@lukoweb/apitogo 0.2.54 → 0.2.56

package/dist/cli/cli.js

@@ -8418,6 +8418,13 @@ async function preparePortal(resolved, manifest, mode, options = {}) {
   for (const page of tsxPages)
     if (page.order !== void 0 && !pageOrders.has(page.route))
       pageOrders.set(page.route, page.order);
+  if (plan2.plansPlugin) {
+    const featured = (await readDemoPlans(resolved.plans?.file))?.find(
+      (item) => typeof item === "object" && item !== null && item.featured === true && typeof item.sku === "string"
+    );
+    if (featured)
+      plan2.plansPlugin.featuredPlanSku = featured.sku.trim().toLowerCase();
+  }
   if (plan2.plansPlugin && plan2.docs) {
     const landing = hostedDocRoutes.some(
       (route) => route === "/" || route === "/index"
@@ -9022,21 +9029,23 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
-        rateLimit: { calls: 3, periodSeconds: 60 },
+        // The platform's Free tier allows at most 60 calls per minute per plan (its rate_limit_per_minute ceiling).
+        rateLimit: { calls: 60, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     }
   ],
-  // Sample plans for the starter: a free plan and two with a price on request, so they show on the pricing page and
-  // the home page and still deploy on a Free project (a plan with a price needs a paid platform plan and billing).
+  // Sample plans for the full template: a free plan and one paid example (API-124). The example's price is in the file
+  // but it is a contact-us plan, so the first deploy works on a Free project (a plan with a price needs Starter or
+  // Professional and billing). `apitogo plan` names the command that starts selling it. It has no limits of its own,
+  // so it stays within any project's ceiling until the tenant sets them.
   starter: [
     {
       sku: "free",
       displayName: "Free",
       default: true,
       limits: {
-        rateLimit: { calls: 3, periodSeconds: 60 },
+        rateLimit: { calls: 60, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     },
@@ -9044,13 +9053,10 @@ var PLAN_TEMPLATES = {
       sku: "pro",
       displayName: "Pro",
       pricingModel: "custom",
-      priceLabel: "Contact us"
-    },
-    {
-      sku: "enterprise",
-      displayName: "Enterprise",
-      pricingModel: "custom",
-      priceLabel: "Contact us"
+      priceLabel: "Contact us",
+      priceAmount: 19,
+      priceCurrency: "usd",
+      billingInterval: "month"
     }
   ],
   tiered: [
@@ -9059,8 +9065,8 @@ var PLAN_TEMPLATES = {
       displayName: "Free",
       default: true,
       limits: {
-        // The platform's Free tier allows at most 3 calls per 60 seconds per plan; a higher number is refused.
-        rateLimit: { calls: 3, periodSeconds: 60 },
+        // The platform's Free tier allows at most 60 calls per minute per plan (its rate_limit_per_minute ceiling).
+        rateLimit: { calls: 60, periodSeconds: 60 },
         quota: { calls: 1e3, periodDays: 30 }
       }
     },
@@ -10295,6 +10301,17 @@ var PlatformApiClient = class {
       `/api/v1/projects/${projectId}/dev-portal/identity-link`
     );
   }
+  /** The active platform hosting plans, the list apitogo.com shows. */
+  listPlatformPlans() {
+    return this.request("GET", "/api/v1/platform-plans");
+  }
+  /** Whether Stripe events reach the project's plans backend; null when there is none or it did not answer. */
+  getBillingWebhookStatus(projectId) {
+    return this.request(
+      "GET",
+      `/api/v1/projects/${projectId}/dev-portal/billing/webhook-status`
+    );
+  }
   getDevPortalBackend(projectId) {
     return this.request(
       "GET",
@@ -10861,7 +10878,7 @@ import {
 // package.json
 var package_default = {
   name: "@lukoweb/apitogo",
-  version: "0.2.54",
+  version: "0.2.56",
   type: "module",
   sideEffects: [
     "**/*.css",
@@ -16020,6 +16037,8 @@ var PlanFilePlanSchema = z14.strictObject({
   pricingModel: z14.enum(["fixed", "custom"]).optional(),
   priceLabel: z14.string().optional(),
   sortOrder: z14.int().optional(),
+  /** Shown as "Popular" on the pricing page (API-124). Only the portal reads it; the platform never sees it. */
+  featured: z14.boolean().optional(),
   /** Action keys such as `get:/orders`. Left out, the plan includes every action of the gateway. */
   includedActions: z14.array(z14.string().trim().min(1)).optional()
 });
@@ -16095,15 +16114,16 @@ function toPlatformPlans(plans, options = {}) {
         }
       } : {}
     } : void 0;
+    const custom = plan2.pricingModel === "custom";
     return {
       sku: plan2.sku.trim().toLowerCase(),
       displayName: plan2.displayName,
       ...limits ? { limitsJson: JSON.stringify(limits) } : {},
       includedActionKeys: plan2.includedActions ?? null,
       ...plan2.pricingModel ? { pricingModel: plan2.pricingModel } : {},
-      ...plan2.priceAmount !== void 0 ? { priceAmount: plan2.priceAmount } : {},
+      ...plan2.priceAmount !== void 0 && !custom ? { priceAmount: plan2.priceAmount } : {},
       ...plan2.priceLabel !== void 0 ? { priceLabel: plan2.priceLabel } : {},
-      ...plan2.priceCurrency ? { priceCurrency: plan2.priceCurrency } : {},
+      ...plan2.priceCurrency && !custom ? { priceCurrency: plan2.priceCurrency } : {},
       ...plan2.billingInterval ? { billingPeriod: BILLING_PERIOD[plan2.billingInterval] } : {},
       sortOrder: plan2.sortOrder ?? index
     };
@@ -19378,7 +19398,7 @@ function buildWizardPlan(input5) {
     } : {}
   });
 }
-async function upsertPlan(project, plan2) {
+async function readPlanCatalog(project) {
   const plans = project.resolved.plans;
   if (!plans) {
     throw new ConfigEditError(
@@ -19404,27 +19424,129 @@ async function upsertPlan(project, plan2) {
     }
     catalog = { version: 1, plans: raw.plans };
   }
-  const index = catalog.plans.findIndex(
-    (item) => isPlainObject3(item) && typeof item.sku === "string" && item.sku.trim().toLowerCase() === plan2.sku
-  );
-  const next = [...catalog.plans];
-  if (index === -1) next.push(plan2);
-  else next[index] = plan2;
-  await mkdir15(path62.dirname(plans.file), { recursive: true });
+  return { file: plans.file, billing: plans.billing, catalog };
+}
+var skuOf = (item) => isPlainObject3(item) && typeof item.sku === "string" ? item.sku.trim().toLowerCase() : void 0;
+async function writePlanCatalog(file, catalog, plans) {
+  await mkdir15(path62.dirname(file), { recursive: true });
   await writeFile18(
-    plans.file,
-    `${JSON.stringify({ ...catalog, plans: next }, null, 2)}
+    file,
+    `${JSON.stringify({ ...catalog, plans }, null, 2)}
 `,
     "utf8"
   );
+}
+async function upsertPlan(project, plan2) {
+  const { file, billing, catalog } = await readPlanCatalog(project);
+  const index = catalog.plans.findIndex((item) => skuOf(item) === plan2.sku);
+  const next = plan2.featured ? catalog.plans.map((item) => {
+    if (!isPlainObject3(item) || item.featured !== true) return item;
+    const { featured: _featured, ...rest } = item;
+    return rest;
+  }) : [...catalog.plans];
+  if (index === -1) next.push(plan2);
+  else next[index] = plan2;
+  await writePlanCatalog(file, catalog, next);
   const paid = isPaidPlan(plan2);
   return {
     action: index === -1 ? "added" : "updated",
     sku: plan2.sku,
-    file: toPosix2(path62.relative(project.dir, plans.file)),
+    file: toPosix2(path62.relative(project.dir, file)),
     paid,
-    needsBilling: paid && plans.billing.provider !== "stripe"
+    needsBilling: paid && billing.provider !== "stripe"
+  };
+}
+var pairOf = (value, flag, unit) => {
+  const match = /^\s*(\d+)\s*\/\s*(\d+)\s*$/.exec(value);
+  const calls = match?.[1] ? Number(match[1]) : Number.NaN;
+  const period = match?.[2] ? Number(match[2]) : Number.NaN;
+  if (!(calls > 0) || !(period > 0)) {
+    throw new ConfigEditError(
+      `${flag} must be <calls>/<${unit}>, both whole numbers above 0, not "${value}".`,
+      flag === "--plan-rate" ? "For example --plan-rate 60/60 is 60 calls per minute." : "For example --plan-quota 50000/30 is 50,000 calls per 30 days."
+    );
+  }
+  return [calls, period];
+};
+async function planFromFlags(project, flags) {
+  const sku = flags.sku.trim().toLowerCase();
+  if (!sku) throw new ConfigEditError("--plan-sku must not be empty.");
+  const { catalog } = await readPlanCatalog(project);
+  const existing = catalog.plans.find((item) => skuOf(item) === sku);
+  const base = isPlainObject3(existing) ? { ...existing } : {};
+  const plan2 = {
+    ...base,
+    sku,
+    displayName: flags.name?.trim() || (typeof base.displayName === "string" ? base.displayName : void 0) || sku.charAt(0).toUpperCase() + sku.slice(1)
   };
+  if (flags.price !== void 0) {
+    const price = flags.price.trim().toLowerCase();
+    if (price === "custom") {
+      plan2.pricingModel = "custom";
+      plan2.priceLabel = typeof base.priceLabel === "string" ? base.priceLabel : "Contact us";
+      delete plan2.priceAmount;
+      delete plan2.priceCurrency;
+      delete plan2.billingInterval;
+    } else {
+      const amount = Number(price);
+      if (!Number.isFinite(amount) || amount < 0) {
+        throw new ConfigEditError(
+          `--plan-price must be an amount (0 for free) or "custom", not "${flags.price}".`,
+          "For example --plan-price 19 for 19 a month, or --plan-price custom for a contact-us plan."
+        );
+      }
+      delete plan2.pricingModel;
+      delete plan2.priceLabel;
+      plan2.priceAmount = amount;
+      if (amount > 0) {
+        plan2.priceCurrency = flags.currency?.trim().toLowerCase() || base.priceCurrency || "usd";
+        plan2.billingInterval = flags.interval ?? base.billingInterval ?? "month";
+      } else {
+        delete plan2.priceCurrency;
+        delete plan2.billingInterval;
+      }
+    }
+  } else {
+    if (flags.currency !== void 0)
+      plan2.priceCurrency = flags.currency.trim().toLowerCase();
+    if (flags.interval !== void 0) plan2.billingInterval = flags.interval;
+  }
+  const limits = isPlainObject3(base.limits) ? { ...base.limits } : {};
+  if (flags.rate !== void 0) {
+    const [calls, periodSeconds] = pairOf(flags.rate, "--plan-rate", "seconds");
+    limits.rateLimit = { calls, periodSeconds };
+  }
+  if (flags.quota !== void 0) {
+    const [calls, periodDays] = pairOf(flags.quota, "--plan-quota", "days");
+    limits.quota = { calls, periodDays };
+  }
+  if (Object.keys(limits).length > 0) plan2.limits = limits;
+  if (flags.order !== void 0) {
+    if (!Number.isInteger(flags.order)) {
+      throw new ConfigEditError(
+        `--plan-order must be a whole number, not ${flags.order}.`,
+        "Lower numbers come first on the pricing page."
+      );
+    }
+    plan2.sortOrder = flags.order;
+  }
+  if (flags.featured === true) plan2.featured = true;
+  else if (flags.featured === false) delete plan2.featured;
+  return parsePlan(plan2);
+}
+async function removePlan(project, rawSku) {
+  const sku = rawSku.trim().toLowerCase();
+  const { file, catalog } = await readPlanCatalog(project);
+  const next = catalog.plans.filter((item) => skuOf(item) !== sku);
+  if (next.length === catalog.plans.length) {
+    const known = catalog.plans.map(skuOf).filter(Boolean).join(", ");
+    throw new ConfigEditError(
+      `There is no plan "${sku}" in ${toPosix2(path62.relative(project.dir, file))}.`,
+      known ? `The plans are: ${known}.` : "The plans file has no plans."
+    );
+  }
+  await writePlanCatalog(file, catalog, next);
+  return { sku, file: toPosix2(path62.relative(project.dir, file)) };
 }
 
 // src/cli/make-config/wrap-up.ts
@@ -19457,7 +19579,7 @@ function printPageResult(page) {
     );
   }
 }
-function printPlanResult(plan2) {
+function printPlanResult(plan2, platformTier) {
   printSuccessToConsole(`Plan "${plan2.sku}" ${plan2.action} in ${plan2.file}.`);
   if (plan2.needsBilling) {
     printWarningToConsole(
@@ -19469,7 +19591,8 @@ function printPlanResult(plan2) {
       "Payments go through Stripe: apitogo deploy asks for your Stripe secret key if the project has none yet."
     );
   }
-  if (plan2.paid) printPaidPlanPlatformWarning();
+  if (plan2.paid && (platformTier === void 0 || platformTier.toLowerCase() === "free"))
+    printPaidPlanPlatformWarning();
 }
 function printPaidPlanPlatformWarning() {
   printWarningToConsole(
@@ -19642,7 +19765,7 @@ async function promptMakeConfigInteractive(handlers) {
 
 // src/cli/make-config/handler.ts
 function hasMutatorFlags(argv) {
-  return argv.title !== void 0 || argv.openapi !== void 0 || argv.source !== void 0 || argv.runtime !== void 0 || argv.runtimeVersion !== void 0 || argv.pageSlug !== void 0 || argv.plan !== void 0 || argv.patch !== void 0 || argv.json === true;
+  return argv.title !== void 0 || argv.openapi !== void 0 || argv.source !== void 0 || argv.runtime !== void 0 || argv.runtimeVersion !== void 0 || argv.pageSlug !== void 0 || argv.plan !== void 0 || argv.planSku !== void 0 || argv.removePlan !== void 0 || argv.patch !== void 0 || argv.json === true;
 }
 function shouldRunInteractive(argv) {
   if (argv.interactive === true) return true;
@@ -19656,6 +19779,15 @@ var describeError = (error) => {
   return hint ? `${error.message}
 ${hint}` : error.message;
 };
+async function platformTierOf(project) {
+  const projectId = project.resolved.project.id;
+  if (!projectId) return void 0;
+  try {
+    return (await new PlatformApiClient(loadConfig()).getSubscription(projectId)).planTier;
+  } catch {
+    return void 0;
+  }
+}
 async function applyConfigFlags(project, argv, changes) {
   let next = project;
   let openApi = null;
@@ -19704,6 +19836,7 @@ async function makeConfig(argv) {
     let openApi = null;
     let page = null;
     let plan2 = null;
+    let removed = null;
     if (interactive) {
       const prompted = await promptMakeConfigInteractive({
         defaultSource: project.config.gateway?.origin.source,
@@ -19755,6 +19888,31 @@ async function makeConfig(argv) {
           changes.push(plan2.action === "added" ? "plan_add" : "plan_update");
         }
       }
+      if (argv.planSku !== void 0) {
+        plan2 = await upsertPlan(
+          project,
+          await planFromFlags(project, {
+            sku: argv.planSku,
+            name: argv.planName,
+            price: argv.planPrice,
+            currency: argv.planCurrency,
+            interval: argv.planInterval,
+            rate: argv.planRate,
+            quota: argv.planQuota,
+            order: argv.planOrder,
+            featured: argv.planFeatured
+          })
+        );
+        changes.push(plan2.action === "added" ? "plan_add" : "plan_update");
+      } else if (argv.planName !== void 0 || argv.planPrice !== void 0 || argv.planRate !== void 0 || argv.planQuota !== void 0 || argv.planOrder !== void 0 || argv.planFeatured !== void 0) {
+        throw new ApitogoError("The --plan-* options need --plan-sku.", {
+          developerHint: "Name the plan they change, for example --plan-sku pro --plan-price 19."
+        });
+      }
+      if (argv.removePlan !== void 0) {
+        removed = await removePlan(project, argv.removePlan);
+        changes.push("plan_remove");
+      }
     }
     const message = changes.length === 0 ? "Nothing to change." : (
       // The change codes (page_add, plan_update, ...) are for scripts: they stay in the JSON output (API-126).
@@ -19771,6 +19929,7 @@ async function makeConfig(argv) {
             openApi,
             page,
             plan: plan2,
+            removed,
             message
           },
           null,
@@ -19786,7 +19945,15 @@ async function makeConfig(argv) {
         );
       }
       if (page) printPageResult(page);
-      if (plan2) printPlanResult(plan2);
+      if (plan2)
+        printPlanResult(
+          plan2,
+          plan2.paid ? await platformTierOf(project) : void 0
+        );
+      if (removed)
+        printSuccessToConsole(
+          `Removed plan "${removed.sku}" from ${removed.file}. Run \`apitogo plan\` to see what deploy does with it.`
+        );
       printResultToConsole(message);
     }
   } catch (error) {
@@ -19852,7 +20019,44 @@ function addConfigOptions(yargs2) {
     type: "boolean",
     default: false,
     describe: "Update an existing page instead of adding one"
-  }).option("plan", {
+  }).option("plan-sku", {
+    type: "string",
+    describe: "Add or change the plan with this SKU in the plans file; the --plan-* options set its fields"
+  }).option("plan-name", {
+    type: "string",
+    describe: "Name of --plan-sku on the pricing page (default: the SKU, capitalised)"
+  }).option("plan-price", {
+    type: "string",
+    describe: "Price of --plan-sku per interval: an amount such as 19 (0 is free), or custom for a contact-us plan"
+  }).option("plan-currency", {
+    type: "string",
+    describe: "Currency of --plan-price (default: usd)"
+  }).option("plan-interval", {
+    type: "string",
+    choices: ["month", "year"],
+    describe: "How often --plan-price is charged (default: month)"
+  }).option("plan-rate", {
+    type: "string",
+    describe: "Rate limit of --plan-sku as <calls>/<seconds>, for example 60/60"
+  }).option("plan-quota", {
+    type: "string",
+    describe: "Quota of --plan-sku as <calls>/<days>, for example 50000/30"
+  }).option("plan-order", {
+    type: "number",
+    describe: "Place of --plan-sku on the pricing page: lower numbers come first"
+  }).option("plan-featured", {
+    type: "boolean",
+    describe: 'Show --plan-sku as "Popular" on the pricing page (--no-plan-featured takes it off); no plan is unless you say so'
+  }).option("remove-plan", {
+    type: "string",
+    describe: "Take the plan with this SKU out of the plans file"
+  }).example(
+    "$0 config --plan-sku pro --plan-name Pro --plan-price 19 --plan-rate 60/60 --plan-quota 50000/30",
+    "A paid plan: 19 USD a month, 60 calls a minute, 50,000 calls per 30 days"
+  ).example(
+    "$0 config --plan-sku enterprise --plan-price custom",
+    "A contact-us plan"
+  ).example("$0 config --remove-plan enterprise", "Take a plan out").option("plan", {
     type: "string",
     describe: "JSON plan added to the plans file (plans.file, default apitogo/plans.json), or replacing the one with the same sku"
   }).option("patch", {
@@ -20199,7 +20403,7 @@ var create_default = {
 };
 
 // src/cli/cmds/deploy.ts
-import path83 from "node:path";
+import path84 from "node:path";
 
 // src/cli/apply/handler.ts
 import path77 from "node:path";
@@ -22667,6 +22871,25 @@ var PLATFORM_PLAN_CATALOG = [
     ]
   }
 ];
+var CHOOSABLE = ["free", "starter", "professional"];
+function toPlanDisplays(plans) {
+  return [...plans].sort((a, b) => a.sortOrder - b.sortOrder).map((plan2) => ({
+    id: plan2.id,
+    displayName: plan2.displayName,
+    priceLabel: [plan2.priceAmount, plan2.pricePeriod].map((part) => part?.trim()).filter(Boolean).join(" "),
+    summary: plan2.tagline,
+    features: plan2.highlights,
+    limitations: CHOOSABLE.includes(plan2.id) ? [] : [`Not chosen here: ${plan2.ctaLabel || "contact us"} on apitogo.com.`]
+  }));
+}
+async function loadPlanDisplays(listPlatformPlans) {
+  try {
+    const plans = await listPlatformPlans();
+    if (plans.length > 0) return toPlanDisplays(plans);
+  } catch {
+  }
+  return PLATFORM_PLAN_CATALOG;
+}
 var PLATFORM_PLAN_USER_PROMPT = "Which API ToGo platform plan do you want for this project \u2014 Free, Starter, or Professional?";
 function formatFreeProjectsQuotaHint(quota) {
   if (quota.remaining > 0) {
@@ -25637,9 +25860,9 @@ function printPlanOptions(catalog) {
     }
   }
 }
-async function pickPlatformPlan() {
+async function pickPlatformPlan(loadPlans = async () => PLATFORM_PLAN_CATALOG) {
   printDiagnosticsToConsole("Which API ToGo plan should this project use?");
-  printPlanOptions(PLATFORM_PLAN_CATALOG);
+  printPlanOptions(await loadPlans());
   printDiagnosticsToConsole("");
   return askPlanChoice();
 }
@@ -25982,7 +26205,7 @@ async function apply(argv) {
 }
 
 // src/cli/deploy/command.ts
-import path82 from "node:path";
+import path83 from "node:path";
 init_invariant();
 
 // src/cli/project/create-handler.ts
@@ -26201,7 +26424,11 @@ async function createLinkedProject(argv, dir, options = {}) {
     assertConfigChecksOut(await runCheckV2(dir));
     let plan2 = argv.plan;
     if (!plan2 && !json && process.stdin.isTTY && process.stdout.isTTY && !loadConfigV2(dir).resolved.project.id) {
-      const picked = await pickPlatformPlan();
+      const picked = await pickPlatformPlan(
+        () => loadPlanDisplays(
+          () => new PlatformApiClient(loadConfig()).listPlatformPlans()
+        )
+      );
       if (!picked) {
         printResultToConsole(
           "No plan selected. Run `apitogo project create --plan free|starter|professional` when you are ready."
@@ -26355,6 +26582,10 @@ async function createProject2(argv) {
   }
 }
 
+// src/cli/secrets/handler.ts
+import path79 from "node:path";
+init_invariant();
+
 // src/cli/secrets/input.ts
 import { createInterface as createInterface6 } from "node:readline/promises";
 var CTRL_C = "";
@@ -26406,8 +26637,164 @@ async function confirm(question) {
   }
 }
 
+// src/cli/secrets/handler.ts
+var SECRET_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+var SecretsError = class extends ApitogoError {
+  constructor(message, developerHint) {
+    super(message, { developerHint, title: "Cannot change secrets" });
+    this.name = "SecretsError";
+  }
+};
+async function resolveProjectId2(argv, deps) {
+  const explicit = argv.projectId?.trim();
+  if (explicit) return explicit;
+  const dir = path79.resolve(process.cwd(), argv.dir ?? ".");
+  if (await isConfigV2(dir)) {
+    const id = loadConfigV2(dir).resolved.project.id;
+    if (id) return id;
+  }
+  if (deps.envProjectId?.trim()) return deps.envProjectId.trim();
+  throw new SecretsError(
+    "This folder is not linked to a project yet.",
+    "Pass --project-id <id>, run `apitogo deploy` once, or set APITOGO_DEFAULT_PROJECT_ID."
+  );
+}
+function requireName(name, action) {
+  if (!name) {
+    throw new SecretsError(
+      `secrets ${action} needs a name.`,
+      `For example: apitogo secrets ${action} STRIPE_API_KEY`
+    );
+  }
+  if (!SECRET_NAME.test(name)) {
+    throw new SecretsError(
+      `"${name}" is not a valid secret name.`,
+      "Use letters, digits and underscores, starting with a letter or underscore (at most 128 characters)."
+    );
+  }
+  return name;
+}
+async function runSecrets(argv, deps) {
+  if (!["set", "list", "rm"].includes(argv.action)) {
+    throw new SecretsError(
+      `Unknown action: ${argv.action}.`,
+      "Use set, list or rm."
+    );
+  }
+  if (argv.action === "list") {
+    const projectId2 = await resolveProjectId2(argv, deps);
+    const { secrets: secrets2 } = await deps.client.listSecrets(projectId2);
+    return { action: "list", projectId: projectId2, secrets: secrets2 };
+  }
+  const name = requireName(argv.name, argv.action);
+  const projectId = await resolveProjectId2(argv, deps);
+  if (argv.action === "rm") {
+    if (argv.yes !== true) {
+      if (!deps.isTerminal)
+        throw new SecretsError(
+          "This is not an interactive terminal.",
+          "Pass --yes to remove the secret."
+        );
+      if (!await deps.confirm(`Remove secret ${name}? (y/N) `))
+        throw new SecretsError("Cancelled. Nothing was removed.");
+    }
+    await deps.client.deleteSecret(projectId, name);
+    return { action: "rm", projectId, name };
+  }
+  let value;
+  if (deps.isTerminal) {
+    value = await deps.askValue(`Value for ${name} (hidden): `);
+    const again = await deps.askValue("Type it again: ");
+    if (again !== value)
+      throw new SecretsError(
+        "The two values are not the same. Nothing was saved."
+      );
+  } else {
+    value = await deps.readPiped();
+  }
+  if (value.length === 0)
+    throw new SecretsError("The value is empty. Nothing was saved.");
+  const result = await deps.client.setSecret(projectId, name, value);
+  const wiredTo = await wireKnownSecret(argv, result.name);
+  return {
+    action: "set",
+    projectId,
+    name: result.name,
+    created: result.created,
+    ...wiredTo ? { wiredTo } : {}
+  };
+}
+var KNOWN_SECRET_PLACES = {
+  STRIPE_WEBHOOK: {
+    path: "plans.billing.webhookSecret",
+    patch: { plans: { billing: { webhookSecret: "secret:STRIPE_WEBHOOK" } } }
+  }
+};
+async function wireKnownSecret(argv, name) {
+  const place = KNOWN_SECRET_PLACES[name.toUpperCase()];
+  if (!place) return void 0;
+  const dir = path79.resolve(process.cwd(), argv.dir ?? ".");
+  if (!await isConfigV2(dir)) return void 0;
+  const project = await openConfigProject(dir);
+  const plans = project.resolved.plans;
+  if (!plans || plans.billing.webhookSecret) return void 0;
+  await saveConfigProject(applyConfigPatch(project, place.patch));
+  return place.path;
+}
+function formatSecrets(result) {
+  if (result.action === "list") {
+    return result.secrets.length === 0 ? ["No secrets are set for this project."] : result.secrets.map((s) => `${s.name}  (updated ${s.updatedAtUtc})`);
+  }
+  if (result.action === "set") {
+    return [
+      `Secret ${result.name} ${result.created ? "created" : "replaced"}.`,
+      ...result.wiredTo ? [
+        `${result.wiredTo} now points to it. Run \`apitogo deploy --only plans\` to apply it.`
+      ] : []
+    ];
+  }
+  return [`Secret ${result.name} removed.`];
+}
+async function secrets(argv) {
+  const json = argv.json === true;
+  try {
+    const config2 = loadConfig();
+    const result = await runSecrets(argv, {
+      client: new PlatformApiClient(config2),
+      envProjectId: config2.defaultProjectId,
+      isTerminal: process.stdin.isTTY === true && !json,
+      askValue: (prompt) => readHidden(prompt),
+      readPiped: () => readStdin(),
+      confirm
+    });
+    if (json) {
+      console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));
+      return;
+    }
+    for (const line2 of formatSecrets(result)) printDiagnosticsToConsole(line2);
+    if (result.action !== "list") printResultToConsole("Done.");
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
+    if (json) {
+      console.log(
+        JSON.stringify({
+          status: "failed",
+          error: message,
+          hint: hint ?? null
+        })
+      );
+      process.exitCode = 1;
+      return;
+    }
+    await printCriticalFailureToConsoleAndExit(
+      hint ? `${message} ${hint}` : message
+    );
+  }
+}
+
 // src/cli/deploy/stripe-key.ts
-import path79 from "node:path";
+import path80 from "node:path";
 init_invariant();
 var StripeKeyError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -26425,7 +26812,7 @@ async function ensureStripeKey(argv, deps) {
   if (!wantsPlans(argv.only)) return { status: "not-needed" };
   let resolved;
   try {
-    resolved = loadConfigV2(path79.resolve(process.cwd(), argv.dir)).resolved;
+    resolved = loadConfigV2(path80.resolve(process.cwd(), argv.dir)).resolved;
   } catch {
     return { status: "not-needed" };
   }
@@ -26467,13 +26854,11 @@ async function ensureStripeKey(argv, deps) {
   return { status: "saved", name };
 }
 
-// src/cli/deploy/v2.ts
-import { rm as rm11 } from "node:fs/promises";
+// src/cli/deploy/stripe-webhook.ts
 init_invariant();
 
-// src/cli/portal/report.ts
-import { access as access9 } from "node:fs/promises";
-import path80 from "node:path";
+// src/cli/deploy/plans.ts
+init_invariant();
 
 // src/cli/deploy/gateway.ts
 import { createHash as createHash4 } from "node:crypto";
@@ -26884,723 +27269,814 @@ async function deployGateway(resolved, projectId, deps, options = {}) {
   };
 }
 
-// src/cli/deploy/identity.ts
-init_invariant();
-var IdentityDeployError = class extends ApitogoError {
+// src/cli/deploy/plans.ts
+var PlansDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
-    super(message, { developerHint, title: "Cannot deploy identity" });
+    super(message, { developerHint, title: "Cannot deploy plans" });
     this.code = code;
-    this.name = "IdentityDeployError";
+    this.name = "PlansDeployError";
   }
 };
-var IDENTITY_STEPS = ["request", "activate"];
-var IDENTITY_CONNECTIONS_STEP = "connections";
-var SECRET_PREFIX = "secret:";
-function normalizedConnections(resolved) {
-  return [...resolved.identity?.connections ?? []].map((connection) => ({
-    ...connection,
-    authority: connection.authority.trim().replace(/\/+$/, "")
-  })).sort((a, b) => a.id.localeCompare(b.id));
-}
-function identityConnectionsHash(projectId, resolved) {
-  return stableJson({
-    projectId,
-    connections: normalizedConnections(resolved)
-  });
-}
-async function recordedConnectionIds(resolved) {
-  const ids = stepOf(
-    await readLedger(resolved.state),
-    "identity",
-    IDENTITY_CONNECTIONS_STEP
-  )?.output?.ids;
-  return ids ? ids.split(",").filter(Boolean) : [];
-}
-function redirectAddressesOf(output4) {
-  return Object.entries(output4 ?? {}).filter(([key]) => key.startsWith("redirect.")).map(([key, redirectUri]) => ({
-    id: key.slice("redirect.".length),
-    redirectUri
-  }));
-}
-function connectionBody(connection) {
-  return {
-    authority: connection.authority,
-    clientId: connection.clientId,
-    clientSecret: connection.clientSecret,
-    scopes: connection.scopes,
-    displayName: connection.displayName
-  };
-}
-function referencedSecretNames(connections) {
-  return [
-    ...new Set(
-      connections.map(
-        (connection) => connection.clientSecret.slice(SECRET_PREFIX.length)
-      )
-    )
+var PLANS_STEPS = [
+  "catalog",
+  "backend",
+  "billing",
+  "identity-link"
+];
+var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var BACKEND_MODULE = "dev-portal";
+var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
+var STRIPE_WEBHOOK_PATH = "/api/v1/webhooks/stripe";
+var STRIPE_WEBHOOK_EVENTS2 = [
+  "checkout.session.completed",
+  "customer.subscription.updated",
+  "customer.subscription.deleted",
+  "invoice.payment_failed"
+];
+function billingNotes(billing) {
+  const notes = [
+    billing.mode === "live" ? "Stripe: LIVE mode. Customers pay with real money." : "Stripe: test mode. Use Stripe's test cards; no real money moves."
   ];
+  notes.push(
+    billing.hasWebhookSecret ? `Stripe webhook endpoint: ${billing.webhookUrl}` : `A payment does not activate a plan until Stripe can confirm it. In your Stripe account add the webhook endpoint ${billing.webhookUrl} (events: ${STRIPE_WEBHOOK_EVENTS2.join(", ")}), store its signing secret with "apitogo secrets set STRIPE_WEBHOOK", set plans.billing.webhookSecret to "secret:STRIPE_WEBHOOK", and deploy again.`
+  );
+  return notes;
 }
-function identityProviderSwitch(resolved, known) {
-  if (!known?.provider || !resolved.identity) return void 0;
-  const to = resolved.identity.provider ?? "apitogo";
-  return known.provider === to ? void 0 : { from: known.provider, to };
-}
-function identityProviderSwitchWarning(from, to) {
-  return `warning: the identity provider changes from ${from} to ${to}. People are known by issuer and subject, so the users, subscriptions and keys made with ${from} are not carried over to ${to}.`;
-}
-var PORTAL_CALLBACK_PATH = "/oauth/callback";
-var defaultSleep3 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-function identityNotDeployableReason(resolved) {
-  const identity = resolved.identity;
-  if (!identity) return "identity is not in the config";
-  if (identity.provider === "oidc" && (!identity.issuer || !identity.clientId))
-    return 'identity.provider "oidc" needs issuer and clientId';
-  return void 0;
+function webhookStatusLine(status2, now = Date.now()) {
+  if (!status2) return void 0;
+  if (!status2.webhookSecretConfigured)
+    return 'Stripe webhook: no signing secret yet, so a payment does not activate a plan. Add the endpoint in Stripe, then run "apitogo secrets set STRIPE_WEBHOOK" and deploy.';
+  if (!status2.lastEventAtUtc)
+    return "Stripe webhook: set up, but no event has arrived yet. Make a test payment to see that Stripe reaches it.";
+  const minutes = Math.max(
+    0,
+    Math.round((now - Date.parse(status2.lastEventAtUtc)) / 6e4)
+  );
+  const ago = minutes < 1 ? "just now" : minutes < 120 ? `${minutes} min ago` : minutes < 48 * 60 ? `${Math.round(minutes / 60)} h ago` : `${Math.round(minutes / (24 * 60))} days ago`;
+  return `Stripe webhook: verified (last event ${ago}${status2.lastEventType ? `, ${status2.lastEventType}` : ""})`;
 }
-function identityBodyForRedirect(resolved, redirectUri) {
+async function plansInputs(resolved, projectId) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
+  const billing = plans.billing;
+  const filePlans = await readPlansFile(plans.file);
+  const wanted = toPlatformPlans(filePlans, {
+    billing: billing.provider === "stripe"
+  });
+  const manifest = await readManifest(resolved.state);
+  const ledger = await readLedger(resolved.state);
+  const billingOn = billing.provider === "stripe" && filePlans.some((plan2) => isPaidPlan(plan2));
+  const billingStep = billingOn || stepOf(ledger, "plans", "billing") !== void 0;
+  const identity = manifest?.services.identity;
+  const ownIdentity = Boolean(
+    identity?.provider === "apitogo" && identity.issuer
+  );
   return {
-    portalRedirectUris: [redirectUri],
-    nativeSignup: resolved.identity?.native ?? true
+    wanted,
+    filePlans,
+    manifest,
+    ownIdentity,
+    catalogHash: stableJson({ projectId, plans: wanted }),
+    backendHash: stableJson({ projectId }),
+    billingOn,
+    billingStep,
+    // Only the references to the project's secrets: a rotated value is applied with --force.
+    billingHash: stableJson({
+      projectId,
+      provider: billingOn ? "stripe" : "none",
+      apiKey: billingOn ? billing.apiKey : void 0,
+      webhookSecret: billingOn ? billing.webhookSecret : void 0,
+      successUrl: billingOn ? billing.successUrl : void 0,
+      cancelUrl: billingOn ? billing.cancelUrl : void 0
+    }),
+    linkHash: stableJson({
+      projectId,
+      issuer: identity?.issuer,
+      clientId: identity?.clientId
+    })
   };
 }
-function identityRequestBody(resolved, portalUrl) {
-  return identityBodyForRedirect(
-    resolved,
-    `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
-  );
-}
-function identityInputsHash(projectId, body) {
-  return stableJson({ projectId, body });
-}
-async function portalUrlOf(resolved, projectId, client) {
-  const known = (await readManifest(resolved.state))?.services.portal?.url;
-  const url2 = known ?? resolveSwaUrl(await client.getProject(projectId));
-  if (!url2)
-    throw new IdentityDeployError(
-      "IDENTITY_PORTAL_ADDRESS_UNKNOWN",
-      "The portal has no public address yet, and the identity needs it for the sign-in redirect.",
-      "The address comes with the project's hosting. Run `apitogo status`: while hosting is still being prepared, wait a few minutes and run `apitogo deploy` again. Once hosting is ready, `apitogo deploy --only portal` gives the portal its address, then deploy identity."
-    );
-  return url2;
+function plansNotDeployableReason(resolved) {
+  return resolved.plans ? void 0 : "plans is not in the config";
 }
-function rejected2(error) {
-  if (error instanceof PlatformApiError && error.status === 409) {
-    throw new IdentityDeployError(
-      "IDENTITY_SETTINGS_CHANGED",
-      "This project already has an identity with other settings, and its audience and portal address cannot be changed in place.",
-      "Keep the portal address as it was, or remove the identity first (this deletes every user in it)."
-    );
+async function allActionKeys(client, projectId) {
+  const keys = [];
+  try {
+    for (let page = 1; ; page++) {
+      const result = await client.listGatewayActions(projectId, page, 100);
+      keys.push(...result.items.map((item) => item.actionKey));
+      if (result.items.length === 0 || page * result.pageSize >= result.totalCount)
+        break;
+    }
+  } catch {
+    return [];
   }
+  return keys;
+}
+function refused(error) {
   if (error instanceof PlatformApiError && error.status === 400) {
     const lines = describePlatformProblem(error);
-    throw new IdentityDeployError(
-      "IDENTITY_REJECTED",
-      `The platform refused the identity request:
+    throw new PlansDeployError(
+      "PLANS_REJECTED",
+      `The platform refused a plan:
   ${lines.join("\n  ") || error.message}`,
-      "Fix the cause in apitogo.config.json and run deploy again."
+      "Fix the plan in the plans file and run deploy again."
     );
   }
   throw error;
 }
-function connectionRejected(error, id) {
-  if (error instanceof PlatformApiError && error.status === 409) {
-    throw new IdentityDeployError(
-      "IDENTITY_CONNECTION_REJECTED",
-      `The identity is not active yet, so connection "${id}" cannot be saved.`,
-      "Run deploy again once the identity is Active."
-    );
-  }
+function billingRefused(error) {
   if (error instanceof PlatformApiError && error.status === 400) {
     const lines = describePlatformProblem(error);
-    throw new IdentityDeployError(
-      "IDENTITY_CONNECTION_REJECTED",
-      `The platform refused login connection "${id}":
-  ${lines.join("\n  ") || error.message}`,
-      "Fix the connection in apitogo.config.json (identity.connections) and run deploy again."
+    throw new PlansDeployError(
+      "PLANS_BILLING_REJECTED",
+      `The platform refused the billing settings: ${lines.join(" ") || error.message}`,
+      "Check plans.billing in the config and the project's secrets (apitogo secrets list). The Stripe key starts with sk_ or rk_, the webhook secret with whsec_."
     );
   }
   throw error;
 }
-async function recordOwnProvider(resolved, projectId) {
-  const identity = resolved.identity;
-  const issuer = identity?.issuer?.replace(/\/+$/, "");
-  const clientId = identity?.clientId;
-  if (!issuer || !clientId)
-    throw new Error("identity.issuer and identity.clientId are needed.");
-  const known = (await readManifest(resolved.state))?.services.identity;
-  const changed = known?.provider !== "oidc" || known.issuer !== issuer || known.clientId !== clientId;
-  if (changed)
-    await writeManifest(
-      resolved.state,
-      withIdentityEntry(await readManifest(resolved.state), {
-        projectId,
-        projectName: resolved.project.name,
-        provider: "oidc",
-        issuer,
-        clientId,
-        nativeSignup: false
-      })
-    );
-  return {
-    status: changed ? "deployed" : "unchanged",
-    steps: [],
-    issuer,
-    clientId
-  };
-}
-async function deployIdentity(resolved, projectId, deps, options = {}) {
-  if (resolved.identity?.provider === "oidc")
-    return recordOwnProvider(resolved, projectId);
+async function deployPlans(resolved, projectId, deps, options = {}) {
+  const plans = resolved.plans;
+  if (!plans) throw new Error("plans is not in the config.");
   const client = deps.client;
   const sleep5 = deps.sleep ?? defaultSleep3;
   const now = deps.now ?? Date.now;
-  const timeoutMs = deps.activateTimeoutMs ?? 12e4;
   const intervalMs = deps.pollIntervalMs ?? 2e3;
-  const portalUrl = await portalUrlOf(resolved, projectId, client);
-  const body = identityRequestBody(resolved, portalUrl);
-  const inputsHash = identityInputsHash(projectId, body);
-  const requestStep = {
-    name: "request",
-    hash: () => inputsHash,
-    run: async () => {
-      try {
-        const answer = await client.putProjectIdentity(projectId, body);
-        return {
-          status: answer.status,
-          redirectUri: body.portalRedirectUris[0] ?? ""
-        };
-      } catch (error) {
-        return rejected2(error);
-      }
-    },
-    // An identity that was removed, or that failed, is not a result worth keeping.
-    stillValid: async () => {
-      const found = await client.getProjectIdentity(projectId);
-      return found !== null && found.status !== "Failed" && found.status !== "Released" && found.status !== "Releasing";
-    }
-  };
-  const activateStep = {
-    name: "activate",
-    hash: () => inputsHash,
+  const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
+  const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
+  const {
+    wanted,
+    manifest,
+    ownIdentity,
+    billingOn,
+    billingStep,
+    billingHash,
+    catalogHash,
+    backendHash,
+    linkHash
+  } = await plansInputs(resolved, projectId);
+  const catalogStep = {
+    name: "catalog",
+    hash: () => catalogHash,
     run: async () => {
-      const deadline = now() + timeoutMs;
-      for (; ; ) {
-        const found = await client.getProjectIdentity(projectId);
-        if (found?.status === "Active")
-          return {
-            issuer: found.issuer,
-            clientId: found.clientId,
-            audience: found.audience,
-            nativeSignup: String(found.nativeSignup)
-          };
-        if (found?.status === "Failed")
-          throw new IdentityDeployError(
-            "IDENTITY_FAILED",
-            `The platform could not make the identity: ${[found.errorCode, found.errorMessage].filter(Boolean).join(" ") || "it failed"}.`,
-            "Fix the cause and run deploy again; the request is sent again."
-          );
-        if (now() >= deadline)
-          throw new IdentityDeployError(
-            "IDENTITY_TIMEOUT",
-            `The identity did not become active within ${Math.round(timeoutMs / 1e3)} seconds (state: ${found?.status ?? "not found"}).`,
-            "Run deploy again to keep waiting."
-          );
-        await sleep5(intervalMs);
+      if (wanted.length === 0) return { created: "0", updated: "0" };
+      const fallback = wanted.some((plan2) => plan2.includedActionKeys === null) ? await allActionKeys(client, projectId) : [];
+      const bodies = wanted.map((plan2) => ({
+        ...plan2,
+        includedActionKeys: plan2.includedActionKeys ?? fallback
+      }));
+      const checked = await client.validateGatewayPlans(bodies, { projectId });
+      if (!checked.valid)
+        throw new PlansDeployError(
+          "PLANS_REJECTED",
+          `The platform refused the plans:
+  ${checked.errors.map((issue4) => `${issue4.field}: ${issue4.message}`).join("\n  ")}`,
+          "Fix the listed problems in the plans file and run deploy again."
+        );
+      const existing = new Map(
+        (await client.listGatewayPlans(projectId)).map((plan2) => [
+          plan2.sku.toLowerCase(),
+          plan2
+        ])
+      );
+      let created = 0;
+      let updated = 0;
+      let archived = 0;
+      const backendSync = /* @__PURE__ */ new Set();
+      const noteSync = (plan2) => {
+        if (plan2.plansBackendSync) backendSync.add(plan2.plansBackendSync);
+      };
+      for (const body of bodies) {
+        const found = existing.get(body.sku);
+        try {
+          if (found) {
+            const result = await client.updateGatewayPlan(projectId, found.id, {
+              displayName: body.displayName,
+              isActive: true,
+              limitsJson: body.limitsJson ?? null,
+              includedActionKeys: body.includedActionKeys,
+              priceAmount: body.priceAmount,
+              pricingModel: body.pricingModel,
+              priceLabel: body.priceLabel,
+              priceCurrency: body.priceCurrency,
+              billingPeriod: body.billingPeriod,
+              sortOrder: body.sortOrder
+            });
+            noteSync(result);
+            updated++;
+          } else {
+            noteSync(await client.createGatewayPlan(projectId, body));
+            created++;
+          }
+        } catch (error) {
+          refused(error);
+        }
+      }
+      const kept = new Set(bodies.map((body) => body.sku));
+      for (const plan2 of existing.values()) {
+        if (!plan2.isActive || kept.has(plan2.sku.toLowerCase())) continue;
+        try {
+          const result = await client.updateGatewayPlan(projectId, plan2.id, {
+            displayName: plan2.displayName,
+            isActive: false,
+            limitsJson: plan2.limitsJson ?? null,
+            includedActionKeys: plan2.includedActions.map(
+              (action) => action.actionKey
+            ),
+            priceAmount: plan2.priceAmount,
+            pricingModel: plan2.pricingModel,
+            priceCurrency: plan2.priceCurrency,
+            billingPeriod: plan2.billingPeriod,
+            sortOrder: plan2.sortOrder
+          });
+          noteSync(result);
+          archived++;
+        } catch (error) {
+          refused(error);
+        }
       }
+      return {
+        created: String(created),
+        updated: String(updated),
+        archived: String(archived),
+        ...backendSync.size > 0 ? { backendSync: [...backendSync].sort().join(",") } : {}
+      };
     },
-    stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
+    // A plan someone deleted on the platform is not a result worth keeping, and neither is one that should be
+    // archived and is not yet.
+    stillValid: async () => {
+      if (wanted.length === 0) return true;
+      const active2 = (await client.listGatewayPlans(projectId)).filter(
+        (plan2) => plan2.isActive
+      );
+      const present = new Set(active2.map((plan2) => plan2.sku.toLowerCase()));
+      return wanted.every((plan2) => present.has(plan2.sku)) && active2.every(
+        (plan2) => wanted.some((w) => w.sku === plan2.sku.toLowerCase())
+      );
+    }
   };
-  const wanted = normalizedConnections(resolved);
-  const steps = [requestStep, activateStep];
-  if (wanted.length > 0 || (await recordedConnectionIds(resolved)).length > 0)
-    steps.push(connectionsStep(resolved, projectId, client, wanted));
+  const backendOf = async () => (await client.getDevPortalBackend(projectId))?.fqdn;
+  const backendStep = {
+    name: "backend",
+    hash: () => backendHash,
+    run: async () => {
+      let fqdn = await backendOf();
+      if (!fqdn) {
+        await client.activateModule(projectId, BACKEND_MODULE);
+        const deadline = now() + backendTimeoutMs;
+        for (; ; ) {
+          fqdn = await backendOf();
+          if (fqdn) break;
+          if (now() >= deadline)
+            throw new PlansDeployError(
+              "PLANS_BACKEND_TIMEOUT",
+              `The plans backend did not get an address within ${Math.round(backendTimeoutMs / 1e3)} seconds.`,
+              "Run deploy again to keep waiting."
+            );
+          await sleep5(intervalMs);
+        }
+      }
+      return { fqdn };
+    },
+    stillValid: async () => Boolean(await backendOf())
+  };
+  const waitForBackendUpdate = async (jobId, what) => {
+    const deadline = now() + linkTimeoutMs;
+    for (; ; ) {
+      const job = (await client.listProvisioningJobs(projectId)).jobs.find(
+        (item) => item.id === jobId
+      );
+      const status2 = job?.status.toLowerCase();
+      if (status2?.startsWith("completed")) return { jobId };
+      if (status2 === "failed")
+        throw new PlansDeployError(
+          `${what.code}_FAILED`,
+          `Applying ${what.text} to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
+          "Run deploy again; it is applied again."
+        );
+      if (now() >= deadline)
+        throw new PlansDeployError(
+          `${what.code}_TIMEOUT`,
+          `Applying ${what.text} did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
+          "Run deploy again to keep waiting."
+        );
+      await sleep5(intervalMs);
+    }
+  };
+  let billingNote;
+  let webhookUrl;
+  const billingStepDef = {
+    name: "billing",
+    hash: () => billingHash,
+    run: async () => {
+      const body = billingOn ? {
+        provider: "stripe",
+        apiKey: plans.billing.apiKey,
+        webhookSecret: plans.billing.webhookSecret,
+        successUrl: plans.billing.successUrl,
+        cancelUrl: plans.billing.cancelUrl
+      } : { provider: "none" };
+      let queued;
+      try {
+        queued = await client.putDevPortalBilling(projectId, body);
+      } catch (error) {
+        billingRefused(error);
+      }
+      const done = await waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_BILLING",
+        text: "the billing settings"
+      });
+      if (billingOn) {
+        billingNote = billingNotes(queued);
+        webhookUrl = queued.webhookUrl;
+      }
+      return { ...done, mode: queued.mode };
+    }
+  };
+  const linkStep = {
+    name: "identity-link",
+    hash: () => linkHash,
+    run: async () => {
+      const queued = await client.linkDevPortalIdentity(projectId);
+      return waitForBackendUpdate(queued.jobId, {
+        code: "PLANS_LINK",
+        text: "the identity"
+      });
+    }
+  };
+  const steps = [
+    catalogStep,
+    backendStep,
+    ...billingStep ? [billingStepDef] : [],
+    ...ownIdentity ? [linkStep] : []
+  ];
   const outcomes = await runPipeline(
     resolved.state,
-    "identity",
+    "plans",
     steps,
-    { force: options.force }
+    {
+      force: options.force
+    }
   );
-  const activate = outcomes.find((outcome) => outcome.step === "activate");
-  const ran = activate !== void 0 && !activate.skipped;
-  const known = (await readManifest(resolved.state))?.services.identity;
-  let learned;
-  if (ran || known?.issuer === void 0) {
-    learned = await client.getProjectIdentity(projectId) ?? void 0;
-    if (learned?.status === "Active") {
+  const catalog = outcomes.find((outcome) => outcome.step === "catalog");
+  const ran = outcomes.some((outcome) => !outcome.skipped);
+  const known = manifest?.services.plans;
+  let apiBaseUrl = known?.apiBaseUrl;
+  if (ran || known?.apiBaseUrl === void 0) {
+    apiBaseUrl = toApiBaseUrl(await backendOf()) ?? apiBaseUrl;
+    if (apiBaseUrl) {
+      const previous = known?.catalogRevision ?? 0;
       await writeManifest(
         resolved.state,
-        withIdentityEntry(await readManifest(resolved.state), {
+        withPlansEntry(await readManifest(resolved.state), {
           projectId,
           projectName: resolved.project.name,
-          issuer: learned.issuer,
-          clientId: learned.clientId,
-          audience: learned.audience,
-          nativeSignup: learned.nativeSignup
+          apiBaseUrl,
+          billing: billingOn ? "stripe" : "none",
+          catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
+          capabilities: billingOn ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
         })
       );
     }
   }
-  const connectionsRan = outcomes.some(
-    (outcome) => outcome.step === IDENTITY_CONNECTIONS_STEP && !outcome.skipped
-  );
+  let webhookLine;
+  let stripeWebhook;
+  if (billingOn && client.getBillingWebhookStatus) {
+    try {
+      const status2 = await client.getBillingWebhookStatus(projectId);
+      webhookLine = webhookStatusLine(status2, now());
+      const url2 = webhookUrl ?? (apiBaseUrl ? `${apiBaseUrl.replace(/\/+$/, "")}${STRIPE_WEBHOOK_PATH}` : void 0);
+      if (status2 && url2)
+        stripeWebhook = {
+          url: url2,
+          secretConfigured: status2.webhookSecretConfigured
+        };
+    } catch {
+    }
+  }
+  const notes = [...billingNote ?? [], ...webhookLine ? [webhookLine] : []];
   return {
-    status: ran || connectionsRan ? "deployed" : "unchanged",
+    status: ran ? "deployed" : "unchanged",
     steps: outcomes.map((outcome) => ({
       step: outcome.step,
       skipped: outcome.skipped
     })),
-    issuer: learned?.issuer ?? known?.issuer,
-    clientId: learned?.clientId ?? known?.clientId,
-    connections: redirectAddressesOf(
-      stepOf(
-        await readLedger(resolved.state),
-        "identity",
-        IDENTITY_CONNECTIONS_STEP
-      )?.output
-    )
+    apiBaseUrl,
+    ...notes.length > 0 ? { notes } : {},
+    ...stripeWebhook ? { stripeWebhook } : {}
   };
 }
-function connectionsStep(resolved, projectId, client, wanted) {
-  const {
-    putProjectIdentityConnection,
-    listProjectIdentityConnections,
-    deleteProjectIdentityConnection,
-    listSecrets
-  } = client;
-  if (!putProjectIdentityConnection || !listProjectIdentityConnections || !deleteProjectIdentityConnection || !listSecrets)
-    throw new Error("The platform client has no login connection calls.");
-  const stamps = async () => {
-    const names = referencedSecretNames(wanted);
-    if (names.length === 0) return {};
-    const listed = await listSecrets.call(client, projectId);
-    const byName2 = new Map(listed.secrets.map((s) => [s.name, s.updatedAtUtc]));
-    const missing = names.filter((name) => !byName2.has(name));
-    if (missing.length > 0)
-      throw new IdentityDeployError(
-        "IDENTITY_SECRET_MISSING",
-        `The secret ${missing.join(", ")} is not set for this project, and a login connection needs it.`,
-        `Run \`apitogo secrets set ${missing[0]}\` with the value from the provider, then deploy again.`
-      );
-    return Object.fromEntries(
-      names.map((name) => [name, byName2.get(name)])
-    );
-  };
-  const sameAddress = (a, b) => a.replace(/\/+$/, "").toLowerCase() === b.replace(/\/+$/, "").toLowerCase();
-  return {
-    name: IDENTITY_CONNECTIONS_STEP,
-    hash: () => identityConnectionsHash(projectId, resolved),
-    run: async () => {
-      const recorded = await stamps();
-      const existing = await listProjectIdentityConnections.call(
-        client,
-        projectId
-      );
-      const redirects = {};
-      for (const connection of wanted) {
-        try {
-          const saved = await putProjectIdentityConnection.call(
-            client,
-            projectId,
-            connection.id,
-            connectionBody(connection)
-          );
-          redirects[`redirect.${connection.id}`] = saved.redirectUri;
-        } catch (error) {
-          return connectionRejected(error, connection.id);
-        }
-      }
-      for (const old of existing)
-        if (!wanted.some((connection) => connection.id === old.id))
-          await deleteProjectIdentityConnection.call(client, projectId, old.id);
-      return {
-        ids: wanted.map((connection) => connection.id).join(","),
-        secretsStamp: stableJson(recorded),
-        ...redirects
-      };
-    },
-    // The platform still has exactly these connections, and none of the secrets was changed since.
-    stillValid: async () => {
-      const found = await listProjectIdentityConnections.call(
-        client,
-        projectId
-      );
-      if (found.length !== wanted.length) return false;
-      for (const connection of wanted) {
-        const there = found.find((f) => f.id === connection.id);
-        if (!there || there.clientId !== connection.clientId || !sameAddress(there.authority, connection.authority))
-          return false;
-      }
-      const before = stepOf(
-        await readLedger(resolved.state),
-        "identity",
-        IDENTITY_CONNECTIONS_STEP
-      )?.output?.secretsStamp;
-      return before === void 0 || before === stableJson(await stamps());
-    }
-  };
+
+// src/cli/deploy/stripe-webhook.ts
+var STRIPE_WEBHOOK_SECRET = "STRIPE_WEBHOOK";
+var SIGNING_SECRET = /^whsec_[A-Za-z0-9]+$/;
+var StripeWebhookError = class extends ApitogoError {
+  constructor(message, developerHint) {
+    super(message, { developerHint, title: "Stripe webhook secret" });
+    this.name = "StripeWebhookError";
+  }
+};
+async function offerStripeWebhookSecret(output4, deps) {
+  const webhook = output4.services.find(
+    (service) => service.service === "plans"
+  )?.stripeWebhook;
+  if (!webhook || webhook.secretConfigured || !deps.interactive)
+    return { status: "not-needed" };
+  deps.print("");
+  deps.print(
+    "Payments need one more step: Stripe must be able to tell your plans backend that a payment went through."
+  );
+  deps.print(
+    `1. In Stripe, open Developers > Webhooks and add an endpoint with the URL ${webhook.url}`
+  );
+  deps.print(`2. Select the events: ${STRIPE_WEBHOOK_EVENTS2.join(", ")}`);
+  deps.print(
+    "3. Open the endpoint, reveal its signing secret (starts with whsec_) and paste it here."
+  );
+  const secret = (await deps.askHidden(
+    "Stripe webhook signing secret (hidden, Enter to skip): "
+  )).trim();
+  if (!secret) {
+    deps.print(
+      `Skipped. Until it is set, a payment does not activate a plan. Run \`apitogo secrets set ${STRIPE_WEBHOOK_SECRET}\`, then \`apitogo deploy --only plans\`.`
+    );
+    return { status: "skipped" };
+  }
+  if (!SIGNING_SECRET.test(secret))
+    throw new StripeWebhookError(
+      "That is not a Stripe webhook signing secret. It was not saved.",
+      `A signing secret starts with whsec_. Run \`apitogo secrets set ${STRIPE_WEBHOOK_SECRET}\` with the right one, then \`apitogo deploy --only plans\`.`
+    );
+  await deps.client().setSecret(output4.projectId, STRIPE_WEBHOOK_SECRET, secret);
+  const wired = await deps.wireConfig();
+  deps.print(
+    `Signing secret saved as the project secret ${STRIPE_WEBHOOK_SECRET}${wired ? `, and ${wired} points to it` : ""}. Deploying the plans again so the backend gets it.`
+  );
+  return { status: "saved", output: await deps.redeployPlans() };
 }
 
-// src/cli/deploy/plans.ts
+// src/cli/deploy/v2.ts
+import { rm as rm11 } from "node:fs/promises";
 init_invariant();
-var PlansDeployError = class extends ApitogoError {
+
+// src/cli/portal/report.ts
+import { access as access9 } from "node:fs/promises";
+import path81 from "node:path";
+
+// src/cli/deploy/identity.ts
+init_invariant();
+var IdentityDeployError = class extends ApitogoError {
   constructor(code, message, developerHint) {
-    super(message, { developerHint, title: "Cannot deploy plans" });
+    super(message, { developerHint, title: "Cannot deploy identity" });
     this.code = code;
-    this.name = "PlansDeployError";
+    this.name = "IdentityDeployError";
   }
 };
-var PLANS_STEPS = [
-  "catalog",
-  "backend",
-  "billing",
-  "identity-link"
-];
-var defaultSleep4 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-var BACKEND_MODULE = "dev-portal";
-var PLANS_CAPABILITIES = { catalog: true, keys: true, usage: true };
-var STRIPE_WEBHOOK_EVENTS2 = [
-  "checkout.session.completed",
-  "customer.subscription.updated",
-  "customer.subscription.deleted",
-  "invoice.payment_failed"
-];
-function billingNotes(billing) {
-  const notes = [
-    billing.mode === "live" ? "Stripe: LIVE mode. Customers pay with real money." : "Stripe: test mode. Use Stripe's test cards; no real money moves."
-  ];
-  notes.push(
-    billing.hasWebhookSecret ? `Stripe webhook endpoint (add it in your Stripe account if it is not there yet): ${billing.webhookUrl}` : `A payment does not activate a plan until Stripe can confirm it. In your Stripe account add the webhook endpoint ${billing.webhookUrl} (events: ${STRIPE_WEBHOOK_EVENTS2.join(", ")}), store its signing secret with "apitogo secrets set STRIPE_WEBHOOK", set plans.billing.webhookSecret to "secret:STRIPE_WEBHOOK", and deploy again.`
-  );
-  return notes;
+var IDENTITY_STEPS = ["request", "activate"];
+var IDENTITY_CONNECTIONS_STEP = "connections";
+var SECRET_PREFIX = "secret:";
+function normalizedConnections(resolved) {
+  return [...resolved.identity?.connections ?? []].map((connection) => ({
+    ...connection,
+    authority: connection.authority.trim().replace(/\/+$/, "")
+  })).sort((a, b) => a.id.localeCompare(b.id));
 }
-async function plansInputs(resolved, projectId) {
-  const plans = resolved.plans;
-  if (!plans) throw new Error("plans is not in the config.");
-  const billing = plans.billing;
-  const filePlans = await readPlansFile(plans.file);
-  const wanted = toPlatformPlans(filePlans, {
-    billing: billing.provider === "stripe"
+function identityConnectionsHash(projectId, resolved) {
+  return stableJson({
+    projectId,
+    connections: normalizedConnections(resolved)
   });
-  const manifest = await readManifest(resolved.state);
-  const ledger = await readLedger(resolved.state);
-  const billingOn = billing.provider === "stripe" && filePlans.some((plan2) => isPaidPlan(plan2));
-  const billingStep = billingOn || stepOf(ledger, "plans", "billing") !== void 0;
-  const identity = manifest?.services.identity;
-  const ownIdentity = Boolean(
-    identity?.provider === "apitogo" && identity.issuer
-  );
+}
+async function recordedConnectionIds(resolved) {
+  const ids = stepOf(
+    await readLedger(resolved.state),
+    "identity",
+    IDENTITY_CONNECTIONS_STEP
+  )?.output?.ids;
+  return ids ? ids.split(",").filter(Boolean) : [];
+}
+function redirectAddressesOf(output4) {
+  return Object.entries(output4 ?? {}).filter(([key]) => key.startsWith("redirect.")).map(([key, redirectUri]) => ({
+    id: key.slice("redirect.".length),
+    redirectUri
+  }));
+}
+function connectionBody(connection) {
   return {
-    wanted,
-    manifest,
-    ownIdentity,
-    catalogHash: stableJson({ projectId, plans: wanted }),
-    backendHash: stableJson({ projectId }),
-    billingOn,
-    billingStep,
-    // Only the references to the project's secrets: a rotated value is applied with --force.
-    billingHash: stableJson({
-      projectId,
-      provider: billingOn ? "stripe" : "none",
-      apiKey: billingOn ? billing.apiKey : void 0,
-      webhookSecret: billingOn ? billing.webhookSecret : void 0,
-      successUrl: billingOn ? billing.successUrl : void 0,
-      cancelUrl: billingOn ? billing.cancelUrl : void 0
-    }),
-    linkHash: stableJson({
-      projectId,
-      issuer: identity?.issuer,
-      clientId: identity?.clientId
-    })
+    authority: connection.authority,
+    clientId: connection.clientId,
+    clientSecret: connection.clientSecret,
+    scopes: connection.scopes,
+    displayName: connection.displayName
   };
 }
-function plansNotDeployableReason(resolved) {
-  return resolved.plans ? void 0 : "plans is not in the config";
-}
-async function allActionKeys(client, projectId) {
-  const keys = [];
-  try {
-    for (let page = 1; ; page++) {
-      const result = await client.listGatewayActions(projectId, page, 100);
-      keys.push(...result.items.map((item) => item.actionKey));
-      if (result.items.length === 0 || page * result.pageSize >= result.totalCount)
-        break;
-    }
-  } catch {
-    return [];
-  }
-  return keys;
+function referencedSecretNames(connections) {
+  return [
+    ...new Set(
+      connections.map(
+        (connection) => connection.clientSecret.slice(SECRET_PREFIX.length)
+      )
+    )
+  ];
 }
-function refused(error) {
-  if (error instanceof PlatformApiError && error.status === 400) {
-    const lines = describePlatformProblem(error);
-    throw new PlansDeployError(
-      "PLANS_REJECTED",
-      `The platform refused a plan:
-  ${lines.join("\n  ") || error.message}`,
-      "Fix the plan in the plans file and run deploy again."
-    );
-  }
-  throw error;
+function identityProviderSwitch(resolved, known) {
+  if (!known?.provider || !resolved.identity) return void 0;
+  const to = resolved.identity.provider ?? "apitogo";
+  return known.provider === to ? void 0 : { from: known.provider, to };
 }
-function billingRefused(error) {
-  if (error instanceof PlatformApiError && error.status === 400) {
-    const lines = describePlatformProblem(error);
-    throw new PlansDeployError(
-      "PLANS_BILLING_REJECTED",
-      `The platform refused the billing settings: ${lines.join(" ") || error.message}`,
-      "Check plans.billing in the config and the project's secrets (apitogo secrets list). The Stripe key starts with sk_ or rk_, the webhook secret with whsec_."
-    );
-  }
-  throw error;
+function identityProviderSwitchWarning(from, to) {
+  return `warning: the identity provider changes from ${from} to ${to}. People are known by issuer and subject, so the users, subscriptions and keys made with ${from} are not carried over to ${to}.`;
 }
-async function deployPlans(resolved, projectId, deps, options = {}) {
-  const plans = resolved.plans;
-  if (!plans) throw new Error("plans is not in the config.");
+var PORTAL_CALLBACK_PATH = "/oauth/callback";
+var defaultSleep4 = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+function identityNotDeployableReason(resolved) {
+  const identity = resolved.identity;
+  if (!identity) return "identity is not in the config";
+  if (identity.provider === "oidc" && (!identity.issuer || !identity.clientId))
+    return 'identity.provider "oidc" needs issuer and clientId';
+  return void 0;
+}
+function identityBodyForRedirect(resolved, redirectUri) {
+  return {
+    portalRedirectUris: [redirectUri],
+    nativeSignup: resolved.identity?.native ?? true
+  };
+}
+function identityRequestBody(resolved, portalUrl) {
+  return identityBodyForRedirect(
+    resolved,
+    `${portalUrl.replace(/\/+$/, "")}${PORTAL_CALLBACK_PATH}`
+  );
+}
+function identityInputsHash(projectId, body) {
+  return stableJson({ projectId, body });
+}
+async function portalUrlOf(resolved, projectId, client) {
+  const known = (await readManifest(resolved.state))?.services.portal?.url;
+  const url2 = known ?? resolveSwaUrl(await client.getProject(projectId));
+  if (!url2)
+    throw new IdentityDeployError(
+      "IDENTITY_PORTAL_ADDRESS_UNKNOWN",
+      "The portal has no public address yet, and the identity needs it for the sign-in redirect.",
+      "The address comes with the project's hosting. Run `apitogo status`: while hosting is still being prepared, wait a few minutes and run `apitogo deploy` again. Once hosting is ready, `apitogo deploy --only portal` gives the portal its address, then deploy identity."
+    );
+  return url2;
+}
+function rejected2(error) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_SETTINGS_CHANGED",
+      "This project already has an identity with other settings, and its audience and portal address cannot be changed in place.",
+      "Keep the portal address as it was, or remove the identity first (this deletes every user in it)."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_REJECTED",
+      `The platform refused the identity request:
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the cause in apitogo.config.json and run deploy again."
+    );
+  }
+  throw error;
+}
+function connectionRejected(error, id) {
+  if (error instanceof PlatformApiError && error.status === 409) {
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The identity is not active yet, so connection "${id}" cannot be saved.`,
+      "Run deploy again once the identity is Active."
+    );
+  }
+  if (error instanceof PlatformApiError && error.status === 400) {
+    const lines = describePlatformProblem(error);
+    throw new IdentityDeployError(
+      "IDENTITY_CONNECTION_REJECTED",
+      `The platform refused login connection "${id}":
+  ${lines.join("\n  ") || error.message}`,
+      "Fix the connection in apitogo.config.json (identity.connections) and run deploy again."
+    );
+  }
+  throw error;
+}
+async function recordOwnProvider(resolved, projectId) {
+  const identity = resolved.identity;
+  const issuer = identity?.issuer?.replace(/\/+$/, "");
+  const clientId = identity?.clientId;
+  if (!issuer || !clientId)
+    throw new Error("identity.issuer and identity.clientId are needed.");
+  const known = (await readManifest(resolved.state))?.services.identity;
+  const changed = known?.provider !== "oidc" || known.issuer !== issuer || known.clientId !== clientId;
+  if (changed)
+    await writeManifest(
+      resolved.state,
+      withIdentityEntry(await readManifest(resolved.state), {
+        projectId,
+        projectName: resolved.project.name,
+        provider: "oidc",
+        issuer,
+        clientId,
+        nativeSignup: false
+      })
+    );
+  return {
+    status: changed ? "deployed" : "unchanged",
+    steps: [],
+    issuer,
+    clientId
+  };
+}
+async function deployIdentity(resolved, projectId, deps, options = {}) {
+  if (resolved.identity?.provider === "oidc")
+    return recordOwnProvider(resolved, projectId);
   const client = deps.client;
   const sleep5 = deps.sleep ?? defaultSleep4;
   const now = deps.now ?? Date.now;
+  const timeoutMs = deps.activateTimeoutMs ?? 12e4;
   const intervalMs = deps.pollIntervalMs ?? 2e3;
-  const backendTimeoutMs = deps.backendTimeoutMs ?? 9e5;
-  const linkTimeoutMs = deps.linkTimeoutMs ?? 6e5;
-  const {
-    wanted,
-    manifest,
-    ownIdentity,
-    billingOn,
-    billingStep,
-    billingHash,
-    catalogHash,
-    backendHash,
-    linkHash
-  } = await plansInputs(resolved, projectId);
-  const catalogStep = {
-    name: "catalog",
-    hash: () => catalogHash,
+  const portalUrl = await portalUrlOf(resolved, projectId, client);
+  const body = identityRequestBody(resolved, portalUrl);
+  const inputsHash = identityInputsHash(projectId, body);
+  const requestStep = {
+    name: "request",
+    hash: () => inputsHash,
     run: async () => {
-      if (wanted.length === 0) return { created: "0", updated: "0" };
-      const fallback = wanted.some((plan2) => plan2.includedActionKeys === null) ? await allActionKeys(client, projectId) : [];
-      const bodies = wanted.map((plan2) => ({
-        ...plan2,
-        includedActionKeys: plan2.includedActionKeys ?? fallback
-      }));
-      const checked = await client.validateGatewayPlans(bodies, { projectId });
-      if (!checked.valid)
-        throw new PlansDeployError(
-          "PLANS_REJECTED",
-          `The platform refused the plans:
-  ${checked.errors.map((issue4) => `${issue4.field}: ${issue4.message}`).join("\n  ")}`,
-          "Fix the listed problems in the plans file and run deploy again."
-        );
-      const existing = new Map(
-        (await client.listGatewayPlans(projectId)).map((plan2) => [
-          plan2.sku.toLowerCase(),
-          plan2
-        ])
-      );
-      let created = 0;
-      let updated = 0;
-      let archived = 0;
-      const backendSync = /* @__PURE__ */ new Set();
-      const noteSync = (plan2) => {
-        if (plan2.plansBackendSync) backendSync.add(plan2.plansBackendSync);
-      };
-      for (const body of bodies) {
-        const found = existing.get(body.sku);
-        try {
-          if (found) {
-            const result = await client.updateGatewayPlan(projectId, found.id, {
-              displayName: body.displayName,
-              isActive: true,
-              limitsJson: body.limitsJson ?? null,
-              includedActionKeys: body.includedActionKeys,
-              priceAmount: body.priceAmount,
-              pricingModel: body.pricingModel,
-              priceLabel: body.priceLabel,
-              priceCurrency: body.priceCurrency,
-              billingPeriod: body.billingPeriod,
-              sortOrder: body.sortOrder
-            });
-            noteSync(result);
-            updated++;
-          } else {
-            noteSync(await client.createGatewayPlan(projectId, body));
-            created++;
-          }
-        } catch (error) {
-          refused(error);
-        }
-      }
-      const kept = new Set(bodies.map((body) => body.sku));
-      for (const plan2 of existing.values()) {
-        if (!plan2.isActive || kept.has(plan2.sku.toLowerCase())) continue;
-        try {
-          const result = await client.updateGatewayPlan(projectId, plan2.id, {
-            displayName: plan2.displayName,
-            isActive: false,
-            limitsJson: plan2.limitsJson ?? null,
-            includedActionKeys: plan2.includedActions.map(
-              (action) => action.actionKey
-            ),
-            priceAmount: plan2.priceAmount,
-            pricingModel: plan2.pricingModel,
-            priceCurrency: plan2.priceCurrency,
-            billingPeriod: plan2.billingPeriod,
-            sortOrder: plan2.sortOrder
-          });
-          noteSync(result);
-          archived++;
-        } catch (error) {
-          refused(error);
-        }
+      try {
+        const answer = await client.putProjectIdentity(projectId, body);
+        return {
+          status: answer.status,
+          redirectUri: body.portalRedirectUris[0] ?? ""
+        };
+      } catch (error) {
+        return rejected2(error);
       }
-      return {
-        created: String(created),
-        updated: String(updated),
-        archived: String(archived),
-        ...backendSync.size > 0 ? { backendSync: [...backendSync].sort().join(",") } : {}
-      };
     },
-    // A plan someone deleted on the platform is not a result worth keeping, and neither is one that should be
-    // archived and is not yet.
+    // An identity that was removed, or that failed, is not a result worth keeping.
     stillValid: async () => {
-      if (wanted.length === 0) return true;
-      const active2 = (await client.listGatewayPlans(projectId)).filter(
-        (plan2) => plan2.isActive
-      );
-      const present = new Set(active2.map((plan2) => plan2.sku.toLowerCase()));
-      return wanted.every((plan2) => present.has(plan2.sku)) && active2.every(
-        (plan2) => wanted.some((w) => w.sku === plan2.sku.toLowerCase())
-      );
+      const found = await client.getProjectIdentity(projectId);
+      return found !== null && found.status !== "Failed" && found.status !== "Released" && found.status !== "Releasing";
     }
   };
-  const backendOf = async () => (await client.getDevPortalBackend(projectId))?.fqdn;
-  const backendStep = {
-    name: "backend",
-    hash: () => backendHash,
+  const activateStep = {
+    name: "activate",
+    hash: () => inputsHash,
     run: async () => {
-      let fqdn = await backendOf();
-      if (!fqdn) {
-        await client.activateModule(projectId, BACKEND_MODULE);
-        const deadline = now() + backendTimeoutMs;
-        for (; ; ) {
-          fqdn = await backendOf();
-          if (fqdn) break;
-          if (now() >= deadline)
-            throw new PlansDeployError(
-              "PLANS_BACKEND_TIMEOUT",
-              `The plans backend did not get an address within ${Math.round(backendTimeoutMs / 1e3)} seconds.`,
-              "Run deploy again to keep waiting."
-            );
-          await sleep5(intervalMs);
-        }
+      const deadline = now() + timeoutMs;
+      for (; ; ) {
+        const found = await client.getProjectIdentity(projectId);
+        if (found?.status === "Active")
+          return {
+            issuer: found.issuer,
+            clientId: found.clientId,
+            audience: found.audience,
+            nativeSignup: String(found.nativeSignup)
+          };
+        if (found?.status === "Failed")
+          throw new IdentityDeployError(
+            "IDENTITY_FAILED",
+            `The platform could not make the identity: ${[found.errorCode, found.errorMessage].filter(Boolean).join(" ") || "it failed"}.`,
+            "Fix the cause and run deploy again; the request is sent again."
+          );
+        if (now() >= deadline)
+          throw new IdentityDeployError(
+            "IDENTITY_TIMEOUT",
+            `The identity did not become active within ${Math.round(timeoutMs / 1e3)} seconds (state: ${found?.status ?? "not found"}).`,
+            "Run deploy again to keep waiting."
+          );
+        await sleep5(intervalMs);
       }
-      return { fqdn };
     },
-    stillValid: async () => Boolean(await backendOf())
-  };
-  const waitForBackendUpdate = async (jobId, what) => {
-    const deadline = now() + linkTimeoutMs;
-    for (; ; ) {
-      const job = (await client.listProvisioningJobs(projectId)).jobs.find(
-        (item) => item.id === jobId
-      );
-      const status2 = job?.status.toLowerCase();
-      if (status2?.startsWith("completed")) return { jobId };
-      if (status2 === "failed")
-        throw new PlansDeployError(
-          `${what.code}_FAILED`,
-          `Applying ${what.text} to the plans backend failed: ${job?.errorMessage ?? "no reason given"}.`,
-          "Run deploy again; it is applied again."
-        );
-      if (now() >= deadline)
-        throw new PlansDeployError(
-          `${what.code}_TIMEOUT`,
-          `Applying ${what.text} did not finish within ${Math.round(linkTimeoutMs / 1e3)} seconds (state: ${status2 ?? "unknown"}).`,
-          "Run deploy again to keep waiting."
-        );
-      await sleep5(intervalMs);
-    }
-  };
-  let billingNote;
-  const billingStepDef = {
-    name: "billing",
-    hash: () => billingHash,
-    run: async () => {
-      const body = billingOn ? {
-        provider: "stripe",
-        apiKey: plans.billing.apiKey,
-        webhookSecret: plans.billing.webhookSecret,
-        successUrl: plans.billing.successUrl,
-        cancelUrl: plans.billing.cancelUrl
-      } : { provider: "none" };
-      let queued;
-      try {
-        queued = await client.putDevPortalBilling(projectId, body);
-      } catch (error) {
-        billingRefused(error);
-      }
-      const done = await waitForBackendUpdate(queued.jobId, {
-        code: "PLANS_BILLING",
-        text: "the billing settings"
-      });
-      if (billingOn) billingNote = billingNotes(queued);
-      return { ...done, mode: queued.mode };
-    }
-  };
-  const linkStep = {
-    name: "identity-link",
-    hash: () => linkHash,
-    run: async () => {
-      const queued = await client.linkDevPortalIdentity(projectId);
-      return waitForBackendUpdate(queued.jobId, {
-        code: "PLANS_LINK",
-        text: "the identity"
-      });
-    }
+    stillValid: async () => (await client.getProjectIdentity(projectId))?.status === "Active"
   };
-  const steps = [
-    catalogStep,
-    backendStep,
-    ...billingStep ? [billingStepDef] : [],
-    ...ownIdentity ? [linkStep] : []
-  ];
+  const wanted = normalizedConnections(resolved);
+  const steps = [requestStep, activateStep];
+  if (wanted.length > 0 || (await recordedConnectionIds(resolved)).length > 0)
+    steps.push(connectionsStep(resolved, projectId, client, wanted));
   const outcomes = await runPipeline(
     resolved.state,
-    "plans",
+    "identity",
     steps,
-    {
-      force: options.force
-    }
+    { force: options.force }
   );
-  const catalog = outcomes.find((outcome) => outcome.step === "catalog");
-  const ran = outcomes.some((outcome) => !outcome.skipped);
-  const known = manifest?.services.plans;
-  let apiBaseUrl = known?.apiBaseUrl;
-  if (ran || known?.apiBaseUrl === void 0) {
-    apiBaseUrl = toApiBaseUrl(await backendOf()) ?? apiBaseUrl;
-    if (apiBaseUrl) {
-      const previous = known?.catalogRevision ?? 0;
+  const activate = outcomes.find((outcome) => outcome.step === "activate");
+  const ran = activate !== void 0 && !activate.skipped;
+  const known = (await readManifest(resolved.state))?.services.identity;
+  let learned;
+  if (ran || known?.issuer === void 0) {
+    learned = await client.getProjectIdentity(projectId) ?? void 0;
+    if (learned?.status === "Active") {
       await writeManifest(
         resolved.state,
-        withPlansEntry(await readManifest(resolved.state), {
-          projectId,
-          projectName: resolved.project.name,
-          apiBaseUrl,
-          billing: billingOn ? "stripe" : "none",
-          catalogRevision: catalog && !catalog.skipped ? previous + 1 : Math.max(previous, 1),
-          capabilities: billingOn ? { ...PLANS_CAPABILITIES, checkout: true } : PLANS_CAPABILITIES
+        withIdentityEntry(await readManifest(resolved.state), {
+          projectId,
+          projectName: resolved.project.name,
+          issuer: learned.issuer,
+          clientId: learned.clientId,
+          audience: learned.audience,
+          nativeSignup: learned.nativeSignup
         })
       );
     }
   }
+  const connectionsRan = outcomes.some(
+    (outcome) => outcome.step === IDENTITY_CONNECTIONS_STEP && !outcome.skipped
+  );
   return {
-    status: ran ? "deployed" : "unchanged",
+    status: ran || connectionsRan ? "deployed" : "unchanged",
     steps: outcomes.map((outcome) => ({
       step: outcome.step,
       skipped: outcome.skipped
     })),
-    apiBaseUrl,
-    ...billingNote ? { notes: billingNote } : {}
+    issuer: learned?.issuer ?? known?.issuer,
+    clientId: learned?.clientId ?? known?.clientId,
+    connections: redirectAddressesOf(
+      stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output
+    )
+  };
+}
+function connectionsStep(resolved, projectId, client, wanted) {
+  const {
+    putProjectIdentityConnection,
+    listProjectIdentityConnections,
+    deleteProjectIdentityConnection,
+    listSecrets
+  } = client;
+  if (!putProjectIdentityConnection || !listProjectIdentityConnections || !deleteProjectIdentityConnection || !listSecrets)
+    throw new Error("The platform client has no login connection calls.");
+  const stamps = async () => {
+    const names = referencedSecretNames(wanted);
+    if (names.length === 0) return {};
+    const listed = await listSecrets.call(client, projectId);
+    const byName2 = new Map(listed.secrets.map((s) => [s.name, s.updatedAtUtc]));
+    const missing = names.filter((name) => !byName2.has(name));
+    if (missing.length > 0)
+      throw new IdentityDeployError(
+        "IDENTITY_SECRET_MISSING",
+        `The secret ${missing.join(", ")} is not set for this project, and a login connection needs it.`,
+        `Run \`apitogo secrets set ${missing[0]}\` with the value from the provider, then deploy again.`
+      );
+    return Object.fromEntries(
+      names.map((name) => [name, byName2.get(name)])
+    );
+  };
+  const sameAddress = (a, b) => a.replace(/\/+$/, "").toLowerCase() === b.replace(/\/+$/, "").toLowerCase();
+  return {
+    name: IDENTITY_CONNECTIONS_STEP,
+    hash: () => identityConnectionsHash(projectId, resolved),
+    run: async () => {
+      const recorded = await stamps();
+      const existing = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      const redirects = {};
+      for (const connection of wanted) {
+        try {
+          const saved = await putProjectIdentityConnection.call(
+            client,
+            projectId,
+            connection.id,
+            connectionBody(connection)
+          );
+          redirects[`redirect.${connection.id}`] = saved.redirectUri;
+        } catch (error) {
+          return connectionRejected(error, connection.id);
+        }
+      }
+      for (const old of existing)
+        if (!wanted.some((connection) => connection.id === old.id))
+          await deleteProjectIdentityConnection.call(client, projectId, old.id);
+      return {
+        ids: wanted.map((connection) => connection.id).join(","),
+        secretsStamp: stableJson(recorded),
+        ...redirects
+      };
+    },
+    // The platform still has exactly these connections, and none of the secrets was changed since.
+    stillValid: async () => {
+      const found = await listProjectIdentityConnections.call(
+        client,
+        projectId
+      );
+      if (found.length !== wanted.length) return false;
+      for (const connection of wanted) {
+        const there = found.find((f) => f.id === connection.id);
+        if (!there || there.clientId !== connection.clientId || !sameAddress(there.authority, connection.authority))
+          return false;
+      }
+      const before = stepOf(
+        await readLedger(resolved.state),
+        "identity",
+        IDENTITY_CONNECTIONS_STEP
+      )?.output?.secretsStamp;
+      return before === void 0 || before === stableJson(await stamps());
+    }
   };
 }
 
@@ -27742,6 +28218,12 @@ async function planPlansService(resolved, ledger, plansRemote2) {
   const archiving = await plansToArchive(projectId, inputs.wanted, plansRemote2);
   const details = [
     ...inputs.wanted.length === 0 ? ["plans: none in the file"] : inputs.wanted.map((plan2) => `plan ${plan2.sku}: ${plan2.displayName}`),
+    // A contact-us plan with a price in the file waits to be sold (the full template's example, API-124).
+    ...inputs.filePlans.filter(
+      (plan2) => plan2.pricingModel === "custom" && typeof plan2.priceAmount === "number" && plan2.priceAmount > 0
+    ).map(
+      (plan2) => `plan ${plan2.sku}: "contact us" for now. On a Starter or Professional project, sell it at ${plan2.priceAmount} ${(plan2.priceCurrency ?? "usd").toUpperCase()} a ${plan2.billingInterval ?? "month"} with: apitogo config --plan-sku ${plan2.sku} --plan-price ${plan2.priceAmount}`
+    ),
     ...archiving.map(
       (sku) => `plan ${sku}: will archive (no longer in the plans file: it leaves the pricing page and takes no new subscribers; current subscribers keep access)`
     ),
@@ -27941,7 +28423,7 @@ async function planPortalService(resolved, ledger) {
     const hash2 = await portalBuildHash(resolved, prepared);
     const previous = stepOf(ledger, "portal", "build");
     const built = await exists5(
-      path80.join(resolved.state.buildDir, "index.html")
+      path81.join(resolved.state.buildDir, "index.html")
     );
     if (previous?.status === "succeeded" && previous.hash === hash2 && built) {
       return {
@@ -28327,7 +28809,7 @@ async function statusV2(dir, only, options = {}) {
     if (service === "portal") {
       const build2 = stepOf(ledger, "portal", "build");
       const built = await exists5(
-        path80.join(resolved.state.buildDir, "index.html")
+        path81.join(resolved.state.buildDir, "index.html")
       );
       const state = build2?.status === "failed" ? "build-failed" : build2?.status === "succeeded" && built ? "built" : "not-built";
       services.push({
@@ -28338,7 +28820,7 @@ async function statusV2(dir, only, options = {}) {
           ...build2?.finishedAt ? [`last build: ${build2.finishedAt}`] : [],
           ...build2?.status === "failed" ? [`error: ${build2.error ?? "unknown"}`] : [],
           ...state === "built" ? [
-            `output: ${path80.relative(resolved.configDir, resolved.state.buildDir)}`
+            `output: ${path81.relative(resolved.configDir, resolved.state.buildDir)}`
           ] : [],
           ...url2 ? [`url: ${url2}`] : ["url: not known (portal is not deployed yet)"],
           ...await hostingLine(resolved, manifest, options.hostingRemote)
@@ -28405,7 +28887,7 @@ function formatStatus(output4) {
 
 // src/cli/deploy/static-web-config.ts
 import { access as access10, writeFile as writeFile22 } from "node:fs/promises";
-import path81 from "node:path";
+import path82 from "node:path";
 var STATIC_WEB_CONFIG_FILE = "staticwebapp.config.json";
 var STATIC_WEB_CONFIG_VERSION = 3;
 var CLIENT_ONLY_ROUTES = [
@@ -28423,7 +28905,7 @@ var DEFAULT_STATIC_WEB_CONFIG = {
   }
 };
 async function ensureStaticWebConfig(buildDir) {
-  const file = path81.join(buildDir, STATIC_WEB_CONFIG_FILE);
+  const file = path82.join(buildDir, STATIC_WEB_CONFIG_FILE);
   try {
     await access10(file);
     return false;
@@ -28680,7 +29162,8 @@ async function deployPlansService(options, deps, projectId, named) {
     steps: result.steps,
     url: result.apiBaseUrl,
     summary: `${planCount} plan${planCount === 1 ? "" : "s"}${billing && billing !== "none" ? `, billing: ${billing}` : ""}`,
-    ...result.notes ? { notes: result.notes } : {}
+    ...result.notes ? { notes: result.notes } : {},
+    ...result.stripeWebhook ? { stripeWebhook: result.stripeWebhook } : {}
   };
 }
 async function recordPortalAddressBeforeBuild(dir, deps, projectId) {
@@ -28777,7 +29260,7 @@ function formatDeploy(output4) {
 // src/cli/deploy/command.ts
 async function ensureLinkedProject(argv, deps) {
   if (argv.projectId?.trim() || deps.envProjectId?.trim()) return true;
-  const dir = path82.resolve(process.cwd(), argv.dir);
+  const dir = path83.resolve(process.cwd(), argv.dir);
   let linked;
   try {
     linked = Boolean(loadConfigV2(dir).resolved.project.id);
@@ -28827,26 +29310,37 @@ async function deployProject(argv) {
     );
   try {
     const config2 = loadConfig();
-    const output4 = await deployV2(
+    const client = new PlatformApiClient(config2);
+    const dir = path83.resolve(process.cwd(), argv.dir);
+    const deploy = (only) => deployV2(
       {
-        dir: path82.resolve(process.cwd(), argv.dir),
-        only: Array.isArray(argv.only) ? argv.only.join(",") : argv.only,
+        dir,
+        only: only ?? (Array.isArray(argv.only) ? argv.only.join(",") : argv.only),
         projectId: argv.projectId,
         env: argv.env,
         force: argv.force === true,
         yes: argv.yes === true,
         jsonOnly: quiet
       },
-      {
-        client: new PlatformApiClient(config2),
-        envProjectId: config2.defaultProjectId
-      }
+      { client, envProjectId: config2.defaultProjectId }
     );
+    const output4 = await deploy();
     if (json) {
       console.log(JSON.stringify({ status: "succeeded", ...output4 }, null, 2));
       return;
     }
     for (const line2 of formatDeploy(output4)) printDiagnosticsToConsole(line2);
+    const webhook = await offerStripeWebhookSecret(output4, {
+      interactive,
+      client: () => client,
+      askHidden: (prompt) => readHidden(prompt),
+      print: printDiagnosticsToConsole,
+      wireConfig: () => wireKnownSecret({ action: "set", dir }, STRIPE_WEBHOOK_SECRET),
+      redeployPlans: () => deploy("plans")
+    });
+    if (webhook.status === "saved")
+      for (const line2 of formatDeploy(webhook.output))
+        printDiagnosticsToConsole(line2);
     printResultToConsole("Deploy finished.");
   } catch (error) {
     await reportFailure(error, json);
@@ -28925,7 +29419,7 @@ var deploy_default = {
   }),
   handler: async (argv) => {
     await captureEvent({ argv, event: "apitogo deploy" });
-    if (await isConfigV2(path83.resolve(process.cwd(), argv.dir))) {
+    if (await isConfigV2(path84.resolve(process.cwd(), argv.dir))) {
       await deployProject(argv);
       return;
     }
@@ -28935,7 +29429,7 @@ var deploy_default = {
 
 // src/cli/export/handler.ts
 import { mkdir as mkdir19, writeFile as writeFile23 } from "node:fs/promises";
-import path84 from "node:path";
+import path85 from "node:path";
 init_invariant();
 var ExportError = class extends ApitogoError {
   constructor(message, developerHint) {
@@ -28949,7 +29443,7 @@ async function exportOpenApi(args, deps) {
       `Cannot export "${args.target}".`,
       "Only `apitogo export openapi` exists."
     );
-  const dir = path84.resolve(process.cwd(), args.dir ?? ".");
+  const dir = path85.resolve(process.cwd(), args.dir ?? ".");
   if (!await isConfigV2(dir))
     throw new ExportError(
       "This command needs a config version 2 project.",
@@ -28974,8 +29468,8 @@ async function exportOpenApi(args, deps) {
     throw error;
   }
   if (!args.out) return { text: text2 };
-  const file = path84.resolve(process.cwd(), args.out);
-  await mkdir19(path84.dirname(file), { recursive: true });
+  const file = path85.resolve(process.cwd(), args.out);
+  await mkdir19(path85.dirname(file), { recursive: true });
   await writeFile23(file, text2);
   return { text: text2, file };
 }
@@ -29251,7 +29745,7 @@ var logout_default = {
 };
 
 // src/cli/portal/commands.ts
-import path85 from "node:path";
+import path86 from "node:path";
 init_invariant();
 function parseOnly(value) {
   if (value === void 0) return void 0;
@@ -29268,7 +29762,7 @@ function parseOnly(value) {
 async function run2(command2, argv, compute, format) {
   const json = argv.json === true;
   try {
-    const dir = path85.resolve(process.cwd(), argv.dir ?? ".");
+    const dir = path86.resolve(process.cwd(), argv.dir ?? ".");
     if (!await isConfigV2(dir)) {
       throw new ServiceEditError(
         `${command2} works with a config version 2 project, and there is none in ${dir}.`,
@@ -29493,14 +29987,14 @@ var remove_default = {
 
 // src/cli/dev/handler.ts
 init_joinUrl();
-import path88 from "node:path";
+import path89 from "node:path";
 
 // src/vite/dev-server.ts
 init_logger();
 import fs11 from "node:fs/promises";
 import http from "node:http";
 import https from "node:https";
-import path87 from "node:path";
+import path88 from "node:path";
 import { createHttpTerminator } from "http-terminator";
 import {
   createServer as createViteServer,
@@ -29533,7 +30027,7 @@ init_loader();
 // src/vite/pagefind-dev-index.ts
 init_invariant();
 init_joinUrl();
-import path86 from "node:path";
+import path87 from "node:path";
 import { createIndex as createIndex2 } from "pagefind";
 import { isRunnableDevEnvironment } from "vite";
 async function* buildPagefindDevIndex(vite, config2) {
@@ -29586,7 +30080,7 @@ async function* buildPagefindDevIndex(vite, config2) {
       path: urlPath
     };
   }
-  const outputPath = path86.join(vite.config.publicDir, "pagefind");
+  const outputPath = path87.join(vite.config.publicDir, "pagefind");
   await pagefindIndex.writeFiles({ outputPath });
   yield { type: "complete", success: true, indexed };
 }
@@ -29605,9 +30099,9 @@ var DevServer = class {
     this.protocol = "https";
     const { dir } = this.options;
     const [key, cert, ca] = await Promise.all([
-      fs11.readFile(path87.resolve(dir, config2.https.key)),
-      fs11.readFile(path87.resolve(dir, config2.https.cert)),
-      config2.https.ca ? fs11.readFile(path87.resolve(dir, config2.https.ca)) : void 0
+      fs11.readFile(path88.resolve(dir, config2.https.key)),
+      fs11.readFile(path88.resolve(dir, config2.https.cert)),
+      config2.https.ca ? fs11.readFile(path88.resolve(dir, config2.https.ca)) : void 0
     ]);
     return https.createServer({ key, cert, ca });
   }
@@ -29624,7 +30118,7 @@ var DevServer = class {
     );
     const server = await this.createNodeServer(config2);
     if (config2.search?.type === "pagefind" && viteConfig.publicDir !== false) {
-      const publicRoot = path87.resolve(
+      const publicRoot = path88.resolve(
         this.options.dir,
         typeof viteConfig.publicDir === "string" ? viteConfig.publicDir : "public"
       );
@@ -29641,7 +30135,7 @@ var DevServer = class {
           // built-in transform middleware which would treat the path as a static asset.
           name: "apitogo:entry-client",
           configureServer(server2) {
-            const entryPath = path87.posix.join(
+            const entryPath = path88.posix.join(
               server2.config.base,
               "/__z/entry.client.tsx"
             );
@@ -29806,7 +30300,7 @@ init_package_json();
 async function dev(argv) {
   const packageJson3 = getZudokuPackageJson();
   process.env.NODE_ENV = "development";
-  let dir = path88.resolve(process.cwd(), argv.dir);
+  let dir = path89.resolve(process.cwd(), argv.dir);
   if (await isConfigV2(dir)) {
     const { root, prepared } = await preparePortalWorkspace(dir, "development");
     dir = root;
@@ -29904,142 +30398,6 @@ var run_default = {
   }
 };
 
-// src/cli/secrets/handler.ts
-import path89 from "node:path";
-init_invariant();
-var SECRET_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
-var SecretsError = class extends ApitogoError {
-  constructor(message, developerHint) {
-    super(message, { developerHint, title: "Cannot change secrets" });
-    this.name = "SecretsError";
-  }
-};
-async function resolveProjectId2(argv, deps) {
-  const explicit = argv.projectId?.trim();
-  if (explicit) return explicit;
-  const dir = path89.resolve(process.cwd(), argv.dir ?? ".");
-  if (await isConfigV2(dir)) {
-    const id = loadConfigV2(dir).resolved.project.id;
-    if (id) return id;
-  }
-  if (deps.envProjectId?.trim()) return deps.envProjectId.trim();
-  throw new SecretsError(
-    "This folder is not linked to a project yet.",
-    "Pass --project-id <id>, run `apitogo deploy` once, or set APITOGO_DEFAULT_PROJECT_ID."
-  );
-}
-function requireName(name, action) {
-  if (!name) {
-    throw new SecretsError(
-      `secrets ${action} needs a name.`,
-      `For example: apitogo secrets ${action} STRIPE_API_KEY`
-    );
-  }
-  if (!SECRET_NAME.test(name)) {
-    throw new SecretsError(
-      `"${name}" is not a valid secret name.`,
-      "Use letters, digits and underscores, starting with a letter or underscore (at most 128 characters)."
-    );
-  }
-  return name;
-}
-async function runSecrets(argv, deps) {
-  if (!["set", "list", "rm"].includes(argv.action)) {
-    throw new SecretsError(
-      `Unknown action: ${argv.action}.`,
-      "Use set, list or rm."
-    );
-  }
-  if (argv.action === "list") {
-    const projectId2 = await resolveProjectId2(argv, deps);
-    const { secrets: secrets2 } = await deps.client.listSecrets(projectId2);
-    return { action: "list", projectId: projectId2, secrets: secrets2 };
-  }
-  const name = requireName(argv.name, argv.action);
-  const projectId = await resolveProjectId2(argv, deps);
-  if (argv.action === "rm") {
-    if (argv.yes !== true) {
-      if (!deps.isTerminal)
-        throw new SecretsError(
-          "This is not an interactive terminal.",
-          "Pass --yes to remove the secret."
-        );
-      if (!await deps.confirm(`Remove secret ${name}? (y/N) `))
-        throw new SecretsError("Cancelled. Nothing was removed.");
-    }
-    await deps.client.deleteSecret(projectId, name);
-    return { action: "rm", projectId, name };
-  }
-  let value;
-  if (deps.isTerminal) {
-    value = await deps.askValue(`Value for ${name} (hidden): `);
-    const again = await deps.askValue("Type it again: ");
-    if (again !== value)
-      throw new SecretsError(
-        "The two values are not the same. Nothing was saved."
-      );
-  } else {
-    value = await deps.readPiped();
-  }
-  if (value.length === 0)
-    throw new SecretsError("The value is empty. Nothing was saved.");
-  const result = await deps.client.setSecret(projectId, name, value);
-  return {
-    action: "set",
-    projectId,
-    name: result.name,
-    created: result.created
-  };
-}
-function formatSecrets(result) {
-  if (result.action === "list") {
-    return result.secrets.length === 0 ? ["No secrets are set for this project."] : result.secrets.map((s) => `${s.name}  (updated ${s.updatedAtUtc})`);
-  }
-  if (result.action === "set") {
-    return [
-      `Secret ${result.name} ${result.created ? "created" : "replaced"}.`
-    ];
-  }
-  return [`Secret ${result.name} removed.`];
-}
-async function secrets(argv) {
-  const json = argv.json === true;
-  try {
-    const config2 = loadConfig();
-    const result = await runSecrets(argv, {
-      client: new PlatformApiClient(config2),
-      envProjectId: config2.defaultProjectId,
-      isTerminal: process.stdin.isTTY === true && !json,
-      askValue: (prompt) => readHidden(prompt),
-      readPiped: () => readStdin(),
-      confirm
-    });
-    if (json) {
-      console.log(JSON.stringify({ status: "succeeded", ...result }, null, 2));
-      return;
-    }
-    for (const line2 of formatSecrets(result)) printDiagnosticsToConsole(line2);
-    if (result.action !== "list") printResultToConsole("Done.");
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    const hint = error instanceof ApitogoError ? error.developerHint : void 0;
-    if (json) {
-      console.log(
-        JSON.stringify({
-          status: "failed",
-          error: message,
-          hint: hint ?? null
-        })
-      );
-      process.exitCode = 1;
-      return;
-    }
-    await printCriticalFailureToConsoleAndExit(
-      hint ? `${message} ${hint}` : message
-    );
-  }
-}
-
 // src/cli/cmds/secrets.ts
 var secrets_default = {
   desc: "Set, list or remove the project's secrets (values are hidden, encrypted on the platform and never shown again)",