@lukoweb/apitogo 0.2.47 → 0.2.49

package/dist/cli/cli.js

@@ -837,7 +837,7 @@ import { stat as stat4 } from "node:fs/promises";
 var fileExists;
 var init_file_exists = __esm({
   "src/config/file-exists.ts"() {
-    fileExists = (path95) => stat4(path95).then(() => true).catch(() => false);
+    fileExists = (path96) => stat4(path96).then(() => true).catch(() => false);
   }
 });
 
@@ -5836,6 +5836,36 @@ import yargs from "yargs/yargs";
 // src/cli/services/handler.ts
 import path52 from "node:path";
 
+// src/config/v2/billing.ts
+import { readFile as readFile2 } from "node:fs/promises";
+var DEFAULT_STRIPE_KEY_SECRET = "STRIPE_API_KEY";
+function isPaidPlan(plan2) {
+  return plan2.pricingModel !== "custom" && typeof plan2.priceAmount === "number" && plan2.priceAmount > 0;
+}
+async function paidPlanSkus(resolved) {
+  const file = resolved.plans?.file;
+  if (!file) return [];
+  try {
+    const raw = JSON.parse(await readFile2(file, "utf8"));
+    if (!Array.isArray(raw.plans)) return [];
+    return raw.plans.filter(
+      (plan2) => typeof plan2 === "object" && plan2 !== null && isPaidPlan(plan2)
+    ).map((plan2) => String(plan2.sku ?? "?"));
+  } catch {
+    return [];
+  }
+}
+async function billingNeeded(resolved) {
+  const plans = resolved.plans;
+  if (!plans?.enabled || plans.billing.provider !== "stripe") return false;
+  return (await paidPlanSkus(resolved)).length > 0;
+}
+function stripeKeySecretName(resolved) {
+  const ref = resolved.plans?.billing.apiKey;
+  const match = ref ? /^secret:(.+)$/.exec(ref) : null;
+  return match?.[1] ?? DEFAULT_STRIPE_KEY_SECRET;
+}
+
 // src/config/v2/errors.ts
 init_invariant();
 function formatConfigIssue(issue4) {
@@ -6043,8 +6073,8 @@ var ConfigV2Schema = z.strictObject({
 var REMOVED_KEYS = {
   "plans.provider": "plans.provider was removed. Only plans.billing.provider (stripe or none) is selectable."
 };
-function pathToString(path95) {
-  return path95.reduce(
+function pathToString(path96) {
+  return path96.reduce(
     (acc, segment) => typeof segment === "number" ? `${acc}[${segment}]` : acc === "" ? String(segment) : `${acc}.${String(segment)}`,
     ""
   );
@@ -6064,9 +6094,9 @@ function step(schema2, segment) {
   }
   return void 0;
 }
-function knownKeysAt(path95) {
+function knownKeysAt(path96) {
   let current = ConfigV2Schema;
-  for (const segment of path95) {
+  for (const segment of path96) {
     if (!current) return [];
     current = step(current, segment);
   }
@@ -6102,7 +6132,7 @@ function unknownKeyHint(fullPath, key, known) {
   return known.length > 0 ? `Allowed keys: ${known.join(", ")}.` : void 0;
 }
 function mapIssue(issue4) {
-  const path95 = pathToString(issue4.path);
+  const path96 = pathToString(issue4.path);
   switch (issue4.code) {
     case "unrecognized_keys":
       return issue4.keys.map((key) => {
@@ -6118,20 +6148,20 @@ function mapIssue(issue4) {
       return [
         {
           code: "CONFIG_INVALID_VALUE",
-          path: path95,
+          path: path96,
           message: `must be one of: ${issue4.values.map((v) => JSON.stringify(v)).join(", ")}.`
         }
       ];
     case "custom": {
       const code = typeof issue4.params?.code === "string" ? issue4.params.code : "CONFIG_INVALID_VALUE";
-      return [{ code, path: path95, message: issue4.message ?? "is invalid." }];
+      return [{ code, path: path96, message: issue4.message ?? "is invalid." }];
     }
     case "invalid_type":
       return [
-        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path95, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path95, message: issue4.message }
+        /received undefined/.test(issue4.message) ? { code: "CONFIG_MISSING_FIELD", path: path96, message: "is required." } : { code: "CONFIG_INVALID_VALUE", path: path96, message: issue4.message }
       ];
     default:
-      return [{ code: "CONFIG_INVALID_VALUE", path: path95, message: issue4.message }];
+      return [{ code: "CONFIG_INVALID_VALUE", path: path96, message: issue4.message }];
   }
 }
 function isRecord(value) {
@@ -6495,7 +6525,8 @@ function resolveConfigV2(config2, configPath) {
       file: plans.file ? path7.resolve(configDir, plans.file) : path7.join(root, "plans.json"),
       billing: {
         provider: plans.billing?.provider ?? "stripe",
-        apiKey: plans.billing?.apiKey,
+        // Stripe is the only provider. Its key lives in the STRIPE_API_KEY secret unless the config names another.
+        apiKey: plans.billing?.apiKey ?? ((plans.billing?.provider ?? "stripe") === "stripe" ? "secret:STRIPE_API_KEY" : void 0),
         webhookSecret: plans.billing?.webhookSecret,
         successUrl: plans.billing?.successUrl,
         cancelUrl: plans.billing?.cancelUrl
@@ -6575,7 +6606,7 @@ function loadConfigV2(pathOrDir) {
 }
 
 // src/config/v2/rules.ts
-import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "node:fs/promises";
+import { readdir as readdir2, readFile as readFile3, stat as stat2 } from "node:fs/promises";
 import path9 from "node:path";
 import { glob } from "glob";
 import { parse as parseYaml } from "yaml";
@@ -6727,7 +6758,7 @@ async function portalRules(config2, resolved, out) {
   }
   if (await isFile(portal.theme)) {
     try {
-      JSON.parse(await readFile2(portal.theme, "utf8"));
+      JSON.parse(await readFile3(portal.theme, "utf8"));
     } catch (error) {
       out.error({
         code: "PORTAL_THEME_INVALID",
@@ -6924,7 +6955,7 @@ async function specRule(spec, index, resolved, out) {
   }
   let document;
   try {
-    const text = await readFile2(spec, "utf8");
+    const text = await readFile3(spec, "utf8");
     document = spec.toLowerCase().endsWith(".json") ? JSON.parse(text) : parseYaml(text);
   } catch (error) {
     out.error({
@@ -7066,7 +7097,7 @@ function identityRules(config2, resolved, out) {
     }
   }
 }
-async function plansRules(config2, resolved, out) {
+async function plansRules(resolved, out, paid) {
   const plans = resolved.plans;
   if (!plans?.enabled) return;
   if (!await isFile(plans.file)) {
@@ -7078,7 +7109,7 @@ async function plansRules(config2, resolved, out) {
     });
   } else {
     try {
-      JSON.parse(await readFile2(plans.file, "utf8"));
+      JSON.parse(await readFile3(plans.file, "utf8"));
     } catch (error) {
       out.error({
         code: "PLANS_FILE_INVALID",
@@ -7087,15 +7118,7 @@ async function plansRules(config2, resolved, out) {
       });
     }
   }
-  if (plans.billing.provider === "stripe") {
-    if (!config2.plans?.billing?.apiKey) {
-      out.error({
-        code: "PLANS_BILLING_INCOMPLETE",
-        path: "plans.billing.apiKey",
-        message: "plans.billing.apiKey is required when billing.provider is stripe.",
-        hint: 'Set it to a secret reference, for example "secret:STRIPE_API_KEY".'
-      });
-    }
+  if (paid) {
     const headless = !(resolved.portal?.enabled === true);
     for (const field of ["successUrl", "cancelUrl"]) {
       if (headless && !plans.billing[field]) {
@@ -7109,8 +7132,12 @@ async function plansRules(config2, resolved, out) {
     }
   }
 }
-function secretRules(config2, context, out, skipped) {
-  const refs = collectSecretRefs(config2);
+function secretRules(config2, resolved, context, out, skipped, paid) {
+  const stripeKeyPath = "plans.billing.apiKey";
+  const named = collectSecretRefs(config2).filter(
+    (ref) => paid || !ref.path.startsWith("plans.billing")
+  );
+  const refs = paid && !named.some((ref) => ref.path === stripeKeyPath) ? [...named, { name: stripeKeySecretName(resolved), path: stripeKeyPath }] : named;
   if (refs.length === 0) return;
   if (!context.knownSecrets) {
     skipped.push(
@@ -7119,7 +7146,14 @@ function secretRules(config2, context, out, skipped) {
     return;
   }
   for (const ref of refs) {
-    if (!context.knownSecrets.has(ref.name)) {
+    if (ref.path === stripeKeyPath && !context.knownSecrets.has(ref.name)) {
+      out.warn({
+        code: "SECRET_NOT_SET",
+        path: ref.path,
+        message: `a plan has a price, and the Stripe key (secret ${ref.name}) is not set yet.`,
+        hint: `apitogo deploy asks for it. Or run: apitogo secrets set ${ref.name}`
+      });
+    } else if (!context.knownSecrets.has(ref.name)) {
       out.error({
         code: "SECRET_NOT_SET",
         path: ref.path,
@@ -7139,12 +7173,13 @@ async function checkConfigV2(config2, resolved, context = {}) {
     error: (issue4) => errors.push(issue4),
     warn: (issue4) => warnings.push(issue4)
   };
+  const paid = await billingNeeded(resolved);
   dependencyRules(config2, resolved, out);
-  secretRules(config2, context, out, skipped);
+  secretRules(config2, resolved, context, out, skipped, paid);
   await portalRules(config2, resolved, out);
   await gatewayRules(resolved, out);
   identityRules(config2, resolved, out);
-  await plansRules(config2, resolved, out);
+  await plansRules(resolved, out, paid);
   return { errors, warnings, skipped };
 }
 
@@ -7190,7 +7225,7 @@ function portalProfile(resolved) {
 }
 
 // src/config/v2/manifest.ts
-import { mkdir as mkdir3, readFile as readFile3, rename, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile4, rename, rm, writeFile as writeFile4 } from "node:fs/promises";
 import path10 from "node:path";
 import { z as z3 } from "zod";
 var SUPPORTED_MANIFEST_SCHEMA = 1;
@@ -7240,7 +7275,7 @@ var ServiceManifestSchema = z3.looseObject({
     }).optional()
   }).default({})
 });
-var issue = (code, path95, message, hint) => ({ code, path: path95, message, hint });
+var issue = (code, path96, message, hint) => ({ code, path: path96, message, hint });
 function parseManifest(raw, file = "services.json") {
   const version = typeof raw === "object" && raw !== null && "schemaVersion" in raw ? raw.schemaVersion : void 0;
   if (typeof version === "number" && version > SUPPORTED_MANIFEST_SCHEMA) {
@@ -7273,7 +7308,7 @@ async function readManifest(state) {
   const file = manifestPathFor(state);
   let text;
   try {
-    text = await readFile3(file, "utf8");
+    text = await readFile4(file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
@@ -7488,7 +7523,7 @@ async function removeServicesFromManifest(state, names) {
 }
 
 // src/config/v2/gateway-reference.ts
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile5 } from "node:fs/promises";
 import { parse } from "yaml";
 var DEFAULT_KEY_HEADER = "Ocp-Apim-Subscription-Key";
 var METHODS = [
@@ -7502,8 +7537,8 @@ var METHODS = [
   "trace"
 ];
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-function actionKey(method, path95) {
-  const trimmed = path95.trim();
+function actionKey(method, path96) {
+  const trimmed = path96.trim();
   const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
   const normalized = withSlash.length > 1 ? withSlash.replace(/\/+$/, "") || "/" : withSlash;
   return `${method.trim().toLowerCase()}:${normalized}`;
@@ -7540,8 +7575,8 @@ var ReferenceSpecError = class extends Error {
 };
 function operationsOf(paths) {
   return Object.entries(paths).flatMap(
-    ([path95, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
-      (method) => [path95, item, method]
+    ([path96, item]) => isObject(item) ? METHODS.filter((method) => isObject(item[method])).map(
+      (method) => [path96, item, method]
     ) : []
   );
 }
@@ -7556,14 +7591,14 @@ function buildReferenceSpec(specText, options) {
     throw new ReferenceSpecError("The OpenAPI file could not be read.");
   const doc = structuredClone(root);
   const paths = isObject(doc.paths) ? doc.paths : {};
-  for (const [path95, item, method] of operationsOf(paths))
-    if (options.deniedOperations.has(actionKey(method, path95)))
+  for (const [path96, item, method] of operationsOf(paths))
+    if (options.deniedOperations.has(actionKey(method, path96)))
       delete item[method];
-  for (const [path95, item] of Object.entries(paths))
+  for (const [path96, item] of Object.entries(paths))
     if (!isObject(item) || !METHODS.some((method) => method in item))
-      delete paths[path95];
-  for (const [path95, item, method] of operationsOf(paths))
-    if (options.publicOperations.has(actionKey(method, path95)))
+      delete paths[path96];
+  for (const [path96, item, method] of operationsOf(paths))
+    if (options.publicOperations.has(actionKey(method, path96)))
       item[method].security = [];
   doc.servers = [{ url: options.gatewayBaseUrl.replace(/\/+$/, "") }];
   for (const item of Object.values(paths)) {
@@ -7626,7 +7661,7 @@ async function renderReferenceSpec(gateway, gatewayBaseUrl, keyHeaderName) {
     throw new ReferenceSpecError("gateway.specs lists no OpenAPI file.");
   let text;
   try {
-    text = await readFile4(file, "utf8");
+    text = await readFile5(file, "utf8");
   } catch {
     throw new ReferenceSpecError(`Cannot read the OpenAPI file ${file}.`);
   }
@@ -7697,7 +7732,7 @@ function stableJson(value) {
 }
 
 // src/config/v2/wrapper.ts
-import { mkdir as mkdir4, readFile as readFile6, rename as rename2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile7, rename as rename2, rm as rm2, writeFile as writeFile5 } from "node:fs/promises";
 import path12 from "node:path";
 
 // src/config/v2/docs-navigation.ts
@@ -7759,7 +7794,7 @@ import { glob as glob2 } from "glob";
 import globParent from "glob-parent";
 
 // src/lib/util/readFrontmatter.ts
-import { readFile as readFile5 } from "node:fs/promises";
+import { readFile as readFile6 } from "node:fs/promises";
 import matter from "gray-matter";
 import { parse as parse2, stringify } from "yaml";
 var yaml = {
@@ -7767,7 +7802,7 @@ var yaml = {
   stringify: (obj) => stringify(obj)
 };
 var readFrontmatter = async (filePath) => {
-  const content = await readFile5(filePath, "utf-8");
+  const content = await readFile6(filePath, "utf-8");
   const normalizedContent = content.replace(/\r\n/g, "\n");
   return matter(normalizedContent, { engines: { yaml } });
 };
@@ -8103,7 +8138,7 @@ function renderWrapper(plan2) {
 async function readDemoPlans(file) {
   if (!file) return void 0;
   try {
-    const parsed = JSON.parse(await readFile6(file, "utf8"));
+    const parsed = JSON.parse(await readFile7(file, "utf8"));
     return Array.isArray(parsed.plans) ? parsed.plans : void 0;
   } catch {
     return void 0;
@@ -8113,7 +8148,7 @@ async function readTheme(resolved) {
   const file = resolved.portal?.theme;
   if (!file) return void 0;
   try {
-    return JSON.parse(await readFile6(file, "utf8"));
+    return JSON.parse(await readFile7(file, "utf8"));
   } catch {
     return void 0;
   }
@@ -8249,7 +8284,7 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
 
 // src/config/v2/workspace.ts
 import { createHash as createHash2 } from "node:crypto";
-import { access as access2, lstat, readFile as readFile7, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
+import { access as access2, lstat, readFile as readFile8, rm as rm3, writeFile as writeFile6 } from "node:fs/promises";
 import path13 from "node:path";
 import { glob as glob3 } from "glob";
 
@@ -8285,7 +8320,7 @@ async function relink(target, link) {
 var GENERATED_PACKAGE_JSON = '{\n  "private": true,\n  "type": "module"\n}\n';
 async function writeGeneratedPackageJson(root) {
   const file = path13.join(root, "package.json");
-  const current = await readFile7(file, "utf8").catch(() => void 0);
+  const current = await readFile8(file, "utf8").catch(() => void 0);
   if (current !== GENERATED_PACKAGE_JSON)
     await writeFile6(file, GENERATED_PACKAGE_JSON, "utf8");
 }
@@ -8304,7 +8339,7 @@ async function materializeWorkspace(resolved, prepared) {
   return root;
 }
 async function configFingerprint(configPath) {
-  const text = await readFile7(configPath, "utf8");
+  const text = await readFile8(configPath, "utf8");
   try {
     const raw = JSON.parse(text);
     if (raw.project) {
@@ -8353,7 +8388,7 @@ async function portalArtifactHash(resolved, manifestText, cliVersion, wrapper =
   for (const file of files) {
     hash2.update(`file:${path13.relative(resolved.configDir, file)}
 `);
-    hash2.update(await readFile7(file));
+    hash2.update(await readFile8(file));
   }
   return hash2.digest("hex");
 }
@@ -9163,13 +9198,6 @@ async function buildPlans(context) {
   const { options, dir, resolved } = context;
   const o = options.plans ?? {};
   const template = o.template ?? (options.template === "blank" ? "none" : isFilled(options.template) ? "starter" : "free");
-  const billing = o.billing ?? (template === "tiered" ? "stripe" : "none");
-  if (template === "tiered" && billing === "none") {
-    throw new ServiceEditError(
-      "The tiered template has paid plans, which need a billing provider.",
-      "Use --billing stripe, or --template free."
-    );
-  }
   const file = o.file ? insideProject(dir, o.file, "Plans file") : void 0;
   const target = file ? path14.join(dir, file) : resolved.plans?.file ?? path14.join(resolved.root, "plans.json");
   await addFile(
@@ -9178,20 +9206,14 @@ async function buildPlans(context) {
     `${JSON.stringify({ version: 1, plans: PLAN_TEMPLATES[template] }, null, 2)}
 `
   );
-  if (billing === "stripe") {
+  if (PLAN_TEMPLATES[template].some((plan2) => isPaidPlan(plan2))) {
     context.notes.push(
-      "Set the billing key: apitogo secrets set STRIPE_API_KEY"
+      "A plan has a price, so payments go through Stripe: apitogo deploy asks for your Stripe secret key."
     );
   }
   return {
     ...options.disabled ? { enabled: false } : {},
-    ...file ? { file } : {},
-    ...billing === "stripe" ? {
-      billing: {
-        provider: "stripe",
-        apiKey: "secret:STRIPE_API_KEY"
-      }
-    } : { billing: { provider: "none" } }
+    ...file ? { file } : {}
   };
 }
 function reparse(configPath, raw) {
@@ -9383,7 +9405,7 @@ async function clearProjectId(dir, projectId) {
 
 // src/config/v2/ledger.ts
 init_invariant();
-import { mkdir as mkdir6, readFile as readFile8, rename as rename4, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
+import { mkdir as mkdir6, readFile as readFile9, rename as rename4, rm as rm5, writeFile as writeFile8 } from "node:fs/promises";
 import path15 from "node:path";
 var LEDGER_VERSION = 1;
 var LedgerError = class extends ApitogoError {
@@ -9400,7 +9422,7 @@ var emptyLedger = () => ({
 async function readLedger(state) {
   let text;
   try {
-    text = await readFile8(state.file, "utf8");
+    text = await readFile9(state.file, "utf8");
   } catch (error) {
     if (error.code === "ENOENT")
       return emptyLedger();
@@ -9535,7 +9557,7 @@ init_invariant();
 
 // src/cli/check/v2.ts
 init_apitogo_config_core();
-import { readFile as readFile15 } from "node:fs/promises";
+import { readFile as readFile16 } from "node:fs/promises";
 import path49 from "node:path";
 
 // src/cli/platform/client/platform-api.ts
@@ -9649,8 +9671,8 @@ var PlatformApiClient = class {
   constructor(config2) {
     this.config = config2;
   }
-  url(path95) {
-    return `${this.config.apiUrl}${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  url(path96) {
+    return `${this.config.apiUrl}${path96.startsWith("/") ? path96 : `/${path96}`}`;
   }
   headers(extra) {
     return {
@@ -9660,9 +9682,9 @@ var PlatformApiClient = class {
       ...extra
     };
   }
-  async request(method, path95, init3) {
+  async request(method, path96, init3) {
     const response = await fetchWithRetry(
-      this.url(path95),
+      this.url(path96),
       {
         method,
         ...init3,
@@ -10108,15 +10130,15 @@ var PlatformApiClient = class {
       }
     );
   }
-  deleteDevPortalPage(projectId, path95) {
-    const query = new URLSearchParams({ path: path95 });
+  deleteDevPortalPage(projectId, path96) {
+    const query = new URLSearchParams({ path: path96 });
     return this.request(
       "DELETE",
       `/api/v1/projects/${projectId}/dev-portal/pages/files?${query.toString()}`
     );
   }
-  renameDevPortalPage(projectId, path95, newName) {
-    const query = new URLSearchParams({ path: path95 });
+  renameDevPortalPage(projectId, path96, newName) {
+    const query = new URLSearchParams({ path: path96 });
     return this.request(
       "POST",
       `/api/v1/projects/${projectId}/dev-portal/pages/files/rename?${query.toString()}`,
@@ -10232,8 +10254,8 @@ var PlatformApiClient = class {
    * the project-less endpoint is used; `planTier` overrides the tier used for paid-plan checks.
    */
   validateGatewayPlans(plans, options = {}) {
-    const path95 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
-    return this.request("POST", path95, {
+    const path96 = options.projectId ? `/api/v1/projects/${options.projectId}/gateway/plans/validate` : "/api/v1/gateway/plans/validate";
+    return this.request("POST", path96, {
       headers: { "Content-Type": "application/json" },
       body: JSON.stringify({ plans, planTier: options.planTier })
     });
@@ -10358,8 +10380,8 @@ var PlatformApiClient = class {
   }
 };
 async function readFileBytes(filePath) {
-  const { readFile: readFile26 } = await import("node:fs/promises");
-  const buffer = await readFile26(filePath);
+  const { readFile: readFile27 } = await import("node:fs/promises");
+  const buffer = await readFile27(filePath);
   const arrayBuffer = new ArrayBuffer(buffer.byteLength);
   new Uint8Array(arrayBuffer).set(buffer);
   return arrayBuffer;
@@ -10456,7 +10478,7 @@ function resolveProjectId(explicit, config2) {
 import {
   access as access4,
   mkdir as mkdir12,
-  readFile as readFile12,
+  readFile as readFile13,
   rename as rename6,
   rm as rm8,
   writeFile as writeFile15
@@ -10464,7 +10486,7 @@ import {
 import path48 from "node:path";
 
 // src/vite/build.ts
-import { mkdir as mkdir11, readFile as readFile10, rename as rename5, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
+import { mkdir as mkdir11, readFile as readFile11, rename as rename5, rm as rm7, writeFile as writeFile13 } from "node:fs/promises";
 import path46 from "node:path";
 import { build as esbuild } from "esbuild";
 import { build as viteBuild, mergeConfig as mergeConfig3 } from "vite";
@@ -10612,7 +10634,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.47",
+  version: "0.2.49",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -11397,14 +11419,14 @@ var flattenAllOf = (schema2) => {
 };
 
 // src/lib/util/traverse.ts
-var traverse = (specification, transform, path95 = []) => {
-  const transformed = transform(specification, path95);
+var traverse = (specification, transform, path96 = []) => {
+  const transformed = transform(specification, path96);
   if (typeof transformed !== "object" || transformed === null) {
     return transformed;
   }
   const result = Array.isArray(transformed) ? [] : {};
   for (const [key, value] of Object.entries(transformed)) {
-    const currentPath = [...path95, key];
+    const currentPath = [...path96, key];
     if (Array.isArray(value)) {
       result[key] = value.map(
         (item, index) => typeof item === "object" && item != null ? traverse(item, transform, [...currentPath, index.toString()]) : item
@@ -11432,9 +11454,9 @@ var resolveLocalRef = (schema2, ref) => {
   if (schemaCache?.has(ref)) {
     return schemaCache.get(ref);
   }
-  const path95 = ref.split("/").slice(1);
+  const path96 = ref.split("/").slice(1);
   let current = schema2;
-  for (const segment of path95) {
+  for (const segment of path96) {
     if (!current || typeof current !== "object") {
       current = null;
     }
@@ -11453,7 +11475,7 @@ var dereference = async (schema2, resolvers = []) => {
   }
   const cloned = structuredClone(schema2);
   const visited = /* @__PURE__ */ new Set();
-  const resolve = async (current, path95) => {
+  const resolve = async (current, path96) => {
     if (isIndexableObject(current)) {
       if (visited.has(current)) {
         return CIRCULAR_REF;
@@ -11461,7 +11483,7 @@ var dereference = async (schema2, resolvers = []) => {
       visited.add(current);
       if (Array.isArray(current)) {
         for (let index = 0; index < current.length; index++) {
-          current[index] = await resolve(current[index], `${path95}/${index}`);
+          current[index] = await resolve(current[index], `${path96}/${index}`);
         }
       } else {
         if ("$ref" in current && typeof current.$ref === "string") {
@@ -11472,13 +11494,13 @@ var dereference = async (schema2, resolvers = []) => {
           for (const resolver of resolvers) {
             const resolved = await resolver($ref);
             if (resolved) {
-              result2 = await resolve(resolved, path95);
+              result2 = await resolve(resolved, path96);
               break;
             }
           }
           if (result2 === void 0) {
             const resolved = await resolveLocalRef(cloned, $ref);
-            result2 = await resolve(resolved, path95);
+            result2 = await resolve(resolved, path96);
           }
           if (hasSiblings) {
             if (result2 === CIRCULAR_REF) {
@@ -11491,7 +11513,7 @@ var dereference = async (schema2, resolvers = []) => {
           return result2;
         }
         for (const key in current) {
-          current[key] = await resolve(current[key], `${path95}/${key}`);
+          current[key] = await resolve(current[key], `${path96}/${key}`);
         }
       }
       visited.delete(current);
@@ -11530,9 +11552,9 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (sub, path95) => {
+  schema2 = traverse(schema2, (sub, path96) => {
     if (sub.example !== void 0) {
-      if (isSchemaPath(path95 ?? [])) {
+      if (isSchemaPath(path96 ?? [])) {
         sub.examples = [sub.example];
       } else {
         sub.examples = {
@@ -11545,11 +11567,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
+  schema2 = traverse(schema2, (schema3, path96) => {
     if (schema3.type === "object" && schema3.properties !== void 0) {
-      const parentPath = path95?.slice(0, -1);
+      const parentPath = path96?.slice(0, -1);
       const isMultipart = parentPath?.some((segment, index) => {
-        return segment === "content" && path95?.[index + 1] === "multipart/form-data";
+        return segment === "content" && path96?.[index + 1] === "multipart/form-data";
       });
       if (isMultipart) {
         const entries = Object.entries(schema3.properties);
@@ -11563,8 +11585,8 @@ var upgradeSchema = (schema2) => {
     }
     return schema3;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
-    if (path95?.includes("content") && path95.includes("application/octet-stream")) {
+  schema2 = traverse(schema2, (schema3, path96) => {
+    if (path96?.includes("content") && path96.includes("application/octet-stream")) {
       return {};
     }
     if (schema3.type === "string" && schema3.format === "binary") {
@@ -11590,11 +11612,11 @@ var upgradeSchema = (schema2) => {
     }
     return sub;
   });
-  schema2 = traverse(schema2, (schema3, path95) => {
+  schema2 = traverse(schema2, (schema3, path96) => {
     if (schema3.type === "string" && schema3.format === "byte") {
-      const parentPath = path95?.slice(0, -1);
+      const parentPath = path96?.slice(0, -1);
       const contentMediaType = parentPath?.find(
-        (_, index) => path95?.[index - 1] === "content"
+        (_, index) => path96?.[index - 1] === "content"
       );
       return {
         type: "string",
@@ -11606,7 +11628,7 @@ var upgradeSchema = (schema2) => {
   });
   return schema2;
 };
-function isSchemaPath(path95) {
+function isSchemaPath(path96) {
   const schemaLocations = [
     ["components", "schemas"],
     "properties",
@@ -11619,10 +11641,10 @@ function isSchemaPath(path95) {
   ];
   return schemaLocations.some((location) => {
     if (Array.isArray(location)) {
-      return location.every((segment, index) => path95[index] === segment);
+      return location.every((segment, index) => path96[index] === segment);
     }
-    return path95.includes(location);
-  }) || path95.includes("schema") || path95.some((segment) => segment.endsWith("Schema"));
+    return path96.includes(location);
+  }) || path96.includes("schema") || path96.some((segment) => segment.endsWith("Schema"));
 }
 
 // src/lib/oas/parser/index.ts
@@ -11704,13 +11726,13 @@ var OPENAPI_PROPS = /* @__PURE__ */ new Set([
   "anyOf",
   "oneOf"
 ]);
-var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path95 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
+var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs = /* @__PURE__ */ new WeakMap(), path96 = [], currentRefPaths = /* @__PURE__ */ new Set()) => {
   if (obj === null || typeof obj !== "object") return obj;
   const refPath = obj.__$ref;
   const isCircular = currentPath.has(obj) || typeof refPath === "string" && currentRefPaths.has(refPath);
   if (isCircular) {
     if (typeof refPath === "string") return SCHEMA_REF_PREFIX + refPath;
-    const circularProp = path95.find((p) => !OPENAPI_PROPS.has(p)) || path95[0];
+    const circularProp = path96.find((p) => !OPENAPI_PROPS.has(p)) || path96[0];
     return [CIRCULAR_REF, circularProp].filter(Boolean).join(":");
   }
   if (refs.has(obj)) return refs.get(obj);
@@ -11720,7 +11742,7 @@ var handleCircularRefs = (obj, currentPath = /* @__PURE__ */ new WeakSet(), refs
     value,
     currentPath,
     refs,
-    [...path95, key],
+    [...path96, key],
     currentRefPaths
   );
   const result = Array.isArray(obj) ? obj.map((item, i) => recurse(item, i.toString())) : Object.fromEntries(
@@ -11755,7 +11777,7 @@ var resolveExtensions = (obj) => Object.fromEntries(
 var getAllTags = (schema2) => {
   const rootTags = schema2.tags ?? [];
   const operations = Object.values(schema2.paths ?? {}).flatMap(
-    (path95) => HttpMethods.map((k) => path95?.[k]).filter((op) => op != null)
+    (path96) => HttpMethods.map((k) => path96?.[k]).filter((op) => op != null)
   );
   const operationTags = new Set(operations.flatMap((op) => op.tags ?? []));
   const hasUntaggedOperations = operations.some(
@@ -11810,7 +11832,7 @@ var getAllSlugs = (ops, schemaTags = []) => {
 var getOperationSlugKey = (op) => [op.path, op.method, op.operationId, op.summary].filter(Boolean).join("-");
 var getAllOperations = (paths) => {
   const operations = Object.entries(paths ?? {}).flatMap(
-    ([path95, value]) => HttpMethods.flatMap((method) => {
+    ([path96, value]) => HttpMethods.flatMap((method) => {
       if (!value?.[method]) return [];
       const operation = value[method];
       const pathParameters = value.parameters ?? [];
@@ -11830,7 +11852,7 @@ var getAllOperations = (paths) => {
       return {
         ...operation,
         method,
-        path: path95,
+        path: path96,
         parameters,
         servers,
         tags: operation.tags ?? []
@@ -12188,8 +12210,8 @@ var Schema = builder.objectRef("Schema").implement({
     }),
     paths: t.field({
       type: [PathItem],
-      resolve: (root) => Object.entries(root.paths ?? {}).map(([path95, value]) => ({
-        path: path95,
+      resolve: (root) => Object.entries(root.paths ?? {}).map(([path96, value]) => ({
+        path: path96,
         // biome-ignore lint/style/noNonNullAssertion: value is guaranteed to be defined
         methods: Object.keys(value)
       }))
@@ -12354,7 +12376,7 @@ init_joinUrl();
 
 // src/vite/api/schema-codegen.ts
 var unescapeJsonPointer = (uri) => decodeURIComponent(uri.replace(/~1/g, "/").replace(/~0/g, "~"));
-var getSegmentsFromPath = (path95) => path95.split("/").slice(1).map(unescapeJsonPointer);
+var getSegmentsFromPath = (path96) => path96.split("/").slice(1).map(unescapeJsonPointer);
 var createLocalRefMap = (obj) => {
   const refMap = /* @__PURE__ */ new Map();
   const siblingsMap = /* @__PURE__ */ new Map();
@@ -12385,16 +12407,16 @@ var replaceMarkers = (code, mergedRefs) => code.replace(/"__refMap:(.*?)"/g, '__
   /"__refMap\+Siblings:(.*?)"/g,
   (_, key) => mergedRefs.get(key) ?? `__refMap["${key}"]`
 );
-var lookup = (schema2, path95, filePath) => {
-  const parts = getSegmentsFromPath(path95);
+var lookup = (schema2, path96, filePath) => {
+  const parts = getSegmentsFromPath(path96);
   let val = schema2;
   for (const part of parts) {
     while (val.$ref?.startsWith("#/")) {
-      val = val.$ref === path95 ? val : lookup(schema2, val.$ref, filePath);
+      val = val.$ref === path96 ? val : lookup(schema2, val.$ref, filePath);
     }
     if (val[part] === void 0) {
       throw new Error(
-        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path95}`
+        `Error in ${filePath ?? "code generation"}: Could not find path segment ${part} in path: ${path96}`
       );
     }
     val = val[part];
@@ -12639,8 +12661,8 @@ var SchemaManager = class {
       }
     }
   };
-  getLatestSchema = (path95) => this.processedSchemas[path95]?.at(0);
-  getSchemasForPath = (path95) => this.processedSchemas[path95];
+  getLatestSchema = (path96) => this.processedSchemas[path96]?.at(0);
+  getSchemasForPath = (path96) => this.processedSchemas[path96];
   getSchemaImports = () => Object.values(this.processedSchemas).flat().filter((s) => s.importKey);
   getUrlToFilePathMap = () => {
     const map = /* @__PURE__ */ new Map();
@@ -15008,7 +15030,7 @@ async function writeOutput(dir, {
 // src/vite/prerender/prerender.ts
 init_logger();
 init_file_exists();
-import { readFile as readFile9, rm as rm6 } from "node:fs/promises";
+import { readFile as readFile10, rm as rm6 } from "node:fs/promises";
 import os from "node:os";
 import path45 from "node:path";
 import { pathToFileURL } from "node:url";
@@ -15100,14 +15122,14 @@ async function generateSitemap({
 
 // src/vite/prerender/utils.ts
 init_joinUrl();
-var resolveRoutePath = (path95) => {
-  const segments = path95.split("/");
+var resolveRoutePath = (path96) => {
+  const segments = path96.split("/");
   if (segments.some((s) => s.startsWith(":") && !s.endsWith("?"))) {
     return void 0;
   }
   return segments.filter((s) => !s.startsWith(":")).join("/") || void 0;
 };
-var isSkipped = (path95) => path95.includes("*") || /^\d+$/.test(path95);
+var isSkipped = (path96) => path96.includes("*") || /^\d+$/.test(path96);
 var resolveRoutes = (routes, parentPath = "") => routes.flatMap((route) => {
   if (route.path && isSkipped(route.path)) return [];
   const routePath = route.path ? resolveRoutePath(route.path) : void 0;
@@ -15284,7 +15306,7 @@ var prerender = async ({
     );
     let markdownFileInfos = [];
     if (await fileExists(markdownInfoPath)) {
-      const markdownInfoContent = await readFile9(markdownInfoPath, "utf-8");
+      const markdownInfoContent = await readFile10(markdownInfoPath, "utf-8");
       markdownFileInfos = JSON.parse(markdownInfoContent);
     }
     if (llmsConfig.llmsTxt || llmsConfig.llmsTxtFull) {
@@ -15435,7 +15457,7 @@ var bundleSSREntry = async (options) => {
   const { dir, adapter, serverOutDir, serverConfigFilename, html, basePath } = options;
   const tempEntryPath = path46.join(dir, "__ssr-entry.ts");
   const packageRoot = getZudokuRootDir();
-  const templateContent = await readFile10(
+  const templateContent = await readFile11(
     path46.join(packageRoot, "src/vite/ssr-templates", `${adapter}.ts`),
     "utf-8"
   );
@@ -15466,7 +15488,7 @@ init_package_json();
 
 // src/cli/init/v2-packages.ts
 import { existsSync as existsSync5 } from "node:fs";
-import { readFile as readFile11, writeFile as writeFile14 } from "node:fs/promises";
+import { readFile as readFile12, writeFile as writeFile14 } from "node:fs/promises";
 import path47 from "node:path";
 var CORE_PACKAGES = [
   "@lukoweb/apitogo",
@@ -15613,17 +15635,17 @@ async function buildV2(options) {
 }
 
 // src/cli/check/gateway-online.ts
-import { readFile as readFile13 } from "node:fs/promises";
+import { readFile as readFile14 } from "node:fs/promises";
 var SPEC_SEND_LIMIT = 5 * 1024 * 1024 + 64 * 1024;
-var issue2 = (code, path95, message, hint) => ({ code, path: path95, message, hint });
+var issue2 = (code, path96, message, hint) => ({ code, path: path96, message, hint });
 function capabilityIssues(gateway, answer) {
   const can = answer.capabilities;
   const plan2 = `your ${answer.tier} plan`;
   const found = [];
-  const unsupported = (path95, what, hint) => found.push(
+  const unsupported = (path96, what, hint) => found.push(
     issue2(
       "GATEWAY_CAPABILITY_UNSUPPORTED",
-      path95,
+      path96,
       `${what} is not available on ${plan2}.`,
       hint
     )
@@ -15677,7 +15699,7 @@ async function onlineGatewayRules(gateway, projectId, api, derivedCors = []) {
   const specFile = gateway.specs[0];
   if (specFile) {
     try {
-      const text = await readFile13(specFile, "utf8");
+      const text = await readFile14(specFile, "utf8");
       if (text.length <= SPEC_SEND_LIMIT) spec = text;
     } catch {
     }
@@ -15704,9 +15726,9 @@ async function onlineGatewayRules(gateway, projectId, api, derivedCors = []) {
 }
 
 // src/cli/deploy/plans-file.ts
-init_invariant();
-import { readFile as readFile14 } from "node:fs/promises";
+import { readFile as readFile15 } from "node:fs/promises";
 import { z as z14 } from "zod";
+init_invariant();
 var PlansFileError = class extends ApitogoError {
   constructor(code, message, developerHint) {
     super(message, { developerHint, title: "Cannot read the plans file" });
@@ -15749,7 +15771,7 @@ var issuesOf = (error) => error.issues.map(
 async function readPlansFile(file) {
   let text;
   try {
-    text = await readFile14(file, "utf8");
+    text = await readFile15(file, "utf8");
   } catch {
     throw new PlansFileError(
       "PLANS_FILE_UNREADABLE",
@@ -15790,12 +15812,12 @@ async function readPlansFile(file) {
 var BILLING_PERIOD = { month: "monthly", year: "annual" };
 function toPlatformPlans(plans, options = {}) {
   return plans.map((plan2, index) => {
-    const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
+    const paid = isPaidPlan(plan2);
     if (paid && !options.billing)
       throw new PlansFileError(
         "PLANS_PAID_UNSUPPORTED",
-        `The plan "${plan2.sku}" has a price, and plans.billing.provider is not stripe, so nobody could pay for it.`,
-        "Set plans.billing.provider to stripe (with plans.billing.apiKey), or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
+        `The plan "${plan2.sku}" has a price, but plans.billing.provider is "none", so nobody could pay for it.`,
+        "Remove plans.billing.provider (Stripe is the provider; deploy asks for its key), or set priceAmount to 0 (or pricingModel to custom for a contact-us plan)."
       );
     const limits = plan2.limits ? {
       ...plan2.limits.rateLimit ? {
@@ -15827,9 +15849,9 @@ function toPlatformPlans(plans, options = {}) {
 }
 
 // src/cli/check/services-online.ts
-var issue3 = (code, path95, message, hint) => ({
+var issue3 = (code, path96, message, hint) => ({
   code,
-  path: path95,
+  path: path96,
   message,
   hint
 });
@@ -15940,7 +15962,7 @@ async function onlinePlansRules(resolved, projectId, api) {
 async function isConfigV2(dir) {
   try {
     return /"version"\s*:\s*2\b/.test(
-      await readFile15(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
+      await readFile16(path49.join(dir, APITOGO_CONFIG_FILENAME), "utf8")
     );
   } catch {
     return false;
@@ -16502,8 +16524,7 @@ function addOptionsFromArguments(service, argv) {
     } : void 0,
     plans: service === "plans" ? {
       file: argv.file,
-      template: argv.template === "free" || argv.template === "tiered" ? argv.template : void 0,
-      billing: argv.billing
+      template: argv.template === "free" || argv.template === "tiered" ? argv.template : void 0
     } : void 0
   };
 }
@@ -16810,10 +16831,6 @@ var add_default = {
       "none"
     ],
     describe: "Content to create: blank (empty shell), starter (filled example) or full (starter plus a Node.js backend in server/). Plans also accept free, tiered and none; none is blank"
-  }).option("billing", {
-    type: "string",
-    choices: ["stripe", "none"],
-    describe: "plans: billing provider"
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo add" });
@@ -17026,7 +17043,7 @@ function formatDevPortalBackendResponse(projectId, backend) {
 // src/cli/platform/helpers/dev-portal-manifest.ts
 init_gateway_limits();
 import { existsSync as existsSync7 } from "node:fs";
-import { access as access5, mkdir as mkdir13, readFile as readFile16, writeFile as writeFile16 } from "node:fs/promises";
+import { access as access5, mkdir as mkdir13, readFile as readFile17, writeFile as writeFile16 } from "node:fs/promises";
 import path55 from "node:path";
 
 // src/cli/make-config/header-pricing-nav.ts
@@ -17606,7 +17623,7 @@ function mergePublishPrerequisitesWithPlatformValidation(prerequisites, manifest
 async function readManifest2(siteDirectory) {
   const filePath = manifestFilePath(siteDirectory);
   if (await pathExists(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     const config2 = JSON.parse(raw);
     return extractManifestFromConfig(config2);
   }
@@ -17617,7 +17634,7 @@ async function writeManifest2(siteDirectory, manifest) {
   await mkdir13(path55.dirname(filePath), { recursive: true });
   let config2 = {};
   if (await pathExists(filePath)) {
-    const raw = await readFile16(filePath, "utf8");
+    const raw = await readFile17(filePath, "utf8");
     config2 = JSON.parse(raw);
   }
   const {
@@ -17636,7 +17653,7 @@ import {
   access as access6,
   appendFile,
   mkdir as mkdir14,
-  readFile as readFile17,
+  readFile as readFile18,
   unlink,
   writeFile as writeFile17
 } from "node:fs/promises";
@@ -17742,7 +17759,7 @@ function applyEnvOverrides2(config2, env) {
 }
 async function readEnvFile(filePath) {
   try {
-    const raw = await readFile17(filePath, "utf8");
+    const raw = await readFile18(filePath, "utf8");
     const env = {};
     for (const line2 of raw.split("\n")) {
       const trimmed = line2.trim();
@@ -17875,7 +17892,7 @@ var SECRETS_COLLECTION_INSTRUCTION = "For go-live, plans must already be in apit
 
 // src/cli/platform/helpers/dev-portal-site-validation.ts
 init_gateway_limits();
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 import { createRequire as createRequire2 } from "node:module";
 import path57 from "node:path";
 var cachedFallbackTs;
@@ -18053,7 +18070,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     let parsed;
     let parseFailed = false;
     try {
-      parsed = JSON.parse(await readFile18(jsonPath, "utf8"));
+      parsed = JSON.parse(await readFile19(jsonPath, "utf8"));
     } catch (error) {
       parseFailed = true;
       issues.push({
@@ -18092,7 +18109,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
     } else {
       for (const relativeFile of existingTsxFiles) {
         checkedFiles.push(relativeFile);
-        const content = await readFile18(
+        const content = await readFile19(
           path57.join(resolvedDir, relativeFile),
           "utf8"
         );
@@ -18115,7 +18132,7 @@ async function validateDevPortalSiteConfig(sourceDirectory, options) {
 
 // src/cli/platform/helpers/npm-build.ts
 import { spawn as spawn2 } from "node:child_process";
-import { access as access7, readFile as readFile19 } from "node:fs/promises";
+import { access as access7, readFile as readFile20 } from "node:fs/promises";
 import path58 from "node:path";
 var BUILD_LOG_TAIL_BYTES = 8192;
 var MIN_NODE_MAJOR = 20;
@@ -18761,7 +18778,7 @@ import { createInterface as createInterface3 } from "node:readline/promises";
 
 // src/cli/make-config/v2-edits.ts
 init_apitogo_config_core();
-import { access as access8, mkdir as mkdir15, readFile as readFile20, writeFile as writeFile18 } from "node:fs/promises";
+import { access as access8, mkdir as mkdir15, readFile as readFile21, writeFile as writeFile18 } from "node:fs/promises";
 import path61 from "node:path";
 import { glob as glob7 } from "glob";
 init_invariant();
@@ -18957,7 +18974,7 @@ async function writeDocsPage(project, input5) {
         "Leave out --page-update to add it."
       );
     }
-    const title = input5.title?.trim() || titleOf(await readFile20(existing, "utf8"));
+    const title = input5.title?.trim() || titleOf(await readFile21(existing, "utf8"));
     file = existing;
     action = "updated";
     await writeFile18(file, buildDocsPage(title ?? slug, input5.content), "utf8");
@@ -19046,7 +19063,7 @@ async function upsertPlan(project, plan2) {
   if (await exists4(plans.file)) {
     let raw;
     try {
-      raw = JSON.parse(await readFile20(plans.file, "utf8"));
+      raw = JSON.parse(await readFile21(plans.file, "utf8"));
     } catch (error) {
       throw new ConfigEditError(
         `${relativeToConfig(project, plans.file)} is not valid JSON (${error.message}).`
@@ -19073,7 +19090,7 @@ async function upsertPlan(project, plan2) {
 `,
     "utf8"
   );
-  const paid = plan2.pricingModel !== "custom" && (plan2.priceAmount ?? 0) > 0;
+  const paid = isPaidPlan(plan2);
   return {
     action: index === -1 ? "added" : "updated",
     sku: plan2.sku,
@@ -19117,7 +19134,12 @@ function printPlanResult(plan2) {
   printSuccessToConsole(`Plan "${plan2.sku}" ${plan2.action} in ${plan2.file}.`);
   if (plan2.needsBilling) {
     printWarningToConsole(
-      "This plan has a price and plans.billing.provider is not stripe, so deploy will refuse it. Set plans.billing.provider to stripe, or make the plan free or custom."
+      'This plan has a price, but plans.billing.provider is "none", so deploy will refuse it. Remove plans.billing.provider (Stripe is the provider), or make the plan free or custom.'
+    );
+  }
+  if (plan2.paid && !plan2.needsBilling) {
+    printHintToConsole(
+      "Payments go through Stripe: apitogo deploy asks for your Stripe secret key if the project has none yet."
     );
   }
   if (plan2.paid) printPaidPlanPlatformWarning();
@@ -19512,7 +19534,7 @@ var config_default = {
 // src/cli/create/handler.ts
 init_apitogo_config_core();
 import { execFile } from "node:child_process";
-import { readFile as readFile21 } from "node:fs/promises";
+import { readFile as readFile22 } from "node:fs/promises";
 import path63 from "node:path";
 import { promisify } from "node:util";
 var execFileAsync = promisify(execFile);
@@ -19546,7 +19568,7 @@ async function gitHasUncommittedChanges(dir) {
 async function defaultName(dir) {
   try {
     const parsed = JSON.parse(
-      await readFile21(path63.join(dir, "package.json"), "utf8")
+      await readFile22(path63.join(dir, "package.json"), "utf8")
     );
     if (typeof parsed.name === "string" && parsed.name.trim())
       return parsed.name.replace(/^@[^/]+\//, "");
@@ -19772,7 +19794,7 @@ var create_default = {
 };
 
 // src/cli/cmds/deploy.ts
-import path80 from "node:path";
+import path81 from "node:path";
 
 // src/cli/apply/handler.ts
 import path75 from "node:path";
@@ -20319,8 +20341,8 @@ function normalizeActionKey(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path96 = pathParts.join(":").trim();
-    return `${method2?.toLowerCase()}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
+    const path97 = pathParts.join(":").trim();
+    return `${method2?.toLowerCase()}:${path97.startsWith("/") ? path97 : `/${path97}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -20329,8 +20351,8 @@ function normalizeActionKey(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path95 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  const path96 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
 }
 async function applyGatewayPublicRoutes(client, projectId, routes, options) {
   const applied = [];
@@ -20808,7 +20830,7 @@ async function upsertGatewayPlansFromManifest(client, config2, projectId, plans,
 }
 
 // src/cli/platform/helpers/openapi-gateway-servers.ts
-import { mkdir as mkdir16, readFile as readFile22, writeFile as writeFile19 } from "node:fs/promises";
+import { mkdir as mkdir16, readFile as readFile23, writeFile as writeFile19 } from "node:fs/promises";
 import path66 from "node:path";
 import YAML from "yaml";
 var GATEWAY_URL_ENV_KEY = "APITOGO_GATEWAY_URL";
@@ -20840,7 +20862,7 @@ async function resolveProjectGatewayUrl(client, projectId) {
   return null;
 }
 async function readOpenApiDocument(filePath) {
-  const content = await readFile22(filePath, "utf8");
+  const content = await readFile23(filePath, "utf8");
   const ext = path66.extname(filePath).toLowerCase();
   const parsed = ext === ".json" ? JSON.parse(content) : YAML.parse(content);
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -20869,7 +20891,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
     path66.resolve(siteDirectory),
     APITOGO_CONFIG_FILENAME2
   );
-  const raw = await readFile22(configPath, "utf8");
+  const raw = await readFile23(configPath, "utf8");
   const config2 = JSON.parse(raw);
   const previousApis = config2.apis;
   const previousBackend = config2.backend;
@@ -20886,7 +20908,7 @@ async function pointSiteApisAtPublishOpenApi(siteDirectory, relativeInput) {
 `, "utf8");
   return {
     restore: async () => {
-      const currentRaw = await readFile22(configPath, "utf8");
+      const currentRaw = await readFile23(configPath, "utf8");
       const current = JSON.parse(currentRaw);
       if (previousApis === void 0) {
         delete current.apis;
@@ -20921,7 +20943,7 @@ async function prepareOpenApiServersForGatewayBuild(options) {
   );
   if (!openApiPath) {
     try {
-      const raw = await readFile22(
+      const raw = await readFile23(
         path66.join(siteDirectory, APITOGO_CONFIG_FILENAME2),
         "utf8"
       );
@@ -20951,8 +20973,8 @@ function normalizeActionKeyFormat(actionKey2) {
   const trimmed = actionKey2.trim();
   if (trimmed.includes(":")) {
     const [method2, ...pathParts] = trimmed.split(":");
-    const path96 = pathParts.join(":").trim();
-    return `${method2.toLowerCase()}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
+    const path97 = pathParts.join(":").trim();
+    return `${method2.toLowerCase()}:${path97.startsWith("/") ? path97 : `/${path97}`}`;
   }
   const spaceIndex = trimmed.indexOf(" ");
   if (spaceIndex <= 0) {
@@ -20961,8 +20983,8 @@ function normalizeActionKeyFormat(actionKey2) {
     );
   }
   const method = trimmed.slice(0, spaceIndex).trim().toLowerCase();
-  const path95 = trimmed.slice(spaceIndex + 1).trim();
-  return `${method}:${path95.startsWith("/") ? path95 : `/${path95}`}`;
+  const path96 = trimmed.slice(spaceIndex + 1).trim();
+  return `${method}:${path96.startsWith("/") ? path96 : `/${path96}`}`;
 }
 function normalizePublicRoute(route) {
   const trimmed = route.trim();
@@ -20995,7 +21017,7 @@ function collectManifestPublicActionKeys(gateway) {
 }
 
 // src/cli/platform/helpers/publish-ledger.ts
-import { mkdir as mkdir17, readFile as readFile23, writeFile as writeFile20 } from "node:fs/promises";
+import { mkdir as mkdir17, readFile as readFile24, writeFile as writeFile20 } from "node:fs/promises";
 import path67 from "node:path";
 var PUBLISH_LEDGER_RELATIVE_PATH = ".apitogo/publish-state.json";
 function publishLedgerPath(siteDirectory) {
@@ -21004,7 +21026,7 @@ function publishLedgerPath(siteDirectory) {
 async function readPublishLedger(siteDirectory) {
   const filePath = publishLedgerPath(siteDirectory);
   try {
-    const raw = await readFile23(filePath, "utf8");
+    const raw = await readFile24(filePath, "utf8");
     const parsed = JSON.parse(raw);
     if (parsed?.version !== 1 || !Array.isArray(parsed.steps)) {
       return null;
@@ -23275,7 +23297,7 @@ async function resolveProjectIdForPublish(client, config2, args, wait, progress,
 import path74 from "node:path";
 
 // src/cli/platform/helpers/dev-portal-site-api-url.ts
-import { readdir as readdir5, readFile as readFile24, writeFile as writeFile21 } from "node:fs/promises";
+import { readdir as readdir5, readFile as readFile25, writeFile as writeFile21 } from "node:fs/promises";
 import path71 from "node:path";
 var SITE_API_BASE_URL_ENV_KEY = "VITE_APITOGO_AUTHENTICATION_API_BASE_URL";
 var PLACEHOLDER_HOST_MARKERS = [
@@ -23300,7 +23322,7 @@ async function readSiteApiBaseUrl(sourceDirectory) {
   const resolved = path71.resolve(sourceDirectory);
   for (const envFile of [".env", ".env.production"]) {
     try {
-      const content = await readFile24(path71.join(resolved, envFile), "utf8");
+      const content = await readFile25(path71.join(resolved, envFile), "utf8");
       const lines = [...content.matchAll(ENV_LINE_GLOBAL_RE)];
       if (lines.length === 0) {
         continue;
@@ -23331,7 +23353,7 @@ async function patchSiteApiBaseUrl(sourceDirectory, apiBaseUrl) {
   for (const envFile of [".env.production", ".env"]) {
     const envPath = path71.join(resolved, envFile);
     try {
-      const content = await readFile24(envPath, "utf8");
+      const content = await readFile25(envPath, "utf8");
       const withoutAssignments = content.replace(ENV_LINE_GLOBAL_RE, "").replace(/\n{3,}/g, "\n\n").trimEnd();
       const patched = withoutAssignments ? `${withoutAssignments}
 ${line2}
@@ -23411,7 +23433,7 @@ async function assertDeployableDistHasLiveApiBaseUrl(distDirectory, expectedApiB
   let found = false;
   let foundPlaceholder = false;
   for await (const file of walkFiles(dist)) {
-    const content = await readFile24(file, "utf8");
+    const content = await readFile25(file, "utf8");
     if (content.includes(needle)) {
       found = true;
     }
@@ -25547,7 +25569,7 @@ async function apply(argv) {
 }
 
 // src/cli/deploy/command.ts
-import path79 from "node:path";
+import path80 from "node:path";
 init_invariant();
 
 // src/cli/project/create-handler.ts
@@ -25914,17 +25936,129 @@ async function createProject2(argv) {
   }
 }
 
+// src/cli/secrets/input.ts
+import { createInterface as createInterface6 } from "node:readline/promises";
+var CTRL_C = "";
+var CTRL_D = "";
+function readHidden(prompt, input5 = process.stdin, output4 = process.stdout) {
+  return new Promise((resolve, reject) => {
+    if (!input5.isTTY || !input5.setRawMode) {
+      reject(new Error("A hidden prompt needs an interactive terminal."));
+      return;
+    }
+    let value = "";
+    output4.write(prompt);
+    input5.setRawMode(true);
+    input5.resume();
+    const finish = (action) => {
+      input5.removeListener("data", onData);
+      input5.setRawMode?.(false);
+      input5.pause();
+      output4.write("\n");
+      action();
+    };
+    const onData = (chunk) => {
+      for (const char of chunk.toString("utf8")) {
+        if (char === CTRL_C)
+          return finish(() => reject(new Error("Cancelled.")));
+        if (char === "\r" || char === "\n" || char === CTRL_D)
+          return finish(() => resolve(value));
+        if (char === "\x7F" || char === "\b") value = value.slice(0, -1);
+        else value += char;
+      }
+    };
+    input5.on("data", onData);
+  });
+}
+async function readStdin(input5 = process.stdin) {
+  const chunks = [];
+  for await (const chunk of input5) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
+async function confirm(question) {
+  const rl = createInterface6({ input: process.stdin, output: process.stdout });
+  try {
+    const answer = (await rl.question(question)).trim().toLowerCase();
+    return answer === "y" || answer === "yes";
+  } finally {
+    rl.close();
+  }
+}
+
+// src/cli/deploy/stripe-key.ts
+import path77 from "node:path";
+init_invariant();
+var StripeKeyError = class extends ApitogoError {
+  constructor(message, developerHint) {
+    super(message, { developerHint, title: "Stripe key needed" });
+    this.name = "StripeKeyError";
+  }
+};
+var STRIPE_KEY = /^(sk|rk)_(test|live)_[A-Za-z0-9]+$/;
+var wantsPlans = (only) => {
+  if (only === void 0) return true;
+  const names = (Array.isArray(only) ? only : only.split(",")).map((name) => name.trim()).filter(Boolean);
+  return names.length === 0 || names.includes("plans");
+};
+async function ensureStripeKey(argv, deps) {
+  if (!wantsPlans(argv.only)) return { status: "not-needed" };
+  let resolved;
+  try {
+    resolved = loadConfigV2(path77.resolve(process.cwd(), argv.dir)).resolved;
+  } catch {
+    return { status: "not-needed" };
+  }
+  if (!resolved.plans?.enabled || resolved.plans.billing.provider !== "stripe")
+    return { status: "not-needed" };
+  const paid = await paidPlanSkus(resolved);
+  if (paid.length === 0) return { status: "not-needed" };
+  const projectId = argv.projectId?.trim() || resolved.project.id || deps.envProjectId?.trim();
+  if (!projectId) return { status: "not-needed" };
+  const name = stripeKeySecretName(resolved);
+  const client = deps.client();
+  const { secrets: secrets2 } = await client.listSecrets(projectId);
+  if (secrets2.some((secret) => secret.name === name))
+    return { status: "present", name };
+  const reason = `The plan${paid.length > 1 ? "s" : ""} ${paid.join(", ")} ${paid.length > 1 ? "have" : "has"} a price, so payments go through Stripe, and this project has no Stripe key yet.`;
+  if (!deps.interactive) {
+    throw new StripeKeyError(
+      reason,
+      `Store it with \`apitogo secrets set ${name}\`, then deploy again. Or make the plans free.`
+    );
+  }
+  deps.print(reason);
+  deps.print(
+    "Paste your Stripe secret key (starts with sk_ or rk_; use an sk_test_ key to try it out). It is stored as a project secret, not in your files."
+  );
+  const key = (await deps.askHidden("Stripe secret key (hidden): ")).trim();
+  if (!key)
+    throw new StripeKeyError(
+      "No key was entered. Nothing was deployed.",
+      `Run \`apitogo secrets set ${name}\` when you have it, then deploy again.`
+    );
+  if (!STRIPE_KEY.test(key))
+    throw new StripeKeyError(
+      "That is not a Stripe secret key. Nothing was deployed.",
+      "A Stripe secret key starts with sk_test_, sk_live_, rk_test_ or rk_live_. Find it in Stripe under Developers > API keys."
+    );
+  await client.setSecret(projectId, name, key);
+  deps.print(`Stripe key saved as the project secret ${name}.`);
+  return { status: "saved", name };
+}
+
 // src/cli/deploy/v2.ts
 import { rm as rm10 } from "node:fs/promises";
 init_invariant();
 
 // src/cli/portal/report.ts
 import { access as access9 } from "node:fs/promises";
-import path77 from "node:path";
+import path78 from "node:path";
 
 // src/cli/deploy/gateway.ts
 import { createHash as createHash4 } from "node:crypto";
-import { readFile as readFile25 } from "node:fs/promises";
+import { readFile as readFile26 } from "node:fs/promises";
 init_invariant();
 var GatewayDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
@@ -25962,7 +26096,7 @@ async function readSpec(gateway) {
       "Add one to gateway.specs in the config."
     );
   try {
-    return await readFile25(file);
+    return await readFile26(file);
   } catch {
     throw new GatewayDeployError(
       "GATEWAY_SPEC_UNREADABLE",
@@ -26722,12 +26856,13 @@ async function plansInputs(resolved, projectId) {
   const plans = resolved.plans;
   if (!plans) throw new Error("plans is not in the config.");
   const billing = plans.billing;
-  const wanted = toPlatformPlans(await readPlansFile(plans.file), {
+  const filePlans = await readPlansFile(plans.file);
+  const wanted = toPlatformPlans(filePlans, {
     billing: billing.provider === "stripe"
   });
   const manifest = await readManifest(resolved.state);
   const ledger = await readLedger(resolved.state);
-  const billingOn = billing.provider === "stripe";
+  const billingOn = billing.provider === "stripe" && filePlans.some((plan2) => isPaidPlan(plan2));
   const billingStep = billingOn || stepOf(ledger, "plans", "billing") !== void 0;
   const identity = manifest?.services.identity;
   const ownIdentity = Boolean(
@@ -26739,11 +26874,12 @@ async function plansInputs(resolved, projectId) {
     ownIdentity,
     catalogHash: stableJson({ projectId, plans: wanted }),
     backendHash: stableJson({ projectId }),
+    billingOn,
     billingStep,
     // Only the references to the project's secrets: a rotated value is applied with --force.
     billingHash: stableJson({
       projectId,
-      provider: billing.provider,
+      provider: billingOn ? "stripe" : "none",
       apiKey: billingOn ? billing.apiKey : void 0,
       webhookSecret: billingOn ? billing.webhookSecret : void 0,
       successUrl: billingOn ? billing.successUrl : void 0,
@@ -26809,6 +26945,7 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
     wanted,
     manifest,
     ownIdentity,
+    billingOn,
     billingStep,
     billingHash,
     catalogHash,
@@ -26968,7 +27105,7 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
     name: "billing",
     hash: () => billingHash,
     run: async () => {
-      const body = plans.billing.provider === "stripe" ? {
+      const body = billingOn ? {
         provider: "stripe",
         apiKey: plans.billing.apiKey,
         webhookSecret: plans.billing.webhookSecret,
@@ -26985,8 +27122,7 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
         code: "PLANS_BILLING",
         text: "the billing settings"
       });
-      if (plans.billing.provider === "stripe")
-        billingNote = billingNotes(queued);
+      if (billingOn) billingNote = billingNotes(queued);
       return { ...done, mode: queued.mode };
     }
   };
@@ -27029,9 +27165,9 @@ async function deployPlans(resolved, projectId, deps, options = {}) {
           projectId,
           projectName: resolved.project.name,
           apiBaseUrl,
-          billing: plans.billing.provider,
+          billing: billingOn ? "stripe" : "none",
           catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
-          capabilities: plans.billing.provider === "stripe" ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
+          capabilities: billingOn ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
         })
       );
     }
@@ -27190,7 +27326,7 @@ async function planPlansService(resolved, ledger, plansRemote2) {
     ),
     inputs.ownIdentity ? "sign-in: the project's identity will be applied to the plans backend" : "sign-in: no identity of the platform deployed, so nothing is applied to the plans backend",
     ...inputs.billingStep ? [
-      resolved.plans?.billing.provider === "stripe" ? "billing: the Stripe key and webhook secret of the project's secrets will be applied to the plans backend" : "billing: switched off, so the stored Stripe settings will be removed from the plans backend"
+      inputs.billingOn ? "billing: a plan has a price, so the Stripe key and webhook secret of the project's secrets will be applied to the plans backend" : "billing: no plan has a price, so the stored Stripe settings will be removed from the plans backend"
     ] : [],
     ...steps.map(
       (name) => `step ${name}: ${stepState(stepOf(ledger, "plans", name), hashes[name])}`
@@ -27384,7 +27520,7 @@ async function planPortalService(resolved, ledger) {
     const hash2 = await portalBuildHash(resolved, prepared);
     const previous = stepOf(ledger, "portal", "build");
     const built = await exists5(
-      path77.join(resolved.state.buildDir, "index.html")
+      path78.join(resolved.state.buildDir, "index.html")
     );
     if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
       return {
@@ -27743,7 +27879,7 @@ async function statusV2(dir, only, options = {}) {
     if (service === "portal") {
       const build2 = stepOf(ledger, "portal", "build");
       const built = await exists5(
-        path77.join(resolved.state.buildDir, "index.html")
+        path78.join(resolved.state.buildDir, "index.html")
       );
       const state = build2?.status === "failed" ? "build-failed" : build2?.status === "succeeded" && built ? "built" : "not-built";
       services.push({
@@ -27754,7 +27890,7 @@ async function statusV2(dir, only, options = {}) {
           ...build2?.finishedAt ? [`last build: ${build2.finishedAt}`] : [],
           ...build2?.status === "failed" ? [`error: ${build2.error ?? "unknown"}`] : [],
           ...state === "built" ? [
-            `output: ${path77.relative(resolved.configDir, resolved.state.buildDir)}`
+            `output: ${path78.relative(resolved.configDir, resolved.state.buildDir)}`
           ] : [],
           ...url2 ? [`url: ${url2}`] : ["url: not known (portal is not deployed yet)"],
           ...await hostingLine(resolved, manifest, options.hostingRemote)
@@ -27821,7 +27957,7 @@ function formatStatus(output4) {
 
 // src/cli/deploy/static-web-config.ts
 import { access as access10, writeFile as writeFile22 } from "node:fs/promises";
-import path78 from "node:path";
+import path79 from "node:path";
 var STATIC_WEB_CONFIG_FILE = "staticwebapp.config.json";
 var STATIC_WEB_CONFIG_VERSION = 3;
 var CLIENT_ONLY_ROUTES = [
@@ -27839,7 +27975,7 @@ var DEFAULT_STATIC_WEB_CONFIG = {
   }
 };
 async function ensureStaticWebConfig(buildDir) {
-  const file = path78.join(buildDir, STATIC_WEB_CONFIG_FILE);
+  const file = path79.join(buildDir, STATIC_WEB_CONFIG_FILE);
   try {
     await access10(file);
     return false;
@@ -28190,7 +28326,7 @@ function formatDeploy(output4) {
 // src/cli/deploy/command.ts
 async function ensureLinkedProject(argv, deps) {
   if (argv.projectId?.trim() || deps.envProjectId?.trim()) return true;
-  const dir = path79.resolve(process.cwd(), argv.dir);
+  const dir = path80.resolve(process.cwd(), argv.dir);
   let linked;
   try {
     linked = Boolean(loadConfigV2(dir).resolved.project.id);
@@ -28220,6 +28356,18 @@ async function deployProject(argv) {
     createProject: (dir) => createLinkedProject({ dir }, dir, { continuingDeploy: true })
   });
   if (!ready) return;
+  try {
+    await ensureStripeKey(argv, {
+      client: () => new PlatformApiClient(loadConfig()),
+      envProjectId: process.env.APITOGO_DEFAULT_PROJECT_ID,
+      interactive,
+      askHidden: (prompt) => readHidden(prompt),
+      print: printDiagnosticsToConsole
+    });
+  } catch (error) {
+    await reportFailure(error, json);
+    return;
+  }
   const quiet = json || argv.verbose !== true;
   if (quiet) applyJsonOnlyDeployQuietMode();
   if (!json && quiet)
@@ -28230,7 +28378,7 @@ async function deployProject(argv) {
     const config2 = loadConfig();
     const output4 = await deployV2(
       {
-        dir: path79.resolve(process.cwd(), argv.dir),
+        dir: path80.resolve(process.cwd(), argv.dir),
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         projectId: argv.projectId,
         env: argv.env,
@@ -28250,23 +28398,26 @@ async function deployProject(argv) {
     for (const line2 of formatDeploy(output4)) printDiagnosticsToConsole(line2);
     printResultToConsole("Deploy finished.");
   } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
-    if (json) {
-      console.log(
-        JSON.stringify({
-          status: "failed",
-          error: message,
-          hint: hint ?? null
-        })
-      );
-      process.exitCode = 1;
-      return;
-    }
-    await printCriticalFailureToConsoleAndExit(
-      hint ? `${message} ${hint}` : message
+    await reportFailure(error, json);
+  }
+}
+async function reportFailure(error, json) {
+  const message = error instanceof Error ? error.message : String(error);
+  const hint = error instanceof ApitogoError ? error.developerHint : void 0;
+  if (json) {
+    console.log(
+      JSON.stringify({
+        status: "failed",
+        error: message,
+        hint: hint ?? null
+      })
     );
+    process.exitCode = 1;
+    return;
   }
+  await printCriticalFailureToConsoleAndExit(
+    hint ? `${message} ${hint}` : message
+  );
 }
 
 // src/cli/cmds/deploy.ts
@@ -28321,7 +28472,7 @@ var deploy_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo deploy" });
-    if (await isConfigV2(path80.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path81.resolve(process.cwd(), argv.dir))) {
       await deployProject(argv);
       return;
     }
@@ -28331,7 +28482,7 @@ var deploy_default = {
 
 // src/cli/export/handler.ts
 import { mkdir as mkdir18, writeFile as writeFile23 } from "node:fs/promises";
-import path81 from "node:path";
+import path82 from "node:path";
 init_invariant();
 var ExportError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -28345,7 +28496,7 @@ async function exportOpenApi(args, deps) {
       `Cannot export "${args.target}".`,
       "Only `apitogo export openapi` exists."
     );
-  const dir = path81.resolve(process.cwd(), args.dir ?? ".");
+  const dir = path82.resolve(process.cwd(), args.dir ?? ".");
   if (!await isConfigV2(dir))
     throw new ExportError(
       "This command needs a config version 2 project.",
@@ -28370,8 +28521,8 @@ async function exportOpenApi(args, deps) {
     throw error;
   }
   if (!args.out) return { text };
-  const file = path81.resolve(process.cwd(), args.out);
-  await mkdir18(path81.dirname(file), { recursive: true });
+  const file = path82.resolve(process.cwd(), args.out);
+  await mkdir18(path82.dirname(file), { recursive: true });
   await writeFile23(file, text);
   return { text, file };
 }
@@ -28464,8 +28615,8 @@ import open3 from "open";
 import colors14 from "picocolors";
 
 // src/cli/platform/device-auth.ts
-function url(apiUrl, path95) {
-  return `${apiUrl}${path95.startsWith("/") ? path95 : `/${path95}`}`;
+function url(apiUrl, path96) {
+  return `${apiUrl}${path96.startsWith("/") ? path96 : `/${path96}`}`;
 }
 async function requestDeviceCode(apiUrl) {
   const response = await fetchWithRetry(
@@ -28647,7 +28798,7 @@ var logout_default = {
 };
 
 // src/cli/portal/commands.ts
-import path82 from "node:path";
+import path83 from "node:path";
 init_invariant();
 function parseOnly(value) {
   if (value === void 0) return void 0;
@@ -28664,7 +28815,7 @@ function parseOnly(value) {
 async function run2(command2, argv, compute, format) {
   const json = argv.json === true;
   try {
-    const dir = path82.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path83.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${command2} works with a config version 2 project, and there is none in ${dir}.`,
@@ -28880,14 +29031,14 @@ var remove_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path85 from "node:path";
+import path86 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs11 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path84 from "node:path";
+import path85 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -28920,7 +29071,7 @@ init_loader();
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path83 from "node:path";
+import path84 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -28973,7 +29124,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path83.join(vite.config.publicDir, "pagefind");
+  const outputPath = path84.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -28992,9 +29143,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.options;
     const [key, cert, ca] = await Promise.all([
-      fs11.readFile(path84.resolve(dir, config2.https.key)),
-      fs11.readFile(path84.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs11.readFile(path84.resolve(dir, config2.https.ca)) : void 0
+      fs11.readFile(path85.resolve(dir, config2.https.key)),
+      fs11.readFile(path85.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs11.readFile(path85.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -29011,7 +29162,7 @@ var DevServer = class {
     );
     const server = await this.createNodeServer(config2);
     if (config2.search?.type === "pagefind" && viteConfig.publicDir !== false) {
-      const publicRoot = path84.resolve(
+      const publicRoot = path85.resolve(
         this.options.dir,
         typeof viteConfig.publicDir === "string" ? viteConfig.publicDir : "public"
       );
@@ -29028,7 +29179,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "apitogo:entry-client",
           configureServer(server2) {
-            const entryPath = path84.posix.join(
+            const entryPath = path85.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -29193,7 +29344,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson3 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  let dir = path85.resolve(process.cwd(), argv.dir);
+  let dir = path86.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(dir)) {
     const { root, prepared } = await preparePortalWorkspace(dir, "development");
     dir = root;
@@ -29292,61 +29443,8 @@ var run_default = {
 };
 
 // src/cli/secrets/handler.ts
-import path86 from "node:path";
+import path87 from "node:path";
 init_invariant();
-
-// src/cli/secrets/input.ts
-import { createInterface as createInterface6 } from "node:readline/promises";
-var CTRL_C = "";
-var CTRL_D = "";
-function readHidden(prompt, input5 = process.stdin, output4 = process.stdout) {
-  return new Promise((resolve, reject) => {
-    if (!input5.isTTY || !input5.setRawMode) {
-      reject(new Error("A hidden prompt needs an interactive terminal."));
-      return;
-    }
-    let value = "";
-    output4.write(prompt);
-    input5.setRawMode(true);
-    input5.resume();
-    const finish = (action) => {
-      input5.removeListener("data", onData);
-      input5.setRawMode?.(false);
-      input5.pause();
-      output4.write("\n");
-      action();
-    };
-    const onData = (chunk) => {
-      for (const char of chunk.toString("utf8")) {
-        if (char === CTRL_C)
-          return finish(() => reject(new Error("Cancelled.")));
-        if (char === "\r" || char === "\n" || char === CTRL_D)
-          return finish(() => resolve(value));
-        if (char === "\x7F" || char === "\b") value = value.slice(0, -1);
-        else value += char;
-      }
-    };
-    input5.on("data", onData);
-  });
-}
-async function readStdin(input5 = process.stdin) {
-  const chunks = [];
-  for await (const chunk of input5) {
-    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
-  }
-  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
-}
-async function confirm(question) {
-  const rl = createInterface6({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = (await rl.question(question)).trim().toLowerCase();
-    return answer === "y" || answer === "yes";
-  } finally {
-    rl.close();
-  }
-}
-
-// src/cli/secrets/handler.ts
 var SECRET_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
 var SecretsError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -29357,7 +29455,7 @@ var SecretsError = class extends ApitogoError {
 async function resolveProjectId2(argv, deps) {
   const explicit = argv.projectId?.trim();
   if (explicit) return explicit;
-  const dir = path86.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path87.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     const id = loadConfigV2(dir).resolved.project.id;
     if (id) return id;
@@ -29517,12 +29615,12 @@ var secrets_default = {
 };
 
 // src/cli/cmds/status.ts
-import path88 from "node:path";
+import path89 from "node:path";
 
 // src/cli/status/handler.ts
-import path87 from "node:path";
+import path88 from "node:path";
 async function status(argv) {
-  const sourceDirectory = path87.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path88.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -29620,7 +29718,7 @@ var status_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo status" });
-    if (await isConfigV2(path88.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path89.resolve(process.cwd(), argv.dir))) {
       await statusOfProject(argv);
       return;
     }
@@ -29629,11 +29727,11 @@ var status_default = {
 };
 
 // src/cli/cmds/teardown.ts
-import path91 from "node:path";
+import path92 from "node:path";
 
 // src/cli/teardown/command.ts
 init_invariant();
-import path89 from "node:path";
+import path90 from "node:path";
 import { createInterface as createInterface7 } from "node:readline/promises";
 
 // src/cli/teardown/v2.ts
@@ -29994,7 +30092,7 @@ async function teardownProject(argv) {
     const progress = createConsoleProgressReporter();
     const result = await teardownV2(
       {
-        dir: path89.resolve(process.cwd(), argv.dir),
+        dir: path90.resolve(process.cwd(), argv.dir),
         projectId: argv.projectId,
         only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
         yes: argv.yes === true,
@@ -30053,7 +30151,7 @@ async function teardownProject(argv) {
 }
 
 // src/cli/teardown/handler.ts
-import path90 from "node:path";
+import path91 from "node:path";
 function resultLooksFailed3(payload) {
   try {
     const parsed = JSON.parse(payload);
@@ -30069,7 +30167,7 @@ async function teardown(argv) {
     );
     return;
   }
-  const sourceDirectory = path90.resolve(process.cwd(), argv.dir);
+  const sourceDirectory = path91.resolve(process.cwd(), argv.dir);
   let config2;
   try {
     config2 = loadConfig();
@@ -30147,7 +30245,7 @@ var teardown_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo teardown" });
-    if (await isConfigV2(path91.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path92.resolve(process.cwd(), argv.dir))) {
       await teardownProject(argv);
       return;
     }
@@ -30157,7 +30255,7 @@ var teardown_default = {
 
 // src/cli/teardown/reset-command.ts
 init_invariant();
-import path92 from "node:path";
+import path93 from "node:path";
 
 // src/cli/teardown/reset.ts
 init_invariant();
@@ -30280,7 +30378,7 @@ async function resetProject(argv) {
     const config2 = loadConfig();
     const result = await resetProjectV2(
       {
-        dir: path92.resolve(process.cwd(), argv.dir),
+        dir: path93.resolve(process.cwd(), argv.dir),
         projectId: argv.projectId,
         yes: argv.yes === true
       },
@@ -30344,7 +30442,7 @@ var test_reset_default = {
 };
 
 // src/cli/test-sign-in/handler.ts
-import path93 from "node:path";
+import path94 from "node:path";
 init_invariant();
 var TestSignInError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -30355,7 +30453,7 @@ var TestSignInError = class extends ApitogoError {
 async function resolveProjectId3(argv) {
   const explicit = argv.projectId?.trim();
   if (explicit) return explicit;
-  const dir = path93.resolve(process.cwd(), argv.dir ?? ".");
+  const dir = path94.resolve(process.cwd(), argv.dir ?? ".");
   if (await isConfigV2(dir)) {
     const id = loadConfigV2(dir).resolved.project.id;
     if (id) return id;
@@ -30495,36 +30593,36 @@ function createApitogoCli(argv) {
 // src/cli/local-handoff.ts
 import { spawn as spawn4 } from "node:child_process";
 import { existsSync as existsSync8, realpathSync as realpathSync2 } from "node:fs";
-import path94 from "node:path";
+import path95 from "node:path";
 var LOCAL_HANDOFF_ENV = "APITOGO_LOCAL_CLI";
 var PACKAGE_NAME = "@lukoweb/apitogo";
 var resolveProjectDir = (argv, cwd) => {
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     const next = argv[i + 1];
-    if (arg === "--dir" && next) return path94.resolve(cwd, next);
+    if (arg === "--dir" && next) return path95.resolve(cwd, next);
     if (arg?.startsWith("--dir=")) {
-      return path94.resolve(cwd, arg.slice("--dir=".length));
+      return path95.resolve(cwd, arg.slice("--dir=".length));
     }
   }
   return cwd;
 };
 var findLocalCli = (projectDir, runningRoot) => {
-  let dir = path94.resolve(projectDir);
+  let dir = path95.resolve(projectDir);
   let localPackageRoot;
   while (!localPackageRoot) {
-    const candidate = path94.join(dir, "node_modules", PACKAGE_NAME);
-    if (existsSync8(path94.join(candidate, "package.json"))) {
+    const candidate = path95.join(dir, "node_modules", PACKAGE_NAME);
+    if (existsSync8(path95.join(candidate, "package.json"))) {
       localPackageRoot = candidate;
-    } else if (dir === path94.dirname(dir)) {
+    } else if (dir === path95.dirname(dir)) {
       return void 0;
     } else {
-      dir = path94.dirname(dir);
+      dir = path95.dirname(dir);
     }
   }
   const localRoot = realpathSync2(localPackageRoot);
   if (localRoot === realpathSync2(runningRoot)) return void 0;
-  return path94.join(localRoot, "cli.js");
+  return path95.join(localRoot, "cli.js");
 };
 var handoffToLocalCli = async (argv, runningRoot) => {
   if (process.env[LOCAL_HANDOFF_ENV] || process.env.ZUDOKU_ENV === "internal") {
@@ -30536,7 +30634,7 @@ var handoffToLocalCli = async (argv, runningRoot) => {
   );
   if (!localCli) return void 0;
   printDiagnosticsToConsole(
-    `Using the project's local ${PACKAGE_NAME} (${path94.dirname(localCli)})`
+    `Using the project's local ${PACKAGE_NAME} (${path95.dirname(localCli)})`
   );
   const child = spawn4(process.execPath, [localCli, ...argv], {
     stdio: "inherit",