@lukoweb/apitogo 0.2.22 → 0.2.24

package/dist/cli/cli.js

@@ -459,8 +459,9 @@ function syncAuthentication(normalized) {
   }
   const auth = authentication ?? {};
   auth.enabled = userPanelEnabled;
-  auth.type = "dev-portal";
-  if (userPanelEnabled) {
+  const keepsOpenId = auth.type === "openid";
+  if (!keepsOpenId) auth.type = "dev-portal";
+  if (userPanelEnabled && !keepsOpenId) {
     const native = asRecord(auth.native) ?? {};
     if (native.enabled === void 0) {
       native.enabled = true;
@@ -483,7 +484,7 @@ function syncAuthentication(normalized) {
       }
     }
   }
-  if (normalized.demoMode !== void 0) {
+  if (normalized.demoMode !== void 0 && !keepsOpenId) {
     auth.demoMode = normalized.demoMode !== false;
   }
   normalized.authentication = auth;
@@ -836,7 +837,7 @@ import { stat as stat4 } from "node:fs/promises";
 var fileExists;
 var init_file_exists = __esm({
   "src/config/file-exists.ts"() {
-    fileExists = (path103) => stat4(path103).then(() => true).catch(() => false);
+    fileExists = (path104) => stat4(path104).then(() => true).catch(() => false);
   }
 });
 
@@ -6189,8 +6190,8 @@ var ConfigV2Schema = z.strictObject({
 var REMOVED_KEYS = {
   "plans.provider": "plans.provider was removed. Only plans.billing.provider (stripe or none) is selectable."
 };
-function pathToString(path103) {
-  return path103.reduce(
+function pathToString(path104) {
+  return path104.reduce(
     (acc, segment) => typeof segment === "number" ? `${acc}[${segment}]` : acc === "" ? String(segment) : `${acc}.${String(segment)}`,
     ""
   );
@@ -6210,9 +6211,9 @@ function step(schema2, segment) {
   }
   return void 0;
 }
-function knownKeysAt(path103) {
+function knownKeysAt(path104) {
   let current = ConfigV2Schema;
-  for (const segment of path103) {
+  for (const segment of path104) {
     if (!current) return [];
     current = step(current, segment);
   }
@@ -6248,7 +6249,7 @@ function unknownKeyHint(fullPath, key, known) {
   return known.length > 0 ? `Allowed keys: ${known.join(", ")}.` : void 0;
 }
 function mapIssue(issue4) {
-  const path103 = pathToString(issue4.path);
+  const path104 = pathToString(issue4.path);
   switch (issue4.code) {
     case "unrecognized_keys":
       return issue4.keys.map((key) => {
@@ -6264,20 +6265,20 @@ function mapIssue(issue4) {
       return [
         {
           code: "CONFIG_INVALID_VALUE",
-          path: path103,
+          path: path104,
           message: `must be one of: ${issue4.values.map((v) => JSON.stringify(v)).join(", ")}.`
         }
       ];
     case "custom": {
       const code = typeof issue4.params?.code === "string" ? issue4.params.code : "CONFIG_INVALID_VALUE";
-      return [{ code, path: path103, message: issue4.message ?? "is invalid." }];
+      return [{ code, path: path104, message: issue4.message ?? "is invalid." }];
     }
     case "invalid_type":
       return [
-        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path103, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path103, message: issue4.message }
+        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path104, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path104, message: issue4.message }
       ];
     default:
-      return [{ code: "CONFIG_INVALID_VALUE", path: path103, message: issue4.message }];
+      return [{ code: "CONFIG_INVALID_VALUE", path: path104, message: issue4.message }];
   }
 }
 function isRecord(value) {
@@ -7301,7 +7302,7 @@ var ServiceManifestSchema = z3.looseObject({
     }).optional()
   }).default({})
 });
-var issue = (code, path103, message, hint) => ({ code, path: path103, message, hint });
+var issue = (code, path104, message, hint) => ({ code, path: path104, message, hint });
 function parseManifest(raw, file = "services.json") {
   const version = typeof raw === "object" && raw !== null && "schemaVersion" in raw ? raw.schemaVersion : void 0;
   if (typeof version === "number" && version > SUPPORTED_MANIFEST_SCHEMA) {
@@ -7555,8 +7556,8 @@ var METHODS = [
   "trace"
 ];
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function actionKey(method, path103) {
-  const trimmed = path103.trim();
+function actionKey(method, path104) {
+  const trimmed = path104.trim();
   const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
   const normalized = withSlash.length > 1 ? withSlash.replace(/\/+$/, "") || "/" : withSlash;
   return `${method.trim().toLowerCase()}:${normalized}`;
@@ -7566,8 +7567,8 @@ function configActionKey(entry) {
   return match?.[1] && match[2] ? actionKey(match[1], match[2]) : void 0;
 }
 function referenceOptions(gateway, gatewayBaseUrl, keyHeaderName) {
-  const access16 = gateway.policies.access;
-  const jwt = access16?.jwt ?? gateway.auth !== void 0;
+  const access17 = gateway.policies.access;
+  const jwt = access17?.jwt ?? gateway.auth !== void 0;
   const keys = (list2) => new Set(
     (list2 ?? []).flatMap((entry) => {
       const key = configActionKey(entry);
@@ -7579,8 +7580,8 @@ function referenceOptions(gateway, gatewayBaseUrl, keyHeaderName) {
     originUrl: gateway.origin.url,
     jwtRequired: jwt && gateway.auth !== void 0,
     oidcMetadataUrl: jwt ? gateway.auth?.metadataUrl : void 0,
-    apiKeyRequired: access16?.apiKey ?? true,
-    apiKeyHeader: keyHeaderName ?? access16?.apiKeyHeader ?? DEFAULT_KEY_HEADER,
+    apiKeyRequired: access17?.apiKey ?? true,
+    apiKeyHeader: keyHeaderName ?? access17?.apiKeyHeader ?? DEFAULT_KEY_HEADER,
     publicOperations: keys(gateway.policies.operations?.public),
     deniedOperations: keys(gateway.policies.operations?.deny)
   };
@@ -7593,8 +7594,8 @@ var ReferenceSpecError = class extends Error {
 };
 function operationsOf(paths) {
   return Object.entries(paths).flatMap(
-    ([path103, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
-      (method) => [path103, item, method]
+    ([path104, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
+      (method) => [path104, item, method]
     ) : []
   );
 }
@@ -7609,14 +7610,14 @@ function buildReferenceSpec(specText, options) {
     throw new ReferenceSpecError("The OpenAPI file could not be read.");
   const doc = structuredClone(root);
   const paths = isObject(doc.paths) ? doc.paths : {};
-  for (const [path103, item, method] of operationsOf(paths))
-    if (options.deniedOperations.has(actionKey(method, path103)))
+  for (const [path104, item, method] of operationsOf(paths))
+    if (options.deniedOperations.has(actionKey(method, path104)))
       delete item[method];
-  for (const [path103, item] of Object.entries(paths))
+  for (const [path104, item] of Object.entries(paths))
     if (!isObject(item) || !METHODS.some((method) => method in item))
-      delete paths[path103];
-  for (const [path103, item, method] of operationsOf(paths))
-    if (options.publicOperations.has(actionKey(method, path103)))
+      delete paths[path104];
+  for (const [path104, item, method] of operationsOf(paths))
+    if (options.publicOperations.has(actionKey(method, path104)))
       item[method].security = [];
   doc.servers = [{ url: options.gatewayBaseUrl.replace(/\/+$/, "") }];
   for (const item of Object.values(paths)) {
@@ -8021,7 +8022,11 @@ function buildSiteConfig(resolved, plan2, theme, extras = {}) {
     },
     modules: {
       docs: { enabled: plan2.docs },
-      userPanel: { enabled: plan2.userPanel }
+      // The plans pages (pricing, choosing a plan) exist only when billing is on, and the plans service is what makes it so.
+      userPanel: {
+        enabled: plan2.userPanel,
+        ...plan2.plansPlugin ? { plans: { enabled: true } } : {}
+      }
     },
     ...plan2.docs ? {
       docs: {
@@ -8042,10 +8047,21 @@ function buildSiteConfig(resolved, plan2, theme, extras = {}) {
     ...navigation.length > 0 ? { navigation } : {},
     ...redirects.length > 0 ? { redirects } : {},
     ...theme !== void 0 ? { theme } : {},
-    ...plan2.auth ? { authentication: { type: "openid", ...plan2.auth } } : {},
+    ...plan2.auth ? { authentication: authenticationFor(plan2) } : {},
     ...plan2.preview ? { preview: true } : {}
   };
 }
+function authenticationFor(plan2) {
+  if (plan2.plansPlugin)
+    return {
+      type: "dev-portal",
+      apiBaseUrl: plan2.plansPlugin.apiBaseUrl,
+      demoMode: false,
+      // Accounts are made at the identity (its own sign-up page), never at the plans backend.
+      native: { enabled: false }
+    };
+  return { type: "openid", ...plan2.auth };
+}
 var PREVIEW_BANNER_MESSAGE = "Preview mode: sign-in and plans use a stand-in manifest. Run `apitogo deploy` for the real services.";
 function renderWrapper(plan2) {
   const imports = [
@@ -8194,9 +8210,27 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
 
 // src/config/v2/workspace.ts
 import { createHash as createHash2 } from "node:crypto";
-import { access as access2, lstat, readFile as readFile7, rm as rm3, symlink } from "node:fs/promises";
+import { access as access2, lstat, readFile as readFile7, rm as rm3 } from "node:fs/promises";
 import path13 from "node:path";
 import { glob as glob3 } from "glob";
+
+// src/config/v2/link-directory.ts
+import { symlink } from "node:fs/promises";
+async function linkDirectory(target, link, options = {}) {
+  const create = options.symlinkFn ?? symlink;
+  const platform = options.platform ?? process.platform;
+  try {
+    await create(target, link, "dir");
+    return "symlink";
+  } catch (error) {
+    if (platform !== "win32" || error.code !== "EPERM")
+      throw error;
+    await create(target, link, "junction");
+    return "junction";
+  }
+}
+
+// src/config/v2/workspace.ts
 var exists2 = (file) => access2(file).then(
   () => true,
   () => false
@@ -8207,7 +8241,7 @@ async function relink(target, link) {
     () => false
   ))
     await rm3(link, { recursive: true, force: true });
-  await symlink(target, link, "dir");
+  await linkDirectory(target, link);
 }
 async function materializeWorkspace(resolved, prepared) {
   const root = path13.dirname(prepared.wrapperPath);
@@ -9003,8 +9037,8 @@ var PlatformApiClient = class {
   constructor(config2) {
     this.config = config2;
   }
-  url(path103) {
-    return `${this.config.apiUrl}${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  url(path104) {
+    return `${this.config.apiUrl}${path104.startsWith("/") ? path104 : `/${path104}`}`;
   }
   headers(extra) {
     return {
@@ -9014,9 +9048,9 @@ var PlatformApiClient = class {
       ...extra
     };
   }
-  async request(method, path103, init4) {
+  async request(method, path104, init4) {
     const response = await fetchWithRetry(
-      this.url(path103),
+      this.url(path104),
       {
         method,
         ...init4,
@@ -9332,6 +9366,34 @@ var PlatformApiClient = class {
       }
     );
   }
+  /**
+   * Adds or updates an upstream login connection of the project's Active identity. The same request twice changes
+   * nothing. The answer carries the redirect address to register with the provider.
+   */
+  putProjectIdentityConnection(projectId, connectionId2, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/identity/connections/${encodeURIComponent(connectionId2)}`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
+  /** The upstream login connections of the project's identity (never their secrets). */
+  listProjectIdentityConnections(projectId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/identity/connections`
+    );
+  }
+  /** Removes a connection. One that is not there is a success. Users who signed in through it keep their accounts. */
+  async deleteProjectIdentityConnection(projectId, connectionId2) {
+    await this.request(
+      "DELETE",
+      `/api/v1/projects/${projectId}/identity/connections/${encodeURIComponent(connectionId2)}`
+    );
+  }
   /** The state of the project's identity, or null when it has none. */
   async getProjectIdentity(projectId) {
     try {
@@ -9425,15 +9487,15 @@ var PlatformApiClient = class {
       }
     );
   }
-  deleteDevPortalPage(projectId, path103) {
-    const query = new URLSearchParams({ path: path103 });
+  deleteDevPortalPage(projectId, path104) {
+    const query = new URLSearchParams({ path: path104 });
     return this.request(
       "DELETE",
       `/api/v1/projects/${projectId}/dev-portal/pages/files?${query.toString()}`
     );
   }
-  renameDevPortalPage(projectId, path103, newName) {
-    const query = new URLSearchParams({ path: path103 });
+  renameDevPortalPage(projectId, path104, newName) {
+    const query = new URLSearchParams({ path: path104 });
     return this.request(
       "POST",
       `/api/v1/projects/${projectId}/dev-portal/pages/files/rename?${query.toString()}`,
@@ -9549,8 +9611,8 @@ var PlatformApiClient = class {
    * the project-less endpoint is used; `planTier` overrides the tier used for paid-plan checks.
    */
   validateGatewayPlans(plans, options = {}) {
-    const path103 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
-    return this.request("POST", path103, {
+    const path104 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
+    return this.request("POST", path104, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ plans, planTier: options.planTier })
     });
@@ -9754,7 +9816,6 @@ import {
   rm as rm8,
   writeFile as writeFile14
 } from "node:fs/promises";
-import { createRequire as createRequire2 } from "node:module";
 import path48 from "node:path";
 
 // src/vite/build.ts
@@ -9906,7 +9967,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.22",
+  version: "0.2.24",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -10688,14 +10749,14 @@ var flattenAllOf = (schema2) => {
 };
 
 // src/lib/util/traverse.ts
-var traverse = (specification, transform, path103 = []) => {
-  const transformed = transform(specification, path103);
+var traverse = (specification, transform, path104 = []) => {
+  const transformed = transform(specification, path104);
   if (typeof transformed !== "object" || transformed === null) {
     return transformed;
   }
   const result = Array.isArray(transformed) ? [] : {};
   for (const [key, value] of Object.entries(transformed)) {
-    const currentPath = [...path103, key];
+    const currentPath = [...path104, key];
     if (Array.isArray(value)) {
       result[key] = value.map(
         (item, index) => typeof item === "object" && item != null ? traverse(item, transform, [...currentPath, index.toString()]) : item
@@ -10723,9 +10784,9 @@ var resolveLocalRef = (schema2, ref) => {
   if (schemaCache?.has(ref)) {
     return schemaCache.get(ref);
   }
-  const path103 = ref.split("/").slice(1);
+  const path104 = ref.split("/").slice(1);
   let current = schema2;
-  for (const segment of path103) {
+  for (const segment of path104) {
     if (!current || typeof current !== "object") {
       current = null;
     }
@@ -10744,7 +10805,7 @@ var dereference = async (schema2, resolvers = []) => {
   }
   const cloned = structuredClone(schema2);
   const visited = /* @__PURE__ */ new Set();
-  const resolve = async (current, path103) => {
+  const resolve = async (current, path104) => {
     if (isIndexableObject(current)) {
       if (visited.has(current)) {
         return CIRCULAR_REF;
@@ -10752,7 +10813,7 @@ var dereference = async (schema2, resolvers = []) => {
       visited.add(current);
       if (Array.isArray(current)) {
         for (let index = 0; index < current.length; index++) {
-          current[index] = await resolve(current[index], `${path103}/${index}`);
+          current[index] = await resolve(current[index], `${path104}/${index}`);
         }
       } else {
         if ("$ref" in current && typeof current.$ref === "string") {
@@ -10763,13 +10824,13 @@ var dereference = async (schema2, resolvers = []) => {
           for (const resolver of resolvers) {
             const resolved = await resolver($ref);
             if (resolved) {
-              result2 = await resolve(resolved, path103);
+              result2 = await resolve(resolved, path104);
               break;
             }
           }
           if (result2 === void 0) {
             const resolved = await resolveLocalRef(cloned, $ref);
-            result2 = await resolve(resolved, path103);
+            result2 = await resolve(resolved, path104);
           }
           if (hasSiblings) {
             if (result2 === CIRCULAR_REF) {
@@ -10782,7 +10843,7 @@ var dereference = async (schema2, resolvers = []) => {
           return result2;
         }
         for (const key in current) {
-          current[key] = await resolve(current[key], `${path103}/${key}`);
+          current[key] = await resolve(current[key], `${path104}/${key}`);
         }
       }
       visited.delete(current);
@@ -10821,9 +10882,9 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (sub, path103) => {
+  schema2 = traverse(schema2, (sub, path104) => {
     if (sub.example !== void 0) {
-      if (isSchemaPath(path103 ?? [])) {
+      if (isSchemaPath(path104 ?? [])) {
         sub.examples = [sub.example];
       } else {
         sub.examples = {
@@ -10836,11 +10897,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
+  schema2 = traverse(schema2, (schema3, path104) => {
     if (schema3.type === "object" && schema3.properties !== void 0) {
-      const parentPath = path103?.slice(0, -1);
+      const parentPath = path104?.slice(0, -1);
       const isMultipart = parentPath?.some((segment, index) => {
-        return segment === "content" && path103?.[index + 1] === "multipart/form-data";
+        return segment === "content" && path104?.[index + 1] === "multipart/form-data";
       });
       if (isMultipart) {
         const entries = Object.entries(schema3.properties);
@@ -10854,8 +10915,8 @@ var upgradeSchema = (schema2) => {
     }
     return schema3;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
-    if (path103?.includes("content") && path103.includes("application/octet-stream")) {
+  schema2 = traverse(schema2, (schema3, path104) => {
+    if (path104?.includes("content") && path104.includes("application/octet-stream")) {
       return {};
     }
     if (schema3.type === "string" && schema3.format === "binary") {
@@ -10881,11 +10942,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path103) => {
+  schema2 = traverse(schema2, (schema3, path104) => {
     if (schema3.type === "string" && schema3.format === "byte") {
-      const parentPath = path103?.slice(0, -1);
+      const parentPath = path104?.slice(0, -1);
       const contentMediaType = parentPath?.find(
-        (_, index) => path103?.[index - 1] === "content"
+        (_, index) => path104?.[index - 1] === "content"
       );
       return {
         type: "string",
@@ -10897,7 +10958,7 @@ var upgradeSchema = (schema2) => {
   });
   return schema2;
 };
-function isSchemaPath(path103) {
+function isSchemaPath(path104) {
   const schemaLocations = [
     ["components", "schemas"],
     "properties",
@@ -10910,10 +10971,10 @@ function isSchemaPath(path103) {
   ];
   return schemaLocations.some((location) => {
     if (Array.isArray(location)) {
-      return location.every((segment, index) => path103[index] === segment);
+      return location.every((segment, index) => path104[index] === segment);
     }
-    return path103.includes(location);
-  }) || path103.includes("schema") || path103.some((segment) => segment.endsWith("Schema"));
+    return path104.includes(location);
+  }) || path104.includes("schema") || path104.some((segment) => segment.endsWith("Schema"));
 }
 
 // src/lib/oas/parser/index.ts
@@ -10995,13 +11056,13 @@ var OPENAPI_PROPS = /* @__PURE__ */ new Set([
   "anyOf",
   "oneOf"
 ]);
-var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path103 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
+var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path104 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
   if (obj === null || typeof obj !== "object") return obj;
   const refPath = obj.__$ref;
   const isCircular = currentPath.has(obj) || typeof refPath === "string" && currentRefPaths.has(refPath);
   if (isCircular) {
     if (typeof refPath === "string") return SCHEMA_REF_PREFIX + refPath;
-    const circularProp = path103.find((p) => !OPENAPI_PROPS.has(p)) || path103[0];
+    const circularProp = path104.find((p) => !OPENAPI_PROPS.has(p)) || path104[0];
     return [CIRCULAR_REF, circularProp].filter(Boolean).join(":");
   }
   if (refs.has(obj)) return refs.get(obj);
@@ -11011,7 +11072,7 @@ var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs
     value,
     currentPath,
     refs,
-    [...path103, key],
+    [...path104, key],
     currentRefPaths
   );
   const result = Array.isArray(obj) ? obj.map((item, i) => recurse(item, i.toString())) : Object.fromEntries(
@@ -11046,7 +11107,7 @@ var resolveExtensions = (obj) => Object.fromEntries(
 var getAllTags = (schema2) => {
   const rootTags = schema2.tags ?? [];
   const operations = Object.values(schema2.paths ?? {}).flatMap(
-    (path103) => HttpMethods.map((k) => path103?.[k]).filter((op) => op != null)
+    (path104) => HttpMethods.map((k) => path104?.[k]).filter((op) => op != null)
   );
   const operationTags = new Set(operations.flatMap((op) => op.tags ?? []));
   const hasUntaggedOperations = operations.some(
@@ -11101,7 +11162,7 @@ var getAllSlugs = (ops, schemaTags = []) => {
 var getOperationSlugKey = (op) => [op.path, op.method, op.operationId, op.summary].filter(Boolean).join("-");
 var getAllOperations = (paths) => {
   const operations = Object.entries(paths ?? {}).flatMap(
-    ([path103, value]) => HttpMethods.flatMap((method) => {
+    ([path104, value]) => HttpMethods.flatMap((method) => {
       if (!value?.[method]) return [];
       const operation = value[method];
       const pathParameters = value.parameters ?? [];
@@ -11121,7 +11182,7 @@ var getAllOperations = (paths) => {
       return {
         ...operation,
         method,
-        path: path103,
+        path: path104,
         parameters,
         servers,
         tags: operation.tags ?? []
@@ -11479,8 +11540,8 @@ var Schema = builder.objectRef("Schema").implement({
     }),
     paths: t.field({
       type: [PathItem],
-      resolve: (root) => Object.entries(root.paths ?? {}).map(([path103, value]) => ({
-        path: path103,
+      resolve: (root) => Object.entries(root.paths ?? {}).map(([path104, value]) => ({
+        path: path104,
         // biome-ignore lint/style/noNonNullAssertion: value is guaranteed to be defined
         methods: Object.keys(value)
       }))
@@ -11645,7 +11706,7 @@ init_joinUrl();
 
 // src/vite/api/schema-codegen.ts
 var unescapeJsonPointer = (uri) => decodeURIComponent(uri.replace(/~1/g, "/").replace(/~0/g, "~"));
-var getSegmentsFromPath = (path103) => path103.split("/").slice(1).map(unescapeJsonPointer);
+var getSegmentsFromPath = (path104) => path104.split("/").slice(1).map(unescapeJsonPointer);
 var createLocalRefMap = (obj) => {
   const refMap = /* @__PURE__ */ new Map();
   const siblingsMap = /* @__PURE__ */ new Map();
@@ -11676,16 +11737,16 @@ var replaceMarkers = (code, mergedRefs) => code.replace(/"__refMap:(.*?)"/g, '__
   /"__refMap\+Siblings:(.*?)"/g,
   (_, key) => mergedRefs.get(key) ?? `__refMap["${key}"]`
 );
-var lookup = (schema2, path103, filePath) => {
-  const parts = getSegmentsFromPath(path103);
+var lookup = (schema2, path104, filePath) => {
+  const parts = getSegmentsFromPath(path104);
   let val = schema2;
   for (const part of parts) {
     while (val.$ref?.startsWith("#/")) {
-      val = val.$ref === path103 ? val : lookup(schema2, val.$ref, filePath);
+      val = val.$ref === path104 ? val : lookup(schema2, val.$ref, filePath);
     }
     if (val[part] === void 0) {
       throw new Error(
-        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path103}`
+        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path104}`
       );
     }
     val = val[part];
@@ -11930,8 +11991,8 @@ var SchemaManager = class {
       }
     }
   };
-  getLatestSchema = (path103) => this.processedSchemas[path103]?.at(0);
-  getSchemasForPath = (path103) => this.processedSchemas[path103];
+  getLatestSchema = (path104) => this.processedSchemas[path104]?.at(0);
+  getSchemasForPath = (path104) => this.processedSchemas[path104];
   getSchemaImports = () => Object.values(this.processedSchemas).flat().filter((s) => s.importKey);
   getUrlToFilePathMap = () => {
     const map = /* @__PURE__ */ new Map();
@@ -14385,14 +14446,14 @@ async function generateSitemap({
 
 // src/vite/prerender/utils.ts
 init_joinUrl();
-var resolveRoutePath = (path103) => {
-  const segments = path103.split("/");
+var resolveRoutePath = (path104) => {
+  const segments = path104.split("/");
   if (segments.some((s) => s.startsWith(":") && !s.endsWith("?"))) {
     return void 0;
   }
   return segments.filter((s) => !s.startsWith(":")).join("/") || void 0;
 };
-var isSkipped = (path103) => path103.includes("*") || /^\d+$/.test(path103);
+var isSkipped = (path104) => path104.includes("*") || /^\d+$/.test(path104);
 var resolveRoutes = (routes, parentPath = "") => routes.flatMap((route) => {
   if (route.path && isSkipped(route.path)) return [];
   const routePath = route.path ? resolveRoutePath(route.path) : void 0;
@@ -14801,15 +14862,9 @@ var missingCorePackages = (dir) => CORE_PACKAGES.filter((name) => !isPackageInst
 
 // src/cli/portal/v2.ts
 function assertPackagesInstalled(resolved, prepared) {
-  const require2 = createRequire2(path48.join(resolved.configDir, "package.json"));
-  const missing = requiredPackages(prepared.plan).filter((name) => {
-    try {
-      require2.resolve(name);
-      return false;
-    } catch {
-      return true;
-    }
-  });
+  const missing = requiredPackages(prepared.plan).filter(
+    (name) => !isPackageInstalled(resolved.configDir, name)
+  );
   const missingCore = missingCorePackages(resolved.configDir);
   if (missing.length === 0 && missingCore.length === 0) return;
   throw new ConfigError(resolved.configPath, [
@@ -14902,15 +14957,15 @@ async function buildV2(options) {
 // src/cli/check/gateway-online.ts
 import { readFile as readFile13 } from "node:fs/promises";
 var SPEC_SEND_LIMIT = 5 * 1024 * 1024 + 64 * 1024;
-var issue2 = (code, path103, message, hint) => ({ code, path: path103, message, hint });
+var issue2 = (code, path104, message, hint) => ({ code, path: path104, message, hint });
 function capabilityIssues(gateway, answer) {
   const can = answer.capabilities;
   const plan2 = `your ${answer.tier} plan`;
   const found = [];
-  const unsupported = (path103, what, hint) => found.push(
+  const unsupported = (path104, what, hint) => found.push(
     issue2(
       "GATEWAY_CAPABILITY_UNSUPPORTED",
-      path103,
+      path104,
       `${what} is not available on ${plan2}.`,
       hint
     )
@@ -15106,9 +15161,9 @@ function toPlatformPlans(plans) {
 }
 
 // src/cli/check/services-online.ts
-var issue3 = (code, path103, message, hint) => ({
+var issue3 = (code, path104, message, hint) => ({
   code,
-  path: path103,
+  path: path104,
   message,
   hint
 });
@@ -15187,9 +15242,10 @@ async function onlinePlansRules(resolved, projectId, api) {
   try {
     const answer = await api.validate(
       projectId,
-      wanted.map(({ includedActionKeys, ...plan2 }) => ({
+      // The platform's check needs the list even when it is empty: the actions are only known after the gateway deploy.
+      wanted.map((plan2) => ({
         ...plan2,
-        ...includedActionKeys ? { includedActionKeys } : {}
+        includedActionKeys: plan2.includedActionKeys ?? []
       }))
     );
     const convert = (item) => issue3(
@@ -18084,11 +18140,11 @@ var SECRETS_COLLECTION_INSTRUCTION = "For go-live, plans must already be in apit
 // src/cli/platform/helpers/dev-portal-site-validation.ts
 init_gateway_limits();
 import { readFile as readFile19 } from "node:fs/promises";
-import { createRequire as createRequire3 } from "node:module";
+import { createRequire as createRequire2 } from "node:module";
 import path59 from "node:path";
 var cachedFallbackTs;
 async function loadTypeScriptForSite(sourceDirectory) {
-  const require2 = createRequire3(
+  const require2 = createRequire2(
     path59.join(path59.resolve(sourceDirectory), "package.json")
   );
   try {
@@ -21571,7 +21627,7 @@ var config_default = {
 };
 
 // src/cli/cmds/deploy.ts
-import path85 from "node:path";
+import path86 from "node:path";
 
 // src/cli/apply/handler.ts
 import path82 from "node:path";
@@ -22103,8 +22159,8 @@ function normalizeActionKey(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path104 = pathParts.join(":").trim();
-    return `${method2?.toLowerCase()}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
+    const path105 = pathParts.join(":").trim();
+    return `${method2?.toLowerCase()}:${path105.startsWith("/") ? path105 : `/${path105}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -22113,8 +22169,8 @@ function normalizeActionKey(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path103 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  const path104 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 async function applyGatewayPublicRoutes(client, projectId, routes, options) {
   const applied = [];
@@ -22735,8 +22791,8 @@ function normalizeActionKeyFormat(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path104 = pathParts.join(":").trim();
-    return `${method2.toLowerCase()}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
+    const path105 = pathParts.join(":").trim();
+    return `${method2.toLowerCase()}:${path105.startsWith("/") ? path105 : `/${path105}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -22745,8 +22801,8 @@ function normalizeActionKeyFormat(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path103 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path103.startsWith("/") ? path103 : `/${path103}`}`;
+  const path104 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 function normalizePublicRoute(route) {
   const trimmed = route.trim();
@@ -27230,7 +27286,7 @@ async function apply(argv) {
 
 // src/cli/deploy/command.ts
 init_invariant();
-import path84 from "node:path";
+import path85 from "node:path";
 
 // src/cli/deploy/v2.ts
 import { rm as rm12 } from "node:fs/promises";
@@ -27486,6 +27542,52 @@ var IdentityDeployError = class extends ApitogoError {
   }
 };
 var IDENTITY_STEPS = ["request", "activate"];
+var IDENTITY_CONNECTIONS_STEP = "connections";
+var SECRET_PREFIX = "secret:";
+function normalizedConnections(resolved) {
+  return [...resolved.identity?.connections ?? []].map((connection) => ({
+    ...connection,
+    authority: connection.authority.trim().replace(/\/+$/, "")
+  })).sort((a, b) => a.id.localeCompare(b.id));
+}
+function identityConnectionsHash(projectId, resolved) {
+  return stableJson({
+    projectId,
+    connections: normalizedConnections(resolved)
+  });
+}
+async function recordedConnectionIds(resolved) {
+  const ids = stepOf(
+    await readLedger(resolved.state),
+    "identity",
+    IDENTITY_CONNECTIONS_STEP
+  )?.output?.ids;
+  return ids ? ids.split(",").filter(Boolean) : [];
+}
+function redirectAddressesOf(output4) {
+  return Object.entries(output4 ?? {}).filter(([key]) => key.startsWith("redirect.")).map(([key, redirectUri]) => ({
+    id: key.slice("redirect.".length),
+    redirectUri
+  }));
+}
+function connectionBody(connection) {
+  return {
+    authority: connection.authority,
+    clientId: connection.clientId,
+    clientSecret: connection.clientSecret,
+    scopes: connection.scopes,
+    displayName: connection.displayName
+  };
+}
+function referencedSecretNames(connections) {
+  return [
+    ...new Set(
+      connections.map(
+        (connection) => connection.clientSecret.slice(SECRET_PREFIX.length)
+      )
+    )
+  ];
+}
 var PORTAL_CALLBACK_PATH = "/oauth/callback";
 var defaultSleep2 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 function identityNotDeployableReason(resolved) {
@@ -27495,14 +27597,18 @@ function identityNotDeployableReason(resolved) {
     return 'identity.provider "oidc" needs issuer and clientId';
   return void 0;
 }
-function identityRequestBody(resolved, portalUrl) {
+function identityBodyForRedirect(resolved, redirectUri) {
   return {
-    portalRedirectUris: [
-      `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
-    ],
+    portalRedirectUris: [redirectUri],
     nativeSignup: resolved.identity?.native ?? true
   };
 }
+function identityRequestBody(resolved, portalUrl) {
+  return identityBodyForRedirect(
+    resolved,
+    `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
+  );
+}
 function identityInputsHash(projectId, body) {
   return stableJson({ projectId, body });
 }
@@ -27536,6 +27642,25 @@ function rejected2(error) {
   }
   throw error;
 }
+function connectionRejected(error, id) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The identity is not active yet, so connection "${id}" cannot be saved.`,
+      "Run deploy again once the identity is Active."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The platform refused login connection "${id}":
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the connection in apitogo.config.json (identity.connections) and run deploy again."
+    );
+  }
+  throw error;
+}
 async function recordOwnProvider(resolved, projectId) {
   const identity = resolved.identity;
   const issuer = identity?.issuer?.replace(/\/+$/, "");
@@ -27580,7 +27705,10 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
     run: async () => {
       try {
         const answer = await client.putProjectIdentity(projectId, body);
-        return { status: answer.status };
+        return {
+          status: answer.status,
+          redirectUri: body.portalRedirectUris[0] ?? ""
+        };
       } catch (error) {
         return rejected2(error);
       }
@@ -27622,10 +27750,14 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
     },
     stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
   };
+  const wanted = normalizedConnections(resolved);
+  const steps = [requestStep, activateStep];
+  if (wanted.length > 0 || (await recordedConnectionIds(resolved)).length > 0)
+    steps.push(connectionsStep(resolved, projectId, client, wanted));
   const outcomes = await runPipeline(
     resolved.state,
     "identity",
-    [requestStep, activateStep],
+    steps,
     { force: options.force }
   );
   const activate = outcomes.find((outcome) => outcome.step === "activate");
@@ -27648,14 +27780,103 @@ async function deployIdentity(resolved, projectId, deps, options = {}) {
       );
     }
   }
+  const connectionsRan = outcomes.some(
+    (outcome) => outcome.step === IDENTITY_CONNECTIONS_STEP && !outcome.skipped
+  );
   return {
-    status: ran ? "deployed" : "unchanged",
+    status: ran || connectionsRan ? "deployed" : "unchanged",
     steps: outcomes.map((outcome) => ({
       step: outcome.step,
       skipped: outcome.skipped
     })),
     issuer: learned?.issuer ?? known?.issuer,
-    clientId: learned?.clientId ?? known?.clientId
+    clientId: learned?.clientId ?? known?.clientId,
+    connections: redirectAddressesOf(
+      stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output
+    )
+  };
+}
+function connectionsStep(resolved, projectId, client, wanted) {
+  const {
+    putProjectIdentityConnection,
+    listProjectIdentityConnections,
+    deleteProjectIdentityConnection,
+    listSecrets
+  } = client;
+  if (!putProjectIdentityConnection || !listProjectIdentityConnections || !deleteProjectIdentityConnection || !listSecrets)
+    throw new Error("The platform client has no login connection calls.");
+  const stamps = async () => {
+    const names = referencedSecretNames(wanted);
+    if (names.length === 0) return {};
+    const listed = await listSecrets.call(client, projectId);
+    const byName2 = new Map(listed.secrets.map((s) => [s.name, s.updatedAtUtc]));
+    const missing = names.filter((name) => !byName2.has(name));
+    if (missing.length > 0)
+      throw new IdentityDeployError(
+        "IDENTITY_SECRET_MISSING",
+        `The secret ${missing.join(", ")} is not set for this project, and a login connection needs it.`,
+        `Run \`apitogo secrets set ${missing[0]}\` with the value from the provider, then deploy again.`
+      );
+    return Object.fromEntries(
+      names.map((name) => [name, byName2.get(name)])
+    );
+  };
+  const sameAddress = (a, b) => a.replace(/\/+$/, "").toLowerCase() === b.replace(/\/+$/, "").toLowerCase();
+  return {
+    name: IDENTITY_CONNECTIONS_STEP,
+    hash: () => identityConnectionsHash(projectId, resolved),
+    run: async () => {
+      const recorded = await stamps();
+      const existing = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      const redirects = {};
+      for (const connection of wanted) {
+        try {
+          const saved = await putProjectIdentityConnection.call(
+            client,
+            projectId,
+            connection.id,
+            connectionBody(connection)
+          );
+          redirects[`redirect.${connection.id}`] = saved.redirectUri;
+        } catch (error) {
+          return connectionRejected(error, connection.id);
+        }
+      }
+      for (const old of existing)
+        if (!wanted.some((connection) => connection.id === old.id))
+          await deleteProjectIdentityConnection.call(client, projectId, old.id);
+      return {
+        ids: wanted.map((connection) => connection.id).join(","),
+        secretsStamp: stableJson(recorded),
+        ...redirects
+      };
+    },
+    // The platform still has exactly these connections, and none of the secrets was changed since.
+    stillValid: async () => {
+      const found = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      if (found.length !== wanted.length) return false;
+      for (const connection of wanted) {
+        const there = found.find((f) => f.id === connection.id);
+        if (!there || there.clientId !== connection.clientId || !sameAddress(there.authority, connection.authority))
+          return false;
+      }
+      const before = stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output?.secretsStamp;
+      return before === void 0 || before === stableJson(await stamps());
+    }
   };
 }
 
@@ -27925,20 +28146,42 @@ async function planIdentityService(resolved, ledger, manifest) {
   }
   const projectId = resolved.project.id;
   const portalUrl = manifest?.services.portal?.url;
-  const body = portalUrl ? identityRequestBody(resolved, portalUrl) : void 0;
+  const recorded = stepOf(ledger, "identity", "request")?.output?.redirectUri;
+  const body = portalUrl ? identityRequestBody(resolved, portalUrl) : recorded ? identityBodyForRedirect(resolved, recorded) : void 0;
   const hash2 = projectId && body ? identityInputsHash(projectId, body) : void 0;
   const details = [
     "provider: apitogo (one issuer for this project)",
     `sign-up with email and password: ${identity.native ? "on" : "off"}`,
-    portalUrl ? `sign-in redirect: ${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}` : "sign-in redirect: the portal address is not known locally; deploy takes it from the project",
+    portalUrl ? `sign-in redirect: ${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}` : recorded ? `sign-in redirect: ${recorded} (sent by the last deploy)` : "sign-in redirect: the portal address is not known locally; deploy takes it from the project",
     ...known?.issuer ? [`issuer: ${known.issuer}`] : [],
     ...IDENTITY_STEPS.map(
       (name) => `step ${name}: ${stepState(stepOf(ledger, "identity", name), hash2)}`
     )
   ];
+  const connections = normalizedConnections(resolved);
+  const leftOnPlatform = (await recordedConnectionIds(resolved)).length > 0;
+  const connectionsHash = projectId ? identityConnectionsHash(projectId, resolved) : void 0;
+  const connectionsRecord = stepOf(
+    ledger,
+    "identity",
+    IDENTITY_CONNECTIONS_STEP
+  );
+  if (connections.length > 0 || leftOnPlatform) {
+    for (const connection of connections)
+      details.push(
+        `login connection ${connection.id}: ${connection.displayName ?? connection.id} (${connection.authority})` + (known?.issuer ? `, register this redirect address with the provider: ${known.issuer.replace(/\/+$/, "")}/account/external/${connection.id}/callback` : "")
+      );
+    if (connections.length === 0)
+      details.push(
+        "login connections: the last deploy's connections will be removed"
+      );
+    details.push(
+      `step ${IDENTITY_CONNECTIONS_STEP}: ${stepState(connectionsRecord, connectionsHash)}`
+    );
+  }
   const allDone = IDENTITY_STEPS.every(
     (name) => isDone(stepOf(ledger, "identity", name), hash2)
-  );
+  ) && (connections.length === 0 && !leftOnPlatform ? true : isDone(connectionsRecord, connectionsHash));
   return {
     ...base,
     action: allDone ? "skip" : "deploy",
@@ -28004,7 +28247,7 @@ async function planPlansService(resolved, ledger) {
 }
 var failedStep = (ledger, service, names) => names.map((name) => ({ name, record: stepOf(ledger, service, name) })).find((step2) => step2.record?.status === "failed");
 var unreachable = (error) => `platform: not reachable (${error instanceof Error ? error.message : String(error)}); showing local records only`;
-async function identityStatus(resolved, ledger, manifest, remote) {
+async function identityStatus(resolved, ledger, manifest, remote, connectionsRemote) {
   const entry = manifest?.services.identity;
   const failed = failedStep(ledger, "identity", IDENTITY_STEPS);
   const details = [];
@@ -28038,6 +28281,15 @@ async function identityStatus(resolved, ledger, manifest, remote) {
           );
           state = "drift";
         }
+        if (connectionsRemote && platform.status === "Active") {
+          const drift = await connectionLines(
+            resolved,
+            projectId,
+            connectionsRemote,
+            details
+          );
+          if (drift && state === "ready") state = "drift";
+        }
       }
     } catch (error) {
       details.push(unreachable(error));
@@ -28053,6 +28305,36 @@ async function identityStatus(resolved, ledger, manifest, remote) {
   }
   return { service: "identity", state, details };
 }
+async function connectionLines(resolved, projectId, remote, details) {
+  const configured = normalizedConnections(resolved);
+  let there;
+  try {
+    there = await remote(projectId);
+  } catch (error) {
+    details.push(unreachable(error));
+    return false;
+  }
+  for (const connection of there)
+    details.push(
+      `login connection ${connection.id}: ${connection.displayName} (${connection.authority}), register this redirect address with the provider: ${connection.redirectUri}`
+    );
+  let differ = false;
+  for (const connection of configured)
+    if (!there.some((t) => t.id === connection.id)) {
+      details.push(
+        `drift: login connection ${connection.id} is in the config but not on the platform; run deploy`
+      );
+      differ = true;
+    }
+  for (const connection of there)
+    if (!configured.some((c) => c.id === connection.id)) {
+      details.push(
+        `drift: login connection ${connection.id} is on the platform but not in the config; deploy removes it`
+      );
+      differ = true;
+    }
+  return differ;
+}
 async function plansStatus(resolved, ledger, manifest, remote, wantedSkus2) {
   const entry = manifest?.services.plans;
   const failed = failedStep(ledger, "plans", PLANS_STEPS);
@@ -28488,7 +28770,8 @@ async function statusV2(dir, only, options = {}) {
           resolved,
           ledger,
           manifest,
-          options.identityRemote
+          options.identityRemote,
+          options.identityConnectionsRemote
         )
       );
       continue;
@@ -28532,6 +28815,36 @@ function formatStatus(output4) {
   ];
 }
 
+// src/cli/deploy/static-web-config.ts
+import { access as access14, writeFile as writeFile25 } from "node:fs/promises";
+import path84 from "node:path";
+var STATIC_WEB_CONFIG_FILE = "staticwebapp.config.json";
+var STATIC_WEB_CONFIG_VERSION = 1;
+var DEFAULT_STATIC_WEB_CONFIG = {
+  navigationFallback: {
+    rewrite: "/index.html",
+    exclude: [
+      "/assets/*",
+      "/*.{png,jpg,jpeg,gif,svg,ico,css,js,mjs,json,txt,xml,webmanifest,woff,woff2,map}"
+    ]
+  }
+};
+async function ensureStaticWebConfig(buildDir) {
+  const file = path84.join(buildDir, STATIC_WEB_CONFIG_FILE);
+  try {
+    await access14(file);
+    return false;
+  } catch {
+    await writeFile25(
+      file,
+      `${JSON.stringify(DEFAULT_STATIC_WEB_CONFIG, null, 2)}
+`,
+      "utf8"
+    );
+    return true;
+  }
+}
+
 // src/cli/deploy/v2.ts
 var DeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -28556,8 +28869,9 @@ function parseDeployOnly(value) {
 function publishStep(deps, options) {
   return {
     name: "publish",
-    hash: () => `${options.buildHash}|${options.projectId}|${options.env ?? ""}`,
+    hash: () => `${options.buildHash}|${options.projectId}|${options.env ?? ""}|host-config-${STATIC_WEB_CONFIG_VERSION}`,
     run: async () => {
+      await ensureStaticWebConfig(options.buildDir);
       const pack = deps.pack ?? packageDirectoryAsTarGz;
       const archive = await pack(options.buildDir, { archiveRoot: "dist" });
       try {
@@ -28694,7 +29008,10 @@ async function deployIdentityService(options, deps, projectId, named) {
     service: "identity",
     status: result.status,
     steps: result.steps,
-    url: result.issuer
+    url: result.issuer,
+    notes: (result.connections ?? []).map(
+      (connection) => `login connection ${connection.id}: register this redirect address with the provider: ${connection.redirectUri}`
+    )
   };
 }
 async function deployPlansService(options, deps, projectId, named) {
@@ -28791,7 +29108,8 @@ function formatDeploy(output4) {
       head,
       ...result.steps.map(
         (step2) => `  ${step2.step}: ${step2.skipped ? "skipped (unchanged)" : "ran"}`
-      )
+      ),
+      ...(result.notes ?? []).map((note) => `  ${note}`)
     ];
   });
 }
@@ -28803,7 +29121,7 @@ async function deployProject(argv) {
     const config2 = loadConfig();
     const output4 = await deployV2(
       {
-        dir: path84.resolve(process.cwd(), argv.dir),
+        dir: path85.resolve(process.cwd(), argv.dir),
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         projectId: argv.projectId,
         env: argv.env,
@@ -28884,7 +29202,7 @@ var deploy_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo deploy" });
-    if (await isConfigV2(path85.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path86.resolve(process.cwd(), argv.dir))) {
       await deployProject(argv);
       return;
     }
@@ -28893,8 +29211,8 @@ var deploy_default = {
 };
 
 // src/cli/export/handler.ts
-import { mkdir as mkdir20, writeFile as writeFile25 } from "node:fs/promises";
-import path86 from "node:path";
+import { mkdir as mkdir20, writeFile as writeFile26 } from "node:fs/promises";
+import path87 from "node:path";
 init_invariant();
 var ExportError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -28908,7 +29226,7 @@ async function exportOpenApi(args, deps) {
       `Cannot export "${args.target}".`,
       "Only `apitogo export openapi` exists."
     );
-  const dir = path86.resolve(process.cwd(), args.dir ?? ".");
+  const dir = path87.resolve(process.cwd(), args.dir ?? ".");
   if (!await isConfigV2(dir))
     throw new ExportError(
       "This command needs a config version 2 project.",
@@ -28933,9 +29251,9 @@ async function exportOpenApi(args, deps) {
     throw error;
   }
   if (!args.out) return { text };
-  const file = path86.resolve(process.cwd(), args.out);
-  await mkdir20(path86.dirname(file), { recursive: true });
-  await writeFile25(file, text);
+  const file = path87.resolve(process.cwd(), args.out);
+  await mkdir20(path87.dirname(file), { recursive: true });
+  await writeFile26(file, text);
   return { text, file };
 }
 async function exportCommand(args) {
@@ -28985,15 +29303,15 @@ var export_default = {
 };
 
 // src/cli/init/handler.ts
-import path90 from "node:path";
+import path91 from "node:path";
 
 // src/cli/scaffold/run-scaffold-discovery.ts
-import { access as access15, readFile as readFile31, writeFile as writeFile27 } from "node:fs/promises";
-import path89 from "node:path";
+import { access as access16, readFile as readFile31, writeFile as writeFile28 } from "node:fs/promises";
+import path90 from "node:path";
 
 // src/cli/scaffold/detect-backend.ts
 import { readdir as readdir4, readFile as readFile29 } from "node:fs/promises";
-import path87 from "node:path";
+import path88 from "node:path";
 var DEFAULT_RUNTIME_VERSION = {
   dotnet: "DOTNET_10",
   nodejs: "NODE_22_LTS",
@@ -29039,15 +29357,15 @@ function isRunnableNodePackage(pkg) {
   return typeof scripts.start === "string" || typeof pkg.main === "string";
 }
 async function detectParentBackend(siteDirectory) {
-  const site = path87.resolve(siteDirectory);
-  const directory = path87.dirname(site);
+  const site = path88.resolve(siteDirectory);
+  const directory = path88.dirname(site);
   if (directory === site) {
     return void 0;
   }
   const files = await listFiles(directory);
   const toResult = (runtime, runtimeVersion, marker) => ({
     directory,
-    sourceDirectory: path87.relative(site, directory).split(path87.sep).join("/") || ".",
+    sourceDirectory: path88.relative(site, directory).split(path88.sep).join("/") || ".",
     runtime,
     runtimeVersion,
     marker
@@ -29055,7 +29373,7 @@ async function detectParentBackend(siteDirectory) {
   const csproj = files.find((f) => f.endsWith(".csproj"));
   const solution = files.find((f) => /\.slnx?$/.test(f));
   if (csproj || solution) {
-    const content = csproj ? await readText(path87.join(directory, csproj)) : void 0;
+    const content = csproj ? await readText(path88.join(directory, csproj)) : void 0;
     return toResult(
       "dotnet",
       dotnetVersionFromCsproj(content),
@@ -29063,7 +29381,7 @@ async function detectParentBackend(siteDirectory) {
     );
   }
   if (files.includes("package.json")) {
-    const raw = await readText(path87.join(directory, "package.json"));
+    const raw = await readText(path88.join(directory, "package.json"));
     try {
       const pkg = JSON.parse(raw ?? "");
       if (isRunnableNodePackage(pkg)) {
@@ -29078,7 +29396,7 @@ async function detectParentBackend(siteDirectory) {
   }
   const pythonMarker = PYTHON_MARKERS.find((m) => files.includes(m));
   if (pythonMarker) {
-    const versionSource = await readText(path87.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path87.join(directory, pythonMarker)))?.match(
+    const versionSource = await readText(path88.join(directory, ".python-version")) ?? (pythonMarker === "pyproject.toml" ? (await readText(path88.join(directory, pythonMarker)))?.match(
       /requires-python\s*=\s*"([^"]+)"/
     )?.[1] : void 0);
     return toResult(
@@ -29092,16 +29410,16 @@ async function detectParentBackend(siteDirectory) {
 
 // src/cli/scaffold/wire-docs.ts
 import {
-  access as access14,
+  access as access15,
   lstat as lstat2,
   mkdir as mkdir21,
   readdir as readdir5,
   readFile as readFile30,
   readlink,
   symlink as symlink2,
-  writeFile as writeFile26
+  writeFile as writeFile27
 } from "node:fs/promises";
-import path88 from "node:path";
+import path89 from "node:path";
 var DOCS_DIR_WHITELIST = [
   "docs",
   "documents",
@@ -29123,7 +29441,7 @@ var PAGES_DIR = "pages";
 var CONFIG_FILENAME = "apitogo.config.json";
 async function pathExists5(filePath) {
   try {
-    await access14(filePath);
+    await access15(filePath);
     return true;
   } catch {
     return false;
@@ -29138,14 +29456,14 @@ async function isDirectory2(filePath) {
   }
 }
 function toPosix3(value) {
-  return value.split(path88.sep).join(path88.posix.sep);
+  return value.split(path89.sep).join(path89.posix.sep);
 }
 function isWhitelistedDirName(name) {
   return DOCS_DIR_WHITELIST.includes(name.toLowerCase());
 }
 function isInside2(parent, child) {
-  const relative = path88.relative(parent, child);
-  return relative === "" || !relative.startsWith("..") && !path88.isAbsolute(relative);
+  const relative = path89.relative(parent, child);
+  return relative === "" || !relative.startsWith("..") && !path89.isAbsolute(relative);
 }
 async function collectMarkdownFiles(dir, excludeDir) {
   const files = [];
@@ -29159,9 +29477,9 @@ async function collectMarkdownFiles(dir, excludeDir) {
     if (entry.name.startsWith(".")) {
       continue;
     }
-    const full = path88.join(dir, entry.name);
+    const full = path89.join(dir, entry.name);
     if (entry.isDirectory()) {
-      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path88.resolve(full) === excludeDir) {
+      if (SKIP_SEARCH_DIRS.has(entry.name) || entry.isSymbolicLink() || excludeDir && path89.resolve(full) === excludeDir) {
         continue;
       }
       files.push(...await collectMarkdownFiles(full, excludeDir));
@@ -29174,11 +29492,11 @@ async function collectMarkdownFiles(dir, excludeDir) {
   return files;
 }
 async function collectSearchRoots(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const parent = path88.dirname(site);
+  const site = path89.resolve(siteDirectory);
+  const parent = path89.dirname(site);
   const roots = [];
   const add = (dir) => {
-    const resolved = path88.resolve(dir);
+    const resolved = path89.resolve(dir);
     if (!roots.includes(resolved)) {
       roots.push(resolved);
     }
@@ -29191,7 +29509,7 @@ async function collectSearchRoots(siteDirectory) {
         if (!entry.isDirectory() || SKIP_SEARCH_DIRS.has(entry.name)) {
           continue;
         }
-        add(path88.join(parent, entry.name));
+        add(path89.join(parent, entry.name));
       }
     } catch {
     }
@@ -29200,13 +29518,13 @@ async function collectSearchRoots(siteDirectory) {
   return roots;
 }
 async function discoverNearbyDocsDirectories(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const sitePages = path88.join(site, PAGES_DIR);
+  const site = path89.resolve(siteDirectory);
+  const sitePages = path89.join(site, PAGES_DIR);
   const searchedDirectories = await collectSearchRoots(site);
   const directories = [];
   const seen = /* @__PURE__ */ new Set();
   const consider = async (dir) => {
-    const resolved = path88.resolve(dir);
+    const resolved = path89.resolve(dir);
     if (resolved === site || seen.has(resolved) || isInside2(sitePages, resolved)) {
       return;
     }
@@ -29223,7 +29541,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
     directories.push({ sourceDirectory: resolved, files });
   };
   for (const root of searchedDirectories) {
-    if (isWhitelistedDirName(path88.basename(root))) {
+    if (isWhitelistedDirName(path89.basename(root))) {
       await consider(root);
     }
     try {
@@ -29235,7 +29553,7 @@ async function discoverNearbyDocsDirectories(siteDirectory) {
         if (!isWhitelistedDirName(entry.name)) {
           continue;
         }
-        await consider(path88.join(root, entry.name));
+        await consider(path89.join(root, entry.name));
       }
     } catch {
     }
@@ -29254,8 +29572,8 @@ function slugifyDirName(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "docs";
 }
 async function allocateLinkName(pagesDir, sourceDirectory, used) {
-  const base = slugifyDirName(path88.basename(sourceDirectory));
-  const parent = slugifyDirName(path88.basename(path88.dirname(sourceDirectory)));
+  const base = slugifyDirName(path89.basename(sourceDirectory));
+  const parent = slugifyDirName(path89.basename(path89.dirname(sourceDirectory)));
   const candidates = [base, `${parent}-${base}`];
   let index = 2;
   while (true) {
@@ -29263,7 +29581,7 @@ async function allocateLinkName(pagesDir, sourceDirectory, used) {
     if (used.has(name)) {
       continue;
     }
-    const target = path88.join(pagesDir, name);
+    const target = path89.join(pagesDir, name);
     if (await pathExists5(target)) {
       const stat7 = await lstat2(target);
       if (!stat7.isDirectory() || !await isManagedLinkDir(target)) {
@@ -29294,8 +29612,8 @@ async function alreadyLinked(linkPath, sourcePath) {
       return false;
     }
     const current = await readlink(linkPath);
-    const resolved = path88.resolve(path88.dirname(linkPath), current);
-    return resolved === path88.resolve(sourcePath);
+    const resolved = path89.resolve(path89.dirname(linkPath), current);
+    return resolved === path89.resolve(sourcePath);
   } catch {
     return false;
   }
@@ -29307,8 +29625,8 @@ async function linkMarkdownFile(sourcePath, linkPath) {
   if (await pathExists5(linkPath)) {
     return "skipped";
   }
-  await mkdir21(path88.dirname(linkPath), { recursive: true });
-  const relativeTarget = path88.relative(path88.dirname(linkPath), sourcePath);
+  await mkdir21(path89.dirname(linkPath), { recursive: true });
+  const relativeTarget = path89.relative(path89.dirname(linkPath), sourcePath);
   await symlink2(
     relativeTarget,
     linkPath,
@@ -29323,7 +29641,7 @@ async function applyDocsNavigation(siteDirectory, routes) {
   if (routes.length === 0) {
     return;
   }
-  const configPath = path88.join(siteDirectory, CONFIG_FILENAME);
+  const configPath = path89.join(siteDirectory, CONFIG_FILENAME);
   if (!await pathExists5(configPath)) {
     return;
   }
@@ -29336,12 +29654,12 @@ async function applyDocsNavigation(siteDirectory, routes) {
     force: false
   });
   const updated = ensureHeaderDocsNavigation(parsed, routes);
-  await writeFile26(configPath, `${JSON.stringify(updated, null, 2)}
+  await writeFile27(configPath, `${JSON.stringify(updated, null, 2)}
 `, "utf8");
 }
 async function discoverAndWireDocs(siteDirectory) {
-  const site = path88.resolve(siteDirectory);
-  const pagesDir = path88.join(site, PAGES_DIR);
+  const site = path89.resolve(siteDirectory);
+  const pagesDir = path89.join(site, PAGES_DIR);
   const { directories, searchedDirectories } = await discoverNearbyDocsDirectories(site);
   if (directories.length === 0) {
     return {
@@ -29363,15 +29681,15 @@ async function discoverAndWireDocs(siteDirectory) {
       directory.sourceDirectory,
       usedNames
     );
-    const linkDirectory = path88.join(pagesDir, linkName);
+    const linkDirectory2 = path89.join(pagesDir, linkName);
     const linked = [];
     const skipped = [];
     for (const sourcePath of directory.files) {
       const relativeSource = toPosix3(
-        path88.relative(directory.sourceDirectory, sourcePath)
+        path89.relative(directory.sourceDirectory, sourcePath)
       );
-      const linkPath = path88.join(linkDirectory, relativeSource);
-      const relativeLink = toPosix3(path88.relative(site, linkPath));
+      const linkPath = path89.join(linkDirectory2, relativeSource);
+      const relativeLink = toPosix3(path89.relative(site, linkPath));
       const route = toRoutePath(relativeLink, PAGES_DIR);
       if (routes.includes(route)) {
         skipped.push({
@@ -29393,7 +29711,7 @@ async function discoverAndWireDocs(siteDirectory) {
     }
     sources.push({
       sourceDirectory: directory.sourceDirectory,
-      linkDirectory,
+      linkDirectory: linkDirectory2,
       linkName,
       files: linked,
       skipped
@@ -29419,11 +29737,11 @@ async function discoverAndWireDocs(siteDirectory) {
   };
 }
 function siteRelative(siteDirectory, filePath) {
-  const relative = toPosix3(path88.relative(siteDirectory, filePath));
+  const relative = toPosix3(path89.relative(siteDirectory, filePath));
   if (!relative) {
     return ".";
   }
-  if (path88.isAbsolute(relative)) {
+  if (path89.isAbsolute(relative)) {
     return toPosix3(filePath);
   }
   if (relative.startsWith("..")) {
@@ -29503,7 +29821,7 @@ function formatInitDiscoveryReport(siteDirectory, openApiDiscovery, docsDiscover
 // src/cli/scaffold/run-scaffold-discovery.ts
 async function pathExists6(filePath) {
   try {
-    await access15(filePath);
+    await access16(filePath);
     return true;
   } catch {
     return false;
@@ -29511,7 +29829,7 @@ async function pathExists6(filePath) {
 }
 async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   const input5 = toSiteRelativeOpenApiInput(siteDirectory, openApiPath);
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
   const raw = await readFile31(jsonConfigPath, "utf8");
   const siteConfig = JSON.parse(raw);
   const updated = applyOpenApiToSiteConfig(siteConfig, {
@@ -29520,7 +29838,7 @@ async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   });
   const backend = updated.backend && typeof updated.backend === "object" && !Array.isArray(updated.backend) ? { ...updated.backend } : {};
   updated.backend = { ...backend, openApiPath: input5 };
-  await writeFile27(
+  await writeFile28(
     jsonConfigPath,
     `${JSON.stringify(updated, null, 2)}
 `,
@@ -29563,7 +29881,7 @@ async function discoverAndWireOpenApiLite(siteDirectory, mode) {
       wired: false
     };
   }
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return {
       openApiDiscovery: {
@@ -29613,7 +29931,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
   if (mode !== "nearby") {
     return { status: "skipped", mode };
   }
-  const jsonConfigPath = path89.join(siteDirectory, "apitogo.config.json");
+  const jsonConfigPath = path90.join(siteDirectory, "apitogo.config.json");
   if (!await pathExists6(jsonConfigPath)) {
     return { status: "not_found" };
   }
@@ -29640,7 +29958,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
       runtime: detected.runtime,
       runtimeVersion: detected.runtimeVersion
     };
-    await writeFile27(
+    await writeFile28(
       jsonConfigPath,
       `${JSON.stringify(siteConfig, null, 2)}
 `,
@@ -29680,8 +29998,8 @@ function slugifyName2(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "dev-portal-site";
 }
 function resolveInitOutputDirectory(dirArg, name) {
-  const resolved = path90.resolve(process.cwd(), dirArg);
-  const base = path90.basename(resolved);
+  const resolved = path91.resolve(process.cwd(), dirArg);
+  const base = path91.basename(resolved);
   const isDot = dirArg === "." || dirArg === "./" || base === "." || resolved === process.cwd();
   if (isDot) {
     const fromName = name?.trim();
@@ -29691,7 +30009,7 @@ function resolveInitOutputDirectory(dirArg, name) {
       );
     }
     return {
-      outputDirectory: path90.resolve(process.cwd(), slugifyName2(fromName)),
+      outputDirectory: path91.resolve(process.cwd(), slugifyName2(fromName)),
       siteName: fromName
     };
   }
@@ -29874,8 +30192,8 @@ import open2 from "open";
 import colors14 from "picocolors";
 
 // src/cli/platform/device-auth.ts
-function url(apiUrl, path103) {
-  return `${apiUrl}${path103.startsWith("/") ? path103 : `/${path103}`}`;
+function url(apiUrl, path104) {
+  return `${apiUrl}${path104.startsWith("/") ? path104 : `/${path104}`}`;
 }
 async function requestDeviceCode(apiUrl) {
   const response = await fetchWithRetry(
@@ -30057,7 +30375,7 @@ var logout_default = {
 };
 
 // src/cli/portal/commands.ts
-import path91 from "node:path";
+import path92 from "node:path";
 init_invariant();
 function parseOnly(value) {
   if (value === void 0) return void 0;
@@ -30074,7 +30392,7 @@ function parseOnly(value) {
 async function run2(command2, argv, compute, format) {
   const json = argv.json === true;
   try {
-    const dir = path91.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path92.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${command2} works with a config version 2 project, and there is none in ${dir}.`,
@@ -30133,6 +30451,14 @@ function identityRemote() {
     return void 0;
   }
 }
+function identityConnectionsRemote() {
+  try {
+    const client = new PlatformApiClient(loadConfig());
+    return (projectId) => client.listProjectIdentityConnections(projectId);
+  } catch {
+    return void 0;
+  }
+}
 function plansRemote() {
   try {
     const client = new PlatformApiClient(loadConfig());
@@ -30152,6 +30478,7 @@ var statusOfProject = (argv) => run2(
   (dir, only) => statusV2(dir, only, {
     gatewayRemote: gatewayRemote(),
     identityRemote: identityRemote(),
+    identityConnectionsRemote: identityConnectionsRemote(),
     plansRemote: plansRemote()
   }),
   formatStatus
@@ -30183,7 +30510,7 @@ var plan_default = {
 
 // src/cli/project/create-handler.ts
 init_invariant();
-import path92 from "node:path";
+import path93 from "node:path";
 
 // src/cli/project/v2.ts
 init_invariant();
@@ -30216,7 +30543,9 @@ async function createProjectV2(options, deps) {
     modules,
     wait: options.wait !== false,
     projectId: linkedProjectId,
-    onProjectResolved: (projectId) => setProjectId(options.dir, projectId)
+    onProjectResolved: async (projectId) => {
+      await setProjectId(options.dir, projectId);
+    }
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {
@@ -30328,7 +30657,7 @@ async function createLinkedProject(argv, dir) {
   }
 }
 async function createProject(argv) {
-  const dir = path92.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path93.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     await createLinkedProject(argv, dir);
     return;
@@ -30452,14 +30781,14 @@ var remove_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path95 from "node:path";
+import path96 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs12 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path94 from "node:path";
+import path95 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -30492,7 +30821,7 @@ init_loader();
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path93 from "node:path";
+import path94 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -30545,7 +30874,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path93.join(vite.config.publicDir, "pagefind");
+  const outputPath = path94.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -30564,9 +30893,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.options;
     const [key, cert, ca] = await Promise.all([
-      fs12.readFile(path94.resolve(dir, config2.https.key)),
-      fs12.readFile(path94.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs12.readFile(path94.resolve(dir, config2.https.ca)) : void 0
+      fs12.readFile(path95.resolve(dir, config2.https.key)),
+      fs12.readFile(path95.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs12.readFile(path95.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -30583,7 +30912,7 @@ var DevServer = class {
     );
     const server = await this.createNodeServer(config2);
     if (config2.search?.type === "pagefind" && viteConfig.publicDir !== false) {
-      const publicRoot = path94.resolve(
+      const publicRoot = path95.resolve(
         this.options.dir,
         typeof viteConfig.publicDir === "string" ? viteConfig.publicDir : "public"
       );
@@ -30600,7 +30929,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "apitogo:entry-client",
           configureServer(server2) {
-            const entryPath = path94.posix.join(
+            const entryPath = path95.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -30765,7 +31094,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson3 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  let dir = path95.resolve(process.cwd(), argv.dir);
+  let dir = path96.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(dir)) {
     const { root, prepared } = await preparePortalWorkspace(dir, "development");
     dir = root;
@@ -30864,7 +31193,7 @@ var run_default = {
 };
 
 // src/cli/secrets/handler.ts
-import path96 from "node:path";
+import path97 from "node:path";
 init_invariant();
 
 // src/cli/secrets/input.ts
@@ -30929,7 +31258,7 @@ var SecretsError = class extends ApitogoError {
 async function resolveProjectId2(argv, deps) {
   const explicit = argv.projectId?.trim();
   if (explicit) return explicit;
-  const dir = path96.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path97.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     const id = loadConfigV2(dir).resolved.project.id;
     if (id) return id;
@@ -31089,12 +31418,12 @@ var secrets_default = {
 };
 
 // src/cli/cmds/status.ts
-import path98 from "node:path";
+import path99 from "node:path";
 
 // src/cli/status/handler.ts
-import path97 from "node:path";
+import path98 from "node:path";
 async function status(argv) {
-  const sourceDirectory = path97.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path98.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -31192,7 +31521,7 @@ var status_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo status" });
-    if (await isConfigV2(path98.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path99.resolve(process.cwd(), argv.dir))) {
       await statusOfProject(argv);
       return;
     }
@@ -31201,11 +31530,11 @@ var status_default = {
 };
 
 // src/cli/cmds/teardown.ts
-import path101 from "node:path";
+import path102 from "node:path";
 
 // src/cli/teardown/command.ts
 init_invariant();
-import path99 from "node:path";
+import path100 from "node:path";
 import { createInterface as createInterface7 } from "node:readline/promises";
 
 // src/cli/teardown/v2.ts
@@ -31566,7 +31895,7 @@ async function teardownProject(argv) {
     const progress = createConsoleProgressReporter();
     const result = await teardownV2(
       {
-        dir: path99.resolve(process.cwd(), argv.dir),
+        dir: path100.resolve(process.cwd(), argv.dir),
         projectId: argv.projectId,
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         yes: argv.yes === true,
@@ -31625,7 +31954,7 @@ async function teardownProject(argv) {
 }
 
 // src/cli/teardown/handler.ts
-import path100 from "node:path";
+import path101 from "node:path";
 function resultLooksFailed3(payload) {
   try {
     const parsed = JSON.parse(payload);
@@ -31641,7 +31970,7 @@ async function teardown(argv) {
     );
     return;
   }
-  const sourceDirectory = path100.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path101.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -31719,7 +32048,7 @@ var teardown_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo teardown" });
-    if (await isConfigV2(path101.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path102.resolve(process.cwd(), argv.dir))) {
       await teardownProject(argv);
       return;
     }
@@ -31797,36 +32126,36 @@ function createApitogoCli(argv) {
 // src/cli/local-handoff.ts
 import { spawn as spawn5 } from "node:child_process";
 import { existsSync as existsSync9, realpathSync as realpathSync2 } from "node:fs";
-import path102 from "node:path";
+import path103 from "node:path";
 var LOCAL_HANDOFF_ENV = "APITOGO_LOCAL_CLI";
 var PACKAGE_NAME = "@lukoweb/apitogo";
 var resolveProjectDir = (argv, cwd) => {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const next = argv[i + 1];
-    if (arg === "--dir" && next) return path102.resolve(cwd, next);
+    if (arg === "--dir" && next) return path103.resolve(cwd, next);
     if (arg?.startsWith("--dir=")) {
-      return path102.resolve(cwd, arg.slice("--dir=".length));
+      return path103.resolve(cwd, arg.slice("--dir=".length));
     }
   }
   return cwd;
 };
 var findLocalCli = (projectDir, runningRoot) => {
-  let dir = path102.resolve(projectDir);
+  let dir = path103.resolve(projectDir);
   let localPackageRoot;
   while (!localPackageRoot) {
-    const candidate = path102.join(dir, "node_modules", PACKAGE_NAME);
-    if (existsSync9(path102.join(candidate, "package.json"))) {
+    const candidate = path103.join(dir, "node_modules", PACKAGE_NAME);
+    if (existsSync9(path103.join(candidate, "package.json"))) {
       localPackageRoot = candidate;
-    } else if (dir === path102.dirname(dir)) {
+    } else if (dir === path103.dirname(dir)) {
       return void 0;
     } else {
-      dir = path102.dirname(dir);
+      dir = path103.dirname(dir);
     }
   }
   const localRoot = realpathSync2(localPackageRoot);
   if (localRoot === realpathSync2(runningRoot)) return void 0;
-  return path102.join(localRoot, "cli.js");
+  return path103.join(localRoot, "cli.js");
 };
 var handoffToLocalCli = async (argv, runningRoot) => {
   if (process.env[LOCAL_HANDOFF_ENV] || process.env.ZUDOKU_ENV === "internal") {
@@ -31838,7 +32167,7 @@ var handoffToLocalCli = async (argv, runningRoot) => {
   );
   if (!localCli) return void 0;
   printDiagnosticsToConsole(
-    `Using the project's local ${PACKAGE_NAME} (${path102.dirname(localCli)})`
+    `Using the project's local ${PACKAGE_NAME} (${path103.dirname(localCli)})`
   );
   const child = spawn5(process.execPath, [localCli, ...argv], {
     stdio: "inherit",