@lukoweb/apitogo 0.2.21 → 0.2.23

package/dist/cli/cli.js

@@ -836,7 +836,7 @@ import { stat as stat4 } from "node:fs/promises";
 var fileExists;
 var init_file_exists = __esm({
   "src/config/file-exists.ts"() {
-    fileExists = (path103) => stat4(path103).then(() => true).catch(() => false);
+    fileExists = (path104) => stat4(path104).then(() => true).catch(() => false);
   }
 });
 
@@ -5814,19 +5814,19 @@ import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/config/v2/errors.ts
 init_invariant();
-function formatConfigIssue(issue3) {
-  const hint = issue3.hint ? ` ${issue3.hint}` : "";
-  const rest = issue3.message.slice(issue3.path.length);
-  const startsWithPath = issue3.path !== "" && issue3.message.startsWith(issue3.path) && (rest === "" || /^[\s:]/.test(rest));
-  const text = startsWithPath ? issue3.message : `${issue3.path === "" ? "(root)" : issue3.path}: ${issue3.message}`;
-  return `${text}${hint} [${issue3.code}]`;
+function formatConfigIssue(issue4) {
+  const hint = issue4.hint ? ` ${issue4.hint}` : "";
+  const rest = issue4.message.slice(issue4.path.length);
+  const startsWithPath = issue4.path !== "" && issue4.message.startsWith(issue4.path) && (rest === "" || /^[\s:]/.test(rest));
+  const text = startsWithPath ? issue4.message : `${issue4.path === "" ? "(root)" : issue4.path}: ${issue4.message}`;
+  return `${text}${hint} [${issue4.code}]`;
 }
 var ConfigError = class extends ApitogoError {
   issues;
   constructor(file, issues) {
     super(
       `${file} has ${issues.length} problem${issues.length === 1 ? "" : "s"}:
-${issues.map((issue3) => `  - ${formatConfigIssue(issue3)}`).join("\n")}`,
+${issues.map((issue4) => `  - ${formatConfigIssue(issue4)}`).join("\n")}`,
       { title: "Invalid apitogo config" }
     );
     this.name = "ConfigError";
@@ -6189,8 +6189,8 @@ var ConfigV2Schema = z.strictObject({
 var REMOVED_KEYS = {
   "plans.provider": "plans.provider was removed. Only plans.billing.provider (stripe or none) is selectable."
 };
-function pathToString(path103) {
-  return path103.reduce(
+function pathToString(path104) {
+  return path104.reduce(
     (acc, segment) => typeof segment === "number" ? `${acc}[${segment}]` : acc === "" ? String(segment) : `${acc}.${String(segment)}`,
     ""
   );
@@ -6210,9 +6210,9 @@ function step(schema2, segment) {
   }
   return void 0;
 }
-function knownKeysAt(path103) {
+function knownKeysAt(path104) {
   let current = ConfigV2Schema;
-  for (const segment of path103) {
+  for (const segment of path104) {
     if (!current) return [];
     current = step(current, segment);
   }
@@ -6247,37 +6247,37 @@ function unknownKeyHint(fullPath, key, known) {
   if (closest) return `Did you mean "${closest.candidate}"?`;
   return known.length > 0 ? `Allowed keys: ${known.join(", ")}.` : void 0;
 }
-function mapIssue(issue3) {
-  const path103 = pathToString(issue3.path);
-  switch (issue3.code) {
+function mapIssue(issue4) {
+  const path104 = pathToString(issue4.path);
+  switch (issue4.code) {
     case "unrecognized_keys":
-      return issue3.keys.map((key) => {
-        const fullPath = pathToString([...issue3.path, key]);
+      return issue4.keys.map((key) => {
+        const fullPath = pathToString([...issue4.path, key]);
         return {
           code: "CONFIG_UNKNOWN_KEY",
           path: fullPath,
           message: `Unknown key "${key}".`,
-          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue3.path))
+          hint: unknownKeyHint(fullPath, key, knownKeysAt(issue4.path))
         };
       });
     case "invalid_value":
       return [
         {
           code: "CONFIG_INVALID_VALUE",
-          path: path103,
-          message: `must be one of: ${issue3.values.map((v) => JSON.stringify(v)).join(", ")}.`
+          path: path104,
+          message: `must be one of: ${issue4.values.map((v) => JSON.stringify(v)).join(", ")}.`
         }
       ];
     case "custom": {
-      const code = typeof issue3.params?.code === "string" ? issue3.params.code : "CONFIG_INVALID_VALUE";
-      return [{ code, path: path103, message: issue3.message ?? "is invalid." }];
+      const code = typeof issue4.params?.code === "string" ? issue4.params.code : "CONFIG_INVALID_VALUE";
+      return [{ code, path: path104, message: issue4.message ?? "is invalid." }];
     }
     case "invalid_type":
       return [
-        /received undefined/.test(issue3.message) ? { code: "CONFIG_MISSING_FIELD", path: path103, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path103, message: issue3.message }
+        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path104, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path104, message: issue4.message }
       ];
     default:
-      return [{ code: "CONFIG_INVALID_VALUE", path: path103, message: issue3.message }];
+      return [{ code: "CONFIG_INVALID_VALUE", path: path104, message: issue4.message }];
   }
 }
 function isRecord(value) {
@@ -6727,7 +6727,7 @@ function dependencyRules(config2, resolved, out) {
 function checkDependencies(config2, resolved) {
   const issues = [];
   dependencyRules(config2, resolved, {
-    error: (issue3) => void issues.push(issue3),
+    error: (issue4) => void issues.push(issue4),
     warn: () => void 0
   });
   return issues;
@@ -7197,8 +7197,8 @@ async function checkConfigV2(config2, resolved, context = {}) {
     "online rules were not run (provider capabilities, origin reachability, OIDC discovery, tier limits)"
   ];
   const out = {
-    error: (issue3) => errors.push(issue3),
-    warn: (issue3) => warnings.push(issue3)
+    error: (issue4) => errors.push(issue4),
+    warn: (issue4) => warnings.push(issue4)
   };
   dependencyRules(config2, resolved, out);
   secretRules(config2, context, out, skipped);
@@ -7301,7 +7301,7 @@ var ServiceManifestSchema = z3.looseObject({
     }).optional()
   }).default({})
 });
-var issue = (code, path103, message, hint) => ({ code, path: path103, message, hint });
+var issue = (code, path104, message, hint) => ({ code, path: path104, message, hint });
 function parseManifest(raw, file = "services.json") {
   const version = typeof raw === "object" && raw !== null && "schemaVersion" in raw ? raw.schemaVersion : void 0;
   if (typeof version === "number" && version > SUPPORTED_MANIFEST_SCHEMA) {
@@ -7457,6 +7457,57 @@ function withGatewayEntry(existing, info) {
     }
   };
 }
+function withIdentityEntry(existing, info) {
+  const base = existing ?? parseManifest({
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    project: { name: info.projectName }
+  });
+  return {
+    ...base,
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    generatedAt: (info.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    preview: void 0,
+    project: { ...base.project, id: info.projectId, name: info.projectName },
+    services: {
+      ...base.services,
+      identity: {
+        ...base.services.identity,
+        provider: info.provider ?? "apitogo",
+        status: "ready",
+        issuer: info.issuer.replace(/\/+$/, ""),
+        clientId: info.clientId,
+        scopes: ["openid", "profile", "email"],
+        ...info.audience ? { audience: info.audience } : {},
+        capabilities: { nativeSignup: info.nativeSignup }
+      }
+    }
+  };
+}
+function withPlansEntry(existing, info) {
+  const base = existing ?? parseManifest({
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    project: { name: info.projectName }
+  });
+  return {
+    ...base,
+    schemaVersion: SUPPORTED_MANIFEST_SCHEMA,
+    generatedAt: (info.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    preview: void 0,
+    project: { ...base.project, id: info.projectId, name: info.projectName },
+    services: {
+      ...base.services,
+      plans: {
+        ...base.services.plans,
+        provider: "apitogo",
+        status: "ready",
+        apiBaseUrl: info.apiBaseUrl.replace(/\/+$/, ""),
+        billing: info.billing,
+        catalogRevision: info.catalogRevision,
+        capabilities: info.capabilities
+      }
+    }
+  };
+}
 async function writeManifest(state, manifest) {
   const file = manifestPathFor(state);
   await mkdir3(path10.dirname(file), { recursive: true });
@@ -7504,8 +7555,8 @@ var METHODS = [
   "trace"
 ];
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function actionKey(method, path103) {
-  const trimmed = path103.trim();
+function actionKey(method, path104) {
+  const trimmed = path104.trim();
   const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
   const normalized = withSlash.length > 1 ? withSlash.replace(/\/+$/, "") || "/" : withSlash;
   return `${method.trim().toLowerCase()}:${normalized}`;
@@ -7515,8 +7566,8 @@ function configActionKey(entry) {
   return match?.[1] && match[2] ? actionKey(match[1], match[2]) : void 0;
 }
 function referenceOptions(gateway, gatewayBaseUrl, keyHeaderName) {
-  const access16 = gateway.policies.access;
-  const jwt = access16?.jwt ?? gateway.auth !== void 0;
+  const access17 = gateway.policies.access;
+  const jwt = access17?.jwt ?? gateway.auth !== void 0;
   const keys = (list2) => new Set(
     (list2 ?? []).flatMap((entry) => {
       const key = configActionKey(entry);
@@ -7528,8 +7579,8 @@ function referenceOptions(gateway, gatewayBaseUrl, keyHeaderName) {
     originUrl: gateway.origin.url,
     jwtRequired: jwt && gateway.auth !== void 0,
     oidcMetadataUrl: jwt ? gateway.auth?.metadataUrl : void 0,
-    apiKeyRequired: access16?.apiKey ?? true,
-    apiKeyHeader: keyHeaderName ?? access16?.apiKeyHeader ?? DEFAULT_KEY_HEADER,
+    apiKeyRequired: access17?.apiKey ?? true,
+    apiKeyHeader: keyHeaderName ?? access17?.apiKeyHeader ?? DEFAULT_KEY_HEADER,
     publicOperations: keys(gateway.policies.operations?.public),
     deniedOperations: keys(gateway.policies.operations?.deny)
   };
@@ -7542,8 +7593,8 @@ var ReferenceSpecError = class extends Error {
 };
 function operationsOf(paths) {
   return Object.entries(paths).flatMap(
-    ([path103, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
-      (method) => [path103, item, method]
+    ([path104, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
+      (method) => [path104, item, method]
     ) : []
   );
 }
@@ -7558,14 +7609,14 @@ function buildReferenceSpec(specText, options) {
     throw new ReferenceSpecError("The OpenAPI file could not be read.");
   const doc = structuredClone(root);
   const paths = isObject(doc.paths) ? doc.paths : {};
-  for (const [path103, item, method] of operationsOf(paths))
-    if (options.deniedOperations.has(actionKey(method, path103)))
+  for (const [path104, item, method] of operationsOf(paths))
+    if (options.deniedOperations.has(actionKey(method, path104)))
       delete item[method];
-  for (const [path103, item] of Object.entries(paths))
+  for (const [path104, item] of Object.entries(paths))
     if (!isObject(item) || !METHODS.some((method) => method in item))
-      delete paths[path103];
-  for (const [path103, item, method] of operationsOf(paths))
-    if (options.publicOperations.has(actionKey(method, path103)))
+      delete paths[path104];
+  for (const [path104, item, method] of operationsOf(paths))
+    if (options.publicOperations.has(actionKey(method, path104)))
       item[method].security = [];
   doc.servers = [{ url: options.gatewayBaseUrl.replace(/\/+$/, "") }];
   for (const item of Object.values(paths)) {
@@ -8266,7 +8317,8 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        rateLimit: { calls: 10, periodSeconds: 60 },
+        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
+        rateLimit: { calls: 3, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     }
@@ -8277,7 +8329,8 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        rateLimit: { calls: 10, periodSeconds: 60 },
+        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
+        rateLimit: { calls: 3, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     },
@@ -8564,12 +8617,12 @@ async function planAddService(service, options) {
       )
     );
     const added = dependencyProblems(next, resolved.configPath).filter(
-      (issue3) => !before.has(issue3.code + issue3.path)
+      (issue4) => !before.has(issue4.code + issue4.path)
     );
     if (added.length > 0) {
       throw new ServiceEditError(
-        added.map((issue3) => issue3.message).join(" "),
-        added.map((issue3) => issue3.hint).filter(Boolean).join(" ") || "Add the missing service first."
+        added.map((issue4) => issue4.message).join(" "),
+        added.map((issue4) => issue4.hint).filter(Boolean).join(" ") || "Add the missing service first."
       );
     }
   }
@@ -8598,11 +8651,11 @@ async function planRemoveService(service, options) {
     dependencyProblems(config2, resolved.configPath).map((i) => i.code + i.path)
   );
   const caused = dependencyProblems(next, resolved.configPath).filter(
-    (issue3) => !before.has(issue3.code + issue3.path)
+    (issue4) => !before.has(issue4.code + issue4.path)
   );
   if (caused.length > 0) {
     throw new ServiceEditError(
-      `${service} cannot be removed while something depends on it: ${caused.map((issue3) => issue3.message).join(" ")}`,
+      `${service} cannot be removed while something depends on it: ${caused.map((issue4) => issue4.message).join(" ")}`,
       "Remove or change the dependent service first."
     );
   }
@@ -8836,7 +8889,7 @@ init_invariant();
 
 // src/cli/check/v2.ts
 init_apitogo_config_core();
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import path49 from "node:path";
 
 // src/cli/platform/client/platform-api.ts
@@ -8950,8 +9003,8 @@ var PlatformApiClient = class {
   constructor(config2) {
     this.config = config2;
   }
-  url(path103) {
-    return `${this.config.apiUrl}${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  url(path104) {
+    return `${this.config.apiUrl}${path104.startsWith("/") ? path104 : `/${path104}`}`;
   }
   headers(extra) {
     return {
@@ -8961,9 +9014,9 @@ var PlatformApiClient = class {
       ...extra
     };
   }
-  async request(method, path103, init4) {
+  async request(method, path104, init4) {
     const response = await fetchWithRetry(
-      this.url(path103),
+      this.url(path104),
       {
         method,
         ...init4,
@@ -9264,6 +9317,52 @@ var PlatformApiClient = class {
       `/api/v1/projects/${projectId}/gateway`
     );
   }
+  /**
+   * Asks for the project's identity. The same request twice changes nothing; a different request for an identity that
+   * exists is refused (409), because its audience and redirect addresses cannot change in place. Answers 200 when it is
+   * already Active and 202 otherwise: read `status` and poll `getProjectIdentity`.
+   */
+  putProjectIdentity(projectId, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/identity`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** The state of the project's identity, or null when it has none. */
+  async getProjectIdentity(projectId) {
+    try {
+      return await this.request(
+        "GET",
+        `/api/v1/projects/${projectId}/identity`
+      );
+    } catch (error) {
+      if (error instanceof PlatformApiError && error.status === 404)
+        return null;
+      throw error;
+    }
+  }
+  /**
+   * Removes the project's identity and DELETES EVERY USER in it, for good. Always sends `confirm=true`: ask the person
+   * before calling. Returns null when there was nothing to remove, otherwise the state to poll until Released.
+   */
+  async deleteProjectIdentity(projectId) {
+    const result = await this.request(
+      "DELETE",
+      `/api/v1/projects/${projectId}/identity?confirm=true`
+    );
+    return result ?? null;
+  }
+  /** Applies the project's identity to its plans backend as the sign-in provider. Queues a job. */
+  linkDevPortalIdentity(projectId) {
+    return this.request(
+      "POST",
+      `/api/v1/projects/${projectId}/dev-portal/identity-link`
+    );
+  }
   getDevPortalBackend(projectId) {
     return this.request(
       "GET",
@@ -9326,15 +9425,15 @@ var PlatformApiClient = class {
       }
     );
   }
-  deleteDevPortalPage(projectId, path103) {
-    const query = new URLSearchParams({ path: path103 });
+  deleteDevPortalPage(projectId, path104) {
+    const query = new URLSearchParams({ path: path104 });
     return this.request(
       "DELETE",
       `/api/v1/projects/${projectId}/dev-portal/pages/files?${query.toString()}`
     );
   }
-  renameDevPortalPage(projectId, path103, newName) {
-    const query = new URLSearchParams({ path: path103 });
+  renameDevPortalPage(projectId, path104, newName) {
+    const query = new URLSearchParams({ path: path104 });
     return this.request(
       "POST",
       `/api/v1/projects/${projectId}/dev-portal/pages/files/rename?${query.toString()}`,
@@ -9450,8 +9549,8 @@ var PlatformApiClient = class {
    * the project-less endpoint is used; `planTier` overrides the tier used for paid-plan checks.
    */
   validateGatewayPlans(plans, options = {}) {
-    const path103 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
-    return this.request("POST", path103, {
+    const path104 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
+    return this.request("POST", path104, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ plans, planTier: options.planTier })
     });
@@ -9552,8 +9651,8 @@ var PlatformApiClient = class {
   }
 };
 async function readFileBytes(filePath) {
-  const { readFile: readFile31 } = await import("node:fs/promises");
-  const buffer = await readFile31(filePath);
+  const { readFile: readFile32 } = await import("node:fs/promises");
+  const buffer = await readFile32(filePath);
   const arrayBuffer = new ArrayBuffer(buffer.byteLength);
   new Uint8Array(arrayBuffer).set(buffer);
   return arrayBuffer;
@@ -9655,7 +9754,6 @@ import {
   rm as rm8,
   writeFile as writeFile14
 } from "node:fs/promises";
-import { createRequire as createRequire2 } from "node:module";
 import path48 from "node:path";
 
 // src/vite/build.ts
@@ -9807,7 +9905,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.21",
+  version: "0.2.23",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -10589,14 +10687,14 @@ var flattenAllOf = (schema2) => {
 };
 
 // src/lib/util/traverse.ts
-var traverse = (specification, transform, path103 = []) => {
-  const transformed = transform(specification, path103);
+var traverse = (specification, transform, path104 = []) => {
+  const transformed = transform(specification, path104);
   if (typeof transformed !== "object" || transformed === null) {
     return transformed;
   }
   const result = Array.isArray(transformed) ? [] : {};
   for (const [key, value] of Object.entries(transformed)) {
-    const currentPath = [...path103, key];
+    const currentPath = [...path104, key];
     if (Array.isArray(value)) {
       result[key] = value.map(
         (item, index) => typeof item === "object" && item != null ? traverse(item, transform, [...currentPath, index.toString()]) : item
@@ -10624,9 +10722,9 @@ var resolveLocalRef = (schema2, ref) => {
   if (schemaCache?.has(ref)) {
     return schemaCache.get(ref);
   }
-  const path103 = ref.split("/").slice(1);
+  const path104 = ref.split("/").slice(1);
   let current = schema2;
-  for (const segment of path103) {
+  for (const segment of path104) {
     if (!current || typeof current !== "object") {
       current = null;
     }
@@ -10645,7 +10743,7 @@ var dereference = async (schema2, resolvers = []) => {
   }
   const cloned = structuredClone(schema2);
   const visited = /* @__PURE__ */ new Set();
-  const resolve = async (current, path103) => {
+  const resolve = async (current, path104) => {
     if (isIndexableObject(current)) {
       if (visited.has(current)) {
         return CIRCULAR_REF;
@@ -10653,7 +10751,7 @@ var dereference = async (schema2, resolvers = []) => {
       visited.add(current);
       if (Array.isArray(current)) {
         for (let index = 0; index < current.length; index++) {
-          current[index] = await resolve(current[index], `${path103}/${index}`);
+          current[index] = await resolve(current[index], `${path104}/${index}`);
         }
       } else {
         if ("$ref" in current && typeof current.$ref === "string") {
@@ -10664,13 +10762,13 @@ var dereference = async (schema2, resolvers = []) => {
           for (const resolver of resolvers) {
             const resolved = await resolver($ref);
             if (resolved) {
-              result2 = await resolve(resolved, path103);
+              result2 = await resolve(resolved, path104);
               break;
             }
           }
           if (result2 === void 0) {
             const resolved = await resolveLocalRef(cloned, $ref);
-            result2 = await resolve(resolved, path103);
+            result2 = await resolve(resolved, path104);
           }
           if (hasSiblings) {
             if (result2 === CIRCULAR_REF) {
@@ -10683,7 +10781,7 @@ var dereference = async (schema2, resolvers = []) => {
           return result2;
         }
         for (const key in current) {
-          current[key] = await resolve(current[key], `${path103}/${key}`);
+          current[key] = await resolve(current[key], `${path104}/${key}`);
         }
       }
       visited.delete(current);
@@ -10722,9 +10820,9 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (sub, path103) => {
+  schema2 = traverse(schema2, (sub, path104) => {
     if (sub.example !== void 0) {
-      if (isSchemaPath(path103 ?? [])) {
+      if (isSchemaPath(path104 ?? [])) {
         sub.examples = [sub.example];
       } else {
         sub.examples = {
@@ -10737,11 +10835,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
+  schema2 = traverse(schema2, (schema3, path104) => {
     if (schema3.type === "object" && schema3.properties !== void 0) {
-      const parentPath = path103?.slice(0, -1);
+      const parentPath = path104?.slice(0, -1);
       const isMultipart = parentPath?.some((segment, index) => {
-        return segment === "content" && path103?.[index + 1] === "multipart/form-data";
+        return segment === "content" && path104?.[index + 1] === "multipart/form-data";
       });
       if (isMultipart) {
         const entries = Object.entries(schema3.properties);
@@ -10755,8 +10853,8 @@ var upgradeSchema = (schema2) => {
     }
     return schema3;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
-    if (path103?.includes("content") && path103.includes("application/octet-stream")) {
+  schema2 = traverse(schema2, (schema3, path104) => {
+    if (path104?.includes("content") && path104.includes("application/octet-stream")) {
       return {};
     }
     if (schema3.type === "string" && schema3.format === "binary") {
@@ -10782,11 +10880,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
+  schema2 = traverse(schema2, (schema3, path104) => {
     if (schema3.type === "string" && schema3.format === "byte") {
-      const parentPath = path103?.slice(0, -1);
+      const parentPath = path104?.slice(0, -1);
       const contentMediaType = parentPath?.find(
-        (_, index) => path103?.[index - 1] === "content"
+        (_, index) => path104?.[index - 1] === "content"
       );
       return {
         type: "string",
@@ -10798,7 +10896,7 @@ var upgradeSchema = (schema2) => {
   });
   return schema2;
 };
-function isSchemaPath(path103) {
+function isSchemaPath(path104) {
   const schemaLocations = [
     ["components", "schemas"],
     "properties",
@@ -10811,10 +10909,10 @@ function isSchemaPath(path103) {
   ];
   return schemaLocations.some((location) => {
     if (Array.isArray(location)) {
-      return location.every((segment, index) => path103[index] === segment);
+      return location.every((segment, index) => path104[index] === segment);
     }
-    return path103.includes(location);
-  }) || path103.includes("schema") || path103.some((segment) => segment.endsWith("Schema"));
+    return path104.includes(location);
+  }) || path104.includes("schema") || path104.some((segment) => segment.endsWith("Schema"));
 }
 
 // src/lib/oas/parser/index.ts
@@ -10896,13 +10994,13 @@ var OPENAPI_PROPS = /* @__PURE__ */ new Set([
   "anyOf",
   "oneOf"
 ]);
-var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path103 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
+var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path104 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
   if (obj === null || typeof obj !== "object") return obj;
   const refPath = obj.__$ref;
   const isCircular = currentPath.has(obj) || typeof refPath === "string" && currentRefPaths.has(refPath);
   if (isCircular) {
     if (typeof refPath === "string") return SCHEMA_REF_PREFIX + refPath;
-    const circularProp = path103.find((p) => !OPENAPI_PROPS.has(p)) || path103[0];
+    const circularProp = path104.find((p) => !OPENAPI_PROPS.has(p)) || path104[0];
     return [CIRCULAR_REF, circularProp].filter(Boolean).join(":");
   }
   if (refs.has(obj)) return refs.get(obj);
@@ -10912,7 +11010,7 @@ var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs
     value,
     currentPath,
     refs,
-    [...path103, key],
+    [...path104, key],
     currentRefPaths
   );
   const result = Array.isArray(obj) ? obj.map((item, i) => recurse(item, i.toString())) : Object.fromEntries(
@@ -10947,7 +11045,7 @@ var resolveExtensions = (obj) => Object.fromEntries(
 var getAllTags = (schema2) => {
   const rootTags = schema2.tags ?? [];
   const operations = Object.values(schema2.paths ?? {}).flatMap(
-    (path103) => HttpMethods.map((k) => path103?.[k]).filter((op) => op != null)
+    (path104) => HttpMethods.map((k) => path104?.[k]).filter((op) => op != null)
   );
   const operationTags = new Set(operations.flatMap((op) => op.tags ?? []));
   const hasUntaggedOperations = operations.some(
@@ -11002,7 +11100,7 @@ var getAllSlugs = (ops, schemaTags = []) => {
 var getOperationSlugKey = (op) => [op.path, op.method, op.operationId, op.summary].filter(Boolean).join("-");
 var getAllOperations = (paths) => {
   const operations = Object.entries(paths ?? {}).flatMap(
-    ([path103, value]) => HttpMethods.flatMap((method) => {
+    ([path104, value]) => HttpMethods.flatMap((method) => {
       if (!value?.[method]) return [];
       const operation = value[method];
       const pathParameters = value.parameters ?? [];
@@ -11022,7 +11120,7 @@ var getAllOperations = (paths) => {
       return {
         ...operation,
         method,
-        path: path103,
+        path: path104,
         parameters,
         servers,
         tags: operation.tags ?? []
@@ -11380,8 +11478,8 @@ var Schema = builder.objectRef("Schema").implement({
     }),
     paths: t.field({
       type: [PathItem],
-      resolve: (root) => Object.entries(root.paths ?? {}).map(([path103, value]) => ({
-        path: path103,
+      resolve: (root) => Object.entries(root.paths ?? {}).map(([path104, value]) => ({
+        path: path104,
         // biome-ignore lint/style/noNonNullAssertion: value is guaranteed to be defined
         methods: Object.keys(value)
       }))
@@ -11546,7 +11644,7 @@ init_joinUrl();
 
 // src/vite/api/schema-codegen.ts
 var unescapeJsonPointer = (uri) => decodeURIComponent(uri.replace(/~1/g, "/").replace(/~0/g, "~"));
-var getSegmentsFromPath = (path103) => path103.split("/").slice(1).map(unescapeJsonPointer);
+var getSegmentsFromPath = (path104) => path104.split("/").slice(1).map(unescapeJsonPointer);
 var createLocalRefMap = (obj) => {
   const refMap = /* @__PURE__ */ new Map();
   const siblingsMap = /* @__PURE__ */ new Map();
@@ -11577,16 +11675,16 @@ var replaceMarkers = (code, mergedRefs) => code.replace(/"__refMap:(.*?)"/g, '__
   /"__refMap\+Siblings:(.*?)"/g,
   (_, key) => mergedRefs.get(key) ?? `__refMap["${key}"]`
 );
-var lookup = (schema2, path103, filePath) => {
-  const parts = getSegmentsFromPath(path103);
+var lookup = (schema2, path104, filePath) => {
+  const parts = getSegmentsFromPath(path104);
   let val = schema2;
   for (const part of parts) {
     while (val.$ref?.startsWith("#/")) {
-      val = val.$ref === path103 ? val : lookup(schema2, val.$ref, filePath);
+      val = val.$ref === path104 ? val : lookup(schema2, val.$ref, filePath);
     }
     if (val[part] === void 0) {
       throw new Error(
-        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path103}`
+        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path104}`
       );
     }
     val = val[part];
@@ -11831,8 +11929,8 @@ var SchemaManager = class {
       }
     }
   };
-  getLatestSchema = (path103) => this.processedSchemas[path103]?.at(0);
-  getSchemasForPath = (path103) => this.processedSchemas[path103];
+  getLatestSchema = (path104) => this.processedSchemas[path104]?.at(0);
+  getSchemasForPath = (path104) => this.processedSchemas[path104];
   getSchemaImports = () => Object.values(this.processedSchemas).flat().filter((s) => s.importKey);
   getUrlToFilePathMap = () => {
     const map = /* @__PURE__ */ new Map();
@@ -14286,14 +14384,14 @@ async function generateSitemap({
 
 // src/vite/prerender/utils.ts
 init_joinUrl();
-var resolveRoutePath = (path103) => {
-  const segments = path103.split("/");
+var resolveRoutePath = (path104) => {
+  const segments = path104.split("/");
   if (segments.some((s) => s.startsWith(":") && !s.endsWith("?"))) {
     return void 0;
   }
   return segments.filter((s) => !s.startsWith(":")).join("/") || void 0;
 };
-var isSkipped = (path103) => path103.includes("*") || /^\d+$/.test(path103);
+var isSkipped = (path104) => path104.includes("*") || /^\d+$/.test(path104);
 var resolveRoutes = (routes, parentPath = "") => routes.flatMap((route) => {
   if (route.path && isSkipped(route.path)) return [];
   const routePath = route.path ? resolveRoutePath(route.path) : void 0;
@@ -14702,15 +14800,9 @@ var missingCorePackages = (dir) => CORE_PACKAGES.filter((name) => !isPackageInst
 
 // src/cli/portal/v2.ts
 function assertPackagesInstalled(resolved, prepared) {
-  const require2 = createRequire2(path48.join(resolved.configDir, "package.json"));
-  const missing = requiredPackages(prepared.plan).filter((name) => {
-    try {
-      require2.resolve(name);
-      return false;
-    } catch {
-      return true;
-    }
-  });
+  const missing = requiredPackages(prepared.plan).filter(
+    (name) => !isPackageInstalled(resolved.configDir, name)
+  );
   const missingCore = missingCorePackages(resolved.configDir);
   if (missing.length === 0 && missingCore.length === 0) return;
   throw new ConfigError(resolved.configPath, [
@@ -14803,15 +14895,15 @@ async function buildV2(options) {
 // src/cli/check/gateway-online.ts
 import { readFile as readFile13 } from "node:fs/promises";
 var SPEC_SEND_LIMIT = 5 * 1024 * 1024 + 64 * 1024;
-var issue2 = (code, path103, message, hint) => ({ code, path: path103, message, hint });
+var issue2 = (code, path104, message, hint) => ({ code, path: path104, message, hint });
 function capabilityIssues(gateway, answer) {
   const can = answer.capabilities;
   const plan2 = `your ${answer.tier} plan`;
   const found = [];
-  const unsupported = (path103, what, hint) => found.push(
+  const unsupported = (path104, what, hint) => found.push(
     issue2(
       "GATEWAY_CAPABILITY_UNSUPPORTED",
-      path103,
+      path104,
       `${what} is not available on ${plan2}.`,
       hint
     )
@@ -14883,11 +14975,240 @@ async function onlineGatewayRules(gateway, projectId, api, derivedCors = []) {
   }
 }
 
+// src/cli/deploy/plans-file.ts
+init_invariant();
+import { readFile as readFile14 } from "node:fs/promises";
+import { z as z14 } from "zod";
+var PlansFileError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot read the plans file" });
+    this.code = code;
+    this.name = "PlansFileError";
+  }
+};
+var Limits = z14.strictObject({
+  rateLimit: z14.strictObject({
+    calls: z14.int().positive(),
+    periodSeconds: z14.int().positive()
+  }).optional(),
+  quota: z14.strictObject({
+    calls: z14.int().positive(),
+    periodDays: z14.int().positive()
+  }).optional()
+});
+var Plan = z14.strictObject({
+  sku: z14.string().trim().min(1),
+  displayName: z14.string().trim().min(1),
+  /** The plan the portal offers first. The platform has no such flag; the portal reads the file order. */
+  default: z14.boolean().optional(),
+  limits: Limits.optional(),
+  priceAmount: z14.number().min(0).optional(),
+  priceCurrency: z14.string().trim().min(1).optional(),
+  billingInterval: z14.enum(["month", "year"]).optional(),
+  pricingModel: z14.enum(["fixed", "custom"]).optional(),
+  priceLabel: z14.string().optional(),
+  sortOrder: z14.int().optional(),
+  /** Action keys such as `get:/orders`. Left out, the plan includes every action of the gateway. */
+  includedActions: z14.array(z14.string().trim().min(1)).optional()
+});
+var PlansFile = z14.strictObject({
+  version: z14.literal(1),
+  plans: z14.array(Plan)
+});
+var issuesOf = (error) => error.issues.map(
+  (issue4) => `${issue4.path.join(".") || "(file)"}: ${issue4.message}`
+);
+async function readPlansFile(file) {
+  let text;
+  try {
+    text = await readFile14(file, "utf8");
+  } catch {
+    throw new PlansFileError(
+      "PLANS_FILE_UNREADABLE",
+      `The plans file ${file} could not be read.`,
+      "Create it with `apitogo add plans`, or set plans.file in the config."
+    );
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (error) {
+    throw new PlansFileError(
+      "PLANS_FILE_INVALID",
+      `The plans file ${file} is not valid JSON (${error.message}).`
+    );
+  }
+  const parsed = PlansFile.safeParse(raw);
+  if (!parsed.success)
+    throw new PlansFileError(
+      "PLANS_FILE_INVALID",
+      `The plans file ${file} is not valid:
+  ${issuesOf(parsed.error).join("\n  ")}`,
+      'Expected { "version": 1, "plans": [ { "sku", "displayName", "limits": { "rateLimit": { "calls", "periodSeconds" }, "quota": { "calls", "periodDays" } } } ] }.'
+    );
+  const seen = /* @__PURE__ */ new Set();
+  for (const plan2 of parsed.data.plans) {
+    const sku = plan2.sku.toLowerCase();
+    if (seen.has(sku))
+      throw new PlansFileError(
+        "PLANS_FILE_INVALID",
+        `The plans file ${file} names the sku "${plan2.sku}" twice.`,
+        "Every plan needs its own sku."
+      );
+    seen.add(sku);
+  }
+  return parsed.data.plans;
+}
+var BILLING_PERIOD = { month: "monthly", year: "annual" };
+function toPlatformPlans(plans) {
+  return plans.map((plan2, index) => {
+    const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
+    if (paid)
+      throw new PlansFileError(
+        "PLANS_PAID_UNSUPPORTED",
+        `The plan "${plan2.sku}" has a price, and deploying paid plans is not available in this CLI version yet.`,
+        "Remove the plan, or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
+      );
+    const limits = plan2.limits ? {
+      ...plan2.limits.rateLimit ? {
+        rateLimit: {
+          calls: plan2.limits.rateLimit.calls,
+          renewalPeriodSeconds: plan2.limits.rateLimit.periodSeconds
+        }
+      } : {},
+      ...plan2.limits.quota ? {
+        quota: {
+          calls: plan2.limits.quota.calls,
+          renewalPeriodDays: plan2.limits.quota.periodDays
+        }
+      } : {}
+    } : void 0;
+    return {
+      sku: plan2.sku.trim().toLowerCase(),
+      displayName: plan2.displayName,
+      ...limits ? { limitsJson: JSON.stringify(limits) } : {},
+      includedActionKeys: plan2.includedActions ?? null,
+      ...plan2.pricingModel ? { pricingModel: plan2.pricingModel } : {},
+      ...plan2.priceAmount !== void 0 ? { priceAmount: plan2.priceAmount } : {},
+      ...plan2.priceLabel !== void 0 ? { priceLabel: plan2.priceLabel } : {},
+      ...plan2.priceCurrency ? { priceCurrency: plan2.priceCurrency } : {},
+      ...plan2.billingInterval ? { billingPeriod: BILLING_PERIOD[plan2.billingInterval] } : {},
+      sortOrder: plan2.sortOrder ?? index
+    };
+  });
+}
+
+// src/cli/check/services-online.ts
+var issue3 = (code, path104, message, hint) => ({
+  code,
+  path: path104,
+  message,
+  hint
+});
+var trimSlash = (value) => value.replace(/\/+$/, "");
+async function onlineIdentityRules(resolved, manifest, api) {
+  const identity = resolved.identity;
+  if (!identity?.enabled) return { errors: [], warnings: [] };
+  const issuer = manifest?.services.identity?.issuer;
+  if (!issuer)
+    return {
+      errors: [],
+      warnings: [],
+      skipped: "the identity's online rules were not run: identity is not deployed yet (run `apitogo deploy --only identity`)"
+    };
+  let answer;
+  try {
+    answer = await api.discover(issuer);
+  } catch (error) {
+    return {
+      errors: [],
+      warnings: [],
+      skipped: `the identity's online rules were not run: the issuer could not be reached (${error instanceof Error ? error.message : String(error)})`
+    };
+  }
+  if ("status" in answer)
+    return {
+      errors: [
+        issue3(
+          "IDENTITY_ISSUER_NOT_ANSWERING",
+          "identity",
+          `the issuer ${issuer} answered ${answer.status} instead of its discovery document.`,
+          "Run `apitogo status --only identity` to see what the platform says, then deploy identity again."
+        )
+      ],
+      warnings: []
+    };
+  if (!answer.document.issuer || trimSlash(answer.document.issuer) !== trimSlash(issuer))
+    return {
+      errors: [
+        issue3(
+          "IDENTITY_ISSUER_MISMATCH",
+          "identity",
+          `the discovery document of ${issuer} names a different issuer (${answer.document.issuer ?? "none"}).`,
+          "Deploy identity again so services.json is rewritten."
+        )
+      ],
+      warnings: []
+    };
+  return { errors: [], warnings: [] };
+}
+async function plansFileProblem(resolved) {
+  const plans = resolved.plans;
+  if (!plans?.enabled) return { wanted: [] };
+  try {
+    return { wanted: toPlatformPlans(await readPlansFile(plans.file)) };
+  } catch (error) {
+    if (!(error instanceof PlansFileError)) throw error;
+    return {
+      wanted: [],
+      issue: issue3(
+        error.code,
+        "plans.file",
+        error.message,
+        error.developerHint
+      )
+    };
+  }
+}
+async function onlinePlansRules(resolved, projectId, api) {
+  const plans = resolved.plans;
+  if (!plans?.enabled) return { errors: [], warnings: [] };
+  const file = await plansFileProblem(resolved);
+  if (file.issue) return { errors: [file.issue], warnings: [] };
+  const wanted = file.wanted;
+  if (wanted.length === 0) return { errors: [], warnings: [] };
+  try {
+    const answer = await api.validate(
+      projectId,
+      // The platform's check needs the list even when it is empty: the actions are only known after the gateway deploy.
+      wanted.map((plan2) => ({
+        ...plan2,
+        includedActionKeys: plan2.includedActionKeys ?? []
+      }))
+    );
+    const convert = (item) => issue3(
+      "PLANS_PLAN_INVALID",
+      `plans.file ${item.field}`,
+      `${item.sku ? `plan ${item.sku}: ` : ""}${item.message}`
+    );
+    return {
+      errors: answer.errors.map(convert),
+      warnings: answer.warnings.map(convert)
+    };
+  } catch (error) {
+    return {
+      errors: [],
+      warnings: [],
+      skipped: `the plans' online rules were not run: the platform could not be asked (${error instanceof Error ? error.message : String(error)})`
+    };
+  }
+}
+
 // src/cli/check/v2.ts
 async function isConfigV2(dir) {
   try {
     return /"version"\s*:\s*2\b/.test(
-      await readFile14(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
+      await readFile15(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
     );
   } catch {
     return false;
@@ -14908,13 +15229,13 @@ async function fetchSecretNames(config2, configuredProjectId, args, deps) {
 }
 async function addGatewayOnlineRules(report, resolved, args, deps) {
   const gateway = resolved.gateway;
-  if (args.offline || !deps.gateway || !gateway?.enabled) return;
+  if (args.offline || !deps.gateway || !gateway?.enabled) return false;
   const projectId = resolved.project.id || deps.envProjectId?.trim();
   if (!projectId) {
     report.skipped.push(
       "the gateway's online rules were not run: this folder is not linked to a project (run `apitogo project create`)"
     );
-    return;
+    return false;
   }
   const manifest = await readManifest(resolved.state);
   const result = await onlineGatewayRules(
@@ -14928,7 +15249,7 @@ async function addGatewayOnlineRules(report, resolved, args, deps) {
   );
   if (result.skipped) {
     report.skipped.push(result.skipped);
-    return;
+    return false;
   }
   const seen = new Set(
     [...report.errors, ...report.warnings].map((i) => `${i.code}|${i.path}`)
@@ -14939,12 +15260,60 @@ async function addGatewayOnlineRules(report, resolved, args, deps) {
     seen.add(key);
     report.errors.push(item);
   }
-  report.skipped = report.skipped.filter(
-    (note) => !note.startsWith("online rules were not run")
-  );
-  report.skipped.unshift(
-    "online rules ran for the gateway only; the other services have none yet"
+  return true;
+}
+async function addServiceOnlineRules(report, resolved, args, deps) {
+  if (args.offline) return [];
+  const ran = [];
+  const seen = new Set(
+    [...report.errors, ...report.warnings].map((i) => `${i.code}|${i.path}`)
   );
+  const take = (list2, into) => {
+    for (const item of list2) {
+      const key = `${item.code}|${item.path}`;
+      if (seen.has(key)) continue;
+      if (item.path === "plans.file" && report.errors.some((e) => e.path === "plans.file"))
+        continue;
+      seen.add(key);
+      into.push(item);
+    }
+  };
+  if (deps.identity && resolved.identity?.enabled) {
+    const result = await onlineIdentityRules(
+      resolved,
+      await readManifest(resolved.state),
+      deps.identity
+    );
+    if (result.skipped) report.skipped.push(result.skipped);
+    else {
+      take(result.errors, report.errors);
+      take(result.warnings, report.warnings);
+      ran.push("identity");
+    }
+  }
+  if (deps.plans && resolved.plans?.enabled) {
+    const projectId = resolved.project.id || deps.envProjectId?.trim();
+    if (!projectId)
+      report.skipped.push(
+        "the plans' online rules were not run: this folder is not linked to a project (run `apitogo project create`)"
+      );
+    else {
+      const result = await onlinePlansRules(resolved, projectId, deps.plans);
+      if (result.skipped) report.skipped.push(result.skipped);
+      else {
+        take(result.errors, report.errors);
+        take(result.warnings, report.warnings);
+        ran.push("plans");
+      }
+    }
+  }
+  return ran;
+}
+function onlineRulesNote(ran) {
+  if (ran.length === 1 && ran[0] === "gateway")
+    return "online rules ran for the gateway only; the other services have none yet";
+  const names = ran.length > 1 ? `${ran.slice(0, -1).join(", ")} and ${ran[ran.length - 1]}` : ran[0] ?? "";
+  return `online rules ran for the ${names}`;
 }
 async function addApiReferenceWarning(report, resolved) {
   const portal = resolved.portal;
@@ -14968,7 +15337,7 @@ async function validatePortalBuild(dir) {
       return {
         code: error.issues[0]?.code ?? "PORTAL_BUILD_FAILED",
         path: error.issues[0]?.path ?? "portal",
-        message: error.issues.map((issue3) => issue3.message).join(" "),
+        message: error.issues.map((issue4) => issue4.message).join(" "),
         hint: error.issues[0]?.hint
       };
     }
@@ -14997,7 +15366,19 @@ async function runCheckV2(dir, args = {}, deps = {}) {
       knownSecrets: online.names
     });
     if (online.failure) report.skipped.push(online.failure);
-    await addGatewayOnlineRules(report, resolved, args, deps);
+    const file = await plansFileProblem(resolved);
+    if (file.issue && !report.errors.some((e) => e.path === file.issue.path))
+      report.errors.push(file.issue);
+    const ran = [];
+    if (await addGatewayOnlineRules(report, resolved, args, deps))
+      ran.push("gateway");
+    ran.push(...await addServiceOnlineRules(report, resolved, args, deps));
+    if (ran.length > 0) {
+      report.skipped = report.skipped.filter(
+        (note) => !note.startsWith("online rules were not run")
+      );
+      report.skipped.unshift(onlineRulesNote(ran));
+    }
     await addApiReferenceWarning(report, resolved);
   } catch (error) {
     if (!(error instanceof ConfigError)) throw error;
@@ -15025,11 +15406,11 @@ async function runCheckV2(dir, args = {}, deps = {}) {
     ...report
   };
 }
-var line = (label, issue3) => `${label}: ${formatConfigIssue(issue3)}`;
+var line = (label, issue4) => `${label}: ${formatConfigIssue(issue4)}`;
 function formatCheckV2(output4) {
   const lines = [
-    ...output4.errors.map((issue3) => line("error", issue3)),
-    ...output4.warnings.map((issue3) => line("warning", issue3)),
+    ...output4.errors.map((issue4) => line("error", issue4)),
+    ...output4.warnings.map((issue4) => line("warning", issue4)),
     ...output4.skipped.map((note) => `not checked: ${note}`)
   ];
   const errors = `${output4.errors.length} error${output4.errors.length === 1 ? "" : "s"}`;
@@ -15039,6 +15420,14 @@ function formatCheckV2(output4) {
   );
   return lines;
 }
+async function discoverIssuer(issuer) {
+  const response = await fetch(
+    `${issuer.replace(/\/+$/, "")}/.well-known/openid-configuration`,
+    { signal: AbortSignal.timeout(1e4) }
+  );
+  if (!response.ok) return { status: response.status };
+  return { document: await response.json() };
+}
 function platformDependencies(args) {
   if (args.offline) return {};
   try {
@@ -15050,6 +15439,10 @@ function platformDependencies(args) {
       gateway: {
         check: (projectId, body) => client.checkGateway(projectId, body),
         capabilities: (projectId) => client.getGatewayCapabilities(projectId)
+      },
+      identity: { discover: discoverIssuer },
+      plans: {
+        validate: (projectId, plans) => client.validateGatewayPlans(plans, { projectId })
       }
     };
   } catch {
@@ -15076,7 +15469,7 @@ init_package_json();
 
 // src/cli/platform/helpers/npm-build.ts
 import { spawn } from "node:child_process";
-import { access as access5, readFile as readFile15 } from "node:fs/promises";
+import { access as access5, readFile as readFile16 } from "node:fs/promises";
 import path50 from "node:path";
 var BUILD_LOG_TAIL_BYTES = 8192;
 var MIN_NODE_MAJOR = 20;
@@ -16028,7 +16421,7 @@ function formatDevPortalBackendResponse(projectId, backend) {
 // src/cli/platform/helpers/dev-portal-manifest.ts
 init_gateway_limits();
 import { existsSync as existsSync7 } from "node:fs";
-import { access as access6, mkdir as mkdir13, readFile as readFile16, writeFile as writeFile15 } from "node:fs/promises";
+import { access as access6, mkdir as mkdir13, readFile as readFile17, writeFile as writeFile15 } from "node:fs/promises";
 import path57 from "node:path";
 
 // src/cli/make-config/json-config.ts
@@ -17328,7 +17721,7 @@ function applyOpenApiToSiteConfig(config2, options) {
 async function readManifest2(siteDirectory) {
   const filePath = manifestFilePath(siteDirectory);
   if (await pathExists2(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     const config2 = JSON.parse(raw);
     return extractManifestFromConfig(config2);
   }
@@ -17339,7 +17732,7 @@ async function writeManifest2(siteDirectory, manifest) {
   await mkdir13(path57.dirname(filePath), { recursive: true });
   let config2 = {};
   if (await pathExists2(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     config2 = JSON.parse(raw);
   }
   const {
@@ -17358,7 +17751,7 @@ import {
   access as access7,
   appendFile,
   mkdir as mkdir14,
-  readFile as readFile17,
+  readFile as readFile18,
   unlink,
   writeFile as writeFile16
 } from "node:fs/promises";
@@ -17464,7 +17857,7 @@ function applyEnvOverrides2(config2, env) {
 }
 async function readEnvFile(filePath) {
   try {
-    const raw = await readFile17(filePath, "utf8");
+    const raw = await readFile18(filePath, "utf8");
     const env = {};
     for (const line2 of raw.split("\n")) {
       const trimmed = line2.trim();
@@ -17641,7 +18034,7 @@ async function writeScaffoldEnv(siteDirectory) {
   for (const legacyName of [".env.example"]) {
     const legacyPath = path58.join(resolvedDirectory, legacyName);
     try {
-      const legacy = await readFile17(legacyPath, "utf8");
+      const legacy = await readFile18(legacyPath, "utf8");
       if (!envFileHasActiveAssignments(legacy)) {
         await unlink(legacyPath);
         filesWritten.push(`removed:${legacyName}`);
@@ -17652,7 +18045,7 @@ async function writeScaffoldEnv(siteDirectory) {
   const gitignorePath = path58.join(resolvedDirectory, ".gitignore");
   let gitignore = "";
   try {
-    gitignore = await readFile17(gitignorePath, "utf8");
+    gitignore = await readFile18(gitignorePath, "utf8");
   } catch {
     gitignore = "";
   }
@@ -17684,12 +18077,12 @@ var SECRETS_COLLECTION_INSTRUCTION = "For go-live, plans must already be in apit
 
 // src/cli/platform/helpers/dev-portal-site-validation.ts
 init_gateway_limits();
-import { readFile as readFile18 } from "node:fs/promises";
-import { createRequire as createRequire3 } from "node:module";
+import { readFile as readFile19 } from "node:fs/promises";
+import { createRequire as createRequire2 } from "node:module";
 import path59 from "node:path";
 var cachedFallbackTs;
 async function loadTypeScriptForSite(sourceDirectory) {
-  const require2 = createRequire3(
+  const require2 = createRequire2(
     path59.join(path59.resolve(sourceDirectory), "package.json")
   );
   try {
@@ -17862,7 +18255,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     let parsed;
     let parseFailed = false;
     try {
-      parsed = JSON.parse(await readFile18(jsonPath, "utf8"));
+      parsed = JSON.parse(await readFile19(jsonPath, "utf8"));
     } catch (error) {
       parseFailed = true;
       issues.push({
@@ -17901,7 +18294,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     } else {
       for (const relativeFile of existingTsxFiles) {
         checkedFiles.push(relativeFile);
-        const content = await readFile18(
+        const content = await readFile19(
           path59.join(resolvedDir, relativeFile),
           "utf8"
         );
@@ -17922,7 +18315,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
   };
 }
 function formatSiteValidationErrors(result) {
-  return result.issues.map((issue3) => `${issue3.file}: ${issue3.message}`).join("; ");
+  return result.issues.map((issue4) => `${issue4.file}: ${issue4.message}`).join("; ");
 }
 function buildSiteValidationResponseFields(result) {
   if (result.valid) {
@@ -18326,7 +18719,7 @@ async function checkPublishReadiness(client, _config, args) {
   const mergedPrerequisites = mergePublishPrerequisitesWithPlatformValidation(
     publishPrerequisites,
     platformValidation.issues.map(
-      (issue3) => `${issue3.field}: ${issue3.message}`
+      (issue4) => `${issue4.field}: ${issue4.message}`
     )
   );
   const siteValidation = await validateDevPortalSiteConfig(sourceDirectory);
@@ -18448,7 +18841,7 @@ var check_default = {
 
 // src/cli/make-config/handler.ts
 import { constants as constants2 } from "node:fs";
-import { access as access12, mkdir as mkdir17, readFile as readFile23, writeFile as writeFile21 } from "node:fs/promises";
+import { access as access12, mkdir as mkdir17, readFile as readFile24, writeFile as writeFile21 } from "node:fs/promises";
 import path71 from "node:path";
 import { stdin as input2 } from "node:process";
 import { glob as glob8 } from "glob";
@@ -18588,7 +18981,7 @@ function withDefaultIncludedActionKeys(plan2, actionKeys) {
 }
 
 // src/cli/scaffold/dev-portal-config-pages.ts
-import { access as access8, readFile as readFile19, rename as rename7, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
+import { access as access8, readFile as readFile20, rename as rename7, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
 import path63 from "node:path";
 async function writeConfigAtomically(filePath, content) {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
@@ -19353,7 +19746,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
   if (!configPath) {
     return { updated: false };
   }
-  const original = await readFile19(configPath, "utf8");
+  const original = await readFile20(configPath, "utf8");
   const patched = patchApitogoConfigForNewPage(original, slug, label, {
     typescript: configPath.endsWith(".tsx")
   });
@@ -19365,7 +19758,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
 }
 
 // src/cli/scaffold/wire-openapi.ts
-import { access as access10, readFile as readFile21, writeFile as writeFile19 } from "node:fs/promises";
+import { access as access10, readFile as readFile22, writeFile as writeFile19 } from "node:fs/promises";
 import path68 from "node:path";
 
 // src/cli/platform/helpers/openapi.ts
@@ -19569,7 +19962,7 @@ async function validateOpenApiFile(filePath) {
 }
 
 // src/cli/scaffold/scaffold-dev-portal-site.ts
-import { mkdir as mkdir15, readFile as readFile20, writeFile as writeFile18 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile21, writeFile as writeFile18 } from "node:fs/promises";
 import path67 from "node:path";
 
 // src/cli/scaffold/apitogo-npm-packages.ts
@@ -19977,7 +20370,7 @@ function patchDashboardPageConfig(content) {
 async function ensureAccountPlansPage(outputDirectory) {
   const pagePath = path67.join(outputDirectory, ACCOUNT_PLANS_PAGE_PATH);
   try {
-    await readFile20(pagePath, "utf8");
+    await readFile21(pagePath, "utf8");
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
@@ -19988,7 +20381,7 @@ async function ensureAccountPlansPage(outputDirectory) {
 async function ensureDashboardPage(outputDirectory) {
   const pagePath = path67.join(outputDirectory, DASHBOARD_PAGE_PATH);
   try {
-    await readFile20(pagePath, "utf8");
+    await readFile21(pagePath, "utf8");
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
@@ -20050,7 +20443,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
   const filesWritten = [];
   const packageJsonPath = path67.join(outputDirectory, "package.json");
   if (options.patchPackageJson !== false) {
-    const packageJson3 = await readFile20(packageJsonPath, "utf8");
+    const packageJson3 = await readFile21(packageJsonPath, "utf8");
     await writeFile18(
       packageJsonPath,
       rewritePackageJson(packageJson3, {
@@ -20062,7 +20455,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
     filesWritten.push("package.json");
   }
   const configPath = path67.join(outputDirectory, "apitogo.config.tsx");
-  const configContent = await readFile20(configPath, "utf8");
+  const configContent = await readFile21(configPath, "utf8");
   await writeFile18(
     configPath,
     patchDashboardPageConfig(
@@ -20169,7 +20562,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
   }
   const jsonConfigPath = manifestFilePath(resolvedSource);
   if (await pathExists4(jsonConfigPath)) {
-    const raw = await readFile21(jsonConfigPath, "utf8");
+    const raw = await readFile22(jsonConfigPath, "utf8");
     const siteConfig = JSON.parse(raw);
     const updated = applyOpenApiToSiteConfig(siteConfig, {
       input: input5,
@@ -20183,7 +20576,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
     );
   } else {
     const tsxConfigPath = path68.join(resolvedSource, "apitogo.config.tsx");
-    const configContent = await readFile21(tsxConfigPath, "utf8");
+    const configContent = await readFile22(tsxConfigPath, "utf8");
     try {
       const patched = patchApitogoConfigOpenApiToFile(configContent, input5);
       await writeFile19(tsxConfigPath, patched);
@@ -20539,7 +20932,7 @@ export default function ${componentName}() {
 // src/cli/make-config/scaffold-project.ts
 init_package_json();
 import { constants } from "node:fs";
-import { access as access11, mkdir as mkdir16, readFile as readFile22, writeFile as writeFile20 } from "node:fs/promises";
+import { access as access11, mkdir as mkdir16, readFile as readFile23, writeFile as writeFile20 } from "node:fs/promises";
 import path70 from "node:path";
 import { glob as glob7 } from "glob";
 
@@ -20621,7 +21014,7 @@ async function ensurePackageJson2(dir) {
 `, "utf8");
     return true;
   }
-  const raw = await readFile22(pkgPath, "utf8");
+  const raw = await readFile23(pkgPath, "utf8");
   let pkg;
   try {
     pkg = JSON.parse(raw);
@@ -20750,7 +21143,7 @@ var fileExists3 = async (filePath) => {
   }
 };
 var readJsonConfig = async (filePath) => {
-  const raw = await readFile23(filePath, "utf8");
+  const raw = await readFile24(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject3(parsed)) {
     throw new Error(`${APITOGO_JSON_FILENAME} must be a JSON object.`);
@@ -20800,7 +21193,7 @@ async function persistConfig(config2, ctx) {
 `, "utf8");
   const tsxPath = path71.join(ctx.dir, "apitogo.config.tsx");
   if (await fileExists3(tsxPath) && tsxRoutes.length > 0) {
-    const tsxSource = await readFile23(tsxPath, "utf8");
+    const tsxSource = await readFile24(tsxPath, "utf8");
     if (isManagedConfigWrapper(tsxSource)) {
       await writeFile21(
         tsxPath,
@@ -21172,7 +21565,7 @@ var config_default = {
 };
 
 // src/cli/cmds/deploy.ts
-import path85 from "node:path";
+import path86 from "node:path";
 
 // src/cli/apply/handler.ts
 import path82 from "node:path";
@@ -21196,15 +21589,15 @@ function buildGatewayPlansValidationRequest(plans) {
     };
   });
 }
-function toConfigIssue(issue3) {
+function toConfigIssue(issue4) {
   return {
-    ...issue3,
-    field: issue3.field.replace(/\.limitsJson$/, ".limits")
+    ...issue4,
+    field: issue4.field.replace(/\.limitsJson$/, ".limits")
   };
 }
-function formatGatewayPlanIssue(issue3) {
-  const sku = issue3.sku ? ` (${issue3.sku})` : "";
-  return `${issue3.field}${sku}: ${issue3.message}`;
+function formatGatewayPlanIssue(issue4) {
+  const sku = issue4.sku ? ` (${issue4.sku})` : "";
+  return `${issue4.field}${sku}: ${issue4.message}`;
 }
 async function checkGatewayPlansOnPlatform(client, args) {
   let result;
@@ -21227,10 +21620,10 @@ async function checkGatewayPlansOnPlatform(client, args) {
 async function assertGatewayPlansValidForPublish(client, args) {
   const localErrors = args.localErrors ?? [];
   const check2 = await checkGatewayPlansOnPlatform(client, args);
-  const localFields = new Set(localErrors.map((issue3) => issue3.field));
+  const localFields = new Set(localErrors.map((issue4) => issue4.field));
   const errors = [
     ...localErrors,
-    ...(check2?.errors ?? []).filter((issue3) => !localFields.has(issue3.field))
+    ...(check2?.errors ?? []).filter((issue4) => !localFields.has(issue4.field))
   ];
   if (errors.length === 0) {
     return { blocked: false };
@@ -21704,8 +22097,8 @@ function normalizeActionKey(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path104 = pathParts.join(":").trim();
-    return `${method2?.toLowerCase()}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
+    const path105 = pathParts.join(":").trim();
+    return `${method2?.toLowerCase()}:${path105.startsWith("/") ? path105 : `/${path105}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -21714,8 +22107,8 @@ function normalizeActionKey(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path103 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  const path104 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 async function applyGatewayPublicRoutes(client, projectId, routes, options) {
   const applied = [];
@@ -22193,7 +22586,7 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
 }
 
 // src/cli/platform/helpers/openapi-gateway-servers.ts
-import { mkdir as mkdir18, readFile as readFile24, writeFile as writeFile22 } from "node:fs/promises";
+import { mkdir as mkdir18, readFile as readFile25, writeFile as writeFile22 } from "node:fs/promises";
 import path74 from "node:path";
 import YAML3 from "yaml";
 var GATEWAY_URL_ENV_KEY = "APITOGO_GATEWAY_URL";
@@ -22225,7 +22618,7 @@ async function resolveProjectGatewayUrl(client, projectId) {
   return null;
 }
 async function readOpenApiDocument(filePath) {
-  const content = await readFile24(filePath, "utf8");
+  const content = await readFile25(filePath, "utf8");
   const ext = path74.extname(filePath).toLowerCase();
   const parsed = ext === ".json" ? JSON.parse(content) : YAML3.parse(content);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -22254,7 +22647,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
     path74.resolve(siteDirectory),
     APITOGO_CONFIG_FILENAME2
   );
-  const raw = await readFile24(configPath, "utf8");
+  const raw = await readFile25(configPath, "utf8");
   const config2 = JSON.parse(raw);
   const previousApis = config2.apis;
   const previousBackend = config2.backend;
@@ -22271,7 +22664,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
 `, "utf8");
   return {
     restore: async () => {
-      const currentRaw = await readFile24(configPath, "utf8");
+      const currentRaw = await readFile25(configPath, "utf8");
       const current = JSON.parse(currentRaw);
       if (previousApis === void 0) {
         delete current.apis;
@@ -22306,7 +22699,7 @@ async function prepareOpenApiServersForGatewayBuild(options) {
   );
   if (!openApiPath) {
     try {
-      const raw = await readFile24(
+      const raw = await readFile25(
         path74.join(siteDirectory, APITOGO_CONFIG_FILENAME2),
         "utf8"
       );
@@ -22336,8 +22729,8 @@ function normalizeActionKeyFormat(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path104 = pathParts.join(":").trim();
-    return `${method2.toLowerCase()}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
+    const path105 = pathParts.join(":").trim();
+    return `${method2.toLowerCase()}:${path105.startsWith("/") ? path105 : `/${path105}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -22346,8 +22739,8 @@ function normalizeActionKeyFormat(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path103 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  const path104 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 function normalizePublicRoute(route) {
   const trimmed = route.trim();
@@ -22380,7 +22773,7 @@ function collectManifestPublicActionKeys(gateway) {
 }
 
 // src/cli/platform/helpers/publish-ledger.ts
-import { mkdir as mkdir19, readFile as readFile25, writeFile as writeFile23 } from "node:fs/promises";
+import { mkdir as mkdir19, readFile as readFile26, writeFile as writeFile23 } from "node:fs/promises";
 import path75 from "node:path";
 var PUBLISH_LEDGER_RELATIVE_PATH = ".apitogo/publish-state.json";
 function publishLedgerPath(siteDirectory) {
@@ -22389,7 +22782,7 @@ function publishLedgerPath(siteDirectory) {
 async function readPublishLedger(siteDirectory) {
   const filePath = publishLedgerPath(siteDirectory);
   try {
-    const raw = await readFile25(filePath, "utf8");
+    const raw = await readFile26(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || !Array.isArray(parsed.steps)) {
       return null;
@@ -24092,6 +24485,10 @@ function resumedCreateStep(projectId) {
   };
 }
 async function resolveBootstrapProjectId(client, args, steps) {
+  if (args.projectId) {
+    steps.push(resumedCreateStep(args.projectId));
+    return { projectId: args.projectId, resumed: true };
+  }
   const existing = await findExistingProjectByName(client, args.name);
   if (existing) {
     steps.push(resumedCreateStep(existing.id));
@@ -24151,11 +24548,14 @@ async function handleBootstrapProject(client, config2, args, progress) {
     {
       name: args.name,
       description: args.description,
-      modules
+      modules,
+      projectId: args.projectId
     },
     steps
   );
-  if (selectFreePlan && !resumed) {
+  await args.onProjectResolved?.(projectId);
+  const continuingWithoutPlan = selectFreePlan && args.projectId !== void 0 && isPlatformPlanUnselected((await client.getProject(projectId)).planTier);
+  if (selectFreePlan && (!resumed || continuingWithoutPlan)) {
     await bootstrapProgress?.onStep("Selecting free plan");
     const freeResult = await handleSelectFreePlan(
       client,
@@ -24167,7 +24567,7 @@ async function handleBootstrapProject(client, config2, args, progress) {
       return freeResult;
     }
     steps.push({ step: "select_free_plan", status: "succeeded" });
-  } else if (selectFreePlan && resumed) {
+  } else if (selectFreePlan && resumed && !continuingWithoutPlan) {
     steps.push({
       step: "select_free_plan",
       status: "skipped",
@@ -24356,9 +24756,9 @@ async function handleTeardownProject(client, config2, args, progress) {
 
 // src/cli/platform/tools/dev-portal-bootstrap-shared.ts
 var BootstrapStepError = class extends Error {
-  constructor(failedStep, message, recoveryHint) {
+  constructor(failedStep2, message, recoveryHint) {
     super(message);
-    this.failedStep = failedStep;
+    this.failedStep = failedStep2;
     this.recoveryHint = recoveryHint;
     this.name = "BootstrapStepError";
   }
@@ -24561,7 +24961,7 @@ async function resolveProjectIdForPublish(client, config2, args, wait, progress,
 import path81 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-site-api-url.ts
-import { readdir as readdir3, readFile as readFile26, writeFile as writeFile24 } from "node:fs/promises";
+import { readdir as readdir3, readFile as readFile27, writeFile as writeFile24 } from "node:fs/promises";
 import path78 from "node:path";
 var SITE_API_BASE_URL_ENV_KEY = "VITE_APITOGO_AUTHENTICATION_API_BASE_URL";
 var PLACEHOLDER_HOST_MARKERS = [
@@ -24586,7 +24986,7 @@ async function readSiteApiBaseUrl(sourceDirectory) {
   const resolved = path78.resolve(sourceDirectory);
   for (const envFile of [".env", ".env.production"]) {
     try {
-      const content = await readFile26(path78.join(resolved, envFile), "utf8");
+      const content = await readFile27(path78.join(resolved, envFile), "utf8");
       const lines = [...content.matchAll(ENV_LINE_GLOBAL_RE)];
       if (lines.length === 0) {
         continue;
@@ -24617,7 +25017,7 @@ async function patchSiteApiBaseUrl(sourceDirectory, apiBaseUrl) {
   for (const envFile of [".env.production", ".env"]) {
     const envPath = path78.join(resolved, envFile);
     try {
-      const content = await readFile26(envPath, "utf8");
+      const content = await readFile27(envPath, "utf8");
       const withoutAssignments = content.replace(ENV_LINE_GLOBAL_RE, "").replace(/\n{3,}/g, "\n\n").trimEnd();
       const patched = withoutAssignments ? `${withoutAssignments}
 ${line2}
@@ -24697,7 +25097,7 @@ async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiB
   let found = false;
   let foundPlaceholder = false;
   for await (const file of walkFiles(dist)) {
-    const content = await readFile26(file, "utf8");
+    const content = await readFile27(file, "utf8");
     if (content.includes(needle)) {
       found = true;
     }
@@ -25382,7 +25782,7 @@ function throwOnManifestIssues(issues) {
     return;
   }
   throw new Error(
-    `apitogo.config.json is not platform-compatible: ${issues.map((issue3) => `${issue3.field}: ${issue3.message}`).join("; ")}`
+    `apitogo.config.json is not platform-compatible: ${issues.map((issue4) => `${issue4.field}: ${issue4.message}`).join("; ")}`
   );
 }
 async function runApplyFromSiteDirectory(client, config2, args, progress) {
@@ -26400,14 +26800,14 @@ function formatBlockedOrFailedResultForHuman(parsed) {
     const lines = [
       typeof parsed.userMessage === "string" ? parsed.userMessage : "Deploy is blocked: apitogo.config.json has errors."
     ];
-    for (const issue3 of Array.isArray(parsed.errors) ? parsed.errors : []) {
-      lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
+    for (const issue4 of Array.isArray(parsed.errors) ? parsed.errors : []) {
+      lines.push(`  - ${formatGatewayPlanIssue(issue4)}`);
     }
     const warnings = Array.isArray(parsed.warnings) ? parsed.warnings : [];
     if (warnings.length > 0) {
       lines.push("", "Warnings:");
-      for (const issue3 of warnings) {
-        lines.push(`  - ${formatGatewayPlanIssue(issue3)}`);
+      for (const issue4 of warnings) {
+        lines.push(`  - ${formatGatewayPlanIssue(issue4)}`);
       }
     }
     lines.push(
@@ -26824,7 +27224,7 @@ async function apply(argv) {
 
 // src/cli/deploy/command.ts
 init_invariant();
-import path84 from "node:path";
+import path85 from "node:path";
 
 // src/cli/deploy/v2.ts
 import { rm as rm12 } from "node:fs/promises";
@@ -26836,7 +27236,7 @@ import path83 from "node:path";
 
 // src/cli/deploy/gateway.ts
 import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile27 } from "node:fs/promises";
+import { readFile as readFile28 } from "node:fs/promises";
 init_invariant();
 var GatewayDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -26876,7 +27276,7 @@ async function readSpec(gateway) {
       "Add one to gateway.specs in the config."
     );
   try {
-    return await readFile27(file);
+    return await readFile28(file);
   } catch {
     throw new GatewayDeployError(
       "GATEWAY_SPEC_UNREADABLE",
@@ -27070,58 +27470,692 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
   };
 }
 
-// src/cli/portal/report.ts
-var DEPLOY_ORDER = [
-  "identity",
-  "gateway",
-  "plans",
-  "portal"
-];
-var exists4 = (file) => access13(file).then(
-  () => true,
-  () => false
-);
-function sectionOf(resolved, service) {
-  return resolved[service];
+// src/cli/deploy/identity.ts
+init_invariant();
+var IdentityDeployError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot deploy identity" });
+    this.code = code;
+    this.name = "IdentityDeployError";
+  }
+};
+var IDENTITY_STEPS = ["request", "activate"];
+var PORTAL_CALLBACK_PATH = "/oauth/callback";
+var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function identityNotDeployableReason(resolved) {
+  const identity = resolved.identity;
+  if (!identity) return "identity is not in the config";
+  if (identity.provider === "oidc" && (!identity.issuer || !identity.clientId))
+    return 'identity.provider "oidc" needs issuer and clientId';
+  return void 0;
 }
-function chooseServices(only) {
-  return DEPLOY_ORDER.filter((name) => !only || only.includes(name));
+function identityBodyForRedirect(resolved, redirectUri) {
+  return {
+    portalRedirectUris: [redirectUri],
+    nativeSignup: resolved.identity?.native ?? true
+  };
 }
-async function planPortalService(resolved, ledger) {
-  const base = { service: "portal", details: [] };
-  try {
-    const manifest = await readManifest(resolved.state);
-    const prepared = await preparePortal(resolved, manifest, "production", {
-      write: false
-    });
-    const { profile, plan: plan2 } = prepared;
-    const details = [
-      `docs: ${!profile.docs.enabled ? "off" : profile.docs.provider === "external" ? `external (${profile.docs.url})` : "built by apitogo"}`,
-      `console: ${profile.console.enabled ? "on" : "off"}`,
-      `manifest: ${prepared.manifestSource === "file" ? "services.json" : "not needed"}`,
-      ...[
-        plan2.auth ? "sign-in" : void 0,
-        plan2.signup ? "sign-up" : void 0,
-        plan2.userPanel ? "account pages" : void 0,
-        plan2.plansPlugin ? "pricing, keys and usage pages" : void 0,
-        plan2.apiReference ? "API reference" : void 0
-      ].filter((feature) => feature !== void 0).map((feature) => `will appear: ${feature}`),
-      ...plan2.skipped.map((s) => `left out: ${s.piece} (${s.reason})`)
-    ];
-    const hash2 = await portalBuildHash(resolved, prepared);
-    const previous = stepOf(ledger, "portal", "build");
-    const built = await exists4(
-      path83.join(resolved.state.buildDir, "index.html")
+function identityRequestBody(resolved, portalUrl) {
+  return identityBodyForRedirect(
+    resolved,
+    `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
+  );
+}
+function identityInputsHash(projectId, body) {
+  return stableJson({ projectId, body });
+}
+async function portalUrlOf(resolved, projectId, client) {
+  const known = (await readManifest(resolved.state))?.services.portal?.url;
+  const url2 = known ?? resolveSwaUrl(await client.getProject(projectId));
+  if (!url2)
+    throw new IdentityDeployError(
+      "IDENTITY_PORTAL_ADDRESS_UNKNOWN",
+      "The portal has no public address yet, and the identity needs it for the sign-in redirect.",
+      "Run `apitogo deploy --only portal` once so the platform gives the portal an address, then deploy identity."
     );
-    if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
-      return {
-        ...base,
-        action: "skip",
-        reason: "build skipped: nothing it depends on has changed",
-        details,
-        issues: []
-      };
-    }
+  return url2;
+}
+function rejected2(error) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_SETTINGS_CHANGED",
+      "This project already has an identity with other settings, and its audience and portal address cannot be changed in place.",
+      "Keep the portal address as it was, or remove the identity first (this deletes every user in it)."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_REJECTED",
+      `The platform refused the identity request:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the cause in apitogo.config.json and run deploy again."
+    );
+  }
+  throw error;
+}
+async function recordOwnProvider(resolved, projectId) {
+  const identity = resolved.identity;
+  const issuer = identity?.issuer?.replace(/\/+$/, "");
+  const clientId = identity?.clientId;
+  if (!issuer || !clientId)
+    throw new Error("identity.issuer and identity.clientId are needed.");
+  const known = (await readManifest(resolved.state))?.services.identity;
+  const changed = known?.provider !== "oidc" || known.issuer !== issuer || known.clientId !== clientId;
+  if (changed)
+    await writeManifest(
+      resolved.state,
+      withIdentityEntry(await readManifest(resolved.state), {
+        projectId,
+        projectName: resolved.project.name,
+        provider: "oidc",
+        issuer,
+        clientId,
+        nativeSignup: false
+      })
+    );
+  return {
+    status: changed ? "deployed" : "unchanged",
+    steps: [],
+    issuer,
+    clientId
+  };
+}
+async function deployIdentity(resolved, projectId, deps, options = {}) {
+  if (resolved.identity?.provider === "oidc")
+    return recordOwnProvider(resolved, projectId);
+  const client = deps.client;
+  const sleep5 = deps.sleep ?? defaultSleep2;
+  const now = deps.now ?? Date.now;
+  const timeoutMs = deps.activateTimeoutMs ?? 12e4;
+  const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const portalUrl = await portalUrlOf(resolved, projectId, client);
+  const body = identityRequestBody(resolved, portalUrl);
+  const inputsHash = identityInputsHash(projectId, body);
+  const requestStep = {
+    name: "request",
+    hash: () => inputsHash,
+    run: async () => {
+      try {
+        const answer = await client.putProjectIdentity(projectId, body);
+        return {
+          status: answer.status,
+          redirectUri: body.portalRedirectUris[0] ?? ""
+        };
+      } catch (error) {
+        return rejected2(error);
+      }
+    },
+    // An identity that was removed, or that failed, is not a result worth keeping.
+    stillValid: async () => {
+      const found = await client.getProjectIdentity(projectId);
+      return found !== null && found.status !== "Failed" && found.status !== "Released" && found.status !== "Releasing";
+    }
+  };
+  const activateStep = {
+    name: "activate",
+    hash: () => inputsHash,
+    run: async () => {
+      const deadline = now() + timeoutMs;
+      for (; ; ) {
+        const found = await client.getProjectIdentity(projectId);
+        if (found?.status === "Active")
+          return {
+            issuer: found.issuer,
+            clientId: found.clientId,
+            audience: found.audience,
+            nativeSignup: String(found.nativeSignup)
+          };
+        if (found?.status === "Failed")
+          throw new IdentityDeployError(
+            "IDENTITY_FAILED",
+            `The platform could not make the identity: ${[found.errorCode, found.errorMessage].filter(Boolean).join(" ") || "it failed"}.`,
+            "Fix the cause and run deploy again; the request is sent again."
+          );
+        if (now() >= deadline)
+          throw new IdentityDeployError(
+            "IDENTITY_TIMEOUT",
+            `The identity did not become active within ${Math.round(timeoutMs / 1e3)} seconds (state: ${found?.status ?? "not found"}).`,
+            "Run deploy again to keep waiting."
+          );
+        await sleep5(intervalMs);
+      }
+    },
+    stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
+  };
+  const outcomes = await runPipeline(
+    resolved.state,
+    "identity",
+    [requestStep, activateStep],
+    { force: options.force }
+  );
+  const activate = outcomes.find((outcome) => outcome.step === "activate");
+  const ran = activate !== void 0 && !activate.skipped;
+  const known = (await readManifest(resolved.state))?.services.identity;
+  let learned;
+  if (ran || known?.issuer === void 0) {
+    learned = await client.getProjectIdentity(projectId) ?? void 0;
+    if (learned?.status === "Active") {
+      await writeManifest(
+        resolved.state,
+        withIdentityEntry(await readManifest(resolved.state), {
+          projectId,
+          projectName: resolved.project.name,
+          issuer: learned.issuer,
+          clientId: learned.clientId,
+          audience: learned.audience,
+          nativeSignup: learned.nativeSignup
+        })
+      );
+    }
+  }
+  return {
+    status: ran ? "deployed" : "unchanged",
+    steps: outcomes.map((outcome) => ({
+      step: outcome.step,
+      skipped: outcome.skipped
+    })),
+    issuer: learned?.issuer ?? known?.issuer,
+    clientId: learned?.clientId ?? known?.clientId
+  };
+}
+
+// src/cli/deploy/plans.ts
+init_invariant();
+var PlansDeployError = class extends ApitogoError {
+  constructor(code, message, developerHint) {
+    super(message, { developerHint, title: "Cannot deploy plans" });
+    this.code = code;
+    this.name = "PlansDeployError";
+  }
+};
+var PLANS_STEPS = ["catalog", "backend", "identity-link"];
+var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var BACKEND_MODULE = "dev-portal";
+var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
+async function plansInputs(resolved, projectId) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
+  const wanted = toPlatformPlans(await readPlansFile(plans.file));
+  const manifest = await readManifest(resolved.state);
+  const identity = manifest?.services.identity;
+  const ownIdentity = Boolean(
+    identity?.provider === "apitogo" && identity.issuer
+  );
+  return {
+    wanted,
+    manifest,
+    ownIdentity,
+    catalogHash: stableJson({ projectId, plans: wanted }),
+    backendHash: stableJson({ projectId }),
+    linkHash: stableJson({
+      projectId,
+      issuer: identity?.issuer,
+      clientId: identity?.clientId
+    })
+  };
+}
+function plansNotDeployableReason(resolved) {
+  return resolved.plans ? void 0 : "plans is not in the config";
+}
+async function allActionKeys(client, projectId) {
+  const keys = [];
+  try {
+    for (let page = 1; ; page++) {
+      const result = await client.listGatewayActions(projectId, page, 100);
+      keys.push(...result.items.map((item) => item.actionKey));
+      if (result.items.length === 0 || page * result.pageSize >= result.totalCount)
+        break;
+    }
+  } catch {
+    return [];
+  }
+  return keys;
+}
+function refused(error) {
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new PlansDeployError(
+      "PLANS_REJECTED",
+      `The platform refused a plan:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the plan in the plans file and run deploy again."
+    );
+  }
+  throw error;
+}
+async function deployPlans(resolved, projectId, deps, options = {}) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
+  const client = deps.client;
+  const sleep5 = deps.sleep ?? defaultSleep3;
+  const now = deps.now ?? Date.now;
+  const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
+  const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
+  const { wanted, manifest, ownIdentity, catalogHash, backendHash, linkHash } = await plansInputs(resolved, projectId);
+  const catalogStep = {
+    name: "catalog",
+    hash: () => catalogHash,
+    run: async () => {
+      if (wanted.length === 0) return { created: "0", updated: "0" };
+      const fallback = wanted.some((plan2) => plan2.includedActionKeys === null) ? await allActionKeys(client, projectId) : [];
+      const bodies = wanted.map((plan2) => ({
+        ...plan2,
+        includedActionKeys: plan2.includedActionKeys ?? fallback
+      }));
+      const checked = await client.validateGatewayPlans(bodies, { projectId });
+      if (!checked.valid)
+        throw new PlansDeployError(
+          "PLANS_REJECTED",
+          `The platform refused the plans:
+  ${checked.errors.map((issue4) => `${issue4.field}: ${issue4.message}`).join("\n  ")}`,
+          "Fix the listed problems in the plans file and run deploy again."
+        );
+      const existing = new Map(
+        (await client.listGatewayPlans(projectId)).map((plan2) => [
+          plan2.sku.toLowerCase(),
+          plan2
+        ])
+      );
+      let created = 0;
+      let updated = 0;
+      for (const body of bodies) {
+        const found = existing.get(body.sku);
+        try {
+          if (found) {
+            await client.updateGatewayPlan(projectId, found.id, {
+              displayName: body.displayName,
+              isActive: true,
+              limitsJson: body.limitsJson ?? null,
+              includedActionKeys: body.includedActionKeys,
+              priceAmount: body.priceAmount,
+              pricingModel: body.pricingModel,
+              priceLabel: body.priceLabel,
+              priceCurrency: body.priceCurrency,
+              billingPeriod: body.billingPeriod,
+              sortOrder: body.sortOrder
+            });
+            updated++;
+          } else {
+            await client.createGatewayPlan(projectId, body);
+            created++;
+          }
+        } catch (error) {
+          refused(error);
+        }
+      }
+      return { created: String(created), updated: String(updated) };
+    },
+    // A plan someone deleted on the platform is not a result worth keeping.
+    stillValid: async () => {
+      const present = new Set(
+        (await client.listGatewayPlans(projectId)).filter((plan2) => plan2.isActive).map((plan2) => plan2.sku.toLowerCase())
+      );
+      return wanted.every((plan2) => present.has(plan2.sku));
+    }
+  };
+  const backendOf = async () => (await client.getDevPortalBackend(projectId))?.fqdn;
+  const backendStep = {
+    name: "backend",
+    hash: () => backendHash,
+    run: async () => {
+      let fqdn = await backendOf();
+      if (!fqdn) {
+        await client.activateModule(projectId, BACKEND_MODULE);
+        const deadline = now() + backendTimeoutMs;
+        for (; ; ) {
+          fqdn = await backendOf();
+          if (fqdn) break;
+          if (now() >= deadline)
+            throw new PlansDeployError(
+              "PLANS_BACKEND_TIMEOUT",
+              `The plans backend did not get an address within ${Math.round(backendTimeoutMs / 1e3)} seconds.`,
+              "Run deploy again to keep waiting."
+            );
+          await sleep5(intervalMs);
+        }
+      }
+      return { fqdn };
+    },
+    stillValid: async () => Boolean(await backendOf())
+  };
+  const linkStep = {
+    name: "identity-link",
+    hash: () => linkHash,
+    run: async () => {
+      const queued = await client.linkDevPortalIdentity(projectId);
+      const deadline = now() + linkTimeoutMs;
+      for (; ; ) {
+        const job = (await client.listProvisioningJobs(projectId)).jobs.find(
+          (item) => item.id === queued.jobId
+        );
+        const status2 = job?.status.toLowerCase();
+        if (status2?.startsWith("completed")) return { jobId: queued.jobId };
+        if (status2 === "failed")
+          throw new PlansDeployError(
+            "PLANS_LINK_FAILED",
+            `Applying the identity to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
+            "Run deploy again; the link is applied again."
+          );
+        if (now() >= deadline)
+          throw new PlansDeployError(
+            "PLANS_LINK_TIMEOUT",
+            `Applying the identity did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
+            "Run deploy again to keep waiting."
+          );
+        await sleep5(intervalMs);
+      }
+    }
+  };
+  const steps = [catalogStep, backendStep, ...ownIdentity ? [linkStep] : []];
+  const outcomes = await runPipeline(
+    resolved.state,
+    "plans",
+    steps,
+    {
+      force: options.force
+    }
+  );
+  const catalog = outcomes.find((outcome) => outcome.step === "catalog");
+  const ran = outcomes.some((outcome) => !outcome.skipped);
+  const known = manifest?.services.plans;
+  let apiBaseUrl = known?.apiBaseUrl;
+  if (ran || known?.apiBaseUrl === void 0) {
+    apiBaseUrl = toApiBaseUrl(await backendOf()) ?? apiBaseUrl;
+    if (apiBaseUrl) {
+      const previous = known?.catalogRevision ?? 0;
+      await writeManifest(
+        resolved.state,
+        withPlansEntry(await readManifest(resolved.state), {
+          projectId,
+          projectName: resolved.project.name,
+          apiBaseUrl,
+          billing: plans.billing.provider,
+          catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
+          capabilities: PLANS_CAPABILITIES
+        })
+      );
+    }
+  }
+  return {
+    status: ran ? "deployed" : "unchanged",
+    steps: outcomes.map((outcome) => ({
+      step: outcome.step,
+      skipped: outcome.skipped
+    })),
+    apiBaseUrl
+  };
+}
+
+// src/cli/portal/services-report.ts
+function stepState(record, hash2) {
+  if (!record) return "not done yet";
+  if (record.status === "failed")
+    return `failed last time (${record.error ?? "no message"})`;
+  if (record.status === "running") return "did not finish last time";
+  if (hash2 === void 0)
+    return "done (cannot compare: an input is not known locally)";
+  return record.hash === hash2 ? "done, unchanged" : "inputs changed";
+}
+var isDone = (record, hash2) => record?.status === "succeeded" && hash2 !== void 0 && record.hash === hash2;
+async function planIdentityService(resolved, ledger, manifest) {
+  const base = { service: "identity", issues: [] };
+  const identity = resolved.identity;
+  if (!identity) throw new Error("identity is not configured");
+  const why = identityNotDeployableReason(resolved);
+  if (why)
+    return {
+      ...base,
+      action: "not-deployable-yet",
+      reason: `configured, but ${why}`,
+      details: []
+    };
+  const known = manifest?.services.identity;
+  if (identity.provider === "oidc") {
+    const same = known?.provider === "oidc" && known.issuer === identity.issuer?.replace(/\/+$/, "") && known.clientId === identity.clientId;
+    return {
+      ...base,
+      action: same ? "skip" : "deploy",
+      reason: same ? "deploy skipped: services.json already records your sign-in provider" : "will record your own sign-in provider in services.json (nothing is made on the platform)",
+      details: [
+        `provider: oidc ${identity.issuer}`,
+        `client id: ${identity.clientId}`
+      ]
+    };
+  }
+  const projectId = resolved.project.id;
+  const portalUrl = manifest?.services.portal?.url;
+  const recorded = stepOf(ledger, "identity", "request")?.output?.redirectUri;
+  const body = portalUrl ? identityRequestBody(resolved, portalUrl) : recorded ? identityBodyForRedirect(resolved, recorded) : void 0;
+  const hash2 = projectId && body ? identityInputsHash(projectId, body) : void 0;
+  const details = [
+    "provider: apitogo (one issuer for this project)",
+    `sign-up with email and password: ${identity.native ? "on" : "off"}`,
+    portalUrl ? `sign-in redirect: ${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}` : recorded ? `sign-in redirect: ${recorded} (sent by the last deploy)` : "sign-in redirect: the portal address is not known locally; deploy takes it from the project",
+    ...known?.issuer ? [`issuer: ${known.issuer}`] : [],
+    ...IDENTITY_STEPS.map(
+      (name) => `step ${name}: ${stepState(stepOf(ledger, "identity", name), hash2)}`
+    )
+  ];
+  const allDone = IDENTITY_STEPS.every(
+    (name) => isDone(stepOf(ledger, "identity", name), hash2)
+  );
+  return {
+    ...base,
+    action: allDone ? "skip" : "deploy",
+    reason: allDone ? "deploy skipped: nothing it depends on has changed" : "will deploy: the identity is not made yet, or its settings changed",
+    details
+  };
+}
+async function planPlansService(resolved, ledger) {
+  const base = { service: "plans", issues: [] };
+  const why = plansNotDeployableReason(resolved);
+  if (why)
+    return {
+      ...base,
+      action: "not-deployable-yet",
+      reason: `configured, but ${why}`,
+      details: []
+    };
+  const projectId = resolved.project.id ?? "";
+  let inputs;
+  try {
+    inputs = await plansInputs(resolved, projectId);
+  } catch (error) {
+    if (!(error instanceof PlansFileError)) throw error;
+    return {
+      ...base,
+      action: "blocked",
+      reason: "cannot deploy until this is fixed",
+      details: [],
+      issues: [
+        {
+          code: error.code,
+          path: "plans.file",
+          message: error.message,
+          hint: error.developerHint
+        }
+      ]
+    };
+  }
+  const hashes = {
+    catalog: projectId ? inputs.catalogHash : void 0,
+    backend: projectId ? inputs.backendHash : void 0,
+    "identity-link": projectId ? inputs.linkHash : void 0
+  };
+  const steps = PLANS_STEPS.filter(
+    (name) => name !== "identity-link" || inputs.ownIdentity
+  );
+  const details = [
+    ...inputs.wanted.length === 0 ? ["plans: none in the file"] : inputs.wanted.map((plan2) => `plan ${plan2.sku}: ${plan2.displayName}`),
+    inputs.ownIdentity ? "sign-in: the project's identity will be applied to the plans backend" : "sign-in: no identity of the platform deployed, so nothing is applied to the plans backend",
+    ...steps.map(
+      (name) => `step ${name}: ${stepState(stepOf(ledger, "plans", name), hashes[name])}`
+    )
+  ];
+  const allDone = steps.every(
+    (name) => isDone(stepOf(ledger, "plans", name), hashes[name])
+  );
+  return {
+    ...base,
+    action: allDone ? "skip" : "deploy",
+    reason: allDone ? "deploy skipped: nothing it depends on has changed" : "will deploy: the plans file, the backend or the identity is not applied yet",
+    details
+  };
+}
+var failedStep = (ledger, service, names) => names.map((name) => ({ name, record: stepOf(ledger, service, name) })).find((step2) => step2.record?.status === "failed");
+var unreachable = (error) => `platform: not reachable (${error instanceof Error ? error.message : String(error)}); showing local records only`;
+async function identityStatus(resolved, ledger, manifest, remote) {
+  const entry = manifest?.services.identity;
+  const failed = failedStep(ledger, "identity", IDENTITY_STEPS);
+  const details = [];
+  if (entry?.provider) details.push(`provider: ${entry.provider}`);
+  if (entry?.issuer) details.push(`issuer: ${entry.issuer}`);
+  if (entry?.clientId) details.push(`client id: ${entry.clientId}`);
+  let state = entry ? "ready" : "not-deployed";
+  const projectId = resolved.project.id ?? manifest?.project.id;
+  if (resolved.identity?.provider === "oidc") {
+    details.push("platform: nothing to ask (your own sign-in provider)");
+  } else if (remote && projectId) {
+    try {
+      const platform = await remote(projectId);
+      if (!platform) {
+        details.push("platform: no identity for this project yet");
+        if (entry) state = "drift";
+      } else {
+        details.push(
+          `platform state: ${platform.status}`,
+          `sign-up with email and password: ${platform.nativeSignup ? "on" : "off"}`,
+          `sign-in redirect: ${platform.portalRedirectUris.join(", ") || "none"}`
+        );
+        if (platform.status === "Failed")
+          details.push(
+            `platform problem: ${[platform.errorCode, platform.errorMessage].filter(Boolean).join(" ") || "no message"}`
+          );
+        const same = entry?.issuer === platform.issuer.replace(/\/+$/, "");
+        if (entry && (!same || platform.status !== "Active")) {
+          details.push(
+            "drift: services.json does not match the platform's identity"
+          );
+          state = "drift";
+        }
+      }
+    } catch (error) {
+      details.push(unreachable(error));
+    }
+  } else if (!projectId) {
+    details.push("platform: not asked, this folder is not linked to a project");
+  } else {
+    details.push("platform: not asked, you are not logged in");
+  }
+  if (failed) {
+    details.push(`error: ${failed.record?.error ?? "unknown"}`);
+    state = "deploy-failed";
+  }
+  return { service: "identity", state, details };
+}
+async function plansStatus(resolved, ledger, manifest, remote, wantedSkus2) {
+  const entry = manifest?.services.plans;
+  const failed = failedStep(ledger, "plans", PLANS_STEPS);
+  const details = [];
+  if (entry?.apiBaseUrl) details.push(`plans backend: ${entry.apiBaseUrl}`);
+  if (entry?.catalogRevision !== void 0)
+    details.push(`catalog revision: ${entry.catalogRevision}`);
+  let state = entry ? "ready" : "not-deployed";
+  const projectId = resolved.project.id ?? manifest?.project.id;
+  if (remote && projectId) {
+    try {
+      const platform = await remote(projectId);
+      const active2 = platform.plans.filter((plan2) => plan2.isActive).map((plan2) => plan2.sku.toLowerCase());
+      details.push(
+        `plans on the platform: ${active2.length > 0 ? active2.join(", ") : "none"}`
+      );
+      const missing = (wantedSkus2 ?? []).filter((sku) => !active2.includes(sku));
+      if (missing.length > 0) {
+        details.push(
+          `drift: plans in the file but not on the platform: ${missing.join(", ")}`
+        );
+        if (entry) state = "drift";
+      }
+      if (!platform.backendAddress) {
+        details.push("platform: the plans backend has no address");
+        if (entry) state = "drift";
+      } else if (entry?.apiBaseUrl && entry.apiBaseUrl !== platform.backendAddress.replace(/\/+$/, "")) {
+        details.push(
+          `drift: the plans backend is at ${platform.backendAddress}, services.json says ${entry.apiBaseUrl}`
+        );
+        state = "drift";
+      }
+    } catch (error) {
+      details.push(
+        error instanceof PlatformApiError && error.status === 404 ? "platform: no plans for this project yet" : unreachable(error)
+      );
+    }
+  } else if (!projectId) {
+    details.push("platform: not asked, this folder is not linked to a project");
+  } else {
+    details.push("platform: not asked, you are not logged in");
+  }
+  if (failed) {
+    details.push(`error: ${failed.record?.error ?? "unknown"}`);
+    state = "deploy-failed";
+  }
+  return { service: "plans", state, details };
+}
+
+// src/cli/portal/report.ts
+var DEPLOY_ORDER = [
+  "identity",
+  "gateway",
+  "plans",
+  "portal"
+];
+var exists4 = (file) => access13(file).then(
+  () => true,
+  () => false
+);
+function sectionOf(resolved, service) {
+  return resolved[service];
+}
+function chooseServices(only) {
+  return DEPLOY_ORDER.filter((name) => !only || only.includes(name));
+}
+async function planPortalService(resolved, ledger) {
+  const base = { service: "portal", details: [] };
+  try {
+    const manifest = await readManifest(resolved.state);
+    const prepared = await preparePortal(resolved, manifest, "production", {
+      write: false
+    });
+    const { profile, plan: plan2 } = prepared;
+    const details = [
+      `docs: ${!profile.docs.enabled ? "off" : profile.docs.provider === "external" ? `external (${profile.docs.url})` : "built by apitogo"}`,
+      `console: ${profile.console.enabled ? "on" : "off"}`,
+      `manifest: ${prepared.manifestSource === "file" ? "services.json" : "not needed"}`,
+      ...[
+        plan2.auth ? "sign-in" : void 0,
+        plan2.signup ? "sign-up" : void 0,
+        plan2.userPanel ? "account pages" : void 0,
+        plan2.plansPlugin ? "pricing, keys and usage pages" : void 0,
+        plan2.apiReference ? "API reference" : void 0
+      ].filter((feature) => feature !== void 0).map((feature) => `will appear: ${feature}`),
+      ...plan2.skipped.map((s) => `left out: ${s.piece} (${s.reason})`)
+    ];
+    const hash2 = await portalBuildHash(resolved, prepared);
+    const previous = stepOf(ledger, "portal", "build");
+    const built = await exists4(
+      path83.join(resolved.state.buildDir, "index.html")
+    );
+    if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
+      return {
+        ...base,
+        action: "skip",
+        reason: "build skipped: nothing it depends on has changed",
+        details,
+        issues: []
+      };
+    }
     const reason = !previous ? "no earlier build" : previous.status === "failed" ? `the last build failed (${previous.error ?? "no message"})` : previous.status === "running" ? "the last build did not finish" : !built ? "the build folder is gone" : "its inputs changed since the last build";
     return {
       ...base,
@@ -27310,21 +28344,20 @@ async function planV2(dir, only, options = {}) {
       services.push(
         await planGatewayService(resolved, ledger, options.gatewayDryRun)
       );
+    } else if (service === "identity") {
+      services.push(
+        await planIdentityService(
+          resolved,
+          ledger,
+          await readManifest(resolved.state)
+        )
+      );
     } else {
-      services.push({
-        service,
-        action: "not-deployable-yet",
-        reason: "configured; deploying it is not available in this CLI version yet",
-        details: [],
-        issues: []
-      });
+      services.push(await planPlansService(resolved, ledger));
     }
   }
   return { configPath: resolved.configPath, services };
 }
-function entryStatus(manifest, service) {
-  return manifest?.services[service];
-}
 function originHealthLines(origin) {
   if (!origin.lastProbeAtUtc) return ["origin check: not checked yet"];
   return [
@@ -27398,6 +28431,16 @@ async function gatewayStatus(resolved, ledger, manifest, remote) {
   if (failed) state = "deploy-failed";
   return { service: "gateway", state, details: [...details, ...local] };
 }
+async function wantedSkus(resolved) {
+  if (!resolved.plans) return void 0;
+  try {
+    return (await readPlansFile(resolved.plans.file)).map(
+      (plan2) => plan2.sku.trim().toLowerCase()
+    );
+  } catch {
+    return void 0;
+  }
+}
 async function statusV2(dir, only, options = {}) {
   const { resolved } = loadConfigV2(dir);
   const ledger = await readLedger(resolved.state);
@@ -27413,7 +28456,6 @@ async function statusV2(dir, only, options = {}) {
       services.push({ service, state: "disabled", details: [] });
       continue;
     }
-    const entry = entryStatus(manifest, service);
     const url2 = service === "portal" ? manifest?.services.portal?.url : void 0;
     if (service === "portal") {
       const build2 = stepOf(ledger, "portal", "build");
@@ -27442,14 +28484,26 @@ async function statusV2(dir, only, options = {}) {
       );
       continue;
     }
-    services.push({
-      service,
-      state: entry ? "ready" : "not-deployed",
-      details: entry ? [
-        `status: ${entry.status ?? "ready"}`,
-        ...entry.provider ? [`provider: ${entry.provider}`] : []
-      ] : ["not in services.json: not deployed yet"]
-    });
+    if (service === "identity") {
+      services.push(
+        await identityStatus(
+          resolved,
+          ledger,
+          manifest,
+          options.identityRemote
+        )
+      );
+      continue;
+    }
+    services.push(
+      await plansStatus(
+        resolved,
+        ledger,
+        manifest,
+        options.plansRemote,
+        await wantedSkus(resolved)
+      )
+    );
   }
   return {
     configPath: resolved.configPath,
@@ -27466,7 +28520,7 @@ function formatPlan(output4) {
     `${svc.service}: ${svc.reason}`,
     ...svc.details.map((line2) => `  ${line2}`),
     ...svc.issues.map(
-      (issue3) => `  problem: ${issue3.message}${issue3.hint ? ` ${issue3.hint}` : ""} [${issue3.code}]`
+      (issue4) => `  problem: ${issue4.message}${issue4.hint ? ` ${issue4.hint}` : ""} [${issue4.code}]`
     )
   ]);
 }
@@ -27480,6 +28534,36 @@ function formatStatus(output4) {
   ];
 }
 
+// src/cli/deploy/static-web-config.ts
+import { access as access14, writeFile as writeFile25 } from "node:fs/promises";
+import path84 from "node:path";
+var STATIC_WEB_CONFIG_FILE = "staticwebapp.config.json";
+var STATIC_WEB_CONFIG_VERSION = 1;
+var DEFAULT_STATIC_WEB_CONFIG = {
+  navigationFallback: {
+    rewrite: "/index.html",
+    exclude: [
+      "/assets/*",
+      "/*.{png,jpg,jpeg,gif,svg,ico,css,js,mjs,json,txt,xml,webmanifest,woff,woff2,map}"
+    ]
+  }
+};
+async function ensureStaticWebConfig(buildDir) {
+  const file = path84.join(buildDir, STATIC_WEB_CONFIG_FILE);
+  try {
+    await access14(file);
+    return false;
+  } catch {
+    await writeFile25(
+      file,
+      `${JSON.stringify(DEFAULT_STATIC_WEB_CONFIG, null, 2)}
+`,
+      "utf8"
+    );
+    return true;
+  }
+}
+
 // src/cli/deploy/v2.ts
 var DeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -27504,8 +28588,9 @@ function parseDeployOnly(value) {
 function publishStep(deps, options) {
   return {
     name: "publish",
-    hash: () => `${options.buildHash}|${options.projectId}|${options.env ?? ""}`,
+    hash: () => `${options.buildHash}|${options.projectId}|${options.env ?? ""}|host-config-${STATIC_WEB_CONFIG_VERSION}`,
     run: async () => {
+      await ensureStaticWebConfig(options.buildDir);
       const pack = deps.pack ?? packageDirectoryAsTarGz;
       const archive = await pack(options.buildDir, { archiveRoot: "dist" });
       try {
@@ -27563,19 +28648,14 @@ async function deployV2(options, deps) {
       results.push(await deployGatewayService(options, deps, projectId, named));
       continue;
     }
-    if (service !== "portal") {
-      if (named)
-        throw new DeployError(
-          "SERVICE_NOT_DEPLOYABLE",
-          `Deploying ${service} is not available in this CLI version yet.`,
-          "Only the portal and the gateway can be deployed for now."
-        );
-      results.push({
-        service,
-        status: "skipped",
-        reason: "deploying it is not available in this CLI version yet",
-        steps: []
-      });
+    if (service === "identity") {
+      results.push(
+        await deployIdentityService(options, deps, projectId, named)
+      );
+      continue;
+    }
+    if (service === "plans") {
+      results.push(await deployPlansService(options, deps, projectId, named));
       continue;
     }
     results.push(await deployPortal(options, deps, projectId));
@@ -27619,6 +28699,65 @@ async function deployGatewayService(options, deps, projectId, named) {
     operationCount: result.operationCount
   };
 }
+async function deployIdentityService(options, deps, projectId, named) {
+  const { resolved } = loadConfigV2(options.dir);
+  const why = identityNotDeployableReason(resolved);
+  if (why) {
+    if (named)
+      throw new DeployError(
+        "SERVICE_NOT_DEPLOYABLE",
+        `Identity cannot be deployed: ${why}.`,
+        "Fix the identity section of the config, or deploy another service."
+      );
+    return { service: "identity", status: "skipped", reason: why, steps: [] };
+  }
+  const client = deps.client;
+  if (resolved.identity?.provider !== "oidc" && (!client.putProjectIdentity || !client.getProjectIdentity || !client.getProject))
+    throw new Error("The platform client has no identity calls.");
+  const result = await deployIdentity(
+    resolved,
+    projectId,
+    {
+      ...deps.identity,
+      client
+    },
+    { force: options.force }
+  );
+  return {
+    service: "identity",
+    status: result.status,
+    steps: result.steps,
+    url: result.issuer
+  };
+}
+async function deployPlansService(options, deps, projectId, named) {
+  const { resolved } = loadConfigV2(options.dir);
+  const why = plansNotDeployableReason(resolved);
+  if (why) {
+    if (named)
+      throw new DeployError(
+        "SERVICE_NOT_DEPLOYABLE",
+        `Plans cannot be deployed: ${why}.`,
+        "Add them with `apitogo add plans`, or deploy another service."
+      );
+    return { service: "plans", status: "skipped", reason: why, steps: [] };
+  }
+  const client = deps.client;
+  if (!client.listGatewayPlans || !client.createGatewayPlan || !client.updateGatewayPlan || !client.validateGatewayPlans || !client.listGatewayActions || !client.getDevPortalBackend || !client.activateModule || !client.linkDevPortalIdentity || !client.listProvisioningJobs)
+    throw new Error("The platform client has no plans calls.");
+  const result = await deployPlans(
+    resolved,
+    projectId,
+    { ...deps.plans, client },
+    { force: options.force }
+  );
+  return {
+    service: "plans",
+    status: result.status,
+    steps: result.steps,
+    url: result.apiBaseUrl
+  };
+}
 async function deployPortal(options, deps, projectId) {
   const { resolved, root, prepared } = await preparePortalWorkspace(
     options.dir,
@@ -27697,7 +28836,7 @@ async function deployProject(argv) {
     const config2 = loadConfig();
     const output4 = await deployV2(
       {
-        dir: path84.resolve(process.cwd(), argv.dir),
+        dir: path85.resolve(process.cwd(), argv.dir),
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         projectId: argv.projectId,
         env: argv.env,
@@ -27778,7 +28917,7 @@ var deploy_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo deploy" });
-    if (await isConfigV2(path85.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path86.resolve(process.cwd(), argv.dir))) {
       await deployProject(argv);
       return;
     }
@@ -27787,8 +28926,8 @@ var deploy_default = {
 };
 
 // src/cli/export/handler.ts
-import { mkdir as mkdir20, writeFile as writeFile25 } from "node:fs/promises";
-import path86 from "node:path";
+import { mkdir as mkdir20, writeFile as writeFile26 } from "node:fs/promises";
+import path87 from "node:path";
 init_invariant();
 var ExportError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -27802,7 +28941,7 @@ async function exportOpenApi(args, deps) {
       `Cannot export "${args.target}".`,
       "Only `apitogo export openapi` exists."
     );
-  const dir = path86.resolve(process.cwd(), args.dir ?? ".");
+  const dir = path87.resolve(process.cwd(), args.dir ?? ".");
   if (!await isConfigV2(dir))
     throw new ExportError(
       "This command needs a config version 2 project.",
@@ -27827,9 +28966,9 @@ async function exportOpenApi(args, deps) {
     throw error;
   }
   if (!args.out) return { text };
-  const file = path86.resolve(process.cwd(), args.out);
-  await mkdir20(path86.dirname(file), { recursive: true });
-  await writeFile25(file, text);
+  const file = path87.resolve(process.cwd(), args.out);
+  await mkdir20(path87.dirname(file), { recursive: true });
+  await writeFile26(file, text);
   return { text, file };
 }
 async function exportCommand(args) {
@@ -27879,15 +29018,15 @@ var export_default = {
 };
 
 // src/cli/init/handler.ts
-import path90 from "node:path";
+import path91 from "node:path";
 
 // src/cli/scaffold/run-scaffold-discovery.ts
-import { access as access15, readFile as readFile30, writeFile as writeFile27 } from "node:fs/promises";
-import path89 from "node:path";
+import { access as access16, readFile as readFile31, writeFile as writeFile28 } from "node:fs/promises";
+import path90 from "node:path";
 
 // src/cli/scaffold/detect-backend.ts
-import { readdir as readdir4, readFile as readFile28 } from "node:fs/promises";
-import path87 from "node:path";
+import { readdir as readdir4, readFile as readFile29 } from "node:fs/promises";
+import path88 from "node:path";
 var DEFAULT_RUNTIME_VERSION = {
   dotnet: "DOTNET_10",
   nodejs: "NODE_22_LTS",
@@ -27904,7 +29043,7 @@ async function listFiles(directory) {
 }
 async function readText(filePath) {
   try {
-    return await readFile28(filePath, "utf8");
+    return await readFile29(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -27933,15 +29072,15 @@ function isRunnableNodePackage(pkg) {
   return typeof scripts.start === "string" || typeof pkg.main === "string";
 }
 async function detectParentBackend(siteDirectory) {
-  const site = path87.resolve(siteDirectory);
-  const directory = path87.dirname(site);
+  const site = path88.resolve(siteDirectory);
+  const directory = path88.dirname(site);
   if (directory === site) {
     return void 0;
   }
   const files = await listFiles(directory);
   const toResult = (runtime, runtimeVersion, marker) => ({
     directory,
-    sourceDirectory: path87.relative(site, directory).split(path87.sep).join("/") || ".",
+    sourceDirectory: path88.relative(site, directory).split(path88.sep).join("/") || ".",
     runtime,
     runtimeVersion,
     marker
@@ -27949,7 +29088,7 @@ async function detectParentBackend(siteDirectory) {
   const csproj = files.find((f) => f.endsWith(".csproj"));
   const solution = files.find((f) => /\.slnx?$/.test(f));
   if (csproj || solution) {
-    const content = csproj ? await readText(path87.join(directory, csproj)) : void 0;
+    const content = csproj ? await readText(path88.join(directory, csproj)) : void 0;
     return toResult(
       "dotnet",
       dotnetVersionFromCsproj(content),
@@ -27957,7 +29096,7 @@ async function detectParentBackend(siteDirectory) {
     );
   }
   if (files.includes("package.json")) {
-    const raw = await readText(path87.join(directory, "package.json"));
+    const raw = await readText(path88.join(directory, "package.json"));
     try {
       const pkg = JSON.parse(raw ?? "");
       if (isRunnableNodePackage(pkg)) {
@@ -27972,7 +29111,7 @@ async function detectParentBackend(siteDirectory) {
   }
   const pythonMarker = PYTHON_MARKERS.find((m) => files.includes(m));
   if (pythonMarker) {
-    const versionSource = await readText(path87.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path87.join(directory, pythonMarker)))?.match(
+    const versionSource = await readText(path88.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path88.join(directory, pythonMarker)))?.match(
       /requires-python\s*=\s*"([^"]+)"/
     )?.[1] : void 0);
     return toResult(
@@ -27986,16 +29125,16 @@ async function detectParentBackend(siteDirectory) {
 
 // src/cli/scaffold/wire-docs.ts
 import {
-  access as access14,
+  access as access15,
   lstat as lstat2,
   mkdir as mkdir21,
   readdir as readdir5,
-  readFile as readFile29,
+  readFile as readFile30,
   readlink,
   symlink as symlink2,
-  writeFile as writeFile26
+  writeFile as writeFile27
 } from "node:fs/promises";
-import path88 from "node:path";
+import path89 from "node:path";
 var DOCS_DIR_WHITELIST = [
   "docs",
   "documents",
@@ -28017,7 +29156,7 @@ var PAGES_DIR = "pages";
 var CONFIG_FILENAME = "apitogo.config.json";
 async function pathExists5(filePath) {
   try {
-    await access14(filePath);
+    await access15(filePath);
     return true;
   } catch {
     return false;
@@ -28032,14 +29171,14 @@ async function isDirectory2(filePath) {
   }
 }
 function toPosix3(value) {
-  return value.split(path88.sep).join(path88.posix.sep);
+  return value.split(path89.sep).join(path89.posix.sep);
 }
 function isWhitelistedDirName(name) {
   return DOCS_DIR_WHITELIST.includes(name.toLowerCase());
 }
 function isInside2(parent, child) {
-  const relative = path88.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path88.isAbsolute(relative);
+  const relative = path89.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path89.isAbsolute(relative);
 }
 async function collectMarkdownFiles(dir, excludeDir) {
   const files = [];
@@ -28053,9 +29192,9 @@ async function collectMarkdownFiles(dir, excludeDir) {
     if (entry.name.startsWith(".")) {
       continue;
     }
-    const full = path88.join(dir, entry.name);
+    const full = path89.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path88.resolve(full) === excludeDir) {
+      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path89.resolve(full) === excludeDir) {
         continue;
       }
       files.push(...await collectMarkdownFiles(full, excludeDir));
@@ -28068,11 +29207,11 @@ async function collectMarkdownFiles(dir, excludeDir) {
   return files;
 }
 async function collectSearchRoots(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const parent = path88.dirname(site);
+  const site = path89.resolve(siteDirectory);
+  const parent = path89.dirname(site);
   const roots = [];
   const add = (dir) => {
-    const resolved = path88.resolve(dir);
+    const resolved = path89.resolve(dir);
     if (!roots.includes(resolved)) {
       roots.push(resolved);
     }
@@ -28085,7 +29224,7 @@ async function collectSearchRoots(siteDirectory) {
         if (!entry.isDirectory() || SKIP_SEARCH_DIRS.has(entry.name)) {
           continue;
         }
-        add(path88.join(parent, entry.name));
+        add(path89.join(parent, entry.name));
       }
     } catch {
     }
@@ -28094,13 +29233,13 @@ async function collectSearchRoots(siteDirectory) {
   return roots;
 }
 async function discoverNearbyDocsDirectories(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const sitePages = path88.join(site, PAGES_DIR);
+  const site = path89.resolve(siteDirectory);
+  const sitePages = path89.join(site, PAGES_DIR);
   const searchedDirectories = await collectSearchRoots(site);
   const directories = [];
   const seen = /* @__PURE__ */ new Set();
   const consider = async (dir) => {
-    const resolved = path88.resolve(dir);
+    const resolved = path89.resolve(dir);
     if (resolved === site || seen.has(resolved) || isInside2(sitePages, resolved)) {
       return;
     }
@@ -28117,7 +29256,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
     directories.push({ sourceDirectory: resolved, files });
   };
   for (const root of searchedDirectories) {
-    if (isWhitelistedDirName(path88.basename(root))) {
+    if (isWhitelistedDirName(path89.basename(root))) {
       await consider(root);
     }
     try {
@@ -28129,7 +29268,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
         if (!isWhitelistedDirName(entry.name)) {
           continue;
         }
-        await consider(path88.join(root, entry.name));
+        await consider(path89.join(root, entry.name));
       }
     } catch {
     }
@@ -28148,8 +29287,8 @@ function slugifyDirName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "docs";
 }
 async function allocateLinkName(pagesDir, sourceDirectory, used) {
-  const base = slugifyDirName(path88.basename(sourceDirectory));
-  const parent = slugifyDirName(path88.basename(path88.dirname(sourceDirectory)));
+  const base = slugifyDirName(path89.basename(sourceDirectory));
+  const parent = slugifyDirName(path89.basename(path89.dirname(sourceDirectory)));
   const candidates = [base, `${parent}-${base}`];
   let index = 2;
   while (true) {
@@ -28157,7 +29296,7 @@ async function allocateLinkName(pagesDir, sourceDirectory, used) {
     if (used.has(name)) {
       continue;
     }
-    const target = path88.join(pagesDir, name);
+    const target = path89.join(pagesDir, name);
     if (await pathExists5(target)) {
       const stat7 = await lstat2(target);
       if (!stat7.isDirectory() || !await isManagedLinkDir(target)) {
@@ -28188,8 +29327,8 @@ async function alreadyLinked(linkPath, sourcePath) {
       return false;
     }
     const current = await readlink(linkPath);
-    const resolved = path88.resolve(path88.dirname(linkPath), current);
-    return resolved === path88.resolve(sourcePath);
+    const resolved = path89.resolve(path89.dirname(linkPath), current);
+    return resolved === path89.resolve(sourcePath);
   } catch {
     return false;
   }
@@ -28201,8 +29340,8 @@ async function linkMarkdownFile(sourcePath, linkPath) {
   if (await pathExists5(linkPath)) {
     return "skipped";
   }
-  await mkdir21(path88.dirname(linkPath), { recursive: true });
-  const relativeTarget = path88.relative(path88.dirname(linkPath), sourcePath);
+  await mkdir21(path89.dirname(linkPath), { recursive: true });
+  const relativeTarget = path89.relative(path89.dirname(linkPath), sourcePath);
   await symlink2(
     relativeTarget,
     linkPath,
@@ -28217,11 +29356,11 @@ async function applyDocsNavigation(siteDirectory, routes) {
   if (routes.length === 0) {
     return;
   }
-  const configPath = path88.join(siteDirectory, CONFIG_FILENAME);
+  const configPath = path89.join(siteDirectory, CONFIG_FILENAME);
   if (!await pathExists5(configPath)) {
     return;
   }
-  const raw = await readFile29(configPath, "utf8");
+  const raw = await readFile30(configPath, "utf8");
   const parsed = JSON.parse(raw);
   if (!isPlainObject5(parsed)) {
     return;
@@ -28230,12 +29369,12 @@ async function applyDocsNavigation(siteDirectory, routes) {
     force: false
   });
   const updated = ensureHeaderDocsNavigation(parsed, routes);
-  await writeFile26(configPath, `${JSON.stringify(updated, null, 2)}
+  await writeFile27(configPath, `${JSON.stringify(updated, null, 2)}
 `, "utf8");
 }
 async function discoverAndWireDocs(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const pagesDir = path88.join(site, PAGES_DIR);
+  const site = path89.resolve(siteDirectory);
+  const pagesDir = path89.join(site, PAGES_DIR);
   const { directories, searchedDirectories } = await discoverNearbyDocsDirectories(site);
   if (directories.length === 0) {
     return {
@@ -28257,15 +29396,15 @@ async function discoverAndWireDocs(siteDirectory) {
       directory.sourceDirectory,
       usedNames
     );
-    const linkDirectory = path88.join(pagesDir, linkName);
+    const linkDirectory = path89.join(pagesDir, linkName);
     const linked = [];
     const skipped = [];
     for (const sourcePath of directory.files) {
       const relativeSource = toPosix3(
-        path88.relative(directory.sourceDirectory, sourcePath)
+        path89.relative(directory.sourceDirectory, sourcePath)
       );
-      const linkPath = path88.join(linkDirectory, relativeSource);
-      const relativeLink = toPosix3(path88.relative(site, linkPath));
+      const linkPath = path89.join(linkDirectory, relativeSource);
+      const relativeLink = toPosix3(path89.relative(site, linkPath));
       const route = toRoutePath(relativeLink, PAGES_DIR);
       if (routes.includes(route)) {
         skipped.push({
@@ -28313,11 +29452,11 @@ async function discoverAndWireDocs(siteDirectory) {
   };
 }
 function siteRelative(siteDirectory, filePath) {
-  const relative = toPosix3(path88.relative(siteDirectory, filePath));
+  const relative = toPosix3(path89.relative(siteDirectory, filePath));
   if (!relative) {
     return ".";
   }
-  if (path88.isAbsolute(relative)) {
+  if (path89.isAbsolute(relative)) {
     return toPosix3(filePath);
   }
   if (relative.startsWith("..")) {
@@ -28397,7 +29536,7 @@ function formatInitDiscoveryReport(siteDirectory, openApiDiscovery, docsDiscover
 // src/cli/scaffold/run-scaffold-discovery.ts
 async function pathExists6(filePath) {
   try {
-    await access15(filePath);
+    await access16(filePath);
     return true;
   } catch {
     return false;
@@ -28405,8 +29544,8 @@ async function pathExists6(filePath) {
 }
 async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   const input5 = toSiteRelativeOpenApiInput(siteDirectory, openApiPath);
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
-  const raw = await readFile30(jsonConfigPath, "utf8");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
+  const raw = await readFile31(jsonConfigPath, "utf8");
   const siteConfig = JSON.parse(raw);
   const updated = applyOpenApiToSiteConfig(siteConfig, {
     input: input5,
@@ -28414,7 +29553,7 @@ async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   });
   const backend = updated.backend && typeof updated.backend === "object" && !Array.isArray(updated.backend) ? { ...updated.backend } : {};
   updated.backend = { ...backend, openApiPath: input5 };
-  await writeFile27(
+  await writeFile28(
     jsonConfigPath,
     `${JSON.stringify(updated, null, 2)}
 `,
@@ -28433,7 +29572,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
   const invalidCandidates = [];
   let selected;
   for (const candidate of search.candidates) {
-    const content = await readFile30(candidate, "utf8");
+    const content = await readFile31(candidate, "utf8");
     const parsed = liteParseOpenApi(content, candidate);
     if (parsed.valid) {
       selected = {
@@ -28457,7 +29596,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
       wired: false
     };
   }
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return {
       openApiDiscovery: {
@@ -28507,13 +29646,13 @@ async function discoverAndWireBackend(siteDirectory, mode) {
   if (mode !== "nearby") {
     return { status: "skipped", mode };
   }
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return { status: "not_found" };
   }
   try {
     const siteConfig = JSON.parse(
-      await readFile30(jsonConfigPath, "utf8")
+      await readFile31(jsonConfigPath, "utf8")
     );
     const existing = siteConfig.backend && typeof siteConfig.backend === "object" && !Array.isArray(siteConfig.backend) ? siteConfig.backend : {};
     if (typeof existing.sourceDirectory === "string" && existing.sourceDirectory.trim()) {
@@ -28534,7 +29673,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
       runtime: detected.runtime,
       runtimeVersion: detected.runtimeVersion
     };
-    await writeFile27(
+    await writeFile28(
       jsonConfigPath,
       `${JSON.stringify(siteConfig, null, 2)}
 `,
@@ -28574,8 +29713,8 @@ function slugifyName2(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "dev-portal-site";
 }
 function resolveInitOutputDirectory(dirArg, name) {
-  const resolved = path90.resolve(process.cwd(), dirArg);
-  const base = path90.basename(resolved);
+  const resolved = path91.resolve(process.cwd(), dirArg);
+  const base = path91.basename(resolved);
   const isDot = dirArg === "." || dirArg === "./" || base === "." || resolved === process.cwd();
   if (isDot) {
     const fromName = name?.trim();
@@ -28585,7 +29724,7 @@ function resolveInitOutputDirectory(dirArg, name) {
       );
     }
     return {
-      outputDirectory: path90.resolve(process.cwd(), slugifyName2(fromName)),
+      outputDirectory: path91.resolve(process.cwd(), slugifyName2(fromName)),
       siteName: fromName
     };
   }
@@ -28768,8 +29907,8 @@ import open2 from "open";
 import colors14 from "picocolors";
 
 // src/cli/platform/device-auth.ts
-function url(apiUrl, path103) {
-  return `${apiUrl}${path103.startsWith("/") ? path103 : `/${path103}`}`;
+function url(apiUrl, path104) {
+  return `${apiUrl}${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 async function requestDeviceCode(apiUrl) {
   const response = await fetchWithRetry(
@@ -28951,7 +30090,7 @@ var logout_default = {
 };
 
 // src/cli/portal/commands.ts
-import path91 from "node:path";
+import path92 from "node:path";
 init_invariant();
 function parseOnly(value) {
   if (value === void 0) return void 0;
@@ -28968,7 +30107,7 @@ function parseOnly(value) {
 async function run2(command2, argv, compute, format) {
   const json = argv.json === true;
   try {
-    const dir = path91.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path92.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${command2} works with a config version 2 project, and there is none in ${dir}.`,
@@ -29019,10 +30158,35 @@ function gatewayDryRun() {
     return void 0;
   }
 }
+function identityRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId) => client.getProjectIdentity(projectId);
+  } catch {
+    return void 0;
+  }
+}
+function plansRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return async (projectId) => ({
+      plans: await client.listGatewayPlans(projectId),
+      backendAddress: toApiBaseUrl(
+        (await client.getDevPortalBackend(projectId))?.fqdn
+      )
+    });
+  } catch {
+    return void 0;
+  }
+}
 var statusOfProject = (argv) => run2(
   "status",
   argv,
-  (dir, only) => statusV2(dir, only, { gatewayRemote: gatewayRemote() }),
+  (dir, only) => statusV2(dir, only, {
+    gatewayRemote: gatewayRemote(),
+    identityRemote: identityRemote(),
+    plansRemote: plansRemote()
+  }),
   formatStatus
 );
 
@@ -29052,7 +30216,7 @@ var plan_default = {
 
 // src/cli/project/create-handler.ts
 init_invariant();
-import path92 from "node:path";
+import path93 from "node:path";
 
 // src/cli/project/v2.ts
 init_invariant();
@@ -29069,13 +30233,7 @@ function modulesForConfig(config2) {
 var hostsAnything = (config2) => config2.portal && config2.portal.enabled !== false || config2.gateway && config2.gateway.enabled !== false;
 async function createProjectV2(options, deps) {
   const { config: config2, resolved } = loadConfigV2(options.dir);
-  if (resolved.project.id) {
-    throw new ProjectCreateError(
-      "ALREADY_LINKED",
-      `This folder is already linked to project ${resolved.project.id}.`,
-      "Run `apitogo deploy`. To start over, run `apitogo teardown` first."
-    );
-  }
+  const linkedProjectId = resolved.project.id;
   const modules = modulesForConfig(config2);
   if (!hostsAnything(config2)) {
     throw new ProjectCreateError(
@@ -29089,7 +30247,9 @@ async function createProjectV2(options, deps) {
     name,
     description: options.description,
     modules,
-    wait: options.wait !== false
+    wait: options.wait !== false,
+    projectId: linkedProjectId,
+    onProjectResolved: (projectId) => setProjectId(options.dir, projectId)
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {
@@ -29162,7 +30322,9 @@ async function createLinkedProject(argv, dir) {
             modules: args.modules,
             selectFreePlan: true,
             wait: args.wait,
-            configureGatewayBaseline: false
+            configureGatewayBaseline: false,
+            projectId: args.projectId,
+            onProjectResolved: args.onProjectResolved
           },
           json ? void 0 : progress
         )
@@ -29199,7 +30361,7 @@ async function createLinkedProject(argv, dir) {
   }
 }
 async function createProject(argv) {
-  const dir = path92.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path93.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     await createLinkedProject(argv, dir);
     return;
@@ -29323,14 +30485,14 @@ var remove_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path95 from "node:path";
+import path96 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs12 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path94 from "node:path";
+import path95 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -29363,7 +30525,7 @@ init_loader();
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path93 from "node:path";
+import path94 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -29416,7 +30578,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path93.join(vite.config.publicDir, "pagefind");
+  const outputPath = path94.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -29435,9 +30597,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.options;
     const [key, cert, ca] = await Promise.all([
-      fs12.readFile(path94.resolve(dir, config2.https.key)),
-      fs12.readFile(path94.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs12.readFile(path94.resolve(dir, config2.https.ca)) : void 0
+      fs12.readFile(path95.resolve(dir, config2.https.key)),
+      fs12.readFile(path95.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs12.readFile(path95.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -29454,7 +30616,7 @@ var DevServer = class {
     );
     const server = await this.createNodeServer(config2);
     if (config2.search?.type === "pagefind" && viteConfig.publicDir !== false) {
-      const publicRoot = path94.resolve(
+      const publicRoot = path95.resolve(
         this.options.dir,
         typeof viteConfig.publicDir === "string" ? viteConfig.publicDir : "public"
       );
@@ -29471,7 +30633,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "apitogo:entry-client",
           configureServer(server2) {
-            const entryPath = path94.posix.join(
+            const entryPath = path95.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -29636,7 +30798,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson3 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  let dir = path95.resolve(process.cwd(), argv.dir);
+  let dir = path96.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(dir)) {
     const { root, prepared } = await preparePortalWorkspace(dir, "development");
     dir = root;
@@ -29735,7 +30897,7 @@ var run_default = {
 };
 
 // src/cli/secrets/handler.ts
-import path96 from "node:path";
+import path97 from "node:path";
 init_invariant();
 
 // src/cli/secrets/input.ts
@@ -29800,7 +30962,7 @@ var SecretsError = class extends ApitogoError {
 async function resolveProjectId2(argv, deps) {
   const explicit = argv.projectId?.trim();
   if (explicit) return explicit;
-  const dir = path96.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path97.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     const id = loadConfigV2(dir).resolved.project.id;
     if (id) return id;
@@ -29960,12 +31122,12 @@ var secrets_default = {
 };
 
 // src/cli/cmds/status.ts
-import path98 from "node:path";
+import path99 from "node:path";
 
 // src/cli/status/handler.ts
-import path97 from "node:path";
+import path98 from "node:path";
 async function status(argv) {
-  const sourceDirectory = path97.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path98.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -30063,7 +31225,7 @@ var status_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo status" });
-    if (await isConfigV2(path98.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path99.resolve(process.cwd(), argv.dir))) {
       await statusOfProject(argv);
       return;
     }
@@ -30072,11 +31234,11 @@ var status_default = {
 };
 
 // src/cli/cmds/teardown.ts
-import path101 from "node:path";
+import path102 from "node:path";
 
 // src/cli/teardown/command.ts
 init_invariant();
-import path99 from "node:path";
+import path100 from "node:path";
 import { createInterface as createInterface7 } from "node:readline/promises";
 
 // src/cli/teardown/v2.ts
@@ -30090,12 +31252,14 @@ var TeardownError = class extends ApitogoError {
 };
 async function teardownV2(options, deps) {
   if (options.only) {
-    if (options.only.trim() === "gateway")
-      return teardownGateway(options, deps);
+    const only = options.only.trim();
+    if (only === "gateway") return teardownGateway(options, deps);
+    if (only === "identity") return teardownIdentity(options, deps);
+    if (only === "plans") return teardownPlans(options, deps);
     throw new TeardownError(
       "PARTIAL_TEARDOWN_UNSUPPORTED",
       "The platform cannot release the hosting of one service on its own: it is released by deleting the project.",
-      "Run `apitogo teardown` without --only to delete the whole project, or `apitogo teardown --only gateway` to remove just the gateway. Your local files are kept."
+      "Run `apitogo teardown` without --only to delete the whole project, or `apitogo teardown --only gateway`, `--only identity` or `--only plans` to remove just that service. Your local files are kept."
     );
   }
   const { resolved } = loadConfigV2(options.dir);
@@ -30275,6 +31439,148 @@ Type the project name to confirm: `
     message: "The gateway was removed. The project and your local files are kept."
   };
 }
+function projectIdOf(options, deps, resolved, what) {
+  const projectId = options.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim() || "";
+  if (!projectId) {
+    throw new TeardownError(
+      "PROJECT_REQUIRED",
+      `This folder is not linked to a project, so there is no ${what} to remove.`,
+      "Pass --project-id <id> to name the project."
+    );
+  }
+  return projectId;
+}
+async function confirmByName(options, deps, name, prompt, what) {
+  if (options.yes === true) return;
+  if (!deps.isTerminal) {
+    throw new TeardownError(
+      "CONFIRMATION_REQUIRED",
+      "This is not an interactive terminal.",
+      `Pass --yes to remove the ${what} without asking.`
+    );
+  }
+  const typed = await deps.askName(prompt);
+  if (typed.trim() !== name) {
+    throw new TeardownError(
+      "CANCELLED",
+      "The name did not match. Nothing was removed."
+    );
+  }
+}
+async function clearService(resolved, service) {
+  const cleared = [];
+  const ledger = await readLedger(resolved.state);
+  if (ledger.services[service]) {
+    await clearServices(resolved.state, [service]);
+    cleared.push(`state.json entries of ${service}`);
+  }
+  if ((await readManifest(resolved.state))?.services[service]) {
+    await removeServicesFromManifest(resolved.state, [service]);
+    cleared.push(`the ${service} entry of services.json`);
+  }
+  return cleared;
+}
+async function teardownIdentity(options, deps) {
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = projectIdOf(options, deps, resolved, "identity");
+  const client = deps.client;
+  if (!client.getProjectIdentity || !client.deleteProjectIdentity)
+    throw new Error("The platform client has no identity calls.");
+  const project = await client.getProject(projectId);
+  const name = project.name;
+  const current = await client.getProjectIdentity(projectId);
+  if (!current || current.status === "Released")
+    throw new TeardownError(
+      "IDENTITY_NOT_DEPLOYED",
+      "The platform has no identity for this project.",
+      "There is nothing to remove. Clear stale local records by deleting the identity entries in the state folder."
+    );
+  await confirmByName(
+    options,
+    deps,
+    name,
+    `This removes the identity of project "${name}" (${projectId}) and DELETES EVERY USER in it, for good. Nobody can sign in to the portal or the API until a new identity is made. The project, the portal and the gateway stay.
+Type the project name to confirm: `,
+    "identity"
+  );
+  const answer = await client.deleteProjectIdentity(projectId);
+  if (answer !== null) {
+    const sleep5 = deps.identity?.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = Date.now() + (options.wait === false ? 0 : deps.identity?.timeoutMs ?? 12e4);
+    for (; ; ) {
+      const state = await client.getProjectIdentity(projectId);
+      if (state === null || state.status === "Released") break;
+      if (state.status === "Failed")
+        throw new TeardownError(
+          "DELETE_FAILED",
+          `The platform could not remove the identity: ${[state.errorCode, state.errorMessage].filter(Boolean).join(" ") || state.status}.`,
+          "Nothing local was changed. Try again, or contact support with the project id."
+        );
+      if (Date.now() >= deadline) {
+        return {
+          projectId,
+          projectName: name,
+          status: "pending",
+          cleared: [],
+          message: "The identity is queued for removal and the platform finishes it in the background. Local records are kept until then: run `apitogo teardown --only identity` again later to clear them."
+        };
+      }
+      await sleep5(deps.identity?.pollIntervalMs ?? 2e3);
+    }
+  }
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    scope: "identity",
+    cleared: await clearService(resolved, "identity"),
+    message: "The identity and its users were removed. The project and your local files are kept."
+  };
+}
+async function teardownPlans(options, deps) {
+  const { resolved } = loadConfigV2(options.dir);
+  const projectId = projectIdOf(options, deps, resolved, "plans");
+  const client = deps.client;
+  if (!client.listGatewayPlans || !client.deleteGatewayPlan)
+    throw new Error("The platform client has no plans calls.");
+  const project = await client.getProject(projectId);
+  const name = project.name;
+  const plans = await client.listGatewayPlans(projectId);
+  if (plans.length === 0)
+    throw new TeardownError(
+      "PLANS_NOT_DEPLOYED",
+      "The platform has no plans for this project.",
+      "There is nothing to remove. Clear stale local records by deleting the plans entries in the state folder."
+    );
+  await confirmByName(
+    options,
+    deps,
+    name,
+    `This removes the plans (${plans.map((plan2) => plan2.sku).join(", ")}) of project "${name}" (${projectId}). Customers' subscriptions and API keys on them stop working. The plans backend stays: it is released with the project.
+Type the project name to confirm: `,
+    "plans"
+  );
+  for (const plan2 of plans) {
+    try {
+      await client.deleteGatewayPlan(projectId, plan2.id);
+    } catch (error) {
+      if (error instanceof PlatformApiError && error.status === 404) continue;
+      throw new TeardownError(
+        "DELETE_FAILED",
+        `The platform could not remove the plan "${plan2.sku}": ${error instanceof Error ? error.message : String(error)}.`,
+        "Plans removed before it are gone. Nothing local was changed; run the command again after fixing the cause."
+      );
+    }
+  }
+  return {
+    projectId,
+    projectName: name,
+    status: "removed",
+    scope: "plans",
+    cleared: await clearService(resolved, "plans"),
+    message: "The plans were removed. The plans backend, the project and your local files are kept."
+  };
+}
 
 // src/cli/teardown/command.ts
 async function ask3(prompt) {
@@ -30293,7 +31599,7 @@ async function teardownProject(argv) {
     const progress = createConsoleProgressReporter();
     const result = await teardownV2(
       {
-        dir: path99.resolve(process.cwd(), argv.dir),
+        dir: path100.resolve(process.cwd(), argv.dir),
         projectId: argv.projectId,
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         yes: argv.yes === true,
@@ -30324,7 +31630,7 @@ async function teardownProject(argv) {
       return;
     }
     printDiagnosticsToConsole(
-      result.scope === "gateway" ? `Removed the gateway of project ${result.projectName} (${result.projectId}).` : `${result.status === "removed" ? "Deleted" : "Queued deletion of"} project ${result.projectName} (${result.projectId}).`
+      result.scope === "gateway" || result.scope === "identity" || result.scope === "plans" ? `Removed the ${result.scope} of project ${result.projectName} (${result.projectId}).` : `${result.status === "removed" ? "Deleted" : "Queued deletion of"} project ${result.projectName} (${result.projectId}).`
     );
     if (result.cleared.length > 0)
       printDiagnosticsToConsole(
@@ -30352,7 +31658,7 @@ async function teardownProject(argv) {
 }
 
 // src/cli/teardown/handler.ts
-import path100 from "node:path";
+import path101 from "node:path";
 function resultLooksFailed3(payload) {
   try {
     const parsed = JSON.parse(payload);
@@ -30368,7 +31674,7 @@ async function teardown(argv) {
     );
     return;
   }
-  const sourceDirectory = path100.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path101.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -30429,7 +31735,7 @@ var teardown_default = {
     describe: "Override project GUID"
   }).option("only", {
     type: "string",
-    describe: "Config version 2: only `gateway` is supported (removes the gateway, keeps the project); other hosting is released only by deleting the whole project"
+    describe: "Config version 2: `gateway`, `identity` or `plans` removes just that service and keeps the project (`identity` deletes every user in it); other hosting is released only by deleting the whole project"
   }).option("yes", {
     alias: "y",
     type: "boolean",
@@ -30446,7 +31752,7 @@ var teardown_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo teardown" });
-    if (await isConfigV2(path101.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path102.resolve(process.cwd(), argv.dir))) {
       await teardownProject(argv);
       return;
     }
@@ -30524,36 +31830,36 @@ function createApitogoCli(argv) {
 // src/cli/local-handoff.ts
 import { spawn as spawn5 } from "node:child_process";
 import { existsSync as existsSync9, realpathSync as realpathSync2 } from "node:fs";
-import path102 from "node:path";
+import path103 from "node:path";
 var LOCAL_HANDOFF_ENV = "APITOGO_LOCAL_CLI";
 var PACKAGE_NAME = "@lukoweb/apitogo";
 var resolveProjectDir = (argv, cwd) => {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const next = argv[i + 1];
-    if (arg === "--dir" && next) return path102.resolve(cwd, next);
+    if (arg === "--dir" && next) return path103.resolve(cwd, next);
     if (arg?.startsWith("--dir=")) {
-      return path102.resolve(cwd, arg.slice("--dir=".length));
+      return path103.resolve(cwd, arg.slice("--dir=".length));
     }
   }
   return cwd;
 };
 var findLocalCli = (projectDir, runningRoot) => {
-  let dir = path102.resolve(projectDir);
+  let dir = path103.resolve(projectDir);
   let localPackageRoot;
   while (!localPackageRoot) {
-    const candidate = path102.join(dir, "node_modules", PACKAGE_NAME);
-    if (existsSync9(path102.join(candidate, "package.json"))) {
+    const candidate = path103.join(dir, "node_modules", PACKAGE_NAME);
+    if (existsSync9(path103.join(candidate, "package.json"))) {
       localPackageRoot = candidate;
-    } else if (dir === path102.dirname(dir)) {
+    } else if (dir === path103.dirname(dir)) {
       return void 0;
     } else {
-      dir = path102.dirname(dir);
+      dir = path103.dirname(dir);
     }
   }
   const localRoot = realpathSync2(localPackageRoot);
   if (localRoot === realpathSync2(runningRoot)) return void 0;
-  return path102.join(localRoot, "cli.js");
+  return path103.join(localRoot, "cli.js");
 };
 var handoffToLocalCli = async (argv, runningRoot) => {
   if (process.env[LOCAL_HANDOFF_ENV] || process.env.ZUDOKU_ENV === "internal") {
@@ -30565,7 +31871,7 @@ var handoffToLocalCli = async (argv, runningRoot) => {
   );
   if (!localCli) return void 0;
   printDiagnosticsToConsole(
-    `Using the project's local ${PACKAGE_NAME} (${path102.dirname(localCli)})`
+    `Using the project's local ${PACKAGE_NAME} (${path103.dirname(localCli)})`
   );
   const child = spawn5(process.execPath, [localCli, ...argv], {
     stdio: "inherit",