@lukoweb/apitogo 0.2.30 → 0.2.34

package/dist/cli/cli.js

@@ -5267,7 +5267,7 @@ var llms_exports = {};
 __export(llms_exports, {
   generateLlmsTxtFiles: () => generateLlmsTxtFiles
 });
-import { writeFile as writeFile11 } from "node:fs/promises";
+import { writeFile as writeFile12 } from "node:fs/promises";
 import path44 from "node:path";
 import colors10 from "picocolors";
 async function generateLlmsTxtFiles({
@@ -5303,7 +5303,7 @@ async function generateLlmsTxtFiles({
       }
     }
     const llmsTxt2 = llmsTxtParts.join("\n");
-    await writeFile11(path44.join(baseOutputDir, "llms.txt"), llmsTxt2, "utf-8");
+    await writeFile12(path44.join(baseOutputDir, "llms.txt"), llmsTxt2, "utf-8");
     if (process.env.APITOGO_JSON_ONLY !== "1") {
       console.log(colors10.blue("\u2713 generated llms.txt"));
     }
@@ -5330,7 +5330,7 @@ ${info.content}
 `);
     }
     const llmsFull = llmsFullParts.join("\n");
-    await writeFile11(
+    await writeFile12(
       path44.join(baseOutputDir, "llms-full.txt"),
       llmsFull,
       "utf-8"
@@ -5811,7 +5811,6 @@ import yargs from "yargs/yargs";
 
 // src/cli/services/handler.ts
 import path53 from "node:path";
-import { createInterface as createInterface2 } from "node:readline/promises";
 
 // src/config/v2/errors.ts
 init_invariant();
@@ -6540,8 +6539,11 @@ import path8 from "node:path";
 
 // src/config/v2/resolve.ts
 import path7 from "node:path";
+function toGlobPath(value) {
+  return value.split(path7.sep).join("/");
+}
 function fromConfig(configDir, value) {
-  return value.startsWith("!") ? `!${path7.resolve(configDir, value.slice(1))}` : path7.resolve(configDir, value);
+  return value.startsWith("!") ? `!${toGlobPath(path7.resolve(configDir, value.slice(1)))}` : toGlobPath(path7.resolve(configDir, value));
 }
 function resolveConfigV2(config2, configPath) {
   const absoluteConfigPath = path7.resolve(configPath);
@@ -6569,7 +6571,7 @@ function resolveConfigV2(config2, configPath) {
       docs: {
         enabled: portal.docs?.enabled ?? true,
         provider,
-        content: provider === "external" ? [] : portal.docs?.content ? portal.docs.content.map((glob9) => fromConfig(configDir, glob9)) : [path7.join(dir, "pages", "**", "*.{md,mdx}")],
+        content: provider === "external" ? [] : portal.docs?.content ? portal.docs.content.map((glob9) => fromConfig(configDir, glob9)) : [toGlobPath(path7.join(dir, "pages", "**", "*.{md,mdx}"))],
         url: portal.docs?.url
       },
       console: { enabled: portal.console?.enabled ?? true },
@@ -6815,8 +6817,9 @@ async function portalRules(config2, resolved, out) {
   }
 }
 async function docsContentRule(config2, patterns, resolved, out) {
-  const include = patterns.filter((pattern) => !pattern.startsWith("!"));
-  const ignore2 = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+  const globs = patterns.map(toGlobPath);
+  const include = globs.filter((pattern) => !pattern.startsWith("!"));
+  const ignore2 = globs.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
   const matches = include.length > 0 ? await glob(include, { nodir: true, ignore: ignore2, absolute: true }) : [];
   if (matches.length > 0) return;
   const shown = config2.portal?.docs?.content ?? [
@@ -7092,7 +7095,7 @@ function identityRules(config2, resolved, out) {
         );
     }
   }
-  for (const [list2, label] of [
+  for (const [list2, label2] of [
     [identity.connections, "connections"],
     [identity.clients, "clients"]
   ]) {
@@ -7101,8 +7104,8 @@ function identityRules(config2, resolved, out) {
       if (seen.has(item.id)) {
         out.error({
           code: "IDENTITY_DUPLICATE_ID",
-          path: `identity.${label}[${index}].id`,
-          message: `the id "${item.id}" is used more than once in identity.${label}.`
+          path: `identity.${label2}[${index}].id`,
+          message: `the id "${item.id}" is used more than once in identity.${label2}.`
         });
       }
       seen.add(item.id);
@@ -7835,8 +7838,9 @@ var readFrontmatter = async (filePath) => {
 // src/config/v2/home-redirect.ts
 var IGNORED = ["**/node_modules/**", "**/dist/**", "**/.git/**"];
 async function docRoutes(patterns, options = {}) {
-  const excluded = patterns.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
-  const included = patterns.filter((pattern) => !pattern.startsWith("!"));
+  const globs = patterns.map(toGlobPath);
+  const excluded = globs.filter((pattern) => pattern.startsWith("!")).map((pattern) => pattern.slice(1));
+  const included = globs.filter((pattern) => !pattern.startsWith("!"));
   const routes = await Promise.all(
     included.map(async (pattern) => {
       const files = await glob2(pattern, {
@@ -7852,7 +7856,7 @@ async function docRoutes(patterns, options = {}) {
         }))
       )).filter(({ draft }) => !draft).map(({ file }) => file);
       return published.map(
-        (file) => `/${path11.posix.relative(parent, file).replace(/\.mdx?$/, "")}`
+        (file) => `/${path11.posix.relative(parent, file.replace(/^\/\/\?\//, "")).replace(/\.mdx?$/, "")}`
       );
     })
   );
@@ -8223,7 +8227,7 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
 
 // src/config/v2/workspace.ts
 import { createHash as createHash2 } from "node:crypto";
-import { access as access2, lstat, readFile as readFile7, rm as rm3 } from "node:fs/promises";
+import { access as access2, lstat, readFile as readFile7, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import path13 from "node:path";
 import { glob as glob3 } from "glob";
 
@@ -8256,9 +8260,17 @@ async function relink(target, link) {
     await rm3(link, { recursive: true, force: true });
   await linkDirectory(target, link);
 }
+var GENERATED_PACKAGE_JSON = '{\n  "private": true,\n  "type": "module"\n}\n';
+async function writeGeneratedPackageJson(root) {
+  const file = path13.join(root, "package.json");
+  const current = await readFile7(file, "utf8").catch(() => void 0);
+  if (current !== GENERATED_PACKAGE_JSON)
+    await writeFile6(file, GENERATED_PACKAGE_JSON, "utf8");
+}
 async function materializeWorkspace(resolved, prepared) {
   const root = path13.dirname(prepared.wrapperPath);
   await ensureStateDir(resolved.state);
+  await writeGeneratedPackageJson(root);
   await relink(resolved.configDir, path13.join(root, CONTENT_LINK));
   const publicDir = resolved.portal && path13.join(resolved.portal.dir, "public");
   const publicLink = path13.join(root, "public");
@@ -8326,15 +8338,22 @@ async function portalArtifactHash(resolved, manifestText, cliVersion, wrapper =
 
 // src/config/v2/services.ts
 init_invariant();
-import { access as access3, mkdir as mkdir5, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access3, mkdir as mkdir5, rename as rename3, rm as rm4, stat as stat3, writeFile as writeFile7 } from "node:fs/promises";
 import path14 from "node:path";
 var SERVICES = ["portal", "gateway", "identity", "plans"];
 var ServiceEditError = class extends ApitogoError {
-  constructor(message, developerHint) {
+  constructor(message, developerHint, missingServices = []) {
     super(message, { developerHint, title: "Cannot change the services" });
+    this.missingServices = missingServices;
     this.name = "ServiceEditError";
   }
 };
+var httpsProblem = (value) => /^https:\/\/\S+$/i.test(value) ? void 0 : "The address must start with https://";
+var DEFAULT_RUNTIME_VERSION = {
+  nodejs: "NODE_22_LTS",
+  python: "PYTHON_312",
+  dotnet: "DOTNET_8"
+};
 function isServiceName(value) {
   return SERVICES.includes(value);
 }
@@ -8430,7 +8449,10 @@ async function buildPortal(context) {
   if (!external && o.docsUrl) {
     throw new ServiceEditError("--docs-url needs --docs-provider external.");
   }
-  if (external && !o.docsUrl) {
+  const docsUrl = o.docsUrl ?? (external && options.ask ? await options.ask.text("HTTPS address of your docs site", {
+    validate: httpsProblem
+  }) : void 0);
+  if (external && !docsUrl) {
     throw new ServiceEditError(
       "--docs-provider external needs --docs-url <https url>."
     );
@@ -8444,6 +8466,13 @@ async function buildPortal(context) {
       const candidates = await detectExistingDocs(dir);
       if (candidates.length === 1 || candidates.length > 1 && options.acceptAllDocs) {
         content = candidates.map((candidate) => candidate.glob);
+      } else if (candidates.length > 1 && options.ask) {
+        const places = candidates.map((c) => c.path).join(", ");
+        if (await options.ask.confirm(
+          `Several places with documentation were found (${places}). Include all of them?`,
+          true
+        ))
+          content = candidates.map((candidate) => candidate.glob);
       } else if (candidates.length > 1) {
         throw new ServiceEditError(
           `Several places with documentation were found (${candidates.map((c) => c.path).join(", ")}).`,
@@ -8462,7 +8491,7 @@ async function buildPortal(context) {
   return {
     ...options.disabled ? { enabled: false } : {},
     name,
-    ...external ? { docs: { provider: "external", url: o.docsUrl } } : content.length > 0 ? { docs: { content } } : {},
+    ...external ? { docs: { provider: "external", url: docsUrl } } : content.length > 0 ? { docs: { content } } : {},
     ...o.noConsole ? { console: { enabled: false } } : {},
     ...o.requireAuth ? { requireAuth: true } : {},
     ...o.search && !external ? { search: o.search } : {}
@@ -8471,7 +8500,20 @@ async function buildPortal(context) {
 async function buildGateway(context) {
   const { options, dir, resolved } = context;
   const o = options.gateway ?? {};
-  const mode = o.origin ?? (o.url ? "proxy" : o.source || o.runtime ? "managed" : void 0);
+  const ask4 = options.ask;
+  let mode = o.origin ?? (o.url ? "proxy" : o.source || o.runtime ? "managed" : void 0);
+  if (!mode && ask4) {
+    mode = await ask4.choose("How does the gateway reach your API?", [
+      {
+        value: "proxy",
+        label: "My API runs somewhere else: the gateway forwards calls to its https address"
+      },
+      {
+        value: "managed",
+        label: "The platform runs my code (nodejs, python or dotnet)"
+      }
+    ]);
+  }
   if (!mode) {
     throw new ServiceEditError(
       "The gateway needs an origin: say how it reaches your API.",
@@ -8480,11 +8522,25 @@ async function buildGateway(context) {
   }
   let origin;
   if (mode === "proxy") {
-    if (!o.url)
+    const url2 = o.url ?? (ask4 ? await ask4.text("https address of your API", {
+      validate: httpsProblem
+    }) : void 0);
+    if (!url2)
       throw new ServiceEditError("--origin proxy needs --url <https url>.");
-    origin = { mode, url: o.url };
+    origin = { mode, url: url2 };
   } else {
-    if (!o.source || !o.runtime || !o.runtimeVersion) {
+    const source = o.source ?? (ask4 ? await ask4.text("Folder with your code, relative to the project", {
+      default: "server"
+    }) : void 0);
+    const runtime = o.runtime ?? (ask4 ? await ask4.choose("Runtime of your code", [
+      { value: "nodejs", label: "Node.js" },
+      { value: "python", label: "Python" },
+      { value: "dotnet", label: ".NET" }
+    ]) : void 0);
+    const runtimeVersion = o.runtimeVersion ?? (ask4 && runtime ? await ask4.text("Runtime version", {
+      default: DEFAULT_RUNTIME_VERSION[runtime]
+    }) : void 0);
+    if (!source || !runtime || !runtimeVersion) {
       throw new ServiceEditError(
         "--origin managed needs --source, --runtime and --runtime-version.",
         "For example: --source server --runtime nodejs --runtime-version NODE_22_LTS."
@@ -8492,16 +8548,29 @@ async function buildGateway(context) {
     }
     origin = {
       mode,
-      source: insideProject(dir, o.source, "Source folder"),
-      runtime: o.runtime,
-      runtimeVersion: o.runtimeVersion,
+      source: insideProject(dir, source, "Source folder"),
+      runtime,
+      runtimeVersion,
       ...o.exclude?.length ? { exclude: o.exclude } : {}
     };
   }
   let specs;
-  if (o.spec?.length) {
+  let requestedSpecs = o.spec ?? [];
+  let createSpec = o.createSpec === true;
+  if (requestedSpecs.length === 0 && !createSpec && ask4) {
+    const answer = await ask4.choose("OpenAPI file of your API", [
+      { value: "create", label: "Start from a small file the command creates" },
+      { value: "existing", label: "Use a file I already have" }
+    ]);
+    if (answer === "create") createSpec = true;
+    else
+      requestedSpecs = [
+        await ask4.text("Path of your OpenAPI file, relative to the project")
+      ];
+  }
+  if (requestedSpecs.length > 0) {
     specs = [];
-    for (const requested of o.spec) {
+    for (const requested of requestedSpecs) {
       const relative = insideProject(dir, requested, "OpenAPI file");
       if (!await stat3(path14.join(dir, relative)).then(
         (s) => s.isFile(),
@@ -8513,7 +8582,7 @@ async function buildGateway(context) {
       }
       specs.push(relative);
     }
-  } else if (o.createSpec) {
+  } else if (createSpec) {
     const target = path14.join(resolved.apisDir, "openapi.yaml");
     await addFile(context, target, STARTER_SPEC(resolved.project.name));
     specs = [rel(dir, target)];
@@ -8545,12 +8614,15 @@ async function buildGateway(context) {
     ...Object.keys(policies).length > 0 ? { policies } : {}
   };
 }
-function buildIdentity(context) {
+async function buildIdentity(context) {
   const { options } = context;
   const o = options.identity ?? {};
   const provider = o.provider ?? "apitogo";
   if (provider === "oidc") {
-    if (!o.issuer)
+    const issuer = o.issuer ?? (options.ask ? await options.ask.text("https address of your OIDC issuer", {
+      validate: httpsProblem
+    }) : void 0);
+    if (!issuer)
       throw new ServiceEditError("--provider oidc needs --issuer <https url>.");
     if (o.connection || o.native === false) {
       throw new ServiceEditError(
@@ -8560,7 +8632,7 @@ function buildIdentity(context) {
     return {
       ...options.disabled ? { enabled: false } : {},
       provider,
-      issuer: o.issuer,
+      issuer,
       ...o.clientId ? { clientId: o.clientId } : {}
     };
   }
@@ -8634,6 +8706,15 @@ async function buildPlans(context) {
 function reparse(configPath, raw) {
   return parseConfigV2(JSON.parse(JSON.stringify(raw)), configPath);
 }
+function missingServicesOf(issues) {
+  const missing = /* @__PURE__ */ new Set();
+  for (const { code } of issues) {
+    if (code === "PLANS_GATEWAY_REQUIRED") missing.add("gateway");
+    if (code === "PLANS_IDENTITY_REQUIRED" || code === "PORTAL_CAPABILITY_MISSING")
+      missing.add("identity");
+  }
+  return [...missing];
+}
 function dependencyProblems(config2, configPath) {
   return checkDependencies(config2, resolveConfigV2(config2, configPath));
 }
@@ -8655,7 +8736,7 @@ async function planAddService(service, options) {
     keep: [],
     notes: []
   };
-  const section = service === "portal" ? await buildPortal(context) : service === "gateway" ? await buildGateway(context) : service === "identity" ? buildIdentity(context) : await buildPlans(context);
+  const section = service === "portal" ? await buildPortal(context) : service === "gateway" ? await buildGateway(context) : service === "identity" ? await buildIdentity(context) : await buildPlans(context);
   const next = reparse(resolved.configPath, { ...config2, [service]: section });
   if (!options.disabled) {
     const before = new Set(
@@ -8669,7 +8750,8 @@ async function planAddService(service, options) {
     if (added.length > 0) {
       throw new ServiceEditError(
         added.map((issue4) => issue4.message).join(" "),
-        added.map((issue4) => issue4.hint).filter(Boolean).join(" ") || "Add the missing service first."
+        added.map((issue4) => issue4.hint).filter(Boolean).join(" ") || "Add the missing service first.",
+        missingServicesOf(added)
       );
     }
   }
@@ -8727,7 +8809,7 @@ async function planRemoveService(service, options) {
 async function writeConfig(configPath, config2) {
   const temporary = `${configPath}.${process.pid}.tmp`;
   try {
-    await writeFile6(temporary, `${JSON.stringify(config2, null, 2)}
+    await writeFile7(temporary, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
     await rename3(temporary, configPath);
   } catch (error) {
@@ -8740,7 +8822,7 @@ async function applyServiceEdit(edit) {
   for (const file of edit.files) {
     await mkdir5(path14.dirname(file.path), { recursive: true });
     try {
-      await writeFile6(file.path, file.content, { flag: "wx" });
+      await writeFile7(file.path, file.content, { flag: "wx" });
       created.push(file.path);
     } catch (error) {
       if (error.code !== "EEXIST") throw error;
@@ -8788,7 +8870,7 @@ async function clearProjectId(dir, projectId) {
 
 // src/config/v2/ledger.ts
 init_invariant();
-import { mkdir as mkdir6, readFile as readFile8, rename as rename4, rm as rm5, writeFile as writeFile7 } from "node:fs/promises";
+import { mkdir as mkdir6, readFile as readFile8, rename as rename4, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
 import path15 from "node:path";
 var LEDGER_VERSION = 1;
 var LedgerError = class extends ApitogoError {
@@ -8847,7 +8929,7 @@ async function writeLedger(state, ledger) {
   await mkdir6(path15.dirname(state.file), { recursive: true });
   const temporary = `${state.file}.${process.pid}.tmp`;
   try {
-    await writeFile7(temporary, `${JSON.stringify(ledger, null, 2)}
+    await writeFile8(temporary, `${JSON.stringify(ledger, null, 2)}
 `, "utf8");
     await rename4(temporary, state.file);
   } catch (error) {
@@ -8928,6 +9010,10 @@ async function clearServices(state, services) {
   );
   if (Object.keys(remaining).length === Object.keys(ledger.services).length)
     return;
+  if (Object.keys(remaining).length === 0) {
+    await rm5(state.file, { force: true });
+    return;
+  }
   await writeLedger(state, { ...ledger, services: remaining });
 }
 
@@ -9133,7 +9219,9 @@ var PlatformApiClient = class {
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({
           planSlug: body.planSlug,
-          currency: body.currency ?? null
+          currency: body.currency ?? null,
+          // Only a platform admin may skip the payment; the platform refuses it for anyone else.
+          ...body.skipPayment ? { skipPayment: true } : {}
         })
       }
     );
@@ -9162,13 +9250,6 @@ var PlatformApiClient = class {
       `/api/v1/projects/${projectId}/infrastructure/provisioning-jobs`
     );
   }
-  getDeploymentToken(projectId, regenerate = false) {
-    const query = regenerate ? "?regenerate=true" : "";
-    return this.request(
-      "POST",
-      `/api/v1/projects/${projectId}/infrastructure/deployment-token${query}`
-    );
-  }
   /**
    * Publishes a built portal (.tgz, root folder `dist`). The platform holds the deploy server key and the project's
    * deployment token, so the CLI only needs its own login. `env` falls back to the platform default.
@@ -9431,6 +9512,20 @@ var PlatformApiClient = class {
     );
     return result ?? null;
   }
+  /**
+   * Gives the plans backend the tenant's own Stripe settings. `apiKey` and `webhookSecret` are `secret:NAME`
+   * references to project secrets, never values. Queues a job that updates the running backend.
+   */
+  putDevPortalBilling(projectId, body) {
+    return this.request(
+      "PUT",
+      `/api/v1/projects/${projectId}/dev-portal/billing`,
+      {
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body)
+      }
+    );
+  }
   /** Applies the project's identity to its plans backend as the sign-in provider. Queues a job. */
   linkDevPortalIdentity(projectId) {
     return this.request(
@@ -9827,12 +9922,12 @@ import {
   readFile as readFile12,
   rename as rename6,
   rm as rm8,
-  writeFile as writeFile14
+  writeFile as writeFile15
 } from "node:fs/promises";
 import path48 from "node:path";
 
 // src/vite/build.ts
-import { mkdir as mkdir11, readFile as readFile10, rename as rename5, rm as rm7, writeFile as writeFile12 } from "node:fs/promises";
+import { mkdir as mkdir11, readFile as readFile10, rename as rename5, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
 import path46 from "node:path";
 import { build as esbuild } from "esbuild";
 import { build as viteBuild, mergeConfig as mergeConfig3 } from "vite";
@@ -9980,7 +10075,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.30",
+  version: "0.2.34",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -10058,6 +10153,7 @@ var package_default = {
     build: "esbuild src/cli/cli.ts src/vite/prerender/worker.ts --outdir=dist/cli --entry-names=[name] --bundle --format=esm --packages=external --target=node20 --platform=node --log-level=error",
     postbuild: "tsx scripts/check-external-deps.ts",
     typecheck: "tsc --project tsconfig.app.json --noEmit",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "generate:types": "tsx scripts/generate-types.js && tsx scripts/generate-flat-config.js",
     "build:standalone": "vite build --mode standalone --config vite.standalone.config.ts --log-level=error",
     prepack: "npm run build && tsx scripts/generate-publish-exports.ts",
@@ -12090,8 +12186,8 @@ var extractRichH1 = (content) => {
     if (!h1) return void 0;
     const children = h1.children;
     const hasJsx = children.some(isMdxJsxElement);
-    const label = mdastToString(h1).trim();
-    return hasJsx ? { label, rich: children } : { label };
+    const label2 = mdastToString(h1).trim();
+    return hasJsx ? { label: label2, rich: children } : { label: label2 };
   } catch {
     return void 0;
   }
@@ -12152,12 +12248,12 @@ var NavigationResolver = class {
       return void 0;
     }
     const richH1 = extractRichH1(content);
-    const label = data.navigation_label ?? data.sidebar_label ?? data.title ?? richH1?.label ?? extractTitleFromContent(content) ?? filePath;
+    const label2 = data.navigation_label ?? data.sidebar_label ?? data.title ?? richH1?.label ?? extractTitleFromContent(content) ?? filePath;
     const icon = data.navigation_icon ?? data.sidebar_icon;
     const doc = {
       type: "doc",
       file: filePath,
-      label,
+      label: label2,
       icon,
       display: data.navigation_display,
       categoryLabel,
@@ -12229,13 +12325,13 @@ var NavigationResolver = class {
 init_invariant();
 
 // src/vite/debug.ts
-import { mkdir as mkdir7, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir7, writeFile as writeFile9 } from "node:fs/promises";
 import path27 from "node:path";
 async function writePluginDebugCode(rootDir, pluginName, code, extension = "js") {
   if (process.env.ZUDOKU_BUILD_DEBUG) {
     const debugDir = path27.join(rootDir, "dist", "debug");
     await mkdir7(debugDir, { recursive: true });
-    await writeFile8(
+    await writeFile9(
       path27.join(debugDir, `${pluginName}.${extension}`),
       typeof code === "string" ? code : code.join("\n")
     );
@@ -12543,8 +12639,8 @@ var viteApiPlugin = async () => {
             return acc;
           }, /* @__PURE__ */ new Map());
           const categoryList = Array.from(categories.entries()).map(
-            ([label, tags]) => ({
-              label,
+            ([label2, tags]) => ({
+              label: label2,
               tags: Array.from(tags)
             })
           );
@@ -13092,7 +13188,7 @@ var plugin_local_manifest_default = viteLocalManifestPlugin;
 init_loader();
 init_ProtectedRoutesSchema();
 init_joinUrl();
-import { mkdir as mkdir8, writeFile as writeFile9 } from "node:fs/promises";
+import { mkdir as mkdir8, writeFile as writeFile10 } from "node:fs/promises";
 import path34 from "node:path";
 import { matchPath } from "react-router";
 var processMarkdownFile = async (filePath) => {
@@ -13204,7 +13300,7 @@ var viteMarkdownExportPlugin = () => {
           const segments = routePath === "/" ? ["index"] : routePath.split("/").filter(Boolean);
           const outputPath = `${path34.join(distDir, ...segments)}.md`;
           await mkdir8(path34.dirname(outputPath), { recursive: true });
-          await writeFile9(outputPath, finalMarkdown, "utf-8");
+          await writeFile10(outputPath, finalMarkdown, "utf-8");
         } catch (error) {
           console.warn(`Failed to export markdown for ${routePath}:`, error);
         }
@@ -13214,7 +13310,7 @@ var viteMarkdownExportPlugin = () => {
           config2.__meta.rootDir,
           "node_modules/.apitogo/markdown-info.json"
         );
-        await writeFile9(
+        await writeFile10(
           markdownInfoPath,
           JSON.stringify(markdownFileInfos, null, 2),
           "utf-8"
@@ -13842,7 +13938,7 @@ function isBareSpecifier(source) {
   return !source.startsWith("\0") && !source.startsWith(".") && !source.startsWith("/") && !path38.isAbsolute(source);
 }
 function isInsideNodeModules(filePath) {
-  return filePath.split(path38.sep).includes("node_modules");
+  return filePath.split(/[\\/]/).includes("node_modules");
 }
 function shouldResolveFromSiteRoot(source, importer, rootDir) {
   if (!importer || !isBareSpecifier(source)) {
@@ -14299,7 +14395,7 @@ ${cssLinks}
 init_package_json();
 init_joinUrl();
 import assert from "node:assert";
-import { cp, mkdir as mkdir9, writeFile as writeFile10 } from "node:fs/promises";
+import { cp, mkdir as mkdir9, writeFile as writeFile11 } from "node:fs/promises";
 import path42 from "node:path";
 var pkgJson = getZudokuPackageJson();
 function generateOutput({
@@ -14360,7 +14456,7 @@ async function writeOutput(dir, {
   const outputDir = process.env.VERCEL ? path42.join(dir, ".vercel/output") : path42.join(dir, "dist/.output");
   await mkdir9(outputDir, { recursive: true });
   const outputFile = path42.join(outputDir, "config.json");
-  await writeFile10(outputFile, JSON.stringify(output4, null, 2), "utf-8");
+  await writeFile11(outputFile, JSON.stringify(output4, null, 2), "utf-8");
   if (process.env.VERCEL) {
     console.log("Wrote Vercel output to", outputDir);
   }
@@ -14756,7 +14852,7 @@ var runPrerender = async (options) => {
     });
     const indexHtml = path46.join(clientOutDir, "index.html");
     if (!workerResults.find((r) => r.outputPath === indexHtml)) {
-      await writeFile12(indexHtml, html, "utf-8");
+      await writeFile13(indexHtml, html, "utf-8");
     }
     const statusPages = workerResults.flatMap(
       (r) => /400|404|500\.html$/.test(r.outputPath) ? r.outputPath : []
@@ -14781,7 +14877,7 @@ var runPrerender = async (options) => {
       rewrites
     });
     if (ZuploEnv.isZuplo && issuer) {
-      await writeFile12(
+      await writeFile13(
         path46.join(dir, DIST_DIR, ".output/zuplo.json"),
         JSON.stringify({ issuer }, null, 2),
         "utf-8"
@@ -14804,7 +14900,7 @@ var bundleSSREntry = async (options) => {
     '"__BASE_PATH__"',
     basePath ? JSON.stringify(basePath) : "undefined"
   );
-  await writeFile12(tempEntryPath, entryContent, "utf-8");
+  await writeFile13(tempEntryPath, entryContent, "utf-8");
   try {
     await esbuild({
       entryPoints: [tempEntryPath],
@@ -14827,7 +14923,7 @@ init_package_json();
 
 // src/cli/init/v2-packages.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { readFile as readFile11, writeFile as writeFile13 } from "node:fs/promises";
+import { readFile as readFile11, writeFile as writeFile14 } from "node:fs/promises";
 import path47 from "node:path";
 var CORE_PACKAGES = [
   "@lukoweb/apitogo",
@@ -14847,7 +14943,7 @@ function packageNameFrom(name) {
 async function ensurePackageJson(dir, name) {
   const file = path47.join(dir, "package.json");
   if (existsSync5(file)) return false;
-  await writeFile13(
+  await writeFile14(
     file,
     `${JSON.stringify(
       {
@@ -14940,7 +15036,7 @@ function portalBuildStep(context, options = {}, build2 = runBuild) {
       await mkdir12(path48.dirname(buildDir), { recursive: true });
       await rename6(path48.join(root, "dist"), buildDir);
       if (prepared.publishedManifest) {
-        await writeFile14(
+        await writeFile15(
           path48.join(buildDir, MANIFEST_FILE),
           `${JSON.stringify(prepared.publishedManifest, null, 2)}
 `
@@ -15137,14 +15233,14 @@ async function readPlansFile(file) {
   return parsed.data.plans;
 }
 var BILLING_PERIOD = { month: "monthly", year: "annual" };
-function toPlatformPlans(plans) {
+function toPlatformPlans(plans, options = {}) {
   return plans.map((plan2, index) => {
     const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
-    if (paid)
+    if (paid && !options.billing)
       throw new PlansFileError(
         "PLANS_PAID_UNSUPPORTED",
-        `The plan "${plan2.sku}" has a price, and deploying paid plans is not available in this CLI version yet.`,
-        "Remove the plan, or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
+        `The plan "${plan2.sku}" has a price, and plans.billing.provider is not stripe, so nobody could pay for it.`,
+        "Set plans.billing.provider to stripe (with plans.billing.apiKey), or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
       );
     const limits = plan2.limits ? {
       ...plan2.limits.rateLimit ? {
@@ -15233,7 +15329,11 @@ async function plansFileProblem(resolved) {
   const plans = resolved.plans;
   if (!plans?.enabled) return { wanted: [] };
   try {
-    return { wanted: toPlatformPlans(await readPlansFile(plans.file)) };
+    return {
+      wanted: toPlatformPlans(await readPlansFile(plans.file), {
+        billing: plans.billing.provider === "stripe"
+      })
+    };
   } catch (error) {
     if (!(error instanceof PlansFileError)) throw error;
     return {
@@ -15483,7 +15583,7 @@ async function runCheckV2(dir, args = {}, deps = {}) {
     ...report
   };
 }
-var line = (label, issue4) => `${label}: ${formatConfigIssue(issue4)}`;
+var line = (label2, issue4) => `${label2}: ${formatConfigIssue(issue4)}`;
 function formatCheckV2(output4) {
   const lines = [
     ...output4.errors.map((issue4) => line("error", issue4)),
@@ -15950,6 +16050,56 @@ async function installMissingPackages(dir, config2, version, options) {
   return { status: "installed", packages: missing, command: shown };
 }
 
+// src/cli/services/prompter.ts
+import { createInterface as createInterface2 } from "node:readline/promises";
+var terminalQuestion = async (prompt) => {
+  const rl = createInterface2({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(prompt);
+  } finally {
+    rl.close();
+  }
+};
+function createAsker(question = terminalQuestion, say = (line2) => console.log(line2)) {
+  return {
+    async text(prompt, options) {
+      for (; ; ) {
+        const suffix = options?.default ? ` [${options.default}]` : "";
+        const answer = (await question(`${prompt}${suffix}: `)).trim();
+        const value = answer || options?.default || "";
+        if (!value) {
+          say("A value is needed.");
+          continue;
+        }
+        const problem = options?.validate?.(value);
+        if (problem) {
+          say(problem);
+          continue;
+        }
+        return value;
+      }
+    },
+    async choose(prompt, choices) {
+      say(prompt);
+      choices.forEach((choice, index) => {
+        say(`  ${index + 1}) ${choice.label}`);
+      });
+      for (; ; ) {
+        const answer = (await question(`Choose 1-${choices.length} [1]: `)).trim();
+        const index = Number(answer || "1");
+        const chosen = Number.isInteger(index) && index >= 1 && index <= choices.length ? choices[index - 1] : choices.find((choice) => choice.value === answer);
+        if (chosen) return chosen.value;
+        say(`Pick a number from 1 to ${choices.length}.`);
+      }
+    },
+    async confirm(prompt, defaultYes = false) {
+      const answer = (await question(`${prompt} (${defaultYes ? "Y/n" : "y/N"}) `)).trim().toLowerCase();
+      if (!answer) return defaultYes;
+      return answer === "y" || answer === "yes";
+    }
+  };
+}
+
 // src/cli/services/handler.ts
 var list = (value) => {
   const items = (Array.isArray(value) ? value : value === void 0 ? [] : [value]).filter(
@@ -16004,15 +16154,6 @@ function addOptionsFromArguments(service, argv) {
   };
 }
 var canPrompt2 = (json) => !json && process.stdin.isTTY === true && process.stdout.isTTY === true;
-async function confirm(question) {
-  const rl = createInterface2({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(question)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
-}
 function describe(edit, dir) {
   return {
     service: edit.service,
@@ -16024,6 +16165,7 @@ function describe(edit, dir) {
 }
 async function run(action, argv, plan2, deps = {}) {
   const json = argv.json === true;
+  const asker = argv.yes === true ? void 0 : deps.asker ?? (canPrompt2(json) ? createAsker() : void 0);
   try {
     if (!isServiceName(argv.service)) {
       throw new ServiceEditError(
@@ -16038,7 +16180,28 @@ async function run(action, argv, plan2, deps = {}) {
         "Create one with `apitogo init`."
       );
     }
-    const edit = await plan2(argv.service);
+    const service = argv.service;
+    let edit;
+    for (let attempt = 0; edit === void 0; attempt++) {
+      try {
+        edit = await plan2(service, asker);
+      } catch (error) {
+        const missing = action === "add" && error instanceof ServiceEditError ? error.missingServices : [];
+        if (missing.length === 0 || !asker || argv.dryRun || attempt >= 3)
+          throw error;
+        for (const needed2 of missing) {
+          if (!await asker.confirm(
+            `${service} needs ${needed2}. Add ${needed2} now?`,
+            true
+          ))
+            throw error;
+          await addService(
+            { service: needed2, dir: argv.dir, install: argv.install },
+            deps
+          );
+        }
+      }
+    }
     const needed = action === "add" ? missingPackages(dir, packagesForConfig(edit.config)) : [];
     if (!json) {
       for (const line2 of formatServiceEdit(edit))
@@ -16059,13 +16222,13 @@ async function run(action, argv, plan2, deps = {}) {
       return;
     }
     if (argv.yes !== true) {
-      if (!canPrompt2(json)) {
+      if (!asker) {
         throw new ServiceEditError(
           "This is not an interactive terminal.",
           "Pass --yes to apply the change, or --dry-run to only see it."
         );
       }
-      if (!await confirm("Apply this change? (y/N) ")) {
+      if (!await asker.confirm("Apply this change?")) {
         printResultToConsole("Cancelled. Nothing was written.");
         return;
       }
@@ -16139,7 +16302,10 @@ async function installPackages(dir, edit, argv, deps, json) {
 var addService = (argv, deps = {}) => run(
   "add",
   argv,
-  (service) => planAddService(service, addOptionsFromArguments(service, argv)),
+  (service, ask4) => planAddService(service, {
+    ...addOptionsFromArguments(service, argv),
+    ask: ask4
+  }),
   deps
 );
 var removeService = (argv) => run(
@@ -16498,7 +16664,7 @@ function formatDevPortalBackendResponse(projectId, backend) {
 // src/cli/platform/helpers/dev-portal-manifest.ts
 init_gateway_limits();
 import { existsSync as existsSync7 } from "node:fs";
-import { access as access6, mkdir as mkdir13, readFile as readFile17, writeFile as writeFile15 } from "node:fs/promises";
+import { access as access6, mkdir as mkdir13, readFile as readFile17, writeFile as writeFile16 } from "node:fs/promises";
 import path57 from "node:path";
 
 // src/cli/make-config/json-config.ts
@@ -17126,11 +17292,11 @@ function buildThinWrapperWithCustomPages(tsxRoutePaths) {
   const customPages = tsxRoutePaths.map((routePath) => {
     const slug = routePath.replace(/^\//, "");
     const name = pageComponentName(slug);
-    const label = labelFromRoutePath(routePath);
+    const label2 = labelFromRoutePath(routePath);
     return `        {
           type: "custom-page",
           path: ${JSON.stringify(routePath)},
-          label: ${JSON.stringify(label)},
+          label: ${JSON.stringify(label2)},
           element: <${name} />,
         },`;
   }).join("\n");
@@ -17213,7 +17379,7 @@ function ensureHeaderDocsNavigation(config2, docRoutes2) {
   }
   return { ...config2, header: { ...header, navigation } };
 }
-function ensureHeaderApiReferenceNavigation(config2, to, label = HEADER_API_REFERENCE_LABEL) {
+function ensureHeaderApiReferenceNavigation(config2, to, label2 = HEADER_API_REFERENCE_LABEL) {
   const current = readHeaderNavigation(config2);
   if (!current) return config2;
   const { header, navigation } = current;
@@ -17221,7 +17387,7 @@ function ensureHeaderApiReferenceNavigation(config2, to, label = HEADER_API_REFE
     return config2;
   }
   const docsIndex = navigation.findIndex(isDocsItem);
-  const item = { label, to };
+  const item = { label: label2, to };
   if (docsIndex >= 0) {
     navigation.splice(docsIndex + 1, 0, item);
   } else {
@@ -17818,7 +17984,7 @@ async function writeManifest2(siteDirectory, manifest) {
     ...safeManifest
   } = manifest;
   config2 = applyManifestToConfig(config2, safeManifest);
-  await writeFile15(filePath, `${JSON.stringify(config2, null, 2)}
+  await writeFile16(filePath, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
   return filePath;
 }
@@ -17830,7 +17996,7 @@ import {
   mkdir as mkdir14,
   readFile as readFile18,
   unlink,
-  writeFile as writeFile16
+  writeFile as writeFile17
 } from "node:fs/promises";
 import path58 from "node:path";
 var ENV_FILENAME = ".env";
@@ -18105,7 +18271,7 @@ async function writeScaffoldEnv(siteDirectory) {
     await access7(envPath);
   } catch {
     await mkdir14(resolvedDirectory, { recursive: true });
-    await writeFile16(envPath, createEnvContent(), "utf8");
+    await writeFile17(envPath, createEnvContent(), "utf8");
     filesWritten.push(ENV_FILENAME);
   }
   for (const legacyName of [".env.example"]) {
@@ -18134,7 +18300,7 @@ async function writeScaffoldEnv(siteDirectory) {
     if (!hasEntry) {
       const suffix = gitignore.length === 0 ? "" : gitignore.endsWith("\n") ? "" : "\n";
       if (gitignore.length === 0) {
-        await writeFile16(gitignorePath, `${entry}
+        await writeFile17(gitignorePath, `${entry}
 `, "utf8");
       } else {
         await appendFile(gitignorePath, `${suffix}${entry}
@@ -18918,7 +19084,7 @@ var check_default = {
 
 // src/cli/make-config/handler.ts
 import { constants as constants2 } from "node:fs";
-import { access as access12, mkdir as mkdir17, readFile as readFile24, writeFile as writeFile21 } from "node:fs/promises";
+import { access as access12, mkdir as mkdir17, readFile as readFile24, writeFile as writeFile22 } from "node:fs/promises";
 import path71 from "node:path";
 import { stdin as input2 } from "node:process";
 import { glob as glob8 } from "glob";
@@ -19058,12 +19224,12 @@ function withDefaultIncludedActionKeys(plan2, actionKeys) {
 }
 
 // src/cli/scaffold/dev-portal-config-pages.ts
-import { access as access8, readFile as readFile20, rename as rename7, rm as rm9, writeFile as writeFile17 } from "node:fs/promises";
+import { access as access8, readFile as readFile20, rename as rename7, rm as rm9, writeFile as writeFile18 } from "node:fs/promises";
 import path63 from "node:path";
 async function writeConfigAtomically(filePath, content) {
   const temporaryPath = `${filePath}.${process.pid}.${Date.now()}.tmp`;
   try {
-    await writeFile17(temporaryPath, content, "utf8");
+    await writeFile18(temporaryPath, content, "utf8");
     await rename7(temporaryPath, filePath);
   } catch (error) {
     await rm9(temporaryPath, { force: true });
@@ -19555,10 +19721,10 @@ ${importStatement}${content.slice(lastImportEnd)}`;
   return `${importStatement}
 ${content}`;
 }
-function formatCustomPageNavigationEntry(slug, label, indent) {
+function formatCustomPageNavigationEntry(slug, label2, indent) {
   const componentName = pageComponentName2(slug);
   const inner = `${indent}  `;
-  const labelLine = label?.trim() ? `${inner}label: ${JSON.stringify(label.trim())},
+  const labelLine = label2?.trim() ? `${inner}label: ${JSON.stringify(label2.trim())},
 ` : "";
   return `${indent}{
 ${inner}type: "custom-page",
@@ -19566,21 +19732,21 @@ ${inner}path: "/${normalizePageSlug2(slug)}",
 ` + labelLine + `${inner}element: <${componentName} />,
 ${indent}},`;
 }
-function formatDocumentationCategoryWithPage(slug, label, indent) {
+function formatDocumentationCategoryWithPage(slug, label2, indent) {
   const inner = `${indent}  `;
   const itemIndent = `${inner}  `;
   return `${indent}{
 ${inner}type: "category",
 ${inner}label: ${JSON.stringify(DOCUMENTATION_NAV_LABEL2)},
 ${inner}items: [
-${formatCustomPageNavigationEntry(slug, label, itemIndent)}
+${formatCustomPageNavigationEntry(slug, label2, itemIndent)}
 ${inner}],
 ${indent}},`;
 }
-function findMatchingArrayClose(content, open3) {
+function findMatchingArrayClose(content, open4) {
   let depth = 0;
   let inString = null;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19619,8 +19785,8 @@ function findDocumentationCategoryItemsRange(content, from, to) {
   if (!itemsMatch) {
     return null;
   }
-  const open3 = afterLabel + itemsMatch.index + itemsMatch[0].length - 1;
-  const close3 = findMatchingArrayClose(content, open3);
+  const open4 = afterLabel + itemsMatch.index + itemsMatch[0].length - 1;
+  const close3 = findMatchingArrayClose(content, open4);
   if (close3 === null || close3 > to) {
     return null;
   }
@@ -19631,7 +19797,7 @@ function findDocumentationCategoryItemsRange(content, from, to) {
   const indentMatch = /^[ \t]*/.exec(content.slice(lineStart));
   const itemsIndent = indentMatch?.[0] ?? "";
   const entryIndent = `${itemsIndent}  `;
-  return { open: open3, close: close3, indent: entryIndent };
+  return { open: open4, close: close3, indent: entryIndent };
 }
 function appendEntryToArrayRange(content, range, entry) {
   const before = content.slice(0, range.close);
@@ -19664,7 +19830,7 @@ ${normalizedEntry}
 ${range.indent}${trimmedInner}
 ${closeIndent}${content.slice(range.close)}`;
 }
-function appendCustomPageToDirectBuildExport(content, slug, label) {
+function appendCustomPageToDirectBuildExport(content, slug, label2) {
   const exportPrefix = "export default ";
   const callPrefix = "buildApitogoConfig(";
   const exportIndex = content.indexOf(`${exportPrefix}${callPrefix}`);
@@ -19672,11 +19838,11 @@ function appendCustomPageToDirectBuildExport(content, slug, label) {
     return null;
   }
   const callStart = exportIndex + exportPrefix.length;
-  const open3 = callStart + callPrefix.length - 1;
+  const open4 = callStart + callPrefix.length - 1;
   let depth = 0;
   let inString = null;
   let close3 = -1;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19711,7 +19877,7 @@ function appendCustomPageToDirectBuildExport(content, slug, label) {
     replaceEnd += 1;
   }
   const buildCall = content.slice(callStart, close3 + 1);
-  const category = formatDocumentationCategoryWithPage(slug, label, "    ");
+  const category = formatDocumentationCategoryWithPage(slug, label2, "    ");
   const replacement = `const config = ${buildCall};
 
 export default {
@@ -19737,10 +19903,10 @@ function findNavigationArrayRange(content) {
     return null;
   }
   const indent = match[1] ?? "";
-  const open3 = match.index + match[0].length - 1;
+  const open4 = match.index + match[0].length - 1;
   let depth = 0;
   let inString = null;
-  for (let i = open3; i < content.length; i++) {
+  for (let i = open4; i < content.length; i++) {
     const char = content[i];
     if (inString) {
       if (char === "\\") {
@@ -19759,13 +19925,13 @@ function findNavigationArrayRange(content) {
     } else if (char === "]") {
       depth -= 1;
       if (depth === 0) {
-        return { open: open3, close: i, indent };
+        return { open: open4, close: i, indent };
       }
     }
   }
   return null;
 }
-function appendCustomPageToNavigation(content, slug, label, _options) {
+function appendCustomPageToNavigation(content, slug, label2, _options) {
   const pagePath = `"/${normalizePageSlug2(slug)}"`;
   if (content.includes(`path: ${pagePath}`)) {
     return content;
@@ -19773,7 +19939,7 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
   const rewrittenBuildExport = appendCustomPageToDirectBuildExport(
     content,
     slug,
-    label
+    label2
   );
   if (rewrittenBuildExport) {
     return rewrittenBuildExport;
@@ -19790,14 +19956,14 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
   if (docsItems) {
     const entry = formatCustomPageNavigationEntry(
       slug,
-      label,
+      label2,
       docsItems.indent
     );
     return appendEntryToArrayRange(content, docsItems, entry);
   }
   const category = formatDocumentationCategoryWithPage(
     slug,
-    label,
+    label2,
     `${range.indent}  `
   );
   return prependEntryToArrayRange(
@@ -19806,11 +19972,11 @@ function appendCustomPageToNavigation(content, slug, label, _options) {
     category
   );
 }
-function patchApitogoConfigForNewPage(content, slug, label, options) {
+function patchApitogoConfigForNewPage(content, slug, label2, options) {
   const withNavigation = appendCustomPageToNavigation(
     content,
     slug,
-    label,
+    label2,
     options
   );
   if (withNavigation === content) {
@@ -19818,13 +19984,13 @@ function patchApitogoConfigForNewPage(content, slug, label, options) {
   }
   return ensurePageImport(withNavigation, pageComponentName2(slug), slug);
 }
-async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
+async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label2) {
   const configPath = await resolveApitogoConfigPath(sourceDirectory);
   if (!configPath) {
     return { updated: false };
   }
   const original = await readFile20(configPath, "utf8");
-  const patched = patchApitogoConfigForNewPage(original, slug, label, {
+  const patched = patchApitogoConfigForNewPage(original, slug, label2, {
     typescript: configPath.endsWith(".tsx")
   });
   if (patched === original) {
@@ -19835,7 +20001,7 @@ async function wireNewDevPortalPageInConfig(sourceDirectory, slug, label) {
 }
 
 // src/cli/scaffold/wire-openapi.ts
-import { access as access10, readFile as readFile22, writeFile as writeFile19 } from "node:fs/promises";
+import { access as access10, readFile as readFile22, writeFile as writeFile20 } from "node:fs/promises";
 import path68 from "node:path";
 
 // src/cli/platform/helpers/openapi.ts
@@ -20039,7 +20205,7 @@ async function validateOpenApiFile(filePath) {
 }
 
 // src/cli/scaffold/scaffold-dev-portal-site.ts
-import { mkdir as mkdir15, readFile as readFile21, writeFile as writeFile18 } from "node:fs/promises";
+import { mkdir as mkdir15, readFile as readFile21, writeFile as writeFile19 } from "node:fs/promises";
 import path67 from "node:path";
 
 // src/cli/scaffold/apitogo-npm-packages.ts
@@ -20451,7 +20617,7 @@ async function ensureAccountPlansPage(outputDirectory) {
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
-    await writeFile18(pagePath, ACCOUNT_PLANS_PAGE);
+    await writeFile19(pagePath, ACCOUNT_PLANS_PAGE);
     return ACCOUNT_PLANS_PAGE_PATH;
   }
 }
@@ -20462,7 +20628,7 @@ async function ensureDashboardPage(outputDirectory) {
     return void 0;
   } catch {
     await mkdir15(path67.dirname(pagePath), { recursive: true });
-    await writeFile18(pagePath, DASHBOARD_PAGE);
+    await writeFile19(pagePath, DASHBOARD_PAGE);
     return DASHBOARD_PAGE_PATH;
   }
 }
@@ -20521,7 +20687,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
   const packageJsonPath = path67.join(outputDirectory, "package.json");
   if (options.patchPackageJson !== false) {
     const packageJson3 = await readFile21(packageJsonPath, "utf8");
-    await writeFile18(
+    await writeFile19(
       packageJsonPath,
       rewritePackageJson(packageJson3, {
         siteName: options.siteName,
@@ -20533,7 +20699,7 @@ async function patchScaffoldedSite(outputDirectory, options) {
   }
   const configPath = path67.join(outputDirectory, "apitogo.config.tsx");
   const configContent = await readFile21(configPath, "utf8");
-  await writeFile18(
+  await writeFile19(
     configPath,
     patchDashboardPageConfig(
       patchAccountPlansPageConfig(
@@ -20645,7 +20811,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
       input: input5,
       apiPath: "api"
     });
-    await writeFile19(
+    await writeFile20(
       jsonConfigPath,
       `${JSON.stringify(updated, null, 2)}
 `,
@@ -20656,7 +20822,7 @@ async function wireDevPortalOpenApi(sourceDirectory, openApiPath) {
     const configContent = await readFile22(tsxConfigPath, "utf8");
     try {
       const patched = patchApitogoConfigOpenApiToFile(configContent, input5);
-      await writeFile19(tsxConfigPath, patched);
+      await writeFile20(tsxConfigPath, patched);
     } catch (error) {
       return {
         status: "failed",
@@ -21009,7 +21175,7 @@ export default function ${componentName}() {
 // src/cli/make-config/scaffold-project.ts
 init_package_json();
 import { constants } from "node:fs";
-import { access as access11, mkdir as mkdir16, readFile as readFile23, writeFile as writeFile20 } from "node:fs/promises";
+import { access as access11, mkdir as mkdir16, readFile as readFile23, writeFile as writeFile21 } from "node:fs/promises";
 import path70 from "node:path";
 import { glob as glob7 } from "glob";
 
@@ -21087,7 +21253,7 @@ async function ensurePackageJson2(dir) {
         typescript: "^5"
       }
     };
-    await writeFile20(pkgPath, `${JSON.stringify(pkg2, null, 2)}
+    await writeFile21(pkgPath, `${JSON.stringify(pkg2, null, 2)}
 `, "utf8");
     return true;
   }
@@ -21114,7 +21280,7 @@ async function ensurePackageJson2(dir) {
   for (const [k, v] of Object.entries(baseDeps)) {
     if (!deps[k]) deps[k] = v;
   }
-  await writeFile20(pkgPath, `${JSON.stringify(pkg, null, 2)}
+  await writeFile21(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `, "utf8");
   return false;
 }
@@ -21149,7 +21315,7 @@ async function ensureTsconfigJson(dir) {
         "user-panel"
       ]
     };
-    await writeFile20(tsPath, `${JSON.stringify(tsconfig, null, 2)}
+    await writeFile21(tsPath, `${JSON.stringify(tsconfig, null, 2)}
 `, "utf8");
     return true;
   }
@@ -21171,17 +21337,17 @@ async function ensurePortalStubFiles(dir) {
   const landingPath = path70.join(dir, "landing", "LandingPage.tsx");
   if (!await fileExists2(landingPath)) {
     await mkdir16(path70.join(dir, "landing"), { recursive: true });
-    await writeFile20(landingPath, LANDING_PAGE_SOURCE, "utf8");
+    await writeFile21(landingPath, LANDING_PAGE_SOURCE, "utf8");
   }
   const plansPath = path70.join(dir, "user-panel", "AccountPlansPage.tsx");
   if (!await fileExists2(plansPath)) {
     await mkdir16(path70.join(dir, "user-panel"), { recursive: true });
-    await writeFile20(plansPath, ACCOUNT_PLANS_PAGE_SOURCE, "utf8");
+    await writeFile21(plansPath, ACCOUNT_PLANS_PAGE_SOURCE, "utf8");
   }
   const dashboardPath = path70.join(dir, "user-panel", "DashboardPage.tsx");
   if (!await fileExists2(dashboardPath)) {
     await mkdir16(path70.join(dir, "user-panel"), { recursive: true });
-    await writeFile20(dashboardPath, DASHBOARD_PAGE_SOURCE, "utf8");
+    await writeFile21(dashboardPath, DASHBOARD_PAGE_SOURCE, "utf8");
   }
   await ensurePublicBrandingFiles(dir);
 }
@@ -21193,11 +21359,11 @@ async function ensurePublicBrandingFiles(dir) {
     if (await fileExists2(dest)) {
       continue;
     }
-    await writeFile20(dest, content, "utf8");
+    await writeFile21(dest, content, "utf8");
   }
   const faviconDest = path70.join(destDir, "Icon.png");
   if (!await fileExists2(faviconDest)) {
-    await writeFile20(faviconDest, Buffer.from(FAVICON_PNG_BASE64, "base64"));
+    await writeFile21(faviconDest, Buffer.from(FAVICON_PNG_BASE64, "base64"));
   }
 }
 async function ensureThinConfigTsx(dir) {
@@ -21205,7 +21371,7 @@ async function ensureThinConfigTsx(dir) {
   if (await fileExists2(tsxPath)) {
     return false;
   }
-  await writeFile20(tsxPath, THIN_WRAPPER_SOURCE, "utf8");
+  await writeFile21(tsxPath, THIN_WRAPPER_SOURCE, "utf8");
   return true;
 }
 
@@ -21266,13 +21432,13 @@ async function persistConfig(config2, ctx) {
       force: ctx.force
     })
   };
-  await writeFile21(ctx.jsonPath, `${JSON.stringify(next, null, 2)}
+  await writeFile22(ctx.jsonPath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   const tsxPath = path71.join(ctx.dir, "apitogo.config.tsx");
   if (await fileExists3(tsxPath) && tsxRoutes.length > 0) {
     const tsxSource = await readFile24(tsxPath, "utf8");
     if (isManagedConfigWrapper(tsxSource)) {
-      await writeFile21(
+      await writeFile22(
         tsxPath,
         buildThinWrapperWithCustomPages(tsxRoutes),
         "utf8"
@@ -21376,7 +21542,7 @@ async function makeConfig(argv) {
           if (action2.kind === "page") {
             const pagePath = path71.join(dir, action2.page.relativePath);
             await mkdir17(path71.dirname(pagePath), { recursive: true });
-            await writeFile21(
+            await writeFile22(
               pagePath,
               buildStarterDocsPageTsx(action2.page.slug, action2.page.title),
               "utf8"
@@ -21485,7 +21651,7 @@ async function makeConfig(argv) {
             argv.pageContent,
             pageTemplate
           );
-          await writeFile21(filePath, tsx, "utf8");
+          await writeFile22(filePath, tsx, "utf8");
           pageResult = {
             action: "updated",
             slug,
@@ -21505,7 +21671,7 @@ async function makeConfig(argv) {
             pageTemplate
           );
           await mkdir17(path71.dirname(filePath), { recursive: true });
-          await writeFile21(filePath, tsx, "utf8");
+          await writeFile22(filePath, tsx, "utf8");
           const configResult = await wireNewDevPortalPageInConfig(
             dir,
             slug,
@@ -21805,8 +21971,8 @@ function createScopedConsoleProgressReporter(stream, stepLabel, shared) {
       }
     },
     isCancelled: () => false,
-    child(label) {
-      return createScopedConsoleProgressReporter(stream, label, shared);
+    child(label2) {
+      return createScopedConsoleProgressReporter(stream, label2, shared);
     }
   };
   const baseOnNewMessages = reporter.onNewMessages.bind(reporter);
@@ -21854,9 +22020,10 @@ var DEFAULT_EXCLUDES = /* @__PURE__ */ new Set([
   "bin",
   "obj"
 ]);
-async function loadGitignore(rootDir) {
+async function loadGitignore(rootDir, extraExcludes = []) {
   const ig = ignore();
   ig.add(["node_modules/", ".git/", "dist/", "bin/", "obj/"]);
+  if (extraExcludes.length > 0) ig.add([...extraExcludes]);
   const gitignorePath = path72.join(rootDir, ".gitignore");
   try {
     const content = await fs7.readFile(gitignorePath, "utf8");
@@ -21884,13 +22051,13 @@ async function collectFiles(rootDir, relativeDir, ig, files) {
     }
   }
 }
-async function collectPackageableFiles(sourceDirectory) {
+async function collectPackageableFiles(sourceDirectory, extraExcludes = []) {
   const resolved = path72.resolve(sourceDirectory);
   const stat7 = await fs7.stat(resolved).catch(() => null);
   if (!stat7?.isDirectory()) {
     throw new Error(`sourceDirectory is not a directory: ${resolved}`);
   }
-  const ig = await loadGitignore(resolved);
+  const ig = await loadGitignore(resolved, extraExcludes);
   const files = [];
   await collectFiles(resolved, "", ig, files);
   if (files.length === 0) {
@@ -21910,9 +22077,9 @@ async function sha256File(filePath) {
   });
   return hash2.digest("hex");
 }
-async function hashDirectoryContents(rootDirectory) {
+async function hashDirectoryContents(rootDirectory, extraExcludes = []) {
   const resolved = path73.resolve(rootDirectory);
-  const files = (await collectPackageableFiles(resolved)).sort(
+  const files = (await collectPackageableFiles(resolved, extraExcludes)).sort(
     (a, b) => a.localeCompare(b)
   );
   const hash2 = createHash3("sha256");
@@ -22663,7 +22830,7 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
 }
 
 // src/cli/platform/helpers/openapi-gateway-servers.ts
-import { mkdir as mkdir18, readFile as readFile25, writeFile as writeFile22 } from "node:fs/promises";
+import { mkdir as mkdir18, readFile as readFile25, writeFile as writeFile23 } from "node:fs/promises";
 import path74 from "node:path";
 import YAML3 from "yaml";
 var GATEWAY_URL_ENV_KEY = "APITOGO_GATEWAY_URL";
@@ -22711,7 +22878,7 @@ async function materializePublishOpenApiWithGateway(siteDirectory, sourceOpenApi
   const doc = await readOpenApiDocument(source);
   const rewritten = withGatewayServers(doc, gatewayUrl);
   await mkdir18(path74.dirname(outputPath), { recursive: true });
-  await writeFile22(
+  await writeFile23(
     outputPath,
     `${JSON.stringify(rewritten, null, 2)}
 `,
@@ -22737,7 +22904,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
   const backend = config2.backend && typeof config2.backend === "object" ? { ...config2.backend } : {};
   backend.openApiPath = relativeInput;
   config2.backend = backend;
-  await writeFile22(configPath, `${JSON.stringify(config2, null, 2)}
+  await writeFile23(configPath, `${JSON.stringify(config2, null, 2)}
 `, "utf8");
   return {
     restore: async () => {
@@ -22753,7 +22920,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
       } else {
         current.backend = previousBackend;
       }
-      await writeFile22(
+      await writeFile23(
         configPath,
         `${JSON.stringify(current, null, 2)}
 `,
@@ -22850,7 +23017,7 @@ function collectManifestPublicActionKeys(gateway) {
 }
 
 // src/cli/platform/helpers/publish-ledger.ts
-import { mkdir as mkdir19, readFile as readFile26, writeFile as writeFile23 } from "node:fs/promises";
+import { mkdir as mkdir19, readFile as readFile26, writeFile as writeFile24 } from "node:fs/promises";
 import path75 from "node:path";
 var PUBLISH_LEDGER_RELATIVE_PATH = ".apitogo/publish-state.json";
 function publishLedgerPath(siteDirectory) {
@@ -22877,7 +23044,7 @@ async function writePublishLedger(siteDirectory, ledger) {
     version: 1,
     updatedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  await writeFile23(filePath, `${JSON.stringify(next, null, 2)}
+  await writeFile24(filePath, `${JSON.stringify(next, null, 2)}
 `, "utf8");
   return filePath;
 }
@@ -23511,9 +23678,9 @@ import { createReadStream as createReadStream2, createWriteStream as createWrite
 import { tmpdir as tmpdir2 } from "node:os";
 import path77 from "node:path";
 import { ZipArchive } from "archiver";
-async function packageBackendDirectory(sourceDirectory) {
+async function packageBackendDirectory(sourceDirectory, extraExcludes = []) {
   const resolved = path77.resolve(sourceDirectory);
-  const files = await collectPackageableFiles(resolved);
+  const files = await collectPackageableFiles(resolved, extraExcludes);
   const zipPath = path77.join(
     tmpdir2(),
     `apitogo-backend-${Date.now()}-${Math.random().toString(36).slice(2)}.zip`
@@ -25038,7 +25205,7 @@ async function resolveProjectIdForPublish(client, config2, args, wait, progress,
 import path81 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-site-api-url.ts
-import { readdir as readdir3, readFile as readFile27, writeFile as writeFile24 } from "node:fs/promises";
+import { readdir as readdir3, readFile as readFile27, writeFile as writeFile25 } from "node:fs/promises";
 import path78 from "node:path";
 var SITE_API_BASE_URL_ENV_KEY = "VITE_APITOGO_AUTHENTICATION_API_BASE_URL";
 var PLACEHOLDER_HOST_MARKERS = [
@@ -25100,13 +25267,13 @@ async function patchSiteApiBaseUrl(sourceDirectory, apiBaseUrl) {
 ${line2}
 ` : `${line2}
 `;
-      await writeFile24(envPath, patched);
+      await writeFile25(envPath, patched);
       patchedExisting = true;
     } catch {
     }
   }
   if (!patchedExisting) {
-    await writeFile24(path78.join(resolved, ".env"), `${line2}
+    await writeFile25(path78.join(resolved, ".env"), `${line2}
 `);
   }
 }
@@ -27324,19 +27491,11 @@ var GatewayDeployError = class extends ApitogoError {
 };
 var sha256 = (text) => createHash4("sha256").update(text).digest("hex");
 function gatewayNotDeployableReason(gateway) {
-  if (gateway.origin.mode === "managed")
-    return "a managed origin cannot be deployed from this CLI version yet; use origin.mode proxy";
   if (gateway.specs.length > 1)
     return "the platform takes one OpenAPI file per gateway, but the config lists several";
   return void 0;
 }
 function assertDeployable(gateway) {
-  if (gateway.origin.mode === "managed")
-    throw new GatewayDeployError(
-      "GATEWAY_MANAGED_ORIGIN_UNSUPPORTED",
-      "A managed origin cannot be deployed from this CLI version yet.",
-      'Set gateway.origin.mode to "proxy" and point gateway.origin.url at your API.'
-    );
   if (gateway.specs.length > 1)
     throw new GatewayDeployError(
       "GATEWAY_MULTIPLE_SPECS",
@@ -27383,6 +27542,37 @@ async function gatewayDeployInputs(resolved, projectId) {
   };
 }
 var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function backendDeployInputs(gateway, projectId) {
+  const { origin } = gateway;
+  if (origin.mode !== "managed" || !origin.source || !origin.runtime || !origin.runtimeVersion)
+    return void 0;
+  const runtime = normalizeRuntime(origin.runtime);
+  const runtimeVersion = normalizeRuntimeVersionSlug(
+    runtime,
+    origin.runtimeVersion
+  );
+  const exclude = origin.exclude ?? [];
+  let tree;
+  try {
+    tree = await hashDirectoryContents(origin.source, exclude);
+  } catch (error) {
+    throw new GatewayDeployError(
+      "GATEWAY_BACKEND_UNREADABLE",
+      `Cannot read the backend source ${origin.source}: ${error instanceof Error ? error.message : String(error)}`,
+      "Check gateway.origin.source in the config. It must be a folder with your API's code."
+    );
+  }
+  return {
+    source: origin.source,
+    runtime,
+    runtimeVersion,
+    exclude,
+    healthPath: origin.healthPath,
+    hash: sha256(
+      `${projectId}|${runtime}|${runtimeVersion}|${origin.healthPath ?? ""}|${stableJson(exclude)}|${tree}`
+    )
+  };
+}
 function describePlatformProblem(error) {
   if (!(error instanceof PlatformApiError) || !error.problem) return [];
   const errors = error.problem.errors;
@@ -27418,11 +27608,73 @@ function rejected(what, error) {
 async function deployGateway(resolved, projectId, deps, options = {}) {
   const { gateway, spec, body, specHash, configHash } = await gatewayDeployInputs(resolved, projectId);
   assertDeployable(gateway);
+  const backend = await backendDeployInputs(gateway, projectId);
   const client = deps.client;
   const sleep5 = deps.sleep ?? defaultSleep;
   const now = deps.now ?? Date.now;
   const timeoutMs = deps.reconcileTimeoutMs ?? 18e4;
+  const backendTimeoutMs = deps.backendTimeoutMs ?? 20 * 6e4;
   const intervalMs = deps.pollIntervalMs ?? 2e3;
+  const backendStep = {
+    name: "backend",
+    hash: () => backend?.hash ?? "",
+    run: async () => {
+      if (!backend) throw new Error("gateway.origin is not a managed origin");
+      const prepared = await prepareBackendPackagingDirectory({
+        sourceDirectory: backend.source,
+        runtime: backend.runtime
+      });
+      let zipPath;
+      try {
+        const packaged = await packageBackendDirectory(
+          prepared.directory,
+          backend.exclude
+        );
+        zipPath = packaged.zipPath;
+        let started;
+        try {
+          started = await client.deployBackend(projectId, {
+            archivePath: packaged.zipPath,
+            runtime: backend.runtime,
+            runtimeVersion: backend.runtimeVersion,
+            healthCheckPath: backend.healthPath
+          });
+        } catch (error) {
+          return rejected("backend upload", error);
+        }
+        if (!started.reused) {
+          const deadline = now() + backendTimeoutMs;
+          for (; ; ) {
+            const state = await client.getDeploymentStatus(
+              projectId,
+              started.deploymentId
+            );
+            if (state.status.toLowerCase() === "healthy") break;
+            if (isTerminalDeploymentStatus(state.status))
+              throw new GatewayDeployError(
+                "GATEWAY_BACKEND_FAILED",
+                `The platform could not deploy your backend (${state.status}): ${state.error ?? state.messages.at(-1)?.message ?? "no reason given"}.`,
+                "Fix the cause and run deploy again; the backend is uploaded again."
+              );
+            if (now() >= deadline)
+              throw new GatewayDeployError(
+                "GATEWAY_BACKEND_TIMEOUT",
+                `Your backend was not ready within ${Math.round(backendTimeoutMs / 6e4)} minutes (state: ${state.status}).`,
+                "Run deploy again to keep waiting."
+              );
+            await sleep5(intervalMs);
+          }
+        }
+        return {
+          deploymentId: started.deploymentId,
+          ...started.artifactContentSha256 ? { artifactSha256: started.artifactContentSha256 } : {}
+        };
+      } finally {
+        if (zipPath) await cleanupZip(zipPath);
+        await prepared.cleanup?.();
+      }
+    }
+  };
   const specStep = {
     name: "spec",
     hash: () => specHash,
@@ -27502,12 +27754,30 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
       };
     }
   };
-  const outcomes = await runPipeline(
-    resolved.state,
-    "gateway",
-    [specStep, configStep, reconcileStep],
-    { force: options.force }
-  );
+  let outcomes;
+  if (backend) {
+    const head = await runPipeline(
+      resolved.state,
+      "gateway",
+      [specStep, configStep],
+      { force: options.force }
+    );
+    const middle = await runPipeline(resolved.state, "gateway", [backendStep], {
+      force: options.force
+    });
+    const changed = [...head, ...middle].some((outcome) => !outcome.skipped);
+    const tail = await runPipeline(resolved.state, "gateway", [reconcileStep], {
+      force: options.force || changed
+    });
+    outcomes = [...head, ...middle, ...tail];
+  } else {
+    outcomes = await runPipeline(
+      resolved.state,
+      "gateway",
+      [specStep, configStep, reconcileStep],
+      { force: options.force }
+    );
+  }
   const reconcile = outcomes.find((outcome) => outcome.step === "reconcile");
   const ran = reconcile !== void 0 && !reconcile.skipped;
   const known = (await readManifest(resolved.state))?.services.gateway;
@@ -27904,15 +28174,41 @@ var PlansDeployError = class extends ApitogoError {
     this.name = "PlansDeployError";
   }
 };
-var PLANS_STEPS = ["catalog", "backend", "identity-link"];
+var PLANS_STEPS = [
+  "catalog",
+  "backend",
+  "billing",
+  "identity-link"
+];
 var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var BACKEND_MODULE = "dev-portal";
 var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
+var STRIPE_WEBHOOK_EVENTS2 = [
+  "checkout.session.completed",
+  "customer.subscription.updated",
+  "customer.subscription.deleted",
+  "invoice.payment_failed"
+];
+function billingNotes(billing) {
+  const notes = [
+    billing.mode === "live" ? "Stripe: LIVE mode. Customers pay with real money." : "Stripe: test mode. Use Stripe's test cards; no real money moves."
+  ];
+  notes.push(
+    billing.hasWebhookSecret ? `Stripe webhook endpoint (add it in your Stripe account if it is not there yet): ${billing.webhookUrl}` : `A payment does not activate a plan until Stripe can confirm it. In your Stripe account add the webhook endpoint ${billing.webhookUrl} (events: ${STRIPE_WEBHOOK_EVENTS2.join(", ")}), store its signing secret with "apitogo secrets set STRIPE_WEBHOOK", set plans.billing.webhookSecret to "secret:STRIPE_WEBHOOK", and deploy again.`
+  );
+  return notes;
+}
 async function plansInputs(resolved, projectId) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
-  const wanted = toPlatformPlans(await readPlansFile(plans.file));
+  const billing = plans.billing;
+  const wanted = toPlatformPlans(await readPlansFile(plans.file), {
+    billing: billing.provider === "stripe"
+  });
   const manifest = await readManifest(resolved.state);
+  const ledger = await readLedger(resolved.state);
+  const billingOn = billing.provider === "stripe";
+  const billingStep = billingOn || stepOf(ledger, "plans", "billing") !== void 0;
   const identity = manifest?.services.identity;
   const ownIdentity = Boolean(
     identity?.provider === "apitogo" && identity.issuer
@@ -27923,6 +28219,16 @@ async function plansInputs(resolved, projectId) {
     ownIdentity,
     catalogHash: stableJson({ projectId, plans: wanted }),
     backendHash: stableJson({ projectId }),
+    billingStep,
+    // Only the references to the project's secrets: a rotated value is applied with --force.
+    billingHash: stableJson({
+      projectId,
+      provider: billing.provider,
+      apiKey: billingOn ? billing.apiKey : void 0,
+      webhookSecret: billingOn ? billing.webhookSecret : void 0,
+      successUrl: billingOn ? billing.successUrl : void 0,
+      cancelUrl: billingOn ? billing.cancelUrl : void 0
+    }),
     linkHash: stableJson({
       projectId,
       issuer: identity?.issuer,
@@ -27959,6 +28265,17 @@ function refused(error) {
   }
   throw error;
 }
+function billingRefused(error) {
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new PlansDeployError(
+      "PLANS_BILLING_REJECTED",
+      `The platform refused the billing settings: ${lines.join(" ") || error.message}`,
+      "Check plans.billing in the config and the project's secrets (apitogo secrets list). The Stripe key starts with sk_ or rk_, the webhook secret with whsec_."
+    );
+  }
+  throw error;
+}
 async function deployPlans(resolved, projectId, deps, options = {}) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
@@ -27968,7 +28285,16 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
   const intervalMs = deps.pollIntervalMs ?? 2e3;
   const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
   const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
-  const { wanted, manifest, ownIdentity, catalogHash, backendHash, linkHash } = await plansInputs(resolved, projectId);
+  const {
+    wanted,
+    manifest,
+    ownIdentity,
+    billingStep,
+    billingHash,
+    catalogHash,
+    backendHash,
+    linkHash
+  } = await plansInputs(resolved, projectId);
   const catalogStep = {
     name: "catalog",
     hash: () => catalogHash,
@@ -28055,35 +28381,73 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
     },
     stillValid: async () => Boolean(await backendOf())
   };
+  const waitForBackendUpdate = async (jobId, what) => {
+    const deadline = now() + linkTimeoutMs;
+    for (; ; ) {
+      const job = (await client.listProvisioningJobs(projectId)).jobs.find(
+        (item) => item.id === jobId
+      );
+      const status2 = job?.status.toLowerCase();
+      if (status2?.startsWith("completed")) return { jobId };
+      if (status2 === "failed")
+        throw new PlansDeployError(
+          `${what.code}_FAILED`,
+          `Applying ${what.text} to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
+          "Run deploy again; it is applied again."
+        );
+      if (now() >= deadline)
+        throw new PlansDeployError(
+          `${what.code}_TIMEOUT`,
+          `Applying ${what.text} did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
+          "Run deploy again to keep waiting."
+        );
+      await sleep5(intervalMs);
+    }
+  };
+  let billingNote;
+  const billingStepDef = {
+    name: "billing",
+    hash: () => billingHash,
+    run: async () => {
+      const body = plans.billing.provider === "stripe" ? {
+        provider: "stripe",
+        apiKey: plans.billing.apiKey,
+        webhookSecret: plans.billing.webhookSecret,
+        successUrl: plans.billing.successUrl,
+        cancelUrl: plans.billing.cancelUrl
+      } : { provider: "none" };
+      let queued;
+      try {
+        queued = await client.putDevPortalBilling(projectId, body);
+      } catch (error) {
+        billingRefused(error);
+      }
+      const done = await waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_BILLING",
+        text: "the billing settings"
+      });
+      if (plans.billing.provider === "stripe")
+        billingNote = billingNotes(queued);
+      return { ...done, mode: queued.mode };
+    }
+  };
   const linkStep = {
     name: "identity-link",
     hash: () => linkHash,
     run: async () => {
       const queued = await client.linkDevPortalIdentity(projectId);
-      const deadline = now() + linkTimeoutMs;
-      for (; ; ) {
-        const job = (await client.listProvisioningJobs(projectId)).jobs.find(
-          (item) => item.id === queued.jobId
-        );
-        const status2 = job?.status.toLowerCase();
-        if (status2?.startsWith("completed")) return { jobId: queued.jobId };
-        if (status2 === "failed")
-          throw new PlansDeployError(
-            "PLANS_LINK_FAILED",
-            `Applying the identity to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
-            "Run deploy again; the link is applied again."
-          );
-        if (now() >= deadline)
-          throw new PlansDeployError(
-            "PLANS_LINK_TIMEOUT",
-            `Applying the identity did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
-            "Run deploy again to keep waiting."
-          );
-        await sleep5(intervalMs);
-      }
+      return waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_LINK",
+        text: "the identity"
+      });
     }
   };
-  const steps = [catalogStep, backendStep, ...ownIdentity ? [linkStep] : []];
+  const steps = [
+    catalogStep,
+    backendStep,
+    ...billingStep ? [billingStepDef] : [],
+    ...ownIdentity ? [linkStep] : []
+  ];
   const outcomes = await runPipeline(
     resolved.state,
     "plans",
@@ -28108,7 +28472,7 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
           apiBaseUrl,
           billing: plans.billing.provider,
           catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
-          capabilities: PLANS_CAPABILITIES
+          capabilities: plans.billing.provider === "stripe" ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
         })
       );
     }
@@ -28119,7 +28483,8 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
       step: outcome.step,
       skipped: outcome.skipped
     })),
-    apiBaseUrl
+    apiBaseUrl,
+    ...billingNote ? { notes: billingNote } : {}
   };
 }
 
@@ -28238,14 +28603,18 @@ async function planPlansService(resolved, ledger) {
   const hashes = {
     catalog: projectId ? inputs.catalogHash : void 0,
     backend: projectId ? inputs.backendHash : void 0,
+    billing: projectId ? inputs.billingHash : void 0,
     "identity-link": projectId ? inputs.linkHash : void 0
   };
   const steps = PLANS_STEPS.filter(
-    (name) => name !== "identity-link" || inputs.ownIdentity
+    (name) => (name !== "identity-link" || inputs.ownIdentity) && (name !== "billing" || inputs.billingStep)
   );
   const details = [
     ...inputs.wanted.length === 0 ? ["plans: none in the file"] : inputs.wanted.map((plan2) => `plan ${plan2.sku}: ${plan2.displayName}`),
     inputs.ownIdentity ? "sign-in: the project's identity will be applied to the plans backend" : "sign-in: no identity of the platform deployed, so nothing is applied to the plans backend",
+    ...inputs.billingStep ? [
+      resolved.plans?.billing.provider === "stripe" ? "billing: the Stripe key and webhook secret of the project's secrets will be applied to the plans backend" : "billing: switched off, so the stored Stripe settings will be removed from the plans backend"
+    ] : [],
     ...steps.map(
       (name) => `step ${name}: ${stepState(stepOf(ledger, "plans", name), hashes[name])}`
     )
@@ -28486,7 +28855,7 @@ function describePolicies(gateway) {
 function dryRunLines(dryRun) {
   const changes = dryRun.changes;
   if (!changes) return [];
-  const list2 = (label, items) => items.length > 0 ? [`  ${label}: ${items.join(", ")}`] : [];
+  const list2 = (label2, items) => items.length > 0 ? [`  ${label2}: ${items.join(", ")}`] : [];
   if (changes.wouldCreate)
     return [
       "platform dry run: the gateway does not exist yet; everything would be created",
@@ -28523,7 +28892,7 @@ async function planGatewayService(resolved, ledger, dryRun) {
       details: []
     };
   const details = [
-    `origin: proxy ${gateway.origin.url ?? "(no url set)"}`,
+    gateway.origin.mode === "managed" ? `origin: managed (${gateway.origin.runtime ?? "no runtime"} from ${gateway.origin.source ?? "no source folder"})` : `origin: proxy ${gateway.origin.url ?? "(no url set)"}`,
     ...gateway.auth ? [`auth: ${gateway.auth.mode}`] : ["auth: none"],
     ...describePolicies(gateway)
   ];
@@ -28576,8 +28945,27 @@ async function planGatewayService(resolved, ledger, dryRun) {
       );
     }
   }
+  let backendHash;
+  try {
+    backendHash = (await backendDeployInputs(gateway, resolved.project.id ?? ""))?.hash;
+  } catch (error) {
+    return {
+      ...base,
+      action: "blocked",
+      reason: "cannot deploy until this is fixed",
+      details,
+      issues: [
+        {
+          code: "GATEWAY_BACKEND_UNREADABLE",
+          path: "gateway.origin.source",
+          message: error instanceof Error ? error.message : String(error)
+        }
+      ]
+    };
+  }
   const step2 = (name) => stepOf(ledger, "gateway", name);
   const hashes = {
+    backend: backendHash ?? "",
     spec: inputs.specHash,
     config: inputs.configHash,
     reconcile: inputs.configHash
@@ -28593,9 +28981,10 @@ async function planGatewayService(resolved, ledger, dryRun) {
   const lines = [
     `step spec (upload the OpenAPI file): ${state("spec")}`,
     `step config (send the wanted state): ${state("config")}`,
+    ...backendHash ? [`step backend (upload and start your code): ${state("backend")}`] : [],
     `step reconcile (wait until the platform applied it): ${state("reconcile")}`
   ];
-  const allDone = step2("spec")?.status === "succeeded" && step2("spec")?.hash === hashes.spec && step2("config")?.status === "succeeded" && step2("config")?.hash === hashes.config && step2("reconcile")?.status === "succeeded" && step2("reconcile")?.hash === hashes.reconcile;
+  const allDone = (!backendHash || step2("backend")?.status === "succeeded" && step2("backend")?.hash === hashes.backend) && step2("spec")?.status === "succeeded" && step2("spec")?.hash === hashes.spec && step2("config")?.status === "succeeded" && step2("config")?.hash === hashes.config && step2("reconcile")?.status === "succeeded" && step2("reconcile")?.hash === hashes.reconcile;
   if (issues.length > 0)
     return {
       ...base,
@@ -28676,7 +29065,7 @@ function corsLines(platform) {
   ];
 }
 async function gatewayStatus(resolved, ledger, manifest, remote) {
-  const steps = ["spec", "config", "reconcile"].map((name) => ({
+  const steps = ["spec", "config", "backend", "reconcile"].map((name) => ({
     name,
     record: stepOf(ledger, "gateway", name)
   }));
@@ -28694,6 +29083,14 @@ async function gatewayStatus(resolved, ledger, manifest, remote) {
   if (remote && projectId) {
     try {
       const platform = await remote(projectId);
+      if (platform.status === "Released") {
+        details.length = 0;
+        details.push(
+          "platform state: Released (the gateway was removed; deploy makes a new one)"
+        );
+        state = "not-deployed";
+        return { service: "gateway", state, details: [...details, ...local] };
+      }
       details.push(
         `platform state: ${platform.status}`,
         platform.inSync ? "drift: none (the real gateway matches the config)" : `drift: the real gateway does not match the config yet (wanted ${platform.desiredHash?.slice(0, 12) ?? "none"}, real ${platform.observedHash?.slice(0, 12) ?? "none"})`,
@@ -28831,7 +29228,7 @@ function formatStatus(output4) {
 }
 
 // src/cli/deploy/static-web-config.ts
-import { access as access14, writeFile as writeFile25 } from "node:fs/promises";
+import { access as access14, writeFile as writeFile26 } from "node:fs/promises";
 import path84 from "node:path";
 var STATIC_WEB_CONFIG_FILE = "staticwebapp.config.json";
 var STATIC_WEB_CONFIG_VERSION = 1;
@@ -28850,7 +29247,7 @@ async function ensureStaticWebConfig(buildDir) {
     await access14(file);
     return false;
   } catch {
-    await writeFile25(
+    await writeFile26(
       file,
       `${JSON.stringify(DEFAULT_STATIC_WEB_CONFIG, null, 2)}
 `,
@@ -28999,7 +29396,7 @@ async function deployGatewayService(options, deps, projectId, named) {
     return { service: "gateway", status: "skipped", reason: why, steps: [] };
   }
   const client = deps.client;
-  if (!client.putGatewaySpec || !client.putGatewayConfig || !client.getGatewayReconciliation || !client.getGatewayStatus || !client.getGatewayCapabilities)
+  if (!client.putGatewaySpec || !client.putGatewayConfig || !client.getGatewayReconciliation || !client.getGatewayStatus || !client.getGatewayCapabilities || gateway?.origin.mode === "managed" && (!client.deployBackend || !client.getDeploymentStatus))
     throw new Error("The platform client has no gateway calls.");
   const result = await deployGateway(
     resolved,
@@ -29074,7 +29471,8 @@ async function deployPlansService(options, deps, projectId, named) {
     service: "plans",
     status: result.status,
     steps: result.steps,
-    url: result.apiBaseUrl
+    url: result.apiBaseUrl,
+    ...result.notes ? { notes: result.notes } : {}
   };
 }
 async function deployPortal(options, deps, projectId) {
@@ -29208,10 +29606,10 @@ var deploy_default = {
     describe: "Override project GUID"
   }).option("project-name", {
     type: "string",
-    describe: "Display name when creating a project"
+    describe: "Version 1: display name when creating a project. Version 2 ignores it: the project is made by `apitogo project create` and named by project.name"
   }).option("platform-plan", {
     type: "string",
-    describe: "Platform hosting tier",
+    describe: "Version 1: platform hosting tier. Version 2 ignores it: a project made by `apitogo project create` is on the Free plan",
     choices: ["free", "starter", "professional"]
   }).option("only", {
     type: "string",
@@ -29246,7 +29644,7 @@ var deploy_default = {
 };
 
 // src/cli/export/handler.ts
-import { mkdir as mkdir20, writeFile as writeFile26 } from "node:fs/promises";
+import { mkdir as mkdir20, writeFile as writeFile27 } from "node:fs/promises";
 import path87 from "node:path";
 init_invariant();
 var ExportError = class extends ApitogoError {
@@ -29288,7 +29686,7 @@ async function exportOpenApi(args, deps) {
   if (!args.out) return { text };
   const file = path87.resolve(process.cwd(), args.out);
   await mkdir20(path87.dirname(file), { recursive: true });
-  await writeFile26(file, text);
+  await writeFile27(file, text);
   return { text, file };
 }
 async function exportCommand(args) {
@@ -29341,13 +29739,13 @@ var export_default = {
 import path91 from "node:path";
 
 // src/cli/scaffold/run-scaffold-discovery.ts
-import { access as access16, readFile as readFile31, writeFile as writeFile28 } from "node:fs/promises";
+import { access as access16, readFile as readFile31, writeFile as writeFile29 } from "node:fs/promises";
 import path90 from "node:path";
 
 // src/cli/scaffold/detect-backend.ts
 import { readdir as readdir4, readFile as readFile29 } from "node:fs/promises";
 import path88 from "node:path";
-var DEFAULT_RUNTIME_VERSION = {
+var DEFAULT_RUNTIME_VERSION2 = {
   dotnet: "DOTNET_10",
   nodejs: "NODE_22_LTS",
   python: "PYTHON_312"
@@ -29374,18 +29772,18 @@ function dotnetVersionFromCsproj(content) {
   if (major === "8" || major === "9" || major === "10") {
     return `DOTNET_${major}`;
   }
-  return DEFAULT_RUNTIME_VERSION.dotnet;
+  return DEFAULT_RUNTIME_VERSION2.dotnet;
 }
 function nodeVersionFromEngines(engines) {
   const range = engines && typeof engines === "object" && !Array.isArray(engines) ? engines.node : void 0;
   if (typeof range === "string" && /(^|[^\d])24/.test(range)) {
     return "NODE_24_LTS";
   }
-  return DEFAULT_RUNTIME_VERSION.nodejs;
+  return DEFAULT_RUNTIME_VERSION2.nodejs;
 }
 function pythonVersionFromText(content) {
   const match = content?.match(/3\.(1[0-4])/);
-  return match ? `PYTHON_3${match[1]}` : DEFAULT_RUNTIME_VERSION.python;
+  return match ? `PYTHON_3${match[1]}` : DEFAULT_RUNTIME_VERSION2.python;
 }
 function isRunnableNodePackage(pkg) {
   const scripts = pkg.scripts && typeof pkg.scripts === "object" ? pkg.scripts : {};
@@ -29452,7 +29850,7 @@ import {
   readFile as readFile30,
   readlink,
   symlink as symlink2,
-  writeFile as writeFile27
+  writeFile as writeFile28
 } from "node:fs/promises";
 import path89 from "node:path";
 var DOCS_DIR_WHITELIST = [
@@ -29689,7 +30087,7 @@ async function applyDocsNavigation(siteDirectory, routes) {
     force: false
   });
   const updated = ensureHeaderDocsNavigation(parsed, routes);
-  await writeFile27(configPath, `${JSON.stringify(updated, null, 2)}
+  await writeFile28(configPath, `${JSON.stringify(updated, null, 2)}
 `, "utf8");
 }
 async function discoverAndWireDocs(siteDirectory) {
@@ -29873,7 +30271,7 @@ async function wireOpenApiIntoJsonConfig(siteDirectory, openApiPath) {
   });
   const backend = updated.backend && typeof updated.backend === "object" && !Array.isArray(updated.backend) ? { ...updated.backend } : {};
   updated.backend = { ...backend, openApiPath: input5 };
-  await writeFile28(
+  await writeFile29(
     jsonConfigPath,
     `${JSON.stringify(updated, null, 2)}
 `,
@@ -29993,7 +30391,7 @@ async function discoverAndWireBackend(siteDirectory, mode) {
       runtime: detected.runtime,
       runtimeVersion: detected.runtimeVersion
     };
-    await writeFile28(
+    await writeFile29(
       jsonConfigPath,
       `${JSON.stringify(siteConfig, null, 2)}
 `,
@@ -30546,6 +30944,7 @@ var plan_default = {
 // src/cli/project/create-handler.ts
 init_invariant();
 import path93 from "node:path";
+import open3 from "open";
 
 // src/cli/project/v2.ts
 init_invariant();
@@ -30557,7 +30956,12 @@ var ProjectCreateError = class extends ApitogoError {
   }
 };
 function modulesForConfig(config2) {
-  return config2.portal && config2.portal.enabled !== false ? ["dev-portal"] : [];
+  const modules = [];
+  if (config2.portal && config2.portal.enabled !== false)
+    modules.push("dev-portal");
+  if (config2.gateway && config2.gateway.enabled !== false && config2.gateway.origin?.mode === "managed")
+    modules.push("apihub");
+  return modules;
 }
 var hostsAnything = (config2) => config2.portal && config2.portal.enabled !== false || config2.gateway && config2.gateway.enabled !== false;
 async function createProjectV2(options, deps) {
@@ -30572,15 +30976,52 @@ async function createProjectV2(options, deps) {
     );
   }
   const name = options.name?.trim() || resolved.project.name;
+  const plan2 = options.plan ?? "free";
+  const onProjectResolved = async (projectId) => {
+    await setProjectId(options.dir, projectId);
+  };
+  let continueWith = linkedProjectId;
+  if (plan2 !== "free") {
+    const first = parse4(
+      await deps.bootstrap({
+        name,
+        description: options.description,
+        modules,
+        wait: false,
+        projectId: linkedProjectId,
+        onProjectResolved,
+        paidPlan: true
+      })
+    );
+    assertCreated(first);
+    const paid = await settlePaidPlan(
+      first.projectId,
+      plan2,
+      options,
+      deps
+    );
+    if (paid.status === "awaiting_checkout") {
+      await setProjectId(options.dir, first.projectId);
+      return {
+        projectId: first.projectId,
+        projectName: name,
+        modules,
+        resumed: first.resumed === true,
+        plan: plan2,
+        status: "awaiting_checkout",
+        checkoutUrl: paid.url
+      };
+    }
+    continueWith = first.projectId;
+  }
   const raw = await deps.bootstrap({
     name,
     description: options.description,
     modules,
     wait: options.wait !== false,
-    projectId: linkedProjectId,
-    onProjectResolved: async (projectId) => {
-      await setProjectId(options.dir, projectId);
-    }
+    projectId: continueWith,
+    onProjectResolved,
+    ...plan2 !== "free" ? { paidPlan: true } : {}
   });
   const outcome = parse4(raw);
   if (outcome.requiresPlatformPlanSelection) {
@@ -30590,13 +31031,7 @@ async function createProjectV2(options, deps) {
       "Pick another name with --name, or choose a plan for that project in the web app."
     );
   }
-  if (outcome.status === "failed" || outcome.status === "blocked" || !outcome.projectId) {
-    throw new ProjectCreateError(
-      "CREATE_FAILED",
-      `The platform could not create the project: ${outcome.message ?? outcome.status ?? "no answer"}.`,
-      "Nothing was written to this folder. Try again, or check `apitogo status`."
-    );
-  }
+  assertCreated(outcome);
   if (outcome.status === "running" || outcome.status === "pending") {
     await setProjectId(options.dir, outcome.projectId);
     throw new ProjectCreateError(
@@ -30610,9 +31045,82 @@ async function createProjectV2(options, deps) {
     projectId: outcome.projectId,
     projectName: name,
     modules,
-    resumed: outcome.resumed === true
+    resumed: outcome.resumed === true,
+    ...plan2 !== "free" ? { plan: plan2 } : {}
   };
 }
+function assertCreated(outcome) {
+  if (outcome.status === "failed" || outcome.status === "blocked" || !outcome.projectId) {
+    throw new ProjectCreateError(
+      "CREATE_FAILED",
+      `The platform could not create the project: ${outcome.message ?? outcome.status ?? "no answer"}.`,
+      "Nothing was written to this folder. Try again, or check `apitogo status`."
+    );
+  }
+}
+var defaultSleep4 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var label = (plan2) => plan2.charAt(0).toUpperCase() + plan2.slice(1);
+async function settlePaidPlan(projectId, plan2, options, deps) {
+  const api = deps.platform;
+  if (!api) throw new Error("The platform client has no plan calls.");
+  const sleep5 = api.sleep ?? defaultSleep4;
+  const now = api.now ?? Date.now;
+  const subscription = await api.getSubscription(projectId);
+  const tier = subscription.planTier.toLowerCase();
+  const onThisPlan = tier === plan2;
+  if (onThisPlan && isPaidPlanActive(subscription)) return { status: "paid" };
+  if (!isPlatformPlanUnselected(subscription.planTier) && !onThisPlan) {
+    throw new ProjectCreateError(
+      "PLAN_CHANGE_UNSUPPORTED",
+      `This project is already on the ${label(tier)} plan, so it cannot be created on ${label(plan2)}.`,
+      "Moving a project to another plan is not supported yet. Create a new project with --plan in a new folder, or change the plan in the web app."
+    );
+  }
+  if (!onThisPlan) {
+    let session;
+    try {
+      session = await api.createCheckoutSession(projectId, {
+        planSlug: plan2,
+        ...options.skipPayment ? { skipPayment: true } : {}
+      });
+    } catch (error) {
+      if (options.skipPayment && error instanceof PlatformApiError && error.status === 403)
+        throw new ProjectCreateError(
+          "SKIP_PAYMENT_REFUSED",
+          "Only a platform admin may skip the payment.",
+          "Run it without --skip-payment to pay through the platform's checkout."
+        );
+      throw error;
+    }
+    if (session.granted) return { status: "paid" };
+    if (!session.url)
+      throw new ProjectCreateError(
+        "CREATE_FAILED",
+        "The platform gave no checkout link.",
+        "Run the command again, or choose the plan in the web app."
+      );
+    api.say?.(`Pay for the ${label(plan2)} plan here: ${session.url}`);
+    if (options.waitForPayment === false)
+      return { status: "awaiting_checkout", url: session.url };
+    if (options.open !== false)
+      await api.openUrl?.(session.url).catch(() => {
+      });
+  }
+  const timeoutMs = options.paymentTimeoutMs ?? 9e5;
+  const deadline = now() + timeoutMs;
+  for (; ; ) {
+    const current = await api.getSubscription(projectId);
+    if (current.planTier.toLowerCase() === plan2 && isPaidPlanActive(current))
+      return { status: "paid" };
+    if (now() >= deadline)
+      throw new ProjectCreateError(
+        "CHECKOUT_PENDING",
+        `The payment for the ${label(plan2)} plan is not confirmed yet.`,
+        `Finish paying with the link above, then run \`apitogo project create --plan ${plan2}\` again; it continues the same project (project.id ${projectId}).`
+      );
+    await sleep5(api.pollIntervalMs ?? 3e3);
+  }
+}
 function parse4(raw) {
   try {
     return JSON.parse(raw);
@@ -30641,9 +31149,22 @@ async function createLinkedProject(argv, dir) {
         dir,
         name: argv.name,
         description: argv.description,
-        wait: argv.wait !== false
+        wait: argv.wait !== false,
+        plan: argv.plan ?? "free",
+        skipPayment: argv.skipPayment === true,
+        open: argv.open !== false,
+        // In JSON mode the link is returned and a later run continues; otherwise the command waits for the payment.
+        waitForPayment: !json
       },
       {
+        platform: {
+          getSubscription: (projectId) => client.getSubscription(projectId),
+          createCheckoutSession: (projectId, body) => client.createCheckoutSession(projectId, body),
+          openUrl: async (url2) => {
+            await open3(url2);
+          },
+          ...json ? {} : { say: (message) => printDiagnosticsToConsole(message) }
+        },
         bootstrap: (args) => handleBootstrapProject(
           client,
           config2,
@@ -30651,7 +31172,7 @@ async function createLinkedProject(argv, dir) {
             name: args.name,
             description: args.description,
             modules: args.modules,
-            selectFreePlan: true,
+            selectFreePlan: args.paidPlan !== true,
             wait: args.wait,
             configureGatewayBaseline: false,
             projectId: args.projectId,
@@ -30666,8 +31187,14 @@ async function createLinkedProject(argv, dir) {
       console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));
       return;
     }
+    if (result.status === "awaiting_checkout") {
+      printResultToConsole(
+        `Project ${result.projectName} (${result.projectId}) is created and linked. Pay for the ${result.plan} plan at ${result.checkoutUrl}, then run \`apitogo project create --plan ${result.plan}\` again to continue.`
+      );
+      return;
+    }
     printDiagnosticsToConsole(
-      `Project ${result.projectName} (${result.projectId}) is ready on the free plan${result.modules.length > 0 ? ` with: ${result.modules.join(", ")}` : " (the gateway is created by `apitogo deploy`)"}.`
+      `Project ${result.projectName} (${result.projectId}) is ready on the ${result.plan ?? "free"} plan${result.modules.length > 0 ? ` with: ${result.modules.join(", ")}` : " (the gateway is created by `apitogo deploy`)"}.`
     );
     printResultToConsole(
       "The folder is linked. Run `apitogo deploy` to publish."
@@ -30697,6 +31224,12 @@ async function createProject(argv) {
     await createLinkedProject(argv, dir);
     return;
   }
+  if (argv.plan && argv.plan !== "free") {
+    await printCriticalFailureToConsoleAndExit(
+      "--plan is for config version 2 folders. For a version 1 project use `apitogo deploy --platform-plan`."
+    );
+    return;
+  }
   const name = argv.name?.trim();
   if (!name) {
     await printCriticalFailureToConsoleAndExit(
@@ -30763,11 +31296,24 @@ var project_create_default = {
     describe: "Optional project description"
   }).option("modules", {
     type: "string",
-    describe: "Comma-separated modules to activate (default: apihub)",
+    describe: "Version 1 only: comma-separated modules to activate (default: apihub). Version 2 takes them from the config (the portal needs dev-portal) and ignores this option",
     default: "apihub"
+  }).option("plan", {
+    type: "string",
+    choices: ["free", "starter", "professional"],
+    describe: "Version 2: the platform plan of the new project (default: free). Starter and Professional are paid through the platform's own checkout, and a project needs one of them to sell paid plans"
+  }).option("open", {
+    type: "boolean",
+    describe: "Open the checkout page in the browser for a paid plan (use --no-open to only print the link)",
+    default: true
+  }).option("skip-payment", {
+    type: "boolean",
+    describe: "Platform admins only: give the paid plan without payment. The platform refuses it for anyone else",
+    default: false,
+    hidden: true
   }).option("wait", {
     type: "boolean",
-    describe: "Wait for warm pool when a platform plan is already selected",
+    describe: "Wait until the hosting from the warm pool is ready before returning, once a platform plan is selected (always so in version 2). Use --no-wait to return sooner",
     default: true
   }).option("json", {
     type: "boolean",
@@ -31272,7 +31818,7 @@ async function readStdin(input5 = process.stdin) {
   }
   return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
 }
-async function confirm2(question) {
+async function confirm(question) {
   const rl = createInterface6({ input: process.stdin, output: process.stdout });
   try {
     const answer = (await rl.question(question)).trim().toLowerCase();
@@ -31388,7 +31934,7 @@ async function secrets(argv) {
       isTerminal: process.stdin.isTTY === true && !json,
       askValue: (prompt) => readHidden(prompt),
       readPiped: () => readStdin(),
-      confirm: confirm2
+      confirm
     });
     if (json) {
       console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));