@lukoweb/apitogo 0.2.29 → 0.2.31

package/dist/cli/cli.js

@@ -7092,7 +7092,7 @@ function identityRules(config2, resolved, out) {
         );
     }
   }
-  for (const [list2, label] of [
+  for (const [list2, label2] of [
     [identity.connections, "connections"],
     [identity.clients, "clients"]
   ]) {
@@ -7101,8 +7101,8 @@ function identityRules(config2, resolved, out) {
       if (seen.has(item.id)) {
         out.error({
           code: "IDENTITY_DUPLICATE_ID",
-          path: `identity.${label}[${index}].id`,
-          message: `the id "${item.id}" is used more than once in identity.${label}.`
+          path: `identity.${label2}[${index}].id`,
+          message: `the id "${item.id}" is used more than once in identity.${label2}.`
         });
       }
       seen.add(item.id);
@@ -9133,7 +9133,9 @@ var PlatformApiClient = class {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           planSlug: body.planSlug,
-          currency: body.currency ?? null
+          currency: body.currency ?? null,
+          // Only a platform admin may skip the payment; the platform refuses it for anyone else.
+          ...body.skipPayment ? { skipPayment: true } : {}
         })
       }
     );
@@ -9431,6 +9433,20 @@ var PlatformApiClient = class {
     );
     return result ?? null;
   }
+  /**
+   * Gives the plans backend the tenant's own Stripe settings. `apiKey` and `webhookSecret` are `secret:NAME`
+   * references to project secrets, never values. Queues a job that updates the running backend.
+   */
+  putDevPortalBilling(projectId, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/dev-portal/billing`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
   /** Applies the project's identity to its plans backend as the sign-in provider. Queues a job. */
   linkDevPortalIdentity(projectId) {
     return this.request(
@@ -9980,7 +9996,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.29",
+  version: "0.2.31",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -12090,8 +12106,8 @@ var extractRichH1 = (content) => {
     if (!h1) return void 0;
     const children = h1.children;
     const hasJsx = children.some(isMdxJsxElement);
-    const label = mdastToString(h1).trim();
-    return hasJsx ? { label, rich: children } : { label };
+    const label2 = mdastToString(h1).trim();
+    return hasJsx ? { label: label2, rich: children } : { label: label2 };
   } catch {
     return void 0;
   }
@@ -12152,12 +12168,12 @@ var NavigationResolver = class {
       return void 0;
     }
     const richH1 = extractRichH1(content);
-    const label = data.navigation_label ?? data.sidebar_label ?? data.title ?? richH1?.label ?? extractTitleFromContent(content) ?? filePath;
+    const label2 = data.navigation_label ?? data.sidebar_label ?? data.title ?? richH1?.label ?? extractTitleFromContent(content) ?? filePath;
     const icon = data.navigation_icon ?? data.sidebar_icon;
     const doc = {
       type: "doc",
       file: filePath,
-      label,
+      label: label2,
       icon,
       display: data.navigation_display,
       categoryLabel,
@@ -12543,8 +12559,8 @@ var viteApiPlugin = async () => {
             return acc;
           }, /* @__PURE__ */ new Map());
           const categoryList = Array.from(categories.entries()).map(
-            ([label, tags]) => ({
-              label,
+            ([label2, tags]) => ({
+              label: label2,
               tags: Array.from(tags)
             })
           );
@@ -15137,14 +15153,14 @@ async function readPlansFile(file) {
   return parsed.data.plans;
 }
 var BILLING_PERIOD = { month: "monthly", year: "annual" };
-function toPlatformPlans(plans) {
+function toPlatformPlans(plans, options = {}) {
   return plans.map((plan2, index) => {
     const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
-    if (paid)
+    if (paid && !options.billing)
       throw new PlansFileError(
         "PLANS_PAID_UNSUPPORTED",
-        `The plan "${plan2.sku}" has a price, and deploying paid plans is not available in this CLI version yet.`,
-        "Remove the plan, or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
+        `The plan "${plan2.sku}" has a price, and plans.billing.provider is not stripe, so nobody could pay for it.`,
+        "Set plans.billing.provider to stripe (with plans.billing.apiKey), or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
       );
     const limits = plan2.limits ? {
       ...plan2.limits.rateLimit ? {
@@ -15233,7 +15249,11 @@ async function plansFileProblem(resolved) {
   const plans = resolved.plans;
   if (!plans?.enabled) return { wanted: [] };
   try {
-    return { wanted: toPlatformPlans(await readPlansFile(plans.file)) };
+    return {
+      wanted: toPlatformPlans(await readPlansFile(plans.file), {
+        billing: plans.billing.provider === "stripe"
+      })
+    };
   } catch (error) {
     if (!(error instanceof PlansFileError)) throw error;
     return {
@@ -15483,7 +15503,7 @@ async function runCheckV2(dir, args = {}, deps = {}) {
     ...report
   };
 }
-var line = (label, issue4) => `${label}: ${formatConfigIssue(issue4)}`;
+var line = (label2, issue4) => `${label2}: ${formatConfigIssue(issue4)}`;
 function formatCheckV2(output4) {
   const lines = [
     ...output4.errors.map((issue4) => line("error", issue4)),
@@ -17126,11 +17146,11 @@ function buildThinWrapperWithCustomPages(tsxRoutePaths) {
   const customPages = tsxRoutePaths.map((routePath) => {
     const slug = routePath.replace(/^\//, "");
     const name = pageComponentName(slug);
-    const label = labelFromRoutePath(routePath);
+    const label2 = labelFromRoutePath(routePath);
     return `        {
           type: "custom-page",
           path: ${JSON.stringify(routePath)},
-          label: ${JSON.stringify(label)},
+          label: ${JSON.stringify(label2)},
           element: <${name} />,
         },`;
   }).join("\n");
@@ -17213,7 +17233,7 @@ function ensureHeaderDocsNavigation(config2, docRoutes2) {
   }
   return { ...config2, header: { ...header, navigation } };
 }
-function ensureHeaderApiReferenceNavigation(config2, to, label = HEADER_API_REFERENCE_LABEL) {
+function ensureHeaderApiReferenceNavigation(config2, to, label2 = HEADER_API_REFERENCE_LABEL) {
   const current = readHeaderNavigation(config2);
   if (!current) return config2;
   const { header, navigation } = current;
@@ -17221,7 +17241,7 @@ function ensureHeaderApiReferenceNavigation(config2, to, label = HEADER_API_REFE
     return config2;
   }
   const docsIndex = navigation.findIndex(isDocsItem);
-  const item = { label, to };
+  const item = { label: label2, to };
   if (docsIndex >= 0) {
     navigation.splice(docsIndex + 1, 0, item);
   } else {
@@ -19555,10 +19575,10 @@ ${importStatement}${content.slice(lastImportEnd)}`;
   return `${importStatement}
 ${content}`;
 }
-function formatCustomPageNavigationEntry(slug, label, indent) {
+function formatCustomPageNavigationEntry(slug, label2, indent) {
   const componentName = pageComponentName2(slug);
   const inner = `${indent}  `;
-  const labelLine = label?.trim() ? `${inner}label: ${JSON.stringify(label.trim())},
+  const labelLine = label2?.trim() ? `${inner}label: ${JSON.stringify(label2.trim())},
 ` : "";
   return `${indent}{
 ${inner}type: "custom-page",
@@ -19566,21 +19586,21 @@ ${inner}path: "/${normalizePageSlug2(slug)}",
 ` + labelLine + `${inner}element: <${componentName} />,
 ${indent}},`;
 }
-function formatDocumentationCategoryWithPage(slug, label, indent) {
+function formatDocumentationCategoryWithPage(slug, label2, indent) {
   const inner = `${indent}  `;
   const itemIndent = `${inner}  `;
   return `${indent}{
 ${inner}type: "category",
 ${inner}label: ${JSON.stringify(DOCUMENTATION_NAV_LABEL2)},
 ${inner}items: [
-${formatCustomPageNavigationEntry(slug, label, itemIndent)}
+${formatCustomPageNavigationEntry(slug, label2, itemIndent)}
 ${inner}],
 ${indent}},`;
 }
-function findMatchingArrayClose(content, open3) {
+function findMatchingArrayClose(content, open4) {
   let depth = 0;
   let inString = null;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19619,8 +19639,8 @@ function findDocumentationCategoryItemsRange(content, from, to) {
   if (!itemsMatch) {
     return null;
   }
-  const open3 = afterLabel + itemsMatch.index + itemsMatch[0].length - 1;
-  const close3 = findMatchingArrayClose(content, open3);
+  const open4 = afterLabel + itemsMatch.index + itemsMatch[0].length - 1;
+  const close3 = findMatchingArrayClose(content, open4);
   if (close3 === null || close3 > to) {
     return null;
   }
@@ -19631,7 +19651,7 @@ function findDocumentationCategoryItemsRange(content, from, to) {
   const indentMatch = /^[ \t]*/.exec(content.slice(lineStart));
   const itemsIndent = indentMatch?.[0] ?? "";
   const entryIndent = `${itemsIndent}  `;
-  return { open: open3, close: close3, indent: entryIndent };
+  return { open: open4, close: close3, indent: entryIndent };
 }
 function appendEntryToArrayRange(content, range, entry) {
   const before = content.slice(0, range.close);
@@ -19664,7 +19684,7 @@ ${normalizedEntry}
 ${range.indent}${trimmedInner}
 ${closeIndent}${content.slice(range.close)}`;
 }
-function appendCustomPageToDirectBuildExport(content, slug, label) {
+function appendCustomPageToDirectBuildExport(content, slug, label2) {
   const exportPrefix = "export default ";
   const callPrefix = "buildApitogoConfig(";
   const exportIndex = content.indexOf(`${exportPrefix}${callPrefix}`);
@@ -19672,11 +19692,11 @@ function appendCustomPageToDirectBuildExport(content, slug, label) {
     return null;
   }
   const callStart = exportIndex + exportPrefix.length;
-  const open3 = callStart + callPrefix.length - 1;
+  const open4 = callStart + callPrefix.length - 1;
   let depth = 0;
   let inString = null;
   let close3 = -1;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19711,7 +19731,7 @@ function appendCustomPageToDirectBuildExport(content, slug, label) {
     replaceEnd += 1;
   }
   const buildCall = content.slice(callStart, close3 + 1);
-  const category = formatDocumentationCategoryWithPage(slug, label, "    ");
+  const category = formatDocumentationCategoryWithPage(slug, label2, "    ");
   const replacement = `const config = ${buildCall};
 
 export default {
@@ -19737,10 +19757,10 @@ function findNavigationArrayRange(content) {
     return null;
   }
   const indent = match[1] ?? "";
-  const open3 = match.index + match[0].length - 1;
+  const open4 = match.index + match[0].length - 1;
   let depth = 0;
   let inString = null;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19759,13 +19779,13 @@ function findNavigationArrayRange(content) {
     } else if (char === "]") {
       depth -= 1;
       if (depth === 0) {
-        return { open: open3, close: i, indent };
+        return { open: open4, close: i, indent };
       }
     }
   }
   return null;
 }
-function appendCustomPageToNavigation(content, slug, label, _options) {
+function appendCustomPageToNavigation(content, slug, label2, _options) {
   const pagePath = `"/${normalizePageSlug2(slug)}"`;
   if (content.includes(`path: ${pagePath}`)) {
     return content;
@@ -19773,7 +19793,7 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
   const rewrittenBuildExport = appendCustomPageToDirectBuildExport(
     content,
     slug,
-    label
+    label2
   );
   if (rewrittenBuildExport) {
     return rewrittenBuildExport;
@@ -19790,14 +19810,14 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
   if (docsItems) {
     const entry = formatCustomPageNavigationEntry(
       slug,
-      label,
+      label2,
       docsItems.indent
     );
     return appendEntryToArrayRange(content, docsItems, entry);
   }
   const category = formatDocumentationCategoryWithPage(
     slug,
-    label,
+    label2,
     `${range.indent}  `
   );
   return prependEntryToArrayRange(
@@ -19806,11 +19826,11 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
     category
   );
 }
-function patchApitogoConfigForNewPage(content, slug, label, options) {
+function patchApitogoConfigForNewPage(content, slug, label2, options) {
   const withNavigation = appendCustomPageToNavigation(
     content,
     slug,
-    label,
+    label2,
     options
   );
   if (withNavigation === content) {
@@ -19818,13 +19838,13 @@ function patchApitogoConfigForNewPage(content, slug, label, options) {
   }
   return ensurePageImport(withNavigation, pageComponentName2(slug), slug);
 }
-async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
+async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label2) {
   const configPath = await resolveApitogoConfigPath(sourceDirectory);
   if (!configPath) {
     return { updated: false };
   }
   const original = await readFile20(configPath, "utf8");
-  const patched = patchApitogoConfigForNewPage(original, slug, label, {
+  const patched = patchApitogoConfigForNewPage(original, slug, label2, {
     typescript: configPath.endsWith(".tsx")
   });
   if (patched === original) {
@@ -21805,8 +21825,8 @@ function createScopedConsoleProgressReporter(stream, stepLabel, shared) {
       }
     },
     isCancelled: () => false,
-    child(label) {
-      return createScopedConsoleProgressReporter(stream, label, shared);
+    child(label2) {
+      return createScopedConsoleProgressReporter(stream, label2, shared);
     }
   };
   const baseOnNewMessages = reporter.onNewMessages.bind(reporter);
@@ -27904,15 +27924,41 @@ var PlansDeployError = class extends ApitogoError {
     this.name = "PlansDeployError";
   }
 };
-var PLANS_STEPS = ["catalog", "backend", "identity-link"];
+var PLANS_STEPS = [
+  "catalog",
+  "backend",
+  "billing",
+  "identity-link"
+];
 var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var BACKEND_MODULE = "dev-portal";
 var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
+var STRIPE_WEBHOOK_EVENTS2 = [
+  "checkout.session.completed",
+  "customer.subscription.updated",
+  "customer.subscription.deleted",
+  "invoice.payment_failed"
+];
+function billingNotes(billing) {
+  const notes = [
+    billing.mode === "live" ? "Stripe: LIVE mode. Customers pay with real money." : "Stripe: test mode. Use Stripe's test cards; no real money moves."
+  ];
+  notes.push(
+    billing.hasWebhookSecret ? `Stripe webhook endpoint (add it in your Stripe account if it is not there yet): ${billing.webhookUrl}` : `A payment does not activate a plan until Stripe can confirm it. In your Stripe account add the webhook endpoint ${billing.webhookUrl} (events: ${STRIPE_WEBHOOK_EVENTS2.join(", ")}), store its signing secret with "apitogo secrets set STRIPE_WEBHOOK", set plans.billing.webhookSecret to "secret:STRIPE_WEBHOOK", and deploy again.`
+  );
+  return notes;
+}
 async function plansInputs(resolved, projectId) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
-  const wanted = toPlatformPlans(await readPlansFile(plans.file));
+  const billing = plans.billing;
+  const wanted = toPlatformPlans(await readPlansFile(plans.file), {
+    billing: billing.provider === "stripe"
+  });
   const manifest = await readManifest(resolved.state);
+  const ledger = await readLedger(resolved.state);
+  const billingOn = billing.provider === "stripe";
+  const billingStep = billingOn || stepOf(ledger, "plans", "billing") !== void 0;
   const identity = manifest?.services.identity;
   const ownIdentity = Boolean(
     identity?.provider === "apitogo" && identity.issuer
@@ -27923,6 +27969,16 @@ async function plansInputs(resolved, projectId) {
     ownIdentity,
     catalogHash: stableJson({ projectId, plans: wanted }),
     backendHash: stableJson({ projectId }),
+    billingStep,
+    // Only the references to the project's secrets: a rotated value is applied with --force.
+    billingHash: stableJson({
+      projectId,
+      provider: billing.provider,
+      apiKey: billingOn ? billing.apiKey : void 0,
+      webhookSecret: billingOn ? billing.webhookSecret : void 0,
+      successUrl: billingOn ? billing.successUrl : void 0,
+      cancelUrl: billingOn ? billing.cancelUrl : void 0
+    }),
     linkHash: stableJson({
       projectId,
       issuer: identity?.issuer,
@@ -27959,6 +28015,17 @@ function refused(error) {
   }
   throw error;
 }
+function billingRefused(error) {
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new PlansDeployError(
+      "PLANS_BILLING_REJECTED",
+      `The platform refused the billing settings: ${lines.join(" ") || error.message}`,
+      "Check plans.billing in the config and the project's secrets (apitogo secrets list). The Stripe key starts with sk_ or rk_, the webhook secret with whsec_."
+    );
+  }
+  throw error;
+}
 async function deployPlans(resolved, projectId, deps, options = {}) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
@@ -27968,7 +28035,16 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
   const intervalMs = deps.pollIntervalMs ?? 2e3;
   const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
   const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
-  const { wanted, manifest, ownIdentity, catalogHash, backendHash, linkHash } = await plansInputs(resolved, projectId);
+  const {
+    wanted,
+    manifest,
+    ownIdentity,
+    billingStep,
+    billingHash,
+    catalogHash,
+    backendHash,
+    linkHash
+  } = await plansInputs(resolved, projectId);
   const catalogStep = {
     name: "catalog",
     hash: () => catalogHash,
@@ -28055,35 +28131,73 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
     },
     stillValid: async () => Boolean(await backendOf())
   };
+  const waitForBackendUpdate = async (jobId, what) => {
+    const deadline = now() + linkTimeoutMs;
+    for (; ; ) {
+      const job = (await client.listProvisioningJobs(projectId)).jobs.find(
+        (item) => item.id === jobId
+      );
+      const status2 = job?.status.toLowerCase();
+      if (status2?.startsWith("completed")) return { jobId };
+      if (status2 === "failed")
+        throw new PlansDeployError(
+          `${what.code}_FAILED`,
+          `Applying ${what.text} to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
+          "Run deploy again; it is applied again."
+        );
+      if (now() >= deadline)
+        throw new PlansDeployError(
+          `${what.code}_TIMEOUT`,
+          `Applying ${what.text} did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
+          "Run deploy again to keep waiting."
+        );
+      await sleep5(intervalMs);
+    }
+  };
+  let billingNote;
+  const billingStepDef = {
+    name: "billing",
+    hash: () => billingHash,
+    run: async () => {
+      const body = plans.billing.provider === "stripe" ? {
+        provider: "stripe",
+        apiKey: plans.billing.apiKey,
+        webhookSecret: plans.billing.webhookSecret,
+        successUrl: plans.billing.successUrl,
+        cancelUrl: plans.billing.cancelUrl
+      } : { provider: "none" };
+      let queued;
+      try {
+        queued = await client.putDevPortalBilling(projectId, body);
+      } catch (error) {
+        billingRefused(error);
+      }
+      const done = await waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_BILLING",
+        text: "the billing settings"
+      });
+      if (plans.billing.provider === "stripe")
+        billingNote = billingNotes(queued);
+      return { ...done, mode: queued.mode };
+    }
+  };
   const linkStep = {
     name: "identity-link",
     hash: () => linkHash,
     run: async () => {
       const queued = await client.linkDevPortalIdentity(projectId);
-      const deadline = now() + linkTimeoutMs;
-      for (; ; ) {
-        const job = (await client.listProvisioningJobs(projectId)).jobs.find(
-          (item) => item.id === queued.jobId
-        );
-        const status2 = job?.status.toLowerCase();
-        if (status2?.startsWith("completed")) return { jobId: queued.jobId };
-        if (status2 === "failed")
-          throw new PlansDeployError(
-            "PLANS_LINK_FAILED",
-            `Applying the identity to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
-            "Run deploy again; the link is applied again."
-          );
-        if (now() >= deadline)
-          throw new PlansDeployError(
-            "PLANS_LINK_TIMEOUT",
-            `Applying the identity did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
-            "Run deploy again to keep waiting."
-          );
-        await sleep5(intervalMs);
-      }
+      return waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_LINK",
+        text: "the identity"
+      });
     }
   };
-  const steps = [catalogStep, backendStep, ...ownIdentity ? [linkStep] : []];
+  const steps = [
+    catalogStep,
+    backendStep,
+    ...billingStep ? [billingStepDef] : [],
+    ...ownIdentity ? [linkStep] : []
+  ];
   const outcomes = await runPipeline(
     resolved.state,
     "plans",
@@ -28108,7 +28222,7 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
           apiBaseUrl,
           billing: plans.billing.provider,
           catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
-          capabilities: PLANS_CAPABILITIES
+          capabilities: plans.billing.provider === "stripe" ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
         })
       );
     }
@@ -28119,7 +28233,8 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
       step: outcome.step,
       skipped: outcome.skipped
     })),
-    apiBaseUrl
+    apiBaseUrl,
+    ...billingNote ? { notes: billingNote } : {}
   };
 }
 
@@ -28238,14 +28353,18 @@ async function planPlansService(resolved, ledger) {
   const hashes = {
     catalog: projectId ? inputs.catalogHash : void 0,
     backend: projectId ? inputs.backendHash : void 0,
+    billing: projectId ? inputs.billingHash : void 0,
     "identity-link": projectId ? inputs.linkHash : void 0
   };
   const steps = PLANS_STEPS.filter(
-    (name) => name !== "identity-link" || inputs.ownIdentity
+    (name) => (name !== "identity-link" || inputs.ownIdentity) && (name !== "billing" || inputs.billingStep)
   );
   const details = [
     ...inputs.wanted.length === 0 ? ["plans: none in the file"] : inputs.wanted.map((plan2) => `plan ${plan2.sku}: ${plan2.displayName}`),
     inputs.ownIdentity ? "sign-in: the project's identity will be applied to the plans backend" : "sign-in: no identity of the platform deployed, so nothing is applied to the plans backend",
+    ...inputs.billingStep ? [
+      resolved.plans?.billing.provider === "stripe" ? "billing: the Stripe key and webhook secret of the project's secrets will be applied to the plans backend" : "billing: switched off, so the stored Stripe settings will be removed from the plans backend"
+    ] : [],
     ...steps.map(
       (name) => `step ${name}: ${stepState(stepOf(ledger, "plans", name), hashes[name])}`
     )
@@ -28486,7 +28605,7 @@ function describePolicies(gateway) {
 function dryRunLines(dryRun) {
   const changes = dryRun.changes;
   if (!changes) return [];
-  const list2 = (label, items) => items.length > 0 ? [`  ${label}: ${items.join(", ")}`] : [];
+  const list2 = (label2, items) => items.length > 0 ? [`  ${label2}: ${items.join(", ")}`] : [];
   if (changes.wouldCreate)
     return [
       "platform dry run: the gateway does not exist yet; everything would be created",
@@ -29074,7 +29193,8 @@ async function deployPlansService(options, deps, projectId, named) {
     service: "plans",
     status: result.status,
     steps: result.steps,
-    url: result.apiBaseUrl
+    url: result.apiBaseUrl,
+    ...result.notes ? { notes: result.notes } : {}
   };
 }
 async function deployPortal(options, deps, projectId) {
@@ -29208,10 +29328,10 @@ var deploy_default = {
     describe: "Override project GUID"
   }).option("project-name", {
     type: "string",
-    describe: "Display name when creating a project"
+    describe: "Version 1: display name when creating a project. Version 2 ignores it: the project is made by `apitogo project create` and named by project.name"
   }).option("platform-plan", {
     type: "string",
-    describe: "Platform hosting tier",
+    describe: "Version 1: platform hosting tier. Version 2 ignores it: a project made by `apitogo project create` is on the Free plan",
     choices: ["free", "starter", "professional"]
   }).option("only", {
     type: "string",
@@ -30546,6 +30666,7 @@ var plan_default = {
 // src/cli/project/create-handler.ts
 init_invariant();
 import path93 from "node:path";
+import open3 from "open";
 
 // src/cli/project/v2.ts
 init_invariant();
@@ -30572,15 +30693,52 @@ async function createProjectV2(options, deps) {
     );
   }
   const name = options.name?.trim() || resolved.project.name;
+  const plan2 = options.plan ?? "free";
+  const onProjectResolved = async (projectId) => {
+    await setProjectId(options.dir, projectId);
+  };
+  let continueWith = linkedProjectId;
+  if (plan2 !== "free") {
+    const first = parse4(
+      await deps.bootstrap({
+        name,
+        description: options.description,
+        modules,
+        wait: false,
+        projectId: linkedProjectId,
+        onProjectResolved,
+        paidPlan: true
+      })
+    );
+    assertCreated(first);
+    const paid = await settlePaidPlan(
+      first.projectId,
+      plan2,
+      options,
+      deps
+    );
+    if (paid.status === "awaiting_checkout") {
+      await setProjectId(options.dir, first.projectId);
+      return {
+        projectId: first.projectId,
+        projectName: name,
+        modules,
+        resumed: first.resumed === true,
+        plan: plan2,
+        status: "awaiting_checkout",
+        checkoutUrl: paid.url
+      };
+    }
+    continueWith = first.projectId;
+  }
   const raw = await deps.bootstrap({
     name,
     description: options.description,
     modules,
     wait: options.wait !== false,
-    projectId: linkedProjectId,
-    onProjectResolved: async (projectId) => {
-      await setProjectId(options.dir, projectId);
-    }
+    projectId: continueWith,
+    onProjectResolved,
+    ...plan2 !== "free" ? { paidPlan: true } : {}
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {
@@ -30590,13 +30748,7 @@ async function createProjectV2(options, deps) {
       "Pick another name with --name, or choose a plan for that project in the web app."
     );
   }
-  if (outcome.status === "failed" || outcome.status === "blocked" || !outcome.projectId) {
-    throw new ProjectCreateError(
-      "CREATE_FAILED",
-      `The platform could not create the project: ${outcome.message ?? outcome.status ?? "no answer"}.`,
-      "Nothing was written to this folder. Try again, or check `apitogo status`."
-    );
-  }
+  assertCreated(outcome);
   if (outcome.status === "running" || outcome.status === "pending") {
     await setProjectId(options.dir, outcome.projectId);
     throw new ProjectCreateError(
@@ -30610,9 +30762,82 @@ async function createProjectV2(options, deps) {
     projectId: outcome.projectId,
     projectName: name,
     modules,
-    resumed: outcome.resumed === true
+    resumed: outcome.resumed === true,
+    ...plan2 !== "free" ? { plan: plan2 } : {}
   };
 }
+function assertCreated(outcome) {
+  if (outcome.status === "failed" || outcome.status === "blocked" || !outcome.projectId) {
+    throw new ProjectCreateError(
+      "CREATE_FAILED",
+      `The platform could not create the project: ${outcome.message ?? outcome.status ?? "no answer"}.`,
+      "Nothing was written to this folder. Try again, or check `apitogo status`."
+    );
+  }
+}
+var defaultSleep4 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var label = (plan2) => plan2.charAt(0).toUpperCase() + plan2.slice(1);
+async function settlePaidPlan(projectId, plan2, options, deps) {
+  const api = deps.platform;
+  if (!api) throw new Error("The platform client has no plan calls.");
+  const sleep5 = api.sleep ?? defaultSleep4;
+  const now = api.now ?? Date.now;
+  const subscription = await api.getSubscription(projectId);
+  const tier = subscription.planTier.toLowerCase();
+  const onThisPlan = tier === plan2;
+  if (onThisPlan && isPaidPlanActive(subscription)) return { status: "paid" };
+  if (!isPlatformPlanUnselected(subscription.planTier) && !onThisPlan) {
+    throw new ProjectCreateError(
+      "PLAN_CHANGE_UNSUPPORTED",
+      `This project is already on the ${label(tier)} plan, so it cannot be created on ${label(plan2)}.`,
+      "Moving a project to another plan is not supported yet. Create a new project with --plan in a new folder, or change the plan in the web app."
+    );
+  }
+  if (!onThisPlan) {
+    let session;
+    try {
+      session = await api.createCheckoutSession(projectId, {
+        planSlug: plan2,
+        ...options.skipPayment ? { skipPayment: true } : {}
+      });
+    } catch (error) {
+      if (options.skipPayment && error instanceof PlatformApiError && error.status === 403)
+        throw new ProjectCreateError(
+          "SKIP_PAYMENT_REFUSED",
+          "Only a platform admin may skip the payment.",
+          "Run it without --skip-payment to pay through the platform's checkout."
+        );
+      throw error;
+    }
+    if (session.granted) return { status: "paid" };
+    if (!session.url)
+      throw new ProjectCreateError(
+        "CREATE_FAILED",
+        "The platform gave no checkout link.",
+        "Run the command again, or choose the plan in the web app."
+      );
+    api.say?.(`Pay for the ${label(plan2)} plan here: ${session.url}`);
+    if (options.waitForPayment === false)
+      return { status: "awaiting_checkout", url: session.url };
+    if (options.open !== false)
+      await api.openUrl?.(session.url).catch(() => {
+      });
+  }
+  const timeoutMs = options.paymentTimeoutMs ?? 9e5;
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const current = await api.getSubscription(projectId);
+    if (current.planTier.toLowerCase() === plan2 && isPaidPlanActive(current))
+      return { status: "paid" };
+    if (now() >= deadline)
+      throw new ProjectCreateError(
+        "CHECKOUT_PENDING",
+        `The payment for the ${label(plan2)} plan is not confirmed yet.`,
+        `Finish paying with the link above, then run \`apitogo project create --plan ${plan2}\` again; it continues the same project (project.id ${projectId}).`
+      );
+    await sleep5(api.pollIntervalMs ?? 3e3);
+  }
+}
 function parse4(raw) {
   try {
     return JSON.parse(raw);
@@ -30641,9 +30866,22 @@ async function createLinkedProject(argv, dir) {
         dir,
         name: argv.name,
         description: argv.description,
-        wait: argv.wait !== false
+        wait: argv.wait !== false,
+        plan: argv.plan ?? "free",
+        skipPayment: argv.skipPayment === true,
+        open: argv.open !== false,
+        // In JSON mode the link is returned and a later run continues; otherwise the command waits for the payment.
+        waitForPayment: !json
       },
       {
+        platform: {
+          getSubscription: (projectId) => client.getSubscription(projectId),
+          createCheckoutSession: (projectId, body) => client.createCheckoutSession(projectId, body),
+          openUrl: async (url2) => {
+            await open3(url2);
+          },
+          ...json ? {} : { say: (message) => printDiagnosticsToConsole(message) }
+        },
         bootstrap: (args) => handleBootstrapProject(
           client,
           config2,
@@ -30651,7 +30889,7 @@ async function createLinkedProject(argv, dir) {
             name: args.name,
             description: args.description,
             modules: args.modules,
-            selectFreePlan: true,
+            selectFreePlan: args.paidPlan !== true,
             wait: args.wait,
             configureGatewayBaseline: false,
             projectId: args.projectId,
@@ -30666,8 +30904,14 @@ async function createLinkedProject(argv, dir) {
       console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));
       return;
     }
+    if (result.status === "awaiting_checkout") {
+      printResultToConsole(
+        `Project ${result.projectName} (${result.projectId}) is created and linked. Pay for the ${result.plan} plan at ${result.checkoutUrl}, then run \`apitogo project create --plan ${result.plan}\` again to continue.`
+      );
+      return;
+    }
     printDiagnosticsToConsole(
-      `Project ${result.projectName} (${result.projectId}) is ready on the free plan${result.modules.length > 0 ? ` with: ${result.modules.join(", ")}` : " (the gateway is created by `apitogo deploy`)"}.`
+      `Project ${result.projectName} (${result.projectId}) is ready on the ${result.plan ?? "free"} plan${result.modules.length > 0 ? ` with: ${result.modules.join(", ")}` : " (the gateway is created by `apitogo deploy`)"}.`
     );
     printResultToConsole(
       "The folder is linked. Run `apitogo deploy` to publish."
@@ -30697,6 +30941,12 @@ async function createProject(argv) {
     await createLinkedProject(argv, dir);
     return;
   }
+  if (argv.plan && argv.plan !== "free") {
+    await printCriticalFailureToConsoleAndExit(
+      "--plan is for config version 2 folders. For a version 1 project use `apitogo deploy --platform-plan`."
+    );
+    return;
+  }
   const name = argv.name?.trim();
   if (!name) {
     await printCriticalFailureToConsoleAndExit(
@@ -30763,11 +31013,24 @@ var project_create_default = {
     describe: "Optional project description"
   }).option("modules", {
     type: "string",
-    describe: "Comma-separated modules to activate (default: apihub)",
+    describe: "Version 1 only: comma-separated modules to activate (default: apihub). Version 2 takes them from the config (the portal needs dev-portal) and ignores this option",
     default: "apihub"
+  }).option("plan", {
+    type: "string",
+    choices: ["free", "starter", "professional"],
+    describe: "Version 2: the platform plan of the new project (default: free). Starter and Professional are paid through the platform's own checkout, and a project needs one of them to sell paid plans"
+  }).option("open", {
+    type: "boolean",
+    describe: "Open the checkout page in the browser for a paid plan (use --no-open to only print the link)",
+    default: true
+  }).option("skip-payment", {
+    type: "boolean",
+    describe: "Platform admins only: give the paid plan without payment. The platform refuses it for anyone else",
+    default: false,
+    hidden: true
   }).option("wait", {
     type: "boolean",
-    describe: "Wait for warm pool when a platform plan is already selected",
+    describe: "Wait until the hosting from the warm pool is ready before returning, once a platform plan is selected (always so in version 2). Use --no-wait to return sooner",
     default: true
   }).option("json", {
     type: "boolean",