch (error) {
+    if (!(error instanceof PlansFileError)) throw error;
+    return {
+      wanted: [],
+      issue: issue3(
+        error.code,
+        "plans.file",
+        error.message,
+        error.developerHint
+      )
+    };
+  }
+}
+async function onlinePlansRules(resolved, projectId, api) {
+  const plans = resolved.plans;
+  if (!plans?.enabled) return { errors: [], warnings: [] };
+  const file = await plansFileProblem(resolved);
+  if (file.issue) return { errors: [file.issue], warnings: [] };
+  const wanted = file.wanted;
+  if (wanted.length === 0) return { errors: [], warnings: [] };
+  try {
+    const answer = await api.validate(
+      projectId,
+      wanted.map(({ includedActionKeys, ...plan2 }) => ({
+        ...plan2,
+        ...includedActionKeys ? { includedActionKeys } : {}
+      }))
+    );
+    const convert = (item) => issue3(
+      "PLANS_PLAN_INVALID",
+      `plans.file ${item.field}`,
+      `${item.sku ? `plan ${item.sku}: ` : ""}${item.message}`
+    );
+    return {
+      errors: answer.errors.map(convert),
+      warnings: answer.warnings.map(convert)
+    };
+  } catch (error) {
+    return {
+      errors: [],
+      warnings: [],
+      skipped: `the plans' online rules were not run: the platform could not be asked (${error instanceof Error ? error.message : String(error)})`
+    };
+  }
+}
+
 // src/cli/check/v2.ts
 async function isConfigV2(dir) {
   try {
     return /"version"\s*:\s*2\b/.test(
-      await readFile14(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
+      await readFile15(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
     );
   } catch {
     return false;
@@ -14908,13 +15235,13 @@ async function fetchSecretNames(config2, configuredProjectId, args, deps) {
 }
 async function addGatewayOnlineRules(report, resolved, args, deps) {
   const gateway = resolved.gateway;
-  if (args.offline || !deps.gateway || !gateway?.enabled) return;
+  if (args.offline || !deps.gateway || !gateway?.enabled) return false;
   const projectId = resolved.project.id || deps.envProjectId?.trim();
   if (!projectId) {
     report.skipped.push(
       "the gateway's online rules were not run: this folder is not linked to a project (run `apitogo project create`)"
     );
-    return;
+    return false;
   }
   const manifest = await readManifest(resolved.state);
   const result = await onlineGatewayRules(
@@ -14928,7 +15255,7 @@ async function addGatewayOnlineRules(report, resolved, args, deps) {
   );
   if (result.skipped) {
     report.skipped.push(result.skipped);
-    return;
+    return false;
   }
   const seen = new Set(
     [...report.errors, ...report.warnings].map((i) => `${i.code}|${i.path}`)
@@ -14939,12 +15266,60 @@ async function addGatewayOnlineRules(report, resolved, args, deps) {
     seen.add(key);
     report.errors.push(item);
   }
-  report.skipped = report.skipped.filter(
-    (note) => !note.startsWith("online rules were not run")
-  );
-  report.skipped.unshift(
-    "online rules ran for the gateway only; the other services have none yet"
+  return true;
+}
+async function addServiceOnlineRules(report, resolved, args, deps) {
+  if (args.offline) return [];
+  const ran = [];
+  const seen = new Set(
+    [...report.errors, ...report.warnings].map((i) => `${i.code}|${i.path}`)
   );
+  const take = (list2, into) => {
+    for (const item of list2) {
+      const key = `${item.code}|${item.path}`;
+      if (seen.has(key)) continue;
+      if (item.path === "plans.file" && report.errors.some((e) => e.path === "plans.file"))
+        continue;
+      seen.add(key);
+      into.push(item);
+    }
+  };
+  if (deps.identity && resolved.identity?.enabled) {
+    const result = await onlineIdentityRules(
+      resolved,
+      await readManifest(resolved.state),
+      deps.identity
+    );
+    if (result.skipped) report.skipped.push(result.skipped);
+    else {
+      take(result.errors, report.errors);
+      take(result.warnings, report.warnings);
+      ran.push("identity");
+    }
+  }
+  if (deps.plans && resolved.plans?.enabled) {
+    const projectId = resolved.project.id || deps.envProjectId?.trim();
+    if (!projectId)
+      report.skipped.push(
+        "the plans' online rules were not run: this folder is not linked to a project (run `apitogo project create`)"
+      );
+    else {
+      const result = await onlinePlansRules(resolved, projectId, deps.plans);
+      if (result.skipped) report.skipped.push(result.skipped);
+      else {
+        take(result.errors, report.errors);
+        take(result.warnings, report.warnings);
+        ran.push("plans");
+      }
+    }
+  }
+  return ran;
+}
+function onlineRulesNote(ran) {
+  if (ran.length === 1 && ran[0] === "gateway")
+    return "online rules ran for the gateway only; the other services have none yet";
+  const names = ran.length > 1 ? `${ran.slice(0, -1).join(", ")} and ${ran[ran.length - 1]}` : ran[0] ?? "";
+  return `online rules ran for the ${names}`;
 }
 async function addApiReferenceWarning(report, resolved) {
   const portal = resolved.portal;
@@ -14968,7 +15343,7 @@ async function validatePortalBuild(dir) {
       return {
         code: error.issues[0]?.code ?? "PORTAL_BUILD_FAILED",
         path: error.issues[0]?.path ?? "portal",
-        message: error.issues.map((issue3) => issue3.message).join(" "),
+        message: error.issues.map((issue4) => issue4.message).join(" "),
         hint: error.issues[0]?.hint
       };
     }
@@ -14997,7 +15372,19 @@ async function runCheckV2(dir, args = {}, deps = {}) {
       knownSecrets: online.names
     });
     if (online.failure) report.skipped.push(online.failure);
-    await addGatewayOnlineRules(report, resolved, args, deps);
+    const file = await plansFileProblem(resolved);
+    if (file.issue && !report.errors.some((e) => e.path === file.issue.path))
+      report.errors.push(file.issue);
+    const ran = [];
+    if (await addGatewayOnlineRules(report, resolved, args, deps))
+      ran.push("gateway");
+    ran.push(...await addServiceOnlineRules(report, resolved, args, deps));
+    if (ran.length > 0) {
+      report.skipped = report.skipped.filter(
+        (note) => !note.startsWith("online rules were not run")
+      );
+      report.skipped.unshift(onlineRulesNote(ran));
+    }
     await addApiReferenceWarning(report, resolved);
   } catch (error) {
     if (!(error instanceof ConfigError)) throw error;
@@ -15025,11 +15412,11 @@ async function runCheckV2(dir, args = {}, deps = {}) {
     ...report
   };
 }
-var line = (label, issue3) => `${label}: ${formatConfigIssue(issue3)}`;
+var line = (label, issue4) => `${label}: ${formatConfigIssue(issue4)}`;
 function formatCheckV2(output4) {
   const lines = [
-    ...output4.errors.map((issue3) => line("error", issue3)),
-    ...output4.warnings.map((issue3) => line("warning", issue3)),
+    ...output4.errors.map((issue4) => line("error", issue4)),
+    ...output4.warnings.map((issue4) => line("warning", issue4)),
     ...output4.skipped.map((note) => `not checked: ${note}`)
   ];
   const errors = `${output4.errors.length} error${output4.errors.length === 1 ? "" : "s"}`;
@@ -15039,6 +15426,14 @@ function formatCheckV2(output4) {
   );
   return lines;
 }
+async function discoverIssuer(issuer) {
+  const response = await fetch(
+    `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`,
+    { signal: AbortSignal.timeout(1e4) }
+  );
+  if (!response.ok) return { status: response.status };
+  return { document: await response.json() };
+}
 function platformDependencies(args) {
   if (args.offline) return {};
   try {
@@ -15050,6 +15445,10 @@ function platformDependencies(args) {
       gateway: {
         check: (projectId, body) => client.checkGateway(projectId, body),
         capabilities: (projectId) => client.getGatewayCapabilities(projectId)
+      },
+      identity: { discover: discoverIssuer },
+      plans: {
+        validate: (projectId, plans) => client.validateGatewayPlans(plans, { projectId })
       }
     };
   } catch {
@@ -15076,7 +15475,7 @@ init_package_json();
 
 // src/cli/platform/helpers/npm-build.ts
 import { spawn } from "node:child_process";
-import { access as access5, readFile as readFile15 } from "node:fs/promises";
+import { access as access5, readFile as readFile16 } from "node:fs/promises";
 import path50 from "node:path";
 var BUILD_LOG_TAIL_BYTES = 8192;
 var MIN_NODE_MAJOR = 20;
@@ -16028,7 +16427,7 @@ function formatDevPortalBackendResponse(projectId, backend) {
 // src/cli/platform/helpers/dev-portal-manifest.ts
 init_gateway_limits();
 import { existsSync as existsSync7 } from "node:fs";
-import { access as access6, mkdir as mkdir13, readFile as readFile16, writeFile as writeFile15 } from "node:fs/promises";
+import { access as access6, mkdir as mkdir13, readFile as readFile17, writeFile as writeFile15 } from "node:fs/promises";
 import path57 from "node:path";
 
 // src/cli/make-config/json-config.ts
@@ -17328,7 +17727,7 @@ function applyOpenApiToSiteConfig(config2, options) {
 async function readManifest2(siteDirectory) {
   const filePath = manifestFilePath(siteDirectory);
   if (await pathExists2(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     const config2 = JSON.parse(raw);
     return extractManifestFromConfig(config2);
   }
@@ -17339,7 +17738,7 @@ async function writeManifest2(siteDirectory, manifest) {
   await mkdir13(path57.dirname(filePath), { recursive: true });
   let config2 = {};
   if (await pathExists2(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     config2 = JSON.parse(raw);
   }
   const {
@@ -17358,7 +17757,7 @@ import {
   access as access7,
   appendFile,
   mkdir as mkdir14,
-  readFile as readFile17,
+  readFile as readFile18,
   unlink,
   writeFile as writeFile16
 } from "node:fs/promises";
@@ -17464,7 +17863,7 @@ function applyEnvOverrides2(config2, env) {
 }
 async function readEnvFile(filePath) {
   try {
-    const raw = await readFile17(filePath, "utf8");
+    const raw = await readFile18(filePath, "utf8");
     const env = {};
     for (const line2 of raw.split("\n")) {
       const trimmed = line2.trim();
@@ -17641,7 +18040,7 @@ async function writeScaffoldEnv(siteDirectory) {
   for (const legacyName of [".env.example"]) {
     const legacyPath = path58.join(resolvedDirectory, legacyName);
     try {
-      const legacy = await readFile17(legacyPath, "utf8");
+      const legacy = await readFile18(legacyPath, "utf8");
       if (!envFileHasActiveAssignments(legacy)) {
         await unlink(legacyPath);
         filesWritten.push(`removed:${legacyName}`);
@@ -17652,7 +18051,7 @@ async function writeScaffoldEnv(siteDirectory) {
   const gitignorePath = path58.join(resolvedDirectory, ".gitignore");
   let gitignore = "";
   try {
-    gitignore = await readFile17(gitignorePath, "utf8");
+    gitignore = await readFile18(gitignorePath, "utf8");
   } catch {
     gitignore = "";
   }
@@ -17684,7 +18083,7 @@ var SECRETS_COLLECTION_INSTRUCTION = "For go-live, plans must already be in apit
 
 // src/cli/platform/helpers/dev-portal-site-validation.ts
 init_gateway_limits();
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 import { createRequire as createRequire3 } from "node:module";
 import path59 from "node:path";
 var cachedFallbackTs;
@@ -17862,7 +18261,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     let parsed;
     let parseFailed = false;
     try {
-      parsed = JSON.parse(await readFile18(jsonPath, "utf8"));
+      parsed = JSON.parse(await readFile19(jsonPath, "utf8"));
     } catch (error) {
       parseFailed = true;
       issues.push({
@@ -17901,7 +18300,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     } else {
       for (const relativeFile of existingTsxFiles) {
         checkedFiles.push(relativeFile);
-        const content = await readFile18(
+        const content = await readFile19(
           path59.join(resolvedDir, relativeFile),
           "utf8"
         );
@@ -17922,7 +18321,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
   };
 }
 function formatSiteValidationErrors(result) {
-  return result.issues.map((issue3) => `${issue3.file}: ${issue3.message}`).join("; ");
+  return result.issues.map((issue4) => `${issue4.file}: ${issue4.message}`).join("; ");
 }
 function buildSiteValidationResponseFields(result) {
   if (result.valid) {
@@ -18326,7 +18725,7 @@ async function checkPublishReadiness(client, _config, args) {
   const mergedPrerequisites = mergePublishPrerequisitesWithPlatformValidation(
     publishPrerequisites,
     platformValidation.issues.map(
-      (issue3) => `${issue3.field}: ${issue3.message}`
+      (issue4) => `${issue4.field}: ${issue4.message}`
     )
   );
   const siteValidation = await validateDevPortalSiteConfig(sourceDirectory);
@@ -18448,7 +18847,7 @@ var check_default = {
 
 // src/cli/make-config/handler.ts
 import { constants as constants2 } from "node:fs";
-import { access as access12, mkdir as mkdir17, readFile as readFile23, writeFile as writeFile21 } from "node:fs/promises";
+import { access as access12, mkdir as mkdir17, readFile as readFile24, writeFile as writeFile21 } from "node:fs/promises";
 import path71 from "node:path";
 import { stdin as input2 } from "node:process";
 import { glob as glob8 } from "glob";
@@ -18588,7 +18987,7 @@ function withDefaultIncludedActionKeys(plan2, actionKeys) {
 }
 
 // src/cli/scaffold/dev-portal-config-pages.ts
-import { access as access8, readFile as readFile19, rename as rename7, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
+import { access as access8, readFile as readFile20, rename as rename7, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
 import path63 from "node:path";
 async function writeConfigAtomically(filePath, content) {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
@@ -19353,7 +19752,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
   if (!configPath) {
     return { updated: false };
   }
-  const original = await readFile19(configPath, "utf8");
+  const original = await readFile20(configPath, "utf8");
   const patched = patchApitogoConfigForNewPage(original, slug, label, {
     typescript: configPath.endsWith(".tsx")
   });
@@ -19365,7 +19764,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
 }
 
 // src/cli/scaffold/wire-openapi.ts
-import { access as access10, readFile as readFile21, writeFile as writeFile19 } from "node:fs/promises";
+import { access as access10, readFile as readFile22, writeFile as writeFile19 } from "node:fs/promises";
 import path68 from "node:path";
 
 // src/cli/platform/helpers/openapi.ts
@@ -19569,7 +19968,7 @@ async function validateOpenApiFile(filePath) {
 }
 
 // src/cli/scaffold/scaffold-dev-portal-site.ts
-import { mkdir as mkdir15, readFile as readFile20, writeFile as writeFile18 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile21, writeFile as writeFile18 } from "node:fs/promises";
 import path67 from "node:path";
 
 // src/cli/scaffold/apitogo-npm-packages.ts
@@ -19977,7 +20376,7 @@ function patchDashboardPageConfig(content) {
 async function ensureAccountPlansPage(outputDirectory) {
   const pagePath = path67.join(outputDirectory, ACCOUNT_PLANS_PAGE_PATH);
   try {
-    await readFile20(pagePath, "utf8");
+    await readFile21(pagePath, "utf8");
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
@@ -19988,7 +20387,7 @@ async function ensureAccountPlansPage(outputDirectory) {
 async function ensureDashboardPage(outputDirectory) {
   const pagePath = path67.join(outputDirectory, DASHBOARD_PAGE_PATH);
   try {
-    await readFile20(pagePath, "utf8");
+    await readFile21(pagePath, "utf8");
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
@@ -20050,7 +20449,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
   const filesWritten = [];
   const packageJsonPath = path67.join(outputDirectory, "package.json");
   if (options.patchPackageJson !== false) {
-    const packageJson3 = await readFile20(packageJsonPath, "utf8");
+    const packageJson3 = await readFile21(packageJsonPath, "utf8");
     await writeFile18(
       packageJsonPath,
       rewritePackageJson(packageJson3, {
@@ -20062,7 +20461,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
     filesWritten.push("package.json");
   }
   const configPath = path67.join(outputDirectory, "apitogo.config.tsx");
-  const configContent = await readFile20(configPath, "utf8");
+  const configContent = await readFile21(configPath, "utf8");
   await writeFile18(
     configPath,
     patchDashboardPageConfig(
@@ -20169,7 +20568,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
   }
   const jsonConfigPath = manifestFilePath(resolvedSource);
   if (await pathExists4(jsonConfigPath)) {
-    const raw = await readFile21(jsonConfigPath, "utf8");
+    const raw = await readFile22(jsonConfigPath, "utf8");
     const siteConfig = JSON.parse(raw);
     const updated = applyOpenApiToSiteConfig(siteConfig, {
       input: input5,
@@ -20183,7 +20582,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
     );
   } else {
     const tsxConfigPath = path68.join(resolvedSource, "apitogo.config.tsx");
-    const configContent = await readFile21(tsxConfigPath, "utf8");
+    const configContent = await readFile22(tsxConfigPath, "utf8");
     try {
       const patched = patchApitogoConfigOpenApiToFile(configContent, input5);
       await writeFile19(tsxConfigPath, patched);
@@ -20539,7 +20938,7 @@ export default function ${componentName}() {
 // src/cli/make-config/scaffold-project.ts
 init_package_json();
 import { constants } from "node:fs";
-import { access as access11, mkdir as mkdir16, readFile as readFile22, writeFile as writeFile20 } from "node:fs/promises";
+import { access as access11, mkdir as mkdir16, readFile as readFile23, writeFile as writeFile20 } from "node:fs/promises";
 import path70 from "node:path";
 import { glob as glob7 } from "glob";
 
@@ -20621,7 +21020,7 @@ async function ensurePackageJson2(dir) {
 `, "utf8");
     return true;
   }
-  const raw = await readFile22(pkgPath, "utf8");
+  const raw = await readFile23(pkgPath, "utf8");
   let pkg;
   try {
     pkg = JSON.parse(raw);
@@ -20750,7 +21149,7 @@ var fileExists3 = async (filePath) => {
   }
 };
 var readJsonConfig = async (filePath) => {
-  const raw = await readFile23(filePath, "utf8");
+  const raw = await readFile24(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject3(parsed)) {
     throw new Error(`${APITOGO_JSON_FILENAME} must be a JSON object.`);
@@ -20800,7 +21199,7 @@ async function persistConfig(config2, ctx) {
 `, "utf8");
   const tsxPath = path71.join(ctx.dir, "apitogo.config.tsx");
   if (await fileExists3(tsxPath) && tsxRoutes.length > 0) {
-    const tsxSource = await readFile23(tsxPath, "utf8");
+    const tsxSource = await readFile24(tsxPath, "utf8");
     if (isManagedConfigWrapper(tsxSource)) {
       await writeFile21(
         tsxPath,
@@ -21196,15 +21595,15 @@ function buildGatewayPlansValidationRequest(plans) {
     };
   });
 }
-function toConfigIssue(issue3) {
+function toConfigIssue(issue4) {
   return {
-    ...issue3,
-    field: issue3.field.replace(/\.limitsJson$/, ".limits")
+    ...issue4,
+    field: issue4.field.replace(/\.limitsJson$/, ".limits")
   };
 }
-function formatGatewayPlanIssue(issue3) {
-  const sku = issue3.sku ? ` (${issue3.sku})` : "";
-  return `${issue3.field}${sku}: ${issue3.message}`;
+function formatGatewayPlanIssue(issue4) {
+  const sku = issue4.sku ? ` (${issue4.sku})` : "";
+  return `${issue4.field}${sku}: ${issue4.message}`;
 }
 async function checkGatewayPlansOnPlatform(client, args) {
   let result;
@@ -21227,10 +21626,10 @@ async function checkGatewayPlansOnPlatform(client, args) {
 async function assertGatewayPlansValidForPublish(client, args) {
   const localErrors = args.localErrors ?? [];
   const check2 = await checkGatewayPlansOnPlatform(client, args);
-  const localFields = new Set(localErrors.map((issue3) => issue3.field));
+  const localFields = new Set(localErrors.map((issue4) => issue4.field));
   const errors = [
     ...localErrors,
-    ...(check2?.errors ?? []).filter((issue3) => !localFields.has(issue3.field))
+    ...(check2?.errors ?? []).filter((issue4) => !localFields.has(issue4.field))
   ];
   if (errors.length === 0) {
     return { blocked: false };
@@ -22193,7 +22592,7 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
 }
 
 // src/cli/platform/helpers/openapi-gateway-servers.ts
-import { mkdir as mkdir18, readFile as readFile24, writeFile as writeFile22 } from "node:fs/promises";
+import { mkdir as mkdir18, readFile as readFile25, writeFile as writeFile22 } from "node:fs/promises";
 import path74 from "node:path";
 import YAML3 from "yaml";
 var GATEWAY_URL_ENV_KEY = "APITOGO_GATEWAY_URL";
@@ -22225,7 +22624,7 @@ async function resolveProjectGatewayUrl(client, projectId) {
   return null;
 }
 async function readOpenApiDocument(filePath) {
-  const content = await readFile24(filePath, "utf8");
+  const content = await readFile25(filePath, "utf8");
   const ext = path74.extname(filePath).toLowerCase();
   const parsed = ext === ".json" ? JSON.parse(content) : YAML3.parse(content);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -22254,7 +22653,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
     path74.resolve(siteDirectory),
     APITOGO_CONFIG_FILENAME2
   );
-  const raw = await readFile24(configPath, "utf8");
+  const raw = await readFile25(configPath, "utf8");
   const config2 = JSON.parse(raw);
   const previousApis = config2.apis;
   const previousBackend = config2.backend;
@@ -22271,7 +22670,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
 `, "utf8");
   return {
     restore: async () => {
-      const currentRaw = await readFile24(configPath, "utf8");
+      const currentRaw = await readFile25(configPath, "utf8");
       const current = JSON.parse(currentRaw);
       if (previousApis === void 0) {
         delete current.apis;
@@ -22306,7 +22705,7 @@ async function prepareOpenApiServersForGatewayBuild(options) {
   );
   if (!openApiPath) {
     try {
-      const raw = await readFile24(
+      const raw = await readFile25(
         path74.join(siteDirectory, APITOGO_CONFIG_FILENAME2),
         "utf8"
       );
@@ -22380,7 +22779,7 @@ function collectManifestPublicActionKeys(gateway) {
 }
 
 // src/cli/platform/helpers/publish-ledger.ts
-import { mkdir as mkdir19, readFile as readFile25, writeFile as writeFile23 } from "node:fs/promises";
+import { mkdir as mkdir19, readFile as readFile26, writeFile as writeFile23 } from "node:fs/promises";
 import path75 from "node:path";
 var PUBLISH_LEDGER_RELATIVE_PATH = ".apitogo/publish-state.json";
 function publishLedgerPath(siteDirectory) {
@@ -22389,7 +22788,7 @@ function publishLedgerPath(siteDirectory) {
 async function readPublishLedger(siteDirectory) {
   const filePath = publishLedgerPath(siteDirectory);
   try {
-    const raw = await readFile25(filePath, "utf8");
+    const raw = await readFile26(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || !Array.isArray(parsed.steps)) {
       return null;
@@ -24092,6 +24491,10 @@ function resumedCreateStep(projectId) {
   };
 }
 async function resolveBootstrapProjectId(client, args, steps) {
+  if (args.projectId) {
+    steps.push(resumedCreateStep(args.projectId));
+    return { projectId: args.projectId, resumed: true };
+  }
   const existing = await findExistingProjectByName(client, args.name);
   if (existing) {
     steps.push(resumedCreateStep(existing.id));
@@ -24151,11 +24554,14 @@ async function handleBootstrapProject(client, config2, args, progress) {
     {
       name: args.name,
       description: args.description,
-      modules
+      modules,
+      projectId: args.projectId
     },
     steps
   );
-  if (selectFreePlan && !resumed) {
+  await args.onProjectResolved?.(projectId);
+  const continuingWithoutPlan = selectFreePlan && args.projectId !== void 0 && isPlatformPlanUnselected((await client.getProject(projectId)).planTier);
+  if (selectFreePlan && (!resumed || continuingWithoutPlan)) {
     await bootstrapProgress?.onStep("Selecting free plan");
     const freeResult = await handleSelectFreePlan(
       client,
@@ -24167,7 +24573,7 @@ async function handleBootstrapProject(client, config2, args, progress) {
       return freeResult;
     }
     steps.push({ step: "select_free_plan", status: "succeeded" });
-  } else if (selectFreePlan && resumed) {
+  } else if (selectFreePlan && resumed && !continuingWithoutPlan) {
     steps.push({
       step: "select_free_plan",
       status: "skipped",
@@ -24356,9 +24762,9 @@ async function handleTeardownProject(client, config2, args, progress) {
 
 // src/cli/platform/tools/dev-portal-bootstrap-shared.ts
 var BootstrapStepError = class extends Error {
-  constructor(failedStep, message, recoveryHint) {
+  constructor(failedStep2, message, recoveryHint) {
     super(message);
-    this.failedStep = failedStep;
+    this.failedStep = failedStep2;
     this.recoveryHint = recoveryHint;
     this.name = "BootstrapStepError";
   }
@@ -24561,7 +24967,7 @@ async function resolveProjectIdForPublish(client, config2, args, wait, progress,
 import path81 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-site-api-url.ts
-import { readdir as readdir3, readFile as readFile26, writeFile as writeFile24 } from "node:fs/promises";
+import { readdir as readdir3, readFile as readFile27, writeFile as writeFile24 } from "node:fs/promises";
 import path78 from "node:path";
 var SITE_API_BASE_URL_ENV_KEY = "VITE_APITOGO_AUTHENTICATION_API_BASE_URL";
 var PLACEHOLDER_HOST_MARKERS = [
@@ -24586,7 +24992,7 @@ async function readSiteApiBaseUrl(sourceDirectory) {
   const resolved = path78.resolve(sourceDirectory);
   for (const envFile of [".env", ".env.production"]) {
     try {
-      const content = await readFile26(path78.join(resolved, envFile), "utf8");
+      const content = await readFile27(path78.join(resolved, envFile), "utf8");
       const lines = [...content.matchAll(ENV_LINE_GLOBAL_RE)];
       if (lines.length === 0) {
         continue;
@@ -24617,7 +25023,7 @@ async function patchSiteApiBaseUrl(sourceDirectory, apiBaseUrl) {
   for (const envFile of [".env.production", ".env"]) {
     const envPath = path78.join(resolved, envFile);
     try {
-      const content = await readFile26(envPath, "utf8");
+      const content = await readFile27(envPath, "utf8");
       const withoutAssignments = content.replace(ENV_LINE_GLOBAL_RE, "").replace(/\n{3,}/g, "\n\n").trimEnd();
       const patched = withoutAssignments ? `${withoutAssignments}
 ${line2}
@@ -24697,7 +25103,7 @@ async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiB
   let found = false;
   let foundPlaceholder = false;
   for await (const file of walkFiles(dist)) {
-    const content = await readFile26(file, "utf8");
+    const content = await readFile27(file, "utf8");
     if (content.includes(needle)) {
       found = true;
     }
@@ -25382,7 +25788,7 @@ function throwOnManifestIssues(issues) {
     return;
   }
   throw new Error(
-    `apitogo.config.json is not platform-compatible: ${issues.map((issue3) => `${issue3.field}: ${issue3.message}`).join("; ")}`
+    `apitogo.config.json is not platform-compatible: ${issues.map((issue4) => `${issue4.field}: ${issue4.message}`).join("; ")}`
   );
 }
 async function runApplyFromSiteDirectory(client, config2, args, progress) {
@@ -26400,14 +26806,14 @@ function formatBlockedOrFailedResultForHuman(parsed) {
     const lines = [
       typeof parsed.userMessage === "string" ? parsed.userMessage : "Deploy is blocked: apitogo.config.json has errors."
     ];
-    for (const issue3 of Array.isArray(parsed.errors) ? parsed.errors : []) {
-      lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
+    for (const issue4 of Array.isArray(parsed.errors) ? parsed.errors : []) {
+      lines.push(`  - ${formatGatewayPlanIssue(issue4)}`);
     }
     const warnings = Array.isArray(parsed.warnings) ? parsed.warnings : [];
     if (warnings.length > 0) {
       lines.push("", "Warnings:");
-      for (const issue3 of warnings) {
-        lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
+      for (const issue4 of warnings) {
+        lines.push(`  - ${formatGatewayPlanIssue(issue4)}`);
       }
     }
     lines.push(
@@ -26836,7 +27242,7 @@ import path83 from "node:path";
 
 // src/cli/deploy/gateway.ts
 import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile27 } from "node:fs/promises";
+import { readFile as readFile28 } from "node:fs/promises";
 init_invariant();
 var GatewayDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -26876,7 +27282,7 @@ async function readSpec(gateway) {
       "Add one to gateway.specs in the config."
     );
   try {
-    return await readFile27(file);
+    return await readFile28(file);
   } catch {
     throw new GatewayDeployError(
       "GATEWAY_SPEC_UNREADABLE",
@@ -27070,73 +27476,699 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
   };
 }
 
-// src/cli/portal/report.ts
-var DEPLOY_ORDER = [
-  "identity",
-  "gateway",
-  "plans",
-  "portal"
-];
-var exists4 = (file) => access13(file).then(
-  () => true,
-  () => false
-);
-function sectionOf(resolved, service) {
-  return resolved[service];
+// src/cli/deploy/identity.ts
+init_invariant();
+var IdentityDeployError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot deploy identity" });
+    this.code = code;
+    this.name = "IdentityDeployError";
+  }
+};
+var IDENTITY_STEPS = ["request", "activate"];
+var PORTAL_CALLBACK_PATH = "/oauth/callback";
+var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function identityNotDeployableReason(resolved) {
+  const identity = resolved.identity;
+  if (!identity) return "identity is not in the config";
+  if (identity.provider === "oidc" && (!identity.issuer || !identity.clientId))
+    return 'identity.provider "oidc" needs issuer and clientId';
+  return void 0;
 }
-function chooseServices(only) {
-  return DEPLOY_ORDER.filter((name) => !only || only.includes(name));
+function identityRequestBody(resolved, portalUrl) {
+  return {
+    portalRedirectUris: [
+      `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
+    ],
+    nativeSignup: resolved.identity?.native ?? true
+  };
 }
-async function planPortalService(resolved, ledger) {
-  const base = { service: "portal", details: [] };
-  try {
-    const manifest = await readManifest(resolved.state);
-    const prepared = await preparePortal(resolved, manifest, "production", {
-      write: false
-    });
-    const { profile, plan: plan2 } = prepared;
-    const details = [
-      `docs: ${!profile.docs.enabled ? "off" : profile.docs.provider === "external" ? `external (${profile.docs.url})` : "built by apitogo"}`,
-      `console: ${profile.console.enabled ? "on" : "off"}`,
-      `manifest: ${prepared.manifestSource === "file" ? "services.json" : "not needed"}`,
-      ...[
-        plan2.auth ? "sign-in" : void 0,
-        plan2.signup ? "sign-up" : void 0,
-        plan2.userPanel ? "account pages" : void 0,
-        plan2.plansPlugin ? "pricing, keys and usage pages" : void 0,
-        plan2.apiReference ? "API reference" : void 0
-      ].filter((feature) => feature !== void 0).map((feature) => `will appear: ${feature}`),
-      ...plan2.skipped.map((s) => `left out: ${s.piece} (${s.reason})`)
-    ];
-    const hash2 = await portalBuildHash(resolved, prepared);
-    const previous = stepOf(ledger, "portal", "build");
-    const built = await exists4(
-      path83.join(resolved.state.buildDir, "index.html")
+function identityInputsHash(projectId, body) {
+  return stableJson({ projectId, body });
+}
+async function portalUrlOf(resolved, projectId, client) {
+  const known = (await readManifest(resolved.state))?.services.portal?.url;
+  const url2 = known ?? resolveSwaUrl(await client.getProject(projectId));
+  if (!url2)
+    throw new IdentityDeployError(
+      "IDENTITY_PORTAL_ADDRESS_UNKNOWN",
+      "The portal has no public address yet, and the identity needs it for the sign-in redirect.",
+      "Run `apitogo deploy --only portal` once so the platform gives the portal an address, then deploy identity."
     );
-    if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
-      return {
-        ...base,
-        action: "skip",
-        reason: "build skipped: nothing it depends on has changed",
-        details,
-        issues: []
-      };
-    }
-    const reason = !previous ? "no earlier build" : previous.status === "failed" ? `the last build failed (${previous.error ?? "no message"})` : previous.status === "running" ? "the last build did not finish" : !built ? "the build folder is gone" : "its inputs changed since the last build";
-    return {
-      ...base,
-      action: "build",
-      reason: `will build: ${reason}`,
-      details,
-      issues: []
-    };
-  } catch (error) {
-    if (!(error instanceof ConfigError)) throw error;
-    return {
-      ...base,
-      action: "blocked",
-      reason: "cannot build until these are fixed",
-      details: [],
+  return url2;
+}
+function rejected2(error) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_SETTINGS_CHANGED",
+      "This project already has an identity with other settings, and its audience and portal address cannot be changed in place.",
+      "Keep the portal address as it was, or remove the identity first (this deletes every user in it)."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_REJECTED",
+      `The platform refused the identity request:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the cause in apitogo.config.json and run deploy again."
+    );
+  }
+  throw error;
+}
+async function recordOwnProvider(resolved, projectId) {
+  const identity = resolved.identity;
+  const issuer = identity?.issuer?.replace(/\/+$/, "");
+  const clientId = identity?.clientId;
+  if (!issuer || !clientId)
+    throw new Error("identity.issuer and identity.clientId are needed.");
+  const known = (await readManifest(resolved.state))?.services.identity;
+  const changed = known?.provider !== "oidc" || known.issuer !== issuer || known.clientId !== clientId;
+  if (changed)
+    await writeManifest(
+      resolved.state,
+      withIdentityEntry(await readManifest(resolved.state), {
+        projectId,
+        projectName: resolved.project.name,
+        provider: "oidc",
+        issuer,
+        clientId,
+        nativeSignup: false
+      })
+    );
+  return {
+    status: changed ? "deployed" : "unchanged",
+    steps: [],
+    issuer,
+    clientId
+  };
+}
+async function deployIdentity(resolved, projectId, deps, options = {}) {
+  if (resolved.identity?.provider === "oidc")
+    return recordOwnProvider(resolved, projectId);
+  const client = deps.client;
+  const sleep5 = deps.sleep ?? defaultSleep2;
+  const now = deps.now ?? Date.now;
+  const timeoutMs = deps.activateTimeoutMs ?? 12e4;
+  const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const portalUrl = await portalUrlOf(resolved, projectId, client);
+  const body = identityRequestBody(resolved, portalUrl);
+  const inputsHash = identityInputsHash(projectId, body);
+  const requestStep = {
+    name: "request",
+    hash: () => inputsHash,
+    run: async () => {
+      try {
+        const answer = await client.putProjectIdentity(projectId, body);
+        return { status: answer.status };
+      } catch (error) {
+        return rejected2(error);
+      }
+    },
+    // An identity that was removed, or that failed, is not a result worth keeping.
+    stillValid: async () => {
+      const found = await client.getProjectIdentity(projectId);
+      return found !== null && found.status !== "Failed" && found.status !== "Released" && found.status !== "Releasing";
+    }
+  };
+  const activateStep = {
+    name: "activate",
+    hash: () => inputsHash,
+    run: async () => {
+      const deadline = now() + timeoutMs;
+      for (; ; ) {
+        const found = await client.getProjectIdentity(projectId);
+        if (found?.status === "Active")
+          return {
+            issuer: found.issuer,
+            clientId: found.clientId,
+            audience: found.audience,
+            nativeSignup: String(found.nativeSignup)
+          };
+        if (found?.status === "Failed")
+          throw new IdentityDeployError(
+            "IDENTITY_FAILED",
+            `The platform could not make the identity: ${[found.errorCode, found.errorMessage].filter(Boolean).join(" ") || "it failed"}.`,
+            "Fix the cause and run deploy again; the request is sent again."
+          );
+        if (now() >= deadline)
+          throw new IdentityDeployError(
+            "IDENTITY_TIMEOUT",
+            `The identity did not become active within ${Math.round(timeoutMs / 1e3)} seconds (state: ${found?.status ?? "not found"}).`,
+            "Run deploy again to keep waiting."
+          );
+        await sleep5(intervalMs);
+      }
+    },
+    stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
+  };
+  const outcomes = await runPipeline(
+    resolved.state,
+    "identity",
+    [requestStep, activateStep],
+    { force: options.force }
+  );
+  const activate = outcomes.find((outcome) => outcome.step === "activate");
+  const ran = activate !== void 0 && !activate.skipped;
+  const known = (await readManifest(resolved.state))?.services.identity;
+  let learned;
+  if (ran || known?.issuer === void 0) {
+    learned = await client.getProjectIdentity(projectId) ?? void 0;
+    if (learned?.status === "Active") {
+      await writeManifest(
+        resolved.state,
+        withIdentityEntry(await readManifest(resolved.state), {
+          projectId,
+          projectName: resolved.project.name,
+          issuer: learned.issuer,
+          clientId: learned.clientId,
+          audience: learned.audience,
+          nativeSignup: learned.nativeSignup
+        })
+      );
+    }
+  }
+  return {
+    status: ran ? "deployed" : "unchanged",
+    steps: outcomes.map((outcome) => ({
+      step: outcome.step,
+      skipped: outcome.skipped
+    })),
+    issuer: learned?.issuer ?? known?.issuer,
+    clientId: learned?.clientId ?? known?.clientId
+  };
+}
+
+// src/cli/deploy/plans.ts
+init_invariant();
+var PlansDeployError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot deploy plans" });
+    this.code = code;
+    this.name = "PlansDeployError";
+  }
+};
+var PLANS_STEPS = ["catalog", "backend", "identity-link"];
+var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var BACKEND_MODULE = "dev-portal";
+var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
+async function plansInputs(resolved, projectId) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
+  const wanted = toPlatformPlans(await readPlansFile(plans.file));
+  const manifest = await readManifest(resolved.state);
+  const identity = manifest?.services.identity;
+  const ownIdentity = Boolean(
+    identity?.provider === "apitogo" && identity.issuer
+  );
+  return {
+    wanted,
+    manifest,
+    ownIdentity,
+    catalogHash: stableJson({ projectId, plans: wanted }),
+    backendHash: stableJson({ projectId }),
+    linkHash: stableJson({
+      projectId,
+      issuer: identity?.issuer,
+      clientId: identity?.clientId
+    })
+  };
+}
+function plansNotDeployableReason(resolved) {
+  return resolved.plans ? void 0 : "plans is not in the config";
+}
+async function allActionKeys(client, projectId) {
+  const keys = [];
+  try {
+    for (let page = 1; ; page++) {
+      const result = await client.listGatewayActions(projectId, page, 100);
+      keys.push(...result.items.map((item) => item.actionKey));
+      if (result.items.length === 0 || page * result.pageSize >= result.totalCount)
+        break;
+    }
+  } catch {
+    return [];
+  }
+  return keys;
+}
+function refused(error) {
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new PlansDeployError(
+      "PLANS_REJECTED",
+      `The platform refused a plan:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the plan in the plans file and run deploy again."
+    );
+  }
+  throw error;
+}
+async function deployPlans(resolved, projectId, deps, options = {}) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
+  const client = deps.client;
+  const sleep5 = deps.sleep ?? defaultSleep3;
+  const now = deps.now ?? Date.now;
+  const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
+  const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
+  const { wanted, manifest, ownIdentity, catalogHash, backendHash, linkHash } = await plansInputs(resolved, projectId);
+  const catalogStep = {
+    name: "catalog",
+    hash: () => catalogHash,
+    run: async () => {
+      if (wanted.length === 0) return { created: "0", updated: "0" };
+      const fallback = wanted.some((plan2) => plan2.includedActionKeys === null) ? await allActionKeys(client, projectId) : [];
+      const bodies = wanted.map((plan2) => ({
+        ...plan2,
+        includedActionKeys: plan2.includedActionKeys ?? fallback
+      }));
+      const checked = await client.validateGatewayPlans(bodies, { projectId });
+      if (!checked.valid)
+        throw new PlansDeployError(
+          "PLANS_REJECTED",
+          `The platform refused the plans:
+  ${checked.errors.map((issue4) => `${issue4.field}: ${issue4.message}`).join("\n  ")}`,
+          "Fix the listed problems in the plans file and run deploy again."
+        );
+      const existing = new Map(
+        (await client.listGatewayPlans(projectId)).map((plan2) => [
+          plan2.sku.toLowerCase(),
+          plan2
+        ])
+      );
+      let created = 0;
+      let updated = 0;
+      for (const body of bodies) {
+        const found = existing.get(body.sku);
+        try {
+          if (found) {
+            await client.updateGatewayPlan(projectId, found.id, {
+              displayName: body.displayName,
+              isActive: true,
+              limitsJson: body.limitsJson ?? null,
+              includedActionKeys: body.includedActionKeys,
+              priceAmount: body.priceAmount,
+              pricingModel: body.pricingModel,
+              priceLabel: body.priceLabel,
+              priceCurrency: body.priceCurrency,
+              billingPeriod: body.billingPeriod,
+              sortOrder: body.sortOrder
+            });
+            updated++;
+          } else {
+            await client.createGatewayPlan(projectId, body);
+            created++;
+          }
+        } catch (error) {
+          refused(error);
+        }
+      }
+      return { created: String(created), updated: String(updated) };
+    },
+    // A plan someone deleted on the platform is not a result worth keeping.
+    stillValid: async () => {
+      const present = new Set(
+        (await client.listGatewayPlans(projectId)).filter((plan2) => plan2.isActive).map((plan2) => plan2.sku.toLowerCase())
+      );
+      return wanted.every((plan2) => present.has(plan2.sku));
+    }
+  };
+  const backendOf = async () => (await client.getDevPortalBackend(projectId))?.fqdn;
+  const backendStep = {
+    name: "backend",
+    hash: () => backendHash,
+    run: async () => {
+      let fqdn = await backendOf();
+      if (!fqdn) {
+        await client.activateModule(projectId, BACKEND_MODULE);
+        const deadline = now() + backendTimeoutMs;
+        for (; ; ) {
+          fqdn = await backendOf();
+          if (fqdn) break;
+          if (now() >= deadline)
+            throw new PlansDeployError(
+              "PLANS_BACKEND_TIMEOUT",
+              `The plans backend did not get an address within ${Math.round(backendTimeoutMs / 1e3)} seconds.`,
+              "Run deploy again to keep waiting."
+            );
+          await sleep5(intervalMs);
+        }
+      }
+      return { fqdn };
+    },
+    stillValid: async () => Boolean(await backendOf())
+  };
+  const linkStep = {
+    name: "identity-link",
+    hash: () => linkHash,
+    run: async () => {
+      const queued = await client.linkDevPortalIdentity(projectId);
+      const deadline = now() + linkTimeoutMs;
+      for (; ; ) {
+        const job = (await client.listProvisioningJobs(projectId)).jobs.find(
+          (item) => item.id === queued.jobId
+        );
+        const status2 = job?.status.toLowerCase();
+        if (status2?.startsWith("completed")) return { jobId: queued.jobId };
+        if (status2 === "failed")
+          throw new PlansDeployError(
+            "PLANS_LINK_FAILED",
+            `Applying the identity to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
+            "Run deploy again; the link is applied again."
+          );
+        if (now() >= deadline)
+          throw new PlansDeployError(
+            "PLANS_LINK_TIMEOUT",
+            `Applying the identity did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
+            "Run deploy again to keep waiting."
+          );
+        await sleep5(intervalMs);
+      }
+    }
+  };
+  const steps = [catalogStep, backendStep, ...ownIdentity ? [linkStep] : []];
+  const outcomes = await runPipeline(
+    resolved.state,
+    "plans",
+    steps,
+    {
+      force: options.force
+    }
+  );
+  const catalog = outcomes.find((outcome) => outcome.step === "catalog");
+  const ran = outcomes.some((outcome) => !outcome.skipped);
+  const known = manifest?.services.plans;
+  let apiBaseUrl = known?.apiBaseUrl;
+  if (ran || known?.apiBaseUrl === void 0) {
+    apiBaseUrl = toApiBaseUrl(await backendOf()) ?? apiBaseUrl;
+    if (apiBaseUrl) {
+      const previous = known?.catalogRevision ?? 0;
+      await writeManifest(
+        resolved.state,
+        withPlansEntry(await readManifest(resolved.state), {
+          projectId,
+          projectName: resolved.project.name,
+          apiBaseUrl,
+          billing: plans.billing.provider,
+          catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
+          capabilities: PLANS_CAPABILITIES
+        })
+      );
+    }
+  }
+  return {
+    status: ran ? "deployed" : "unchanged",
+    steps: outcomes.map((outcome) => ({
+      step: outcome.step,
+      skipped: outcome.skipped
+    })),
+    apiBaseUrl
+  };
+}
+
+// src/cli/portal/services-report.ts
+function stepState(record, hash2) {
+  if (!record) return "not done yet";
+  if (record.status === "failed")
+    return `failed last time (${record.error ?? "no message"})`;
+  if (record.status === "running") return "did not finish last time";
+  if (hash2 === void 0)
+    return "done (cannot compare: an input is not known locally)";
+  return record.hash === hash2 ? "done, unchanged" : "inputs changed";
+}
+var isDone = (record, hash2) => record?.status === "succeeded" && hash2 !== void 0 && record.hash === hash2;
+async function planIdentityService(resolved, ledger, manifest) {
+  const base = { service: "identity", issues: [] };
+  const identity = resolved.identity;
+  if (!identity) throw new Error("identity is not configured");
+  const why = identityNotDeployableReason(resolved);
+  if (why)
+    return {
+      ...base,
+      action: "not-deployable-yet",
+      reason: `configured, but ${why}`,
+      details: []
+    };
+  const known = manifest?.services.identity;
+  if (identity.provider === "oidc") {
+    const same = known?.provider === "oidc" && known.issuer === identity.issuer?.replace(/\/+$/, "") && known.clientId === identity.clientId;
+    return {
+      ...base,
+      action: same ? "skip" : "deploy",
+      reason: same ? "deploy skipped: services.json already records your sign-in provider" : "will record your own sign-in provider in services.json (nothing is made on the platform)",
+      details: [
+        `provider: oidc ${identity.issuer}`,
+        `client id: ${identity.clientId}`
+      ]
+    };
+  }
+  const projectId = resolved.project.id;
+  const portalUrl = manifest?.services.portal?.url;
+  const body = portalUrl ? identityRequestBody(resolved, portalUrl) : void 0;
+  const hash2 = projectId && body ? identityInputsHash(projectId, body) : void 0;
+  const details = [
+    "provider: apitogo (one issuer for this project)",
+    `sign-up with email and password: ${identity.native ? "on" : "off"}`,
+    portalUrl ? `sign-in redirect: ${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}` : "sign-in redirect: the portal address is not known locally; deploy takes it from the project",
+    ...known?.issuer ? [`issuer: ${known.issuer}`] : [],
+    ...IDENTITY_STEPS.map(
+      (name) => `step ${name}: ${stepState(stepOf(ledger, "identity", name), hash2)}`
+    )
+  ];
+  const allDone = IDENTITY_STEPS.every(
+    (name) => isDone(stepOf(ledger, "identity", name), hash2)
+  );
+  return {
+    ...base,
+    action: allDone ? "skip" : "deploy",
+    reason: allDone ? "deploy skipped: nothing it depends on has changed" : "will deploy: the identity is not made yet, or its settings changed",
+    details
+  };
+}
+async function planPlansService(resolved, ledger) {
+  const base = { service: "plans", issues: [] };
+  const why = plansNotDeployableReason(resolved);
+  if (why)
+    return {
+      ...base,
+      action: "not-deployable-yet",
+      reason: `configured, but ${why}`,
+      details: []
+    };
+  const projectId = resolved.project.id ?? "";
+  let inputs;
+  try {
+    inputs = await plansInputs(resolved, projectId);
+  } catch (error) {
+    if (!(error instanceof PlansFileError)) throw error;
+    return {
+      ...base,
+      action: "blocked",
+      reason: "cannot deploy until this is fixed",
+      details: [],
+      issues: [
+        {
+          code: error.code,
+          path: "plans.file",
+          message: error.message,
+          hint: error.developerHint
+        }
+      ]
+    };
+  }
+  const hashes = {
+    catalog: projectId ? inputs.catalogHash : void 0,
+    backend: projectId ? inputs.backendHash : void 0,
+    "identity-link": projectId ? inputs.linkHash : void 0
+  };
+  const steps = PLANS_STEPS.filter(
+    (name) => name !== "identity-link" || inputs.ownIdentity
+  );
+  const details = [
+    ...inputs.wanted.length === 0 ? ["plans: none in the file"] : inputs.wanted.map((plan2) => `plan ${plan2.sku}: ${plan2.displayName}`),
+    inputs.ownIdentity ? "sign-in: the project's identity will be applied to the plans backend" : "sign-in: no identity of the platform deployed, so nothing is applied to the plans backend",
+    ...steps.map(
+      (name) => `step ${name}: ${stepState(stepOf(ledger, "plans", name), hashes[name])}`
+    )
+  ];
+  const allDone = steps.every(
+    (name) => isDone(stepOf(ledger, "plans", name), hashes[name])
+  );
+  return {
+    ...base,
+    action: allDone ? "skip" : "deploy",
+    reason: allDone ? "deploy skipped: nothing it depends on has changed" : "will deploy: the plans file, the backend or the identity is not applied yet",
+    details
+  };
+}
+var failedStep = (ledger, service, names) => names.map((name) => ({ name, record: stepOf(ledger, service, name) })).find((step2) => step2.record?.status === "failed");
+var unreachable = (error) => `platform: not reachable (${error instanceof Error ? error.message : String(error)}); showing local records only`;
+async function identityStatus(resolved, ledger, manifest, remote) {
+  const entry = manifest?.services.identity;
+  const failed = failedStep(ledger, "identity", IDENTITY_STEPS);
+  const details = [];
+  if (entry?.provider) details.push(`provider: ${entry.provider}`);
+  if (entry?.issuer) details.push(`issuer: ${entry.issuer}`);
+  if (entry?.clientId) details.push(`client id: ${entry.clientId}`);
+  let state = entry ? "ready" : "not-deployed";
+  const projectId = resolved.project.id ?? manifest?.project.id;
+  if (resolved.identity?.provider === "oidc") {
+    details.push("platform: nothing to ask (your own sign-in provider)");
+  } else if (remote && projectId) {
+    try {
+      const platform = await remote(projectId);
+      if (!platform) {
+        details.push("platform: no identity for this project yet");
+        if (entry) state = "drift";
+      } else {
+        details.push(
+          `platform state: ${platform.status}`,
+          `sign-up with email and password: ${platform.nativeSignup ? "on" : "off"}`,
+          `sign-in redirect: ${platform.portalRedirectUris.join(", ") || "none"}`
+        );
+        if (platform.status === "Failed")
+          details.push(
+            `platform problem: ${[platform.errorCode, platform.errorMessage].filter(Boolean).join(" ") || "no message"}`
+          );
+        const same = entry?.issuer === platform.issuer.replace(/\/+$/, "");
+        if (entry && (!same || platform.status !== "Active")) {
+          details.push(
+            "drift: services.json does not match the platform's identity"
+          );
+          state = "drift";
+        }
+      }
+    } catch (error) {
+      details.push(unreachable(error));
+    }
+  } else if (!projectId) {
+    details.push("platform: not asked, this folder is not linked to a project");
+  } else {
+    details.push("platform: not asked, you are not logged in");
+  }
+  if (failed) {
+    details.push(`error: ${failed.record?.error ?? "unknown"}`);
+    state = "deploy-failed";
+  }
+  return { service: "identity", state, details };
+}
+async function plansStatus(resolved, ledger, manifest, remote, wantedSkus2) {
+  const entry = manifest?.services.plans;
+  const failed = failedStep(ledger, "plans", PLANS_STEPS);
+  const details = [];
+  if (entry?.apiBaseUrl) details.push(`plans backend: ${entry.apiBaseUrl}`);
+  if (entry?.catalogRevision !== void 0)
+    details.push(`catalog revision: ${entry.catalogRevision}`);
+  let state = entry ? "ready" : "not-deployed";
+  const projectId = resolved.project.id ?? manifest?.project.id;
+  if (remote && projectId) {
+    try {
+      const platform = await remote(projectId);
+      const active2 = platform.plans.filter((plan2) => plan2.isActive).map((plan2) => plan2.sku.toLowerCase());
+      details.push(
+        `plans on the platform: ${active2.length > 0 ? active2.join(", ") : "none"}`
+      );
+      const missing = (wantedSkus2 ?? []).filter((sku) => !active2.includes(sku));
+      if (missing.length > 0) {
+        details.push(
+          `drift: plans in the file but not on the platform: ${missing.join(", ")}`
+        );
+        if (entry) state = "drift";
+      }
+      if (!platform.backendAddress) {
+        details.push("platform: the plans backend has no address");
+        if (entry) state = "drift";
+      } else if (entry?.apiBaseUrl && entry.apiBaseUrl !== platform.backendAddress.replace(/\/+$/, "")) {
+        details.push(
+          `drift: the plans backend is at ${platform.backendAddress}, services.json says ${entry.apiBaseUrl}`
+        );
+        state = "drift";
+      }
+    } catch (error) {
+      details.push(
+        error instanceof PlatformApiError && error.status === 404 ? "platform: no plans for this project yet" : unreachable(error)
+      );
+    }
+  } else if (!projectId) {
+    details.push("platform: not asked, this folder is not linked to a project");
+  } else {
+    details.push("platform: not asked, you are not logged in");
+  }
+  if (failed) {
+    details.push(`error: ${failed.record?.error ?? "unknown"}`);
+    state = "deploy-failed";
+  }
+  return { service: "plans", state, details };
+}
+
+// src/cli/portal/report.ts
+var DEPLOY_ORDER = [
+  "identity",
+  "gateway",
+  "plans",
+  "portal"
+];
+var exists4 = (file) => access13(file).then(
+  () => true,
+  () => false
+);
+function sectionOf(resolved, service) {
+  return resolved[service];
+}
+function chooseServices(only) {
+  return DEPLOY_ORDER.filter((name) => !only || only.includes(name));
+}
+async function planPortalService(resolved, ledger) {
+  const base = { service: "portal", details: [] };
+  try {
+    const manifest = await readManifest(resolved.state);
+    const prepared = await preparePortal(resolved, manifest, "production", {
+      write: false
+    });
+    const { profile, plan: plan2 } = prepared;
+    const details = [
+      `docs: ${!profile.docs.enabled ? "off" : profile.docs.provider === "external" ? `external (${profile.docs.url})` : "built by apitogo"}`,
+      `console: ${profile.console.enabled ? "on" : "off"}`,
+      `manifest: ${prepared.manifestSource === "file" ? "services.json" : "not needed"}`,
+      ...[
+        plan2.auth ? "sign-in" : void 0,
+        plan2.signup ? "sign-up" : void 0,
+        plan2.userPanel ? "account pages" : void 0,
+        plan2.plansPlugin ? "pricing, keys and usage pages" : void 0,
+        plan2.apiReference ? "API reference" : void 0
+      ].filter((feature) => feature !== void 0).map((feature) => `will appear: ${feature}`),
+      ...plan2.skipped.map((s) => `left out: ${s.piece} (${s.reason})`)
+    ];
+    const hash2 = await portalBuildHash(resolved, prepared);
+    const previous = stepOf(ledger, "portal", "build");
+    const built = await exists4(
+      path83.join(resolved.state.buildDir, "index.html")
+    );
+    if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
+      return {
+        ...base,
+        action: "skip",
+        reason: "build skipped: nothing it depends on has changed",
+        details,
+        issues: []
+      };
+    }
+    const reason = !previous ? "no earlier build" : previous.status === "failed" ? `the last build failed (${previous.error ?? "no message"})` : previous.status === "running" ? "the last build did not finish" : !built ? "the build folder is gone" : "its inputs changed since the last build";
+    return {
+      ...base,
+      action: "build",
+      reason: `will build: ${reason}`,
+      details,
+      issues: []
+    };
+  } catch (error) {
+    if (!(error instanceof ConfigError)) throw error;
+    return {
+      ...base,
+      action: "blocked",
+      reason: "cannot build until these are fixed",
+      details: [],
       issues: [...error.issues]
     };
   }
@@ -27310,21 +28342,20 @@ async function planV2(dir, only, options = {}) {
       services.push(
         await planGatewayService(resolved, ledger, options.gatewayDryRun)
       );
+    } else if (service === "identity") {
+      services.push(
+        await planIdentityService(
+          resolved,
+          ledger,
+          await readManifest(resolved.state)
+        )
+      );
     } else {
-      services.push({
-        service,
-        action: "not-deployable-yet",
-        reason: "configured; deploying it is not available in this CLI version yet",
-        details: [],
-        issues: []
-      });
+      services.push(await planPlansService(resolved, ledger));
     }
   }
   return { configPath: resolved.configPath, services };
 }
-function entryStatus(manifest, service) {
-  return manifest?.services[service];
-}
 function originHealthLines(origin) {
   if (!origin.lastProbeAtUtc) return ["origin check: not checked yet"];
   return [
@@ -27398,6 +28429,16 @@ async function gatewayStatus(resolved, ledger, manifest, remote) {
   if (failed) state = "deploy-failed";
   return { service: "gateway", state, details: [...details, ...local] };
 }
+async function wantedSkus(resolved) {
+  if (!resolved.plans) return void 0;
+  try {
+    return (await readPlansFile(resolved.plans.file)).map(
+      (plan2) => plan2.sku.trim().toLowerCase()
+    );
+  } catch {
+    return void 0;
+  }
+}
 async function statusV2(dir, only, options = {}) {
   const { resolved } = loadConfigV2(dir);
   const ledger = await readLedger(resolved.state);
@@ -27413,7 +28454,6 @@ async function statusV2(dir, only, options = {}) {
       services.push({ service, state: "disabled", details: [] });
       continue;
     }
-    const entry = entryStatus(manifest, service);
     const url2 = service === "portal" ? manifest?.services.portal?.url : void 0;
     if (service === "portal") {
       const build2 = stepOf(ledger, "portal", "build");
@@ -27442,14 +28482,26 @@ async function statusV2(dir, only, options = {}) {
       );
       continue;
     }
-    services.push({
-      service,
-      state: entry ? "ready" : "not-deployed",
-      details: entry ? [
-        `status: ${entry.status ?? "ready"}`,
-        ...entry.provider ? [`provider: ${entry.provider}`] : []
-      ] : ["not in services.json: not deployed yet"]
-    });
+    if (service === "identity") {
+      services.push(
+        await identityStatus(
+          resolved,
+          ledger,
+          manifest,
+          options.identityRemote
+        )
+      );
+      continue;
+    }
+    services.push(
+      await plansStatus(
+        resolved,
+        ledger,
+        manifest,
+        options.plansRemote,
+        await wantedSkus(resolved)
+      )
+    );
   }
   return {
     configPath: resolved.configPath,
@@ -27466,7 +28518,7 @@ function formatPlan(output4) {
     `${svc.service}: ${svc.reason}`,
     ...svc.details.map((line2) => `  ${line2}`),
     ...svc.issues.map(
-      (issue3) => `  problem: ${issue3.message}${issue3.hint ? ` ${issue3.hint}` : ""} [${issue3.code}]`
+      (issue4) => `  problem: ${issue4.message}${issue4.hint ? ` ${issue4.hint}` : ""} [${issue4.code}]`
     )
   ]);
 }
@@ -27563,19 +28615,14 @@ async function deployV2(options, deps) {
       results.push(await deployGatewayService(options, deps, projectId, named));
       continue;
     }
-    if (service !== "portal") {
-      if (named)
-        throw new DeployError(
-          "SERVICE_NOT_DEPLOYABLE",
-          `Deploying ${service} is not available in this CLI version yet.`,
-          "Only the portal and the gateway can be deployed for now."
-        );
-      results.push({
-        service,
-        status: "skipped",
-        reason: "deploying it is not available in this CLI version yet",
-        steps: []
-      });
+    if (service === "identity") {
+      results.push(
+        await deployIdentityService(options, deps, projectId, named)
+      );
+      continue;
+    }
+    if (service === "plans") {
+      results.push(await deployPlansService(options, deps, projectId, named));
       continue;
     }
     results.push(await deployPortal(options, deps, projectId));
@@ -27619,6 +28666,65 @@ async function deployGatewayService(options, deps, projectId, named) {
     operationCount: result.operationCount
   };
 }
+async function deployIdentityService(options, deps, projectId, named) {
+  const { resolved } = loadConfigV2(options.dir);
+  const why = identityNotDeployableReason(resolved);
+  if (why) {
+    if (named)
+      throw new DeployError(
+        "SERVICE_NOT_DEPLOYABLE",
+        `Identity cannot be deployed: ${why}.`,
+        "Fix the identity section of the config, or deploy another service."
+      );
+    return { service: "identity", status: "skipped", reason: why, steps: [] };
+  }
+  const client = deps.client;
+  if (resolved.identity?.provider !== "oidc" && (!client.putProjectIdentity || !client.getProjectIdentity || !client.getProject))
+    throw new Error("The platform client has no identity calls.");
+  const result = await deployIdentity(
+    resolved,
+    projectId,
+    {
+      ...deps.identity,
+      client
+    },
+    { force: options.force }
+  );
+  return {
+    service: "identity",
+    status: result.status,
+    steps: result.steps,
+    url: result.issuer
+  };
+}
+async function deployPlansService(options, deps, projectId, named) {
+  const { resolved } = loadConfigV2(options.dir);
+  const why = plansNotDeployableReason(resolved);
+  if (why) {
+    if (named)
+      throw new DeployError(
+        "SERVICE_NOT_DEPLOYABLE",
+        `Plans cannot be deployed: ${why}.`,
+        "Add them with `apitogo add plans`, or deploy another service."
+      );
+    return { service: "plans", status: "skipped", reason: why, steps: [] };
+  }
+  const client = deps.client;
+  if (!client.listGatewayPlans || !client.createGatewayPlan || !client.updateGatewayPlan || !client.validateGatewayPlans || !client.listGatewayActions || !client.getDevPortalBackend || !client.activateModule || !client.linkDevPortalIdentity || !client.listProvisioningJobs)
+    throw new Error("The platform client has no plans calls.");
+  const result = await deployPlans(
+    resolved,
+    projectId,
+    { ...deps.plans, client },
+    { force: options.force }
+  );
+  return {
+    service: "plans",
+    status: result.status,
+    steps: result.steps,
+    url: result.apiBaseUrl
+  };
+}
 async function deployPortal(options, deps, projectId) {
   const { resolved, root, prepared } = await preparePortalWorkspace(
     options.dir,
@@ -27882,11 +28988,11 @@ var export_default = {
 import path90 from "node:path";
 
 // src/cli/scaffold/run-scaffold-discovery.ts
-import { access as access15, readFile as readFile30, writeFile as writeFile27 } from "node:fs/promises";
+import { access as access15, readFile as readFile31, writeFile as writeFile27 } from "node:fs/promises";
 import path89 from "node:path";
 
 // src/cli/scaffold/detect-backend.ts
-import { readdir as readdir4, readFile as readFile28 } from "node:fs/promises";
+import { readdir as readdir4, readFile as readFile29 } from "node:fs/promises";
 import path87 from "node:path";
 var DEFAULT_RUNTIME_VERSION = {
   dotnet: "DOTNET_10",
@@ -27904,7 +29010,7 @@ async function listFiles(directory) {
 }
 async function readText(filePath) {
   try {
-    return await readFile28(filePath, "utf8");
+    return await readFile29(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -27990,7 +29096,7 @@ import {
   lstat as lstat2,
   mkdir as mkdir21,
   readdir as readdir5,
-  readFile as readFile29,
+  readFile as readFile30,
   readlink,
   symlink as symlink2,
   writeFile as writeFile26
@@ -28221,7 +29327,7 @@ async function applyDocsNavigation(siteDirectory, routes) {
   if (!await pathExists5(configPath)) {
     return;
   }
-  const raw = await readFile29(configPath, "utf8");
+  const raw = await readFile30(configPath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject5(parsed)) {
     return;
@@ -28406,7 +29512,7 @@ async function pathExists6(filePath) {
 async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   const input5 = toSiteRelativeOpenApiInput(siteDirectory, openApiPath);
   const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
-  const raw = await readFile30(jsonConfigPath, "utf8");
+  const raw = await readFile31(jsonConfigPath, "utf8");
   const siteConfig = JSON.parse(raw);
   const updated = applyOpenApiToSiteConfig(siteConfig, {
     input: input5,
@@ -28433,7 +29539,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
   const invalidCandidates = [];
   let selected;
   for (const candidate of search.candidates) {
-    const content = await readFile30(candidate, "utf8");
+    const content = await readFile31(candidate, "utf8");
     const parsed = liteParseOpenApi(content, candidate);
     if (parsed.valid) {
       selected = {
@@ -28513,7 +29619,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
   }
   try {
     const siteConfig = JSON.parse(
-      await readFile30(jsonConfigPath, "utf8")
+      await readFile31(jsonConfigPath, "utf8")
     );
     const existing = siteConfig.backend && typeof siteConfig.backend === "object" && !Array.isArray(siteConfig.backend) ? siteConfig.backend : {};
     if (typeof existing.sourceDirectory === "string" && existing.sourceDirectory.trim()) {
@@ -29019,10 +30125,35 @@ function gatewayDryRun() {
     return void 0;
   }
 }
+function identityRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId) => client.getProjectIdentity(projectId);
+  } catch {
+    return void 0;
+  }
+}
+function plansRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return async (projectId) => ({
+      plans: await client.listGatewayPlans(projectId),
+      backendAddress: toApiBaseUrl(
+        (await client.getDevPortalBackend(projectId))?.fqdn
+      )
+    });
+  } catch {
+    return void 0;
+  }
+}
 var statusOfProject = (argv) => run2(
   "status",
   argv,
-  (dir, only) => statusV2(dir, only, { gatewayRemote: gatewayRemote() }),
+  (dir, only) => statusV2(dir, only, {
+    gatewayRemote: gatewayRemote(),
+    identityRemote: identityRemote(),
+    plansRemote: plansRemote()
+  }),
   formatStatus
 );
 
@@ -29069,13 +30200,7 @@ function modulesForConfig(config2) {
 var hostsAnything = (config2) => config2.portal && config2.portal.enabled !== false || config2.gateway && config2.gateway.enabled !== false;
 async function createProjectV2(options, deps) {
   const { config: config2, resolved } = loadConfigV2(options.dir);
-  if (resolved.project.id) {
-    throw new ProjectCreateError(
-      "ALREADY_LINKED",
-      `This folder is already linked to project ${resolved.project.id}.`,
-      "Run `apitogo deploy`. To start over, run `apitogo teardown` first."
-    );
-  }
+  const linkedProjectId = resolved.project.id;
   const modules = modulesForConfig(config2);
   if (!hostsAnything(config2)) {
     throw new ProjectCreateError(
@@ -29089,7 +30214,9 @@ async function createProjectV2(options, deps) {
     name,
     description: options.description,
     modules,
-    wait: options.wait !== false
+    wait: options.wait !== false,
+    projectId: linkedProjectId,
+    onProjectResolved: (projectId) => setProjectId(options.dir, projectId)
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {
@@ -29162,7 +30289,9 @@ async function createLinkedProject(argv, dir) {
             modules: args.modules,
             selectFreePlan: true,
             wait: args.wait,
-            configureGatewayBaseline: false
+            configureGatewayBaseline: false,
+            projectId: args.projectId,
+            onProjectResolved: args.onProjectResolved
           },
           json ? void 0 : progress
         )
@@ -30090,12 +31219,14 @@ var TeardownError = class extends ApitogoError {
 };
 async function teardownV2(options, deps) {
   if (options.only) {
-    if (options.only.trim() === "gateway")
-      return teardownGateway(options, deps);
+    const only = options.only.trim();
+    if (only === "gateway") return teardownGateway(options, deps);
+    if (only === "identity") return teardownIdentity(options, deps);
+    if (only === "plans") return teardownPlans(options, deps);
     throw new TeardownError(
       "PARTIAL_TEARDOWN_UNSUPPORTED",
       "The platform cannot release the hosting of one service on its own: it is released by deleting the project.",
-      "Run `apitogo teardown` without --only to delete the whole project, or `apitogo teardown --only gateway` to remove just the gateway. Your local files are kept."
+      "Run `apitogo teardown` without --only to delete the whole project, or `apitogo teardown --only gateway`, `--only identity` or `--only plans` to remove just that service. Your local files are kept."
     );
   }
   const { resolved } = loadConfigV2(options.dir);
@@ -30275,6 +31406,148 @@ Type the project name to confirm: `
     message: "The gateway was removed. The project and your local files are kept."
   };
 }
+function projectIdOf(options, deps, resolved, what) {
+  const projectId = options.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim() || "";
+  if (!projectId) {
+    throw new TeardownError(
+      "PROJECT_REQUIRED",
+      `This folder is not linked to a project, so there is no ${what} to remove.`,
+      "Pass --project-id <id> to name the project."
+    );
+  }
+  return projectId;
+}
+async function confirmByName(options, deps, name, prompt, what) {
+  if (options.yes === true) return;
+  if (!deps.isTerminal) {
+    throw new TeardownError(
+      "CONFIRMATION_REQUIRED",
+      "This is not an interactive terminal.",
+      `Pass --yes to remove the ${what} without asking.`
+    );
+  }
+  const typed = await deps.askName(prompt);
+  if (typed.trim() !== name) {
+    throw new TeardownError(
+      "CANCELLED",
+      "The name did not match. Nothing was removed."
+    );
+  }
+}
+async function clearService(resolved, service) {
+  const cleared = [];
+  const ledger = await readLedger(resolved.state);
+  if (ledger.services[service]) {
+    await clearServices(resolved.state, [service]);
+    cleared.push(`state.json entries of ${service}`);
+  }
+  if ((await readManifest(resolved.state))?.services[service]) {
+    await removeServicesFromManifest(resolved.state, [service]);
+    cleared.push(`the ${service} entry of services.json`);
+  }
+  return cleared;
+}
+async function teardownIdentity(options, deps) {
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = projectIdOf(options, deps, resolved, "identity");
+  const client = deps.client;
+  if (!client.getProjectIdentity || !client.deleteProjectIdentity)
+    throw new Error("The platform client has no identity calls.");
+  const project = await client.getProject(projectId);
+  const name = project.name;
+  const current = await client.getProjectIdentity(projectId);
+  if (!current || current.status === "Released")
+    throw new TeardownError(
+      "IDENTITY_NOT_DEPLOYED",
+      "The platform has no identity for this project.",
+      "There is nothing to remove. Clear stale local records by deleting the identity entries in the state folder."
+    );
+  await confirmByName(
+    options,
+    deps,
+    name,
+    `This removes the identity of project "${name}" (${projectId}) and DELETES EVERY USER in it, for good. Nobody can sign in to the portal or the API until a new identity is made. The project, the portal and the gateway stay.
+Type the project name to confirm: `,
+    "identity"
+  );
+  const answer = await client.deleteProjectIdentity(projectId);
+  if (answer !== null) {
+    const sleep5 = deps.identity?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = Date.now() + (options.wait === false ? 0 : deps.identity?.timeoutMs ?? 12e4);
+    for (; ; ) {
+      const state = await client.getProjectIdentity(projectId);
+      if (state === null || state.status === "Released") break;
+      if (state.status === "Failed")
+        throw new TeardownError(
+          "DELETE_FAILED",
+          `The platform could not remove the identity: ${[state.errorCode, state.errorMessage].filter(Boolean).join(" ") || state.status}.`,
+          "Nothing local was changed. Try again, or contact support with the project id."
+        );
+      if (Date.now() >= deadline) {
+        return {
+          projectId,
+          projectName: name,
+          status: "pending",
+          cleared: [],
+          message: "The identity is queued for removal and the platform finishes it in the background. Local records are kept until then: run `apitogo teardown --only identity` again later to clear them."
+        };
+      }
+      await sleep5(deps.identity?.pollIntervalMs ?? 2e3);
+    }
+  }
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    scope: "identity",
+    cleared: await clearService(resolved, "identity"),
+    message: "The identity and its users were removed. The project and your local files are kept."
+  };
+}
+async function teardownPlans(options, deps) {
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = projectIdOf(options, deps, resolved, "plans");
+  const client = deps.client;
+  if (!client.listGatewayPlans || !client.deleteGatewayPlan)
+    throw new Error("The platform client has no plans calls.");
+  const project = await client.getProject(projectId);
+  const name = project.name;
+  const plans = await client.listGatewayPlans(projectId);
+  if (plans.length === 0)
+    throw new TeardownError(
+      "PLANS_NOT_DEPLOYED",
+      "The platform has no plans for this project.",
+      "There is nothing to remove. Clear stale local records by deleting the plans entries in the state folder."
+    );
+  await confirmByName(
+    options,
+    deps,
+    name,
+    `This removes the plans (${plans.map((plan2) => plan2.sku).join(", ")}) of project "${name}" (${projectId}). Customers' subscriptions and API keys on them stop working. The plans backend stays: it is released with the project.
+Type the project name to confirm: `,
+    "plans"
+  );
+  for (const plan2 of plans) {
+    try {
+      await client.deleteGatewayPlan(projectId, plan2.id);
+    } catch (error) {
+      if (error instanceof PlatformApiError && error.status === 404) continue;
+      throw new TeardownError(
+        "DELETE_FAILED",
+        `The platform could not remove the plan "${plan2.sku}": ${error instanceof Error ? error.message : String(error)}.`,
+        "Plans removed before it are gone. Nothing local was changed; run the command again after fixing the cause."
+      );
+    }
+  }
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    scope: "plans",
+    cleared: await clearService(resolved, "plans"),
+    message: "The plans were removed. The plans backend, the project and your local files are kept."
+  };
+}
 
 // src/cli/teardown/command.ts
 async function ask3(prompt) {
@@ -30324,7 +31597,7 @@ async function teardownProject(argv) {
       return;
     }
     printDiagnosticsToConsole(
-      result.scope === "gateway" ? `Removed the gateway of project ${result.projectName} (${result.projectId}).` : `${result.status === "removed" ? "Deleted" : "Queued deletion of"} project ${result.projectName} (${result.projectId}).`
+      result.scope === "gateway" || result.scope === "identity" || result.scope === "plans" ? `Removed the ${result.scope} of project ${result.projectName} (${result.projectId}).` : `${result.status === "removed" ? "Deleted" : "Queued deletion of"} project ${result.projectName} (${result.projectId}).`
     );
     if (result.cleared.length > 0)
       printDiagnosticsToConsole(
@@ -30429,7 +31702,7 @@ var teardown_default = {
     describe: "Override project GUID"
   }).option("only", {
     type: "string",
-    describe: "Config version 2: only `gateway` is supported (removes the gateway, keeps the project); other hosting is released only by deleting the whole project"
+    describe: "Config version 2: `gateway`, `identity` or `plans` removes just that service and keeps the project (`identity` deletes every user in it); other hosting is released only by deleting the whole project"
   }).option("yes", {
     alias: "y",
     type: "boolean",