dineway 0.1.48 → 0.1.49

package/dist/cli/index.mjs

@@ -1,35 +1,35 @@
 #!/usr/bin/env node
-import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-B-tbV751.mjs";
+import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-DzIpHGND.mjs";
 import { t as createDatabase } from "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { l as listTablesLike } from "../dialect-helpers-fk43GbDb.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "../config-CVssduLe.mjs";
-import { n as slugify } from "../slugify-BzGxlOFx.mjs";
-import { t as ContentRepository } from "../content-QaryevFO.mjs";
-import { i as encodeBase64url } from "../base64-C1Q9yr0B.mjs";
-import "../types-DfuD0Afl.mjs";
-import { t as MediaRepository } from "../media-DUAjMfvR.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-CBmkmMuU.mjs";
-import { t as OptionsRepository } from "../options-BvJoSSJR.mjs";
-import "../redirect-C2zXRj3c.mjs";
-import "../request-cache-CYMbwZc6.mjs";
-import "../byline-registry-CUSvkasJ.mjs";
-import { t as BylineRepository } from "../byline-1ntDwv8c.mjs";
-import "../fts-manager-CIZlScg5.mjs";
-import { n as SchemaRegistry } from "../registry-CTkbIDB9.mjs";
-import { a as isMissingTableError } from "../loader-tg63WSY2.mjs";
-import "../settings-yLjz_I4T.mjs";
-import { n as VERSION } from "../version-xlzMSXF2.mjs";
+import { i as encodeBase64url } from "../base64-F8-DUraK.mjs";
+import "../types-CSgR9nQB.mjs";
+import { a as isMissingTableError } from "../loader--GOYux8M.mjs";
+import { n as slugify } from "../slugify-BqebcqBg.mjs";
+import { t as ContentRepository } from "../content-CBxYGWfL.mjs";
+import { t as MediaRepository } from "../media-CbKyYukG.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-B169Nm6B.mjs";
+import { t as OptionsRepository } from "../options-LsPjZlqD.mjs";
+import "../redirect-CEACczxo.mjs";
+import "../request-cache-ho99schz.mjs";
+import "../byline-registry-4v6tXMNX.mjs";
+import { t as BylineRepository } from "../byline-BVC1lV6G.mjs";
+import "../fts-manager-B5l_qwrA.mjs";
+import { n as SchemaRegistry } from "../registry-D7HACema.mjs";
+import "../settings-CUXOxzsT.mjs";
+import { n as VERSION } from "../version-C4gfn0PJ.mjs";
 import { i as pluginManifestSchema } from "../manifest-schema-qh2P7RDX.mjs";
 import "../ssrf-DiKqWd3N.mjs";
-import { t as validateSeed } from "../validate-7SYRbz2f.mjs";
-import { t as applySeed } from "../apply-CX3no7XE.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-062Izo8i.mjs";
+import { t as validateSeed } from "../validate-DWmPO6oj.mjs";
+import { t as applySeed } from "../apply-D_RlTYtC.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CeGpBFV2.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
 import { o as convertDataForRead } from "../transport-LSdZVXHF.mjs";
 import { DinewayClient } from "../client/index.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { sql } from "kysely";
 import { imageSize } from "image-size";
 import { createGzipDecoder, unpackTar } from "modern-tar";
@@ -37,15 +37,474 @@ import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSyn
 import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { defineCommand, runCommand, runMain } from "citty";
+import { createInterface } from "node:readline/promises";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
-import { homedir } from "node:os";
+import { ForgewayClient } from "@forgeway/sdk";
 import { access, chmod, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { createInterface } from "node:readline/promises";
+import { homedir } from "node:os";
 import { spawn } from "node:child_process";
 import { pipeline } from "node:stream/promises";
 import { packTar } from "modern-tar/fs";
 
+//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
+const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
+const TRAILING_SLASH_PATTERN$3 = /\/$/;
+function getDinewayUserConfigDir() {
+	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
+}
+function getForgewayAccountSecretPath() {
+	return join(getDinewayUserConfigDir(), "forgeway.json");
+}
+function normalizePlatformApiUrl$1(platformApiUrl) {
+	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$3, "");
+}
+function normalizeEmail$2(email) {
+	return email.trim().toLowerCase();
+}
+function accountKey(platformApiUrl, email) {
+	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
+}
+function normalizeLookup(lookup) {
+	if (typeof lookup === "string") return { cwd: lookup };
+	return lookup ?? {};
+}
+async function readAccountStore() {
+	try {
+		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return { version: 1 };
+	}
+}
+async function writeAccountStore(store) {
+	await mkdir(getDinewayUserConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
+	const file = getForgewayAccountSecretPath();
+	await writeFile(file, JSON.stringify({
+		...store,
+		version: 1
+	}, null, "	") + "\n", {
+		encoding: "utf-8",
+		mode: 384
+	});
+	await chmod(file, 384);
+}
+function accountMatches(credentials, lookup) {
+	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
+	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
+	return true;
+}
+async function readForgewayCredentials(lookup) {
+	const normalizedLookup = normalizeLookup(lookup);
+	const store = await readAccountStore();
+	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
+	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
+	if (accounts.length === 1) return accounts[0] ?? null;
+	return null;
+}
+async function writeForgewayCredentials(credentials, lookup) {
+	const normalizedLookup = normalizeLookup(lookup);
+	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
+	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
+	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
+	const key = accountKey(platformApiUrl, email);
+	const store = await readAccountStore();
+	store.accounts = {
+		...store.accounts,
+		[key]: {
+			...credentials,
+			platformApiUrl
+		}
+	};
+	store.lastAccountKey = key;
+	await writeAccountStore(store);
+}
+async function listForgewayCredentials(platformApiUrl) {
+	const lookup = platformApiUrl ? { platformApiUrl } : {};
+	const store = await readAccountStore();
+	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
+}
+
+//#endregion
+//#region src/cli/forgeway-account.ts
+const TRAILING_SLASH_PATTERN$2 = /\/$/;
+const SHADOW_EMAIL_PATTERN$2 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
+const DEFAULT_FORGEWAY_API_BASE_URL = "https://api.dineway.ai";
+const DEFAULT_DINEWAY_WEB_URL = "https://dineway.ai";
+function normalizeForgewayApiUrl(value) {
+	return (value || DEFAULT_FORGEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+}
+function normalizeDinewayWebUrl(value) {
+	return (value || DEFAULT_DINEWAY_WEB_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+}
+function normalizeForgewayEmail(value) {
+	return value?.trim().toLowerCase() ?? "";
+}
+function isShadowForgewayEmail(email) {
+	return Boolean(email && SHADOW_EMAIL_PATTERN$2.test(email));
+}
+function createForgewayAccountClient(platformApiUrl, accessToken) {
+	return new ForgewayClient({
+		baseUrl: normalizeForgewayApiUrl(platformApiUrl),
+		accessToken,
+		isServerMode: true,
+		auth: { detectOAuthCallback: false }
+	});
+}
+function normalizeForgewayUser$2(user) {
+	if (!user?.id || !user.email) throw new Error("Forgeway session response did not include a user email.");
+	return {
+		id: user.id,
+		name: user.profile?.name ?? user.name ?? user.email,
+		email: user.email,
+		avatarUrl: user.profile?.avatar_url ?? user.avatarUrl ?? user.avatar_url ?? null,
+		emailVerified: user.emailVerified ?? user.email_verified ?? false
+	};
+}
+function assertFormalForgewayUser(user) {
+	if (!user || user.emailVerified !== true || isShadowForgewayEmail(user.email)) throw new Error("Dineway account commands require a verified Forgeway account.");
+	return user;
+}
+async function readStoredForgewayAccount(lookup = {}) {
+	const platformApiUrl = normalizeForgewayApiUrl(lookup.platformApiUrl);
+	const email = normalizeForgewayEmail(lookup.email);
+	if (email) return readForgewayCredentials({
+		platformApiUrl,
+		email
+	});
+	const stored = await readForgewayCredentials({ platformApiUrl });
+	if (stored) return stored;
+	const accounts = (await listForgewayCredentials(platformApiUrl)).filter((credentials) => {
+		try {
+			assertFormalForgewayUser(credentials.user);
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	return accounts.length === 1 ? accounts[0] ?? null : null;
+}
+async function refreshForgewayAccountCredentials(credentials) {
+	const user = assertFormalForgewayUser(credentials.user);
+	if (!credentials.refreshToken) throw new Error("Stored Forgeway account is missing a refresh token. Run `dineway account login`.");
+	const { data, error } = await createForgewayAccountClient(credentials.platformApiUrl).auth.refreshSession({ refreshToken: credentials.refreshToken });
+	if (error || !data?.accessToken) throw new Error(error?.message || "Failed to refresh Forgeway account. Run `dineway account login`.");
+	const refreshedUser = normalizeForgewayUser$2(data.user);
+	if (normalizeForgewayEmail(refreshedUser.email) !== normalizeForgewayEmail(user.email)) throw new Error("Forgeway refresh returned credentials for a different account.");
+	const updated = {
+		...credentials,
+		platformApiUrl: normalizeForgewayApiUrl(credentials.platformApiUrl),
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken ?? credentials.refreshToken,
+		user: {
+			...refreshedUser,
+			emailVerified: true
+		}
+	};
+	await writeForgewayCredentials(updated, {
+		platformApiUrl: updated.platformApiUrl,
+		email: updated.user?.email
+	});
+	return updated;
+}
+async function sendForgewayAccountLoginLink(input) {
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const webUrl = normalizeDinewayWebUrl(input.webUrl);
+	const redirectTo = new URL("/cli-auth", webUrl).toString();
+	const { error } = await createForgewayAccountClient(platformApiUrl).auth.sendPasswordlessSignInEmail({
+		email: input.email,
+		redirectTo
+	});
+	if (error) throw new Error(error.message || "Failed to send Forgeway account sign-in link.");
+}
+async function completeForgewayAccountLogin(input) {
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const { data, error } = await createForgewayAccountClient(platformApiUrl).auth.signInWithPasswordlessToken({ token: input.token });
+	if (error || !data?.accessToken || !data.refreshToken) throw new Error(error?.message || "Forgeway sign-in token is invalid or expired.");
+	const user = normalizeForgewayUser$2(data.user);
+	if (input.email && normalizeForgewayEmail(user.email) !== normalizeForgewayEmail(input.email)) throw new Error("Forgeway sign-in returned credentials for a different email.");
+	const credentials = {
+		platformApiUrl,
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		user: {
+			...user,
+			emailVerified: true
+		}
+	};
+	await writeForgewayCredentials(credentials, {
+		platformApiUrl,
+		email: credentials.user?.email
+	});
+	return credentials;
+}
+async function getForgewayDinewayAccount(credentials) {
+	const refreshed = await refreshForgewayAccountCredentials(credentials);
+	const { data, error } = await createForgewayAccountClient(refreshed.platformApiUrl, refreshed.accessToken).dineway.getAccount();
+	if (error || !data) throw new Error(error?.message || "Failed to fetch Dineway account status from Forgeway.");
+	return {
+		credentials: refreshed,
+		account: data
+	};
+}
+
+//#endregion
+//#region src/cli/output.ts
+/**
+* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
+*
+* Call this early in any command that uses `output()` with `--json`.
+* Safe to call multiple times — only applies the redirect once.
+*/
+function configureOutputMode(args) {
+	if (args.json || !process.stdout.isTTY) {
+		consola$1.options.stdout = process.stderr;
+		consola$1.options.stderr = process.stderr;
+	}
+}
+/**
+* Output data as JSON or pretty-printed.
+*
+* If stdout is not a TTY or --json is set, outputs JSON.
+* Otherwise, outputs a formatted representation.
+*/
+function output(data, args) {
+	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+	else prettyPrint(data);
+}
+function prettyPrint(data, indent = 0) {
+	if (data === null || data === void 0) {
+		consola$1.log("(empty)");
+		return;
+	}
+	if (Array.isArray(data)) {
+		if (data.length === 0) {
+			consola$1.log("(no items)");
+			return;
+		}
+		for (const item of data) {
+			prettyPrint(item, indent);
+			if (indent === 0) consola$1.log("---");
+		}
+		return;
+	}
+	if (typeof data === "object") {
+		const obj = Object(data);
+		if ("items" in obj && Array.isArray(obj.items)) {
+			prettyPrint(obj.items, indent);
+			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
+			return;
+		}
+		const prefix = "  ".repeat(indent);
+		for (const [key, value] of Object.entries(obj)) {
+			if (value === null || value === void 0) continue;
+			if (typeof value === "object" && !Array.isArray(value)) {
+				consola$1.log(`${prefix}${key}:`);
+				prettyPrint(value, indent + 1);
+			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
+			else {
+				const str = typeof value === "string" ? value : JSON.stringify(value);
+				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
+				consola$1.log(`${prefix}${key}: ${display}`);
+			}
+		}
+		return;
+	}
+	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
+}
+
+//#endregion
+//#region src/cli/commands/account.ts
+async function promptLine(question) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return (await readline.question(question)).trim();
+	} finally {
+		readline.close();
+	}
+}
+function resolveApiUrl(args) {
+	return normalizeForgewayApiUrl(args["api-url"] ?? process.env.DINEWAY_API_BASE_URL ?? process.env.FORGEWAY_API_URL);
+}
+function outputAccountJson(value) {
+	console.log(JSON.stringify(value, null, "	"));
+}
+const accountLoginCommand = defineCommand({
+	meta: {
+		name: "login",
+		description: "Log in to the Dineway Web / Forgeway account used for paid services"
+	},
+	args: {
+		email: {
+			type: "string",
+			alias: "e",
+			description: "Forgeway account email"
+		},
+		token: {
+			type: "string",
+			description: "Passwordless sign-in token from the Dineway CLI auth page"
+		},
+		"api-url": {
+			type: "string",
+			description: "Forgeway API URL",
+			default: DEFAULT_FORGEWAY_API_BASE_URL
+		},
+		"web-url": {
+			type: "string",
+			description: "Dineway Web URL used for the email link",
+			default: DEFAULT_DINEWAY_WEB_URL
+		},
+		"send-link": {
+			type: "boolean",
+			description: "Send the email link and exit without prompting for the token"
+		},
+		json: {
+			type: "boolean",
+			description: "Output as JSON"
+		}
+	},
+	async run({ args }) {
+		configureOutputMode(args);
+		const platformApiUrl = resolveApiUrl(args);
+		const webUrl = normalizeDinewayWebUrl(args["web-url"]);
+		const email = normalizeForgewayEmail(args.email) || normalizeForgewayEmail(await promptLine("Dineway account email: "));
+		if (!email) {
+			consola$1.error("Email is required.");
+			process.exit(2);
+		}
+		try {
+			const existing = await readStoredForgewayAccount({
+				platformApiUrl,
+				email
+			});
+			if (existing && !args.token && !args["send-link"]) {
+				const { account } = await getForgewayDinewayAccount(existing);
+				if (args.json) outputAccountJson({
+					loggedIn: true,
+					platformApiUrl,
+					account
+				});
+				else {
+					consola$1.success(`Already logged in as ${pc.bold(account.account.email ?? email)}`);
+					consola$1.info(`Plan: ${pc.cyan(account.plan.name)}`);
+				}
+				return;
+			}
+			if (!args.token) {
+				await sendForgewayAccountLoginLink({
+					email,
+					platformApiUrl,
+					webUrl
+				});
+				if (args.json) outputAccountJson({
+					sent: true,
+					email,
+					platformApiUrl,
+					cliAuthUrl: new URL("/cli-auth", webUrl).toString()
+				});
+				else {
+					consola$1.success(`Sent Dineway account sign-in link to ${pc.bold(email)}`);
+					consola$1.info("Open the email link, copy the CLI token, then paste it here.");
+				}
+				if (args["send-link"]) return;
+			}
+			const { account } = await getForgewayDinewayAccount(await completeForgewayAccountLogin({
+				token: typeof args.token === "string" && args.token.trim() ? args.token.trim() : await promptLine("CLI token: "),
+				platformApiUrl,
+				email
+			}));
+			if (args.json) outputAccountJson({
+				loggedIn: true,
+				platformApiUrl,
+				account
+			});
+			else {
+				consola$1.success(`Logged in as ${pc.bold(account.account.email ?? email)}`);
+				consola$1.info(`Plan: ${pc.cyan(account.plan.name)}`);
+				consola$1.info(`Credits: ${account.credits.availableCredits.toLocaleString()}`);
+				consola$1.info(`Hosted sites: ${account.sites.usedHostedSites.toLocaleString()} / ${account.sites.hostedSiteLimitLabel}`);
+			}
+		} catch (error) {
+			consola$1.error(error instanceof Error ? error.message : "Dineway account login failed");
+			process.exit(2);
+		}
+	}
+});
+const accountStatusCommand = defineCommand({
+	meta: {
+		name: "status",
+		description: "Show Dineway Web / Forgeway account plan, credits, and hosted site slots"
+	},
+	args: {
+		email: {
+			type: "string",
+			alias: "e",
+			description: "Forgeway account email"
+		},
+		"api-url": {
+			type: "string",
+			description: "Forgeway API URL",
+			default: DEFAULT_FORGEWAY_API_BASE_URL
+		},
+		json: {
+			type: "boolean",
+			description: "Output as JSON"
+		}
+	},
+	async run({ args }) {
+		configureOutputMode(args);
+		const platformApiUrl = resolveApiUrl(args);
+		try {
+			const credentials = await readStoredForgewayAccount({
+				platformApiUrl,
+				email: normalizeForgewayEmail(args.email)
+			});
+			if (!credentials) {
+				if (args.json) outputAccountJson({
+					loggedIn: false,
+					platformApiUrl
+				});
+				else consola$1.error("Not logged in. Run: dineway account login");
+				process.exit(2);
+			}
+			const { account } = await getForgewayDinewayAccount(credentials);
+			if (args.json) {
+				outputAccountJson({
+					loggedIn: true,
+					platformApiUrl,
+					account
+				});
+				return;
+			}
+			consola$1.info(`Email: ${pc.bold(account.account.email ?? credentials.user?.email ?? "unknown")}`);
+			consola$1.info(`Plan:  ${pc.cyan(account.plan.name)}`);
+			consola$1.info(`Credits available: ${account.credits.availableCredits.toLocaleString()}`);
+			consola$1.info(`Hosted sites: ${account.sites.usedHostedSites.toLocaleString()} / ${account.sites.hostedSiteLimitLabel}`);
+			if (account.billing.subscription?.status) consola$1.info(`Billing: ${account.billing.subscription.status}`);
+		} catch (error) {
+			consola$1.error(error instanceof Error ? error.message : "Dineway account status failed");
+			process.exit(2);
+		}
+	}
+});
+const accountCommand = defineCommand({
+	meta: {
+		name: "account",
+		description: "Dineway Web account login, status, and billing helpers"
+	},
+	subCommands: {
+		login: accountLoginCommand,
+		status: accountStatusCommand
+	}
+});
+
+//#endregion
 //#region src/cli/credentials.ts
 /**
 * Credential storage for CLI auth tokens.
@@ -99,7 +558,7 @@ function findProjectRoot(from) {
 	}
 	return null;
 }
-function readStore$1() {
+function readStore() {
 	const path = getCredentialPath();
 	try {
 		if (existsSync(path)) {
@@ -109,7 +568,7 @@ function readStore$1() {
 	} catch {}
 	return {};
 }
-function writeStore$1(store) {
+function writeStore(store) {
 	mkdirSync(getConfigDir(), {
 		recursive: true,
 		mode: 448
@@ -124,7 +583,7 @@ function writeStore$1(store) {
 */
 function getCredentials(baseUrl) {
 	const key = resolveCredentialKey(baseUrl);
-	const cred = readStore$1()[key];
+	const cred = readStore()[key];
 	if (!cred || !("accessToken" in cred)) return null;
 	return cred;
 }
@@ -133,19 +592,19 @@ function getCredentials(baseUrl) {
 */
 function saveCredentials(baseUrl, cred) {
 	const key = resolveCredentialKey(baseUrl);
-	const store = readStore$1();
+	const store = readStore();
 	store[key] = cred;
-	writeStore$1(store);
+	writeStore(store);
 }
 /**
 * Remove credentials for a URL.
 */
 function removeCredentials(baseUrl) {
 	const key = resolveCredentialKey(baseUrl);
-	const store = readStore$1();
+	const store = readStore();
 	if (key in store) {
 		delete store[key];
-		writeStore$1(store);
+		writeStore(store);
 		return true;
 	}
 	return false;
@@ -162,7 +621,7 @@ function marketplaceKey(registryUrl) {
 */
 function getMarketplaceCredential(registryUrl) {
 	const key = marketplaceKey(registryUrl);
-	const cred = readStore$1()[key];
+	const cred = readStore()[key];
 	if (!cred || !("token" in cred)) return null;
 	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
 	return cred;
@@ -172,19 +631,19 @@ function getMarketplaceCredential(registryUrl) {
 */
 function saveMarketplaceCredential(registryUrl, cred) {
 	const key = marketplaceKey(registryUrl);
-	const store = readStore$1();
+	const store = readStore();
 	store[key] = cred;
-	writeStore$1(store);
+	writeStore(store);
 }
 /**
 * Remove marketplace credential for a registry URL.
 */
 function removeMarketplaceCredential(registryUrl) {
 	const key = marketplaceKey(registryUrl);
-	const store = readStore$1();
+	const store = readStore();
 	if (key in store) {
 		delete store[key];
-		writeStore$1(store);
+		writeStore(store);
 		return true;
 	}
 	return false;
@@ -359,71 +818,6 @@ function createClientFromArgs(args) {
 	});
 }
 
-//#endregion
-//#region src/cli/output.ts
-/**
-* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
-*
-* Call this early in any command that uses `output()` with `--json`.
-* Safe to call multiple times — only applies the redirect once.
-*/
-function configureOutputMode(args) {
-	if (args.json || !process.stdout.isTTY) {
-		consola$1.options.stdout = process.stderr;
-		consola$1.options.stderr = process.stderr;
-	}
-}
-/**
-* Output data as JSON or pretty-printed.
-*
-* If stdout is not a TTY or --json is set, outputs JSON.
-* Otherwise, outputs a formatted representation.
-*/
-function output(data, args) {
-	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-	else prettyPrint(data);
-}
-function prettyPrint(data, indent = 0) {
-	if (data === null || data === void 0) {
-		consola$1.log("(empty)");
-		return;
-	}
-	if (Array.isArray(data)) {
-		if (data.length === 0) {
-			consola$1.log("(no items)");
-			return;
-		}
-		for (const item of data) {
-			prettyPrint(item, indent);
-			if (indent === 0) consola$1.log("---");
-		}
-		return;
-	}
-	if (typeof data === "object") {
-		const obj = Object(data);
-		if ("items" in obj && Array.isArray(obj.items)) {
-			prettyPrint(obj.items, indent);
-			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
-			return;
-		}
-		const prefix = "  ".repeat(indent);
-		for (const [key, value] of Object.entries(obj)) {
-			if (value === null || value === void 0) continue;
-			if (typeof value === "object" && !Array.isArray(value)) {
-				consola$1.log(`${prefix}${key}:`);
-				prettyPrint(value, indent + 1);
-			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
-			else {
-				const str = typeof value === "string" ? value : JSON.stringify(value);
-				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
-				consola$1.log(`${prefix}${key}: ${display}`);
-			}
-		}
-		return;
-	}
-	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
-}
-
 //#endregion
 //#region src/cli/commands/auth.ts
 /**
@@ -950,7 +1344,157 @@ const contentCommand = defineCommand({
 		restore: restoreCommand,
 		translations: translationsCommand
 	}
-});
+});
+
+//#endregion
+//#region src/cli/paywall.ts
+const PAYWALL_MESSAGE_PATTERN = /\b(quota|credit|credits|upgrade|plan|billing|subscription|slot)\b/i;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function stringField(record, key) {
+	const value = record[key];
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function getNestedError(value) {
+	if (!isRecord$1(value)) return null;
+	const nested = value.error;
+	return isRecord$1(nested) ? nested : value;
+}
+function isHostedSitesResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized === "deploy:forgeway" || normalized === "dineway.hosted_sites" || normalized.includes("hosted_site");
+}
+function isCreditResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized.includes("credit") || normalized.includes("firecrawl") || normalized.includes("dataforseo") || normalized.startsWith("/api/");
+}
+function getCliPaywallRefreshStatus(paywall, account) {
+	if (isHostedSitesResource(paywall.resource)) {
+		const remainingHostedSites = account.sites?.remainingHostedSites;
+		if (remainingHostedSites === null || (remainingHostedSites ?? 0) > 0) return {
+			blocked: false,
+			message: "Hosted capacity is now available. Re-run the blocked command."
+		};
+		return {
+			blocked: true,
+			message: "There is still no hosted capacity. Complete checkout in Dineway Web."
+		};
+	}
+	if (isCreditResource(paywall.resource)) {
+		if ((account.credits?.availableCredits ?? 0) > 0) return {
+			blocked: false,
+			message: "Provider credits are now available. Re-run the blocked command."
+		};
+		return {
+			blocked: true,
+			message: "There are still no provider credits. Complete checkout or top up credits in Dineway Web."
+		};
+	}
+	return {
+		blocked: false,
+		message: "Account status refreshed. Re-run the blocked command when ready."
+	};
+}
+function normalizeCliPaywallError(input) {
+	const error = input.error;
+	const status = error?.status ?? error?.statusCode;
+	const message = error?.message ?? (input.error instanceof Error ? input.error.message : "");
+	const body = error?.body;
+	const candidate = getNestedError(body) ?? getNestedError(input.error) ?? {};
+	if (stringField(candidate, "code") && stringField(candidate, "resource") && stringField(candidate, "reason") && typeof candidate.handoffRequired === "boolean") return {
+		code: stringField(candidate, "code") ?? "PAYWALL_REQUIRED",
+		resource: stringField(candidate, "resource") ?? input.resource,
+		reason: stringField(candidate, "reason") ?? input.reason ?? message,
+		requiredPlan: stringField(candidate, "requiredPlan"),
+		pricingUrl: stringField(candidate, "pricingUrl") ?? new URL("/pricing", normalizeDinewayWebUrl(input.webUrl)).toString(),
+		handoffRequired: candidate.handoffRequired === true
+	};
+	if ((status === 402 || status === 403 || status === 429) && PAYWALL_MESSAGE_PATTERN.test(message)) return {
+		code: status === 429 ? "QUOTA_EXCEEDED" : "PAYWALL_REQUIRED",
+		resource: input.resource,
+		reason: input.reason ?? message,
+		pricingUrl: new URL("/pricing", normalizeDinewayWebUrl(input.webUrl)).toString(),
+		handoffRequired: true
+	};
+	return null;
+}
+async function promptEnter(message) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		await readline.question(message);
+	} finally {
+		readline.close();
+	}
+}
+async function createHandoff(input) {
+	const credentials = await readStoredForgewayAccount({ platformApiUrl: input.platformApiUrl });
+	if (!credentials) return null;
+	const { credentials: refreshed } = await getForgewayDinewayAccount(credentials);
+	const response = await fetch(new URL("/api/dineway-web/handoffs", input.webUrl), {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${refreshed.accessToken}`,
+			"Content-Type": "application/json",
+			"X-Dineway-Request": "1"
+		},
+		body: JSON.stringify({
+			target: "pricing",
+			reason: input.paywall.reason,
+			context: {
+				resource: input.paywall.resource,
+				code: input.paywall.code,
+				requiredPlan: input.paywall.requiredPlan,
+				...input.context
+			}
+		})
+	});
+	const payload = await response.json().catch(() => null);
+	if (!response.ok || !payload?.success || !payload.data?.url) return null;
+	return payload.data.url;
+}
+async function handleCliPaywall(input) {
+	const paywall = normalizeCliPaywallError(input);
+	if (!paywall) return false;
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const webUrl = normalizeDinewayWebUrl(input.webUrl ?? process.env.DINEWAY_WEB_URL);
+	let url = paywall.pricingUrl;
+	let handoffFailed = false;
+	try {
+		const handoffUrl = await createHandoff({
+			paywall,
+			platformApiUrl,
+			webUrl,
+			context: input.context
+		});
+		if (handoffUrl) url = handoffUrl;
+		else handoffFailed = true;
+	} catch {
+		handoffFailed = true;
+	}
+	consola$1.error(paywall.reason);
+	if (handoffFailed) consola$1.info(`Log in first: ${pc.cyan("dineway account login")}`);
+	consola$1.info(`Continue in Dineway Web: ${pc.cyan(url)}`);
+	if (!input.interactive) return true;
+	await promptEnter("Press Enter to continue after upgrading, or Ctrl-C to cancel.");
+	const credentials = await readStoredForgewayAccount({ platformApiUrl });
+	if (!credentials) {
+		consola$1.error("Still not logged in. Run: dineway account login");
+		return true;
+	}
+	try {
+		const { account } = await getForgewayDinewayAccount(credentials);
+		const status = getCliPaywallRefreshStatus(paywall, account);
+		if (status.blocked) consola$1.error(status.message);
+		else consola$1.info(status.message);
+	} catch {
+		consola$1.error("Account is still blocked. Complete checkout or top up credits in Dineway Web.");
+	}
+	return true;
+}
 
 //#endregion
 //#region src/cli/commands/deploy/utils/astro-adapter.ts
@@ -1637,136 +2181,6 @@ async function writeForgewayDeployMetadata(cwd, metadata) {
 	});
 }
 
-//#endregion
-//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
-const DINEWAY_CONFIG_DIR_NAME = ".dineway";
-const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
-const TRAILING_SLASH_PATTERN$2 = /\/$/;
-function getDinewayConfigDir(cwd = process.cwd()) {
-	return join(cwd, DINEWAY_CONFIG_DIR_NAME);
-}
-function getDinewayUserConfigDir() {
-	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
-}
-function getForgewaySecretPath(cwd = process.cwd()) {
-	return join(getDinewayConfigDir(cwd), "forgeway.json");
-}
-function getForgewayAccountSecretPath() {
-	return join(getDinewayUserConfigDir(), "forgeway.json");
-}
-function normalizePlatformApiUrl$1(platformApiUrl) {
-	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$2, "");
-}
-function normalizeEmail$2(email) {
-	return email.trim().toLowerCase();
-}
-function accountKey(platformApiUrl, email) {
-	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
-}
-function normalizeLookup(lookup) {
-	if (typeof lookup === "string") return { cwd: lookup };
-	return lookup ?? {};
-}
-async function readStore(cwd = process.cwd()) {
-	try {
-		const raw = await readFile(getForgewaySecretPath(cwd), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-async function writeStore(store, cwd = process.cwd()) {
-	await mkdir(getDinewayConfigDir(cwd), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewaySecretPath(cwd);
-	await writeFile(file, JSON.stringify(store, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-async function readAccountStore() {
-	try {
-		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return { version: 1 };
-	}
-}
-async function writeAccountStore(store) {
-	await mkdir(getDinewayUserConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewayAccountSecretPath();
-	await writeFile(file, JSON.stringify({
-		...store,
-		version: 1
-	}, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-function accountMatches(credentials, lookup) {
-	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
-	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
-	return true;
-}
-async function readForgewayCredentials(lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const store = await readAccountStore();
-	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
-	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
-	if (accounts.length === 1) return accounts[0] ?? null;
-	return null;
-}
-async function writeForgewayCredentials(credentials, lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
-	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
-	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
-	const key = accountKey(platformApiUrl, email);
-	const store = await readAccountStore();
-	store.accounts = {
-		...store.accounts,
-		[key]: {
-			...credentials,
-			platformApiUrl
-		}
-	};
-	store.lastAccountKey = key;
-	await writeAccountStore(store);
-}
-async function listForgewayCredentials(platformApiUrl) {
-	const lookup = platformApiUrl ? { platformApiUrl } : {};
-	const store = await readAccountStore();
-	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
-}
-function shadowGrantKey(platformApiUrl, placeId) {
-	return `${platformApiUrl.replace(TRAILING_SLASH_PATTERN$2, "")}#${placeId ?? "__unbound__"}`;
-}
-async function readForgewayShadowGrant(platformApiUrl, placeId, cwd) {
-	const store = await readStore(cwd);
-	if (!store.shadowGrants) return null;
-	if (placeId) return store.shadowGrants[shadowGrantKey(platformApiUrl, placeId)] ?? null;
-	const lastKey = store.lastShadowGrantKey;
-	if (lastKey && store.shadowGrants[lastKey]?.platformApiUrl === platformApiUrl) return store.shadowGrants[lastKey];
-	return Object.values(store.shadowGrants).find((grant) => grant.platformApiUrl === platformApiUrl) ?? null;
-}
-async function writeForgewayShadowGrant(grant, cwd) {
-	const store = await readStore(cwd);
-	const key = shadowGrantKey(grant.platformApiUrl, grant.placeId);
-	store.shadowGrants = {
-		...store.shadowGrants,
-		[key]: grant
-	};
-	store.lastShadowGrantKey = key;
-	await writeStore(store, cwd);
-}
-
 //#endregion
 //#region src/cli/commands/deploy/targets/forgeway.ts
 const DEFAULT_DINEWAY_API_BASE_URL$1 = "https://api.dineway.ai";
@@ -1790,7 +2204,6 @@ const DINEWAY_PACKAGE_NAME = "dineway";
 const SEMVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+].*)?$/;
 const LOCAL_PACKAGE_SPEC_PATTERN = /^(?:workspace|file|link|portal):/;
 const SHADOW_EMAIL_PATTERN$1 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
-const OTP_PATTERN = /^\d{6}$/;
 const FOOD_TYPES = new Set([
 	"restaurant",
 	"cafe",
@@ -1925,11 +2338,6 @@ async function parseErrorResponse(response) {
 function normalizeEmail$1(email) {
 	return email.trim().toLowerCase();
 }
-function normalizeOtp(otp) {
-	const value = otp.trim();
-	if (!OTP_PATTERN.test(value)) throw new Error("Forgeway email verification OTP must be a 6-digit numeric code.");
-	return value;
-}
 function isShadowEmail$1(email) {
 	return Boolean(email && SHADOW_EMAIL_PATTERN$1.test(email));
 }
@@ -1948,8 +2356,7 @@ async function refreshFormalAccessToken(context, deps) {
 		platformApiUrl: context.platformApiUrl,
 		accessToken: payload.accessToken,
 		refreshToken: payload.refreshToken ?? context.refreshToken,
-		...user ? { user } : {},
-		source: "shadow-email-upgrade"
+		...user ? { user } : {}
 	};
 	context.accessToken = updated.accessToken;
 	context.refreshToken = updated.refreshToken;
@@ -1961,30 +2368,6 @@ async function refreshFormalAccessToken(context, deps) {
 	});
 	return payload.accessToken;
 }
-async function refreshShadowAccessToken(context, deps) {
-	if (!context.refreshToken) throw new Error("Dineway shadow deploy grant is missing its refresh token.");
-	const response = await forgewayRequest(`${context.platformApiUrl}/api/auth/refresh?client_type=server`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ refreshToken: context.refreshToken })
-	}, deps);
-	if (!response.ok) throw new Error("Failed to refresh Dineway shadow deploy grant. Run dineway deploy again.");
-	const payload = await response.json();
-	if (!payload.accessToken || !payload.refreshToken) throw new Error("Dineway shadow refresh response was missing tokens.");
-	context.accessToken = payload.accessToken;
-	context.refreshToken = payload.refreshToken;
-	await (deps.writeShadowGrant ?? writeForgewayShadowGrant)({
-		platformApiUrl: context.platformApiUrl,
-		placeId: context.placeId,
-		accessToken: payload.accessToken,
-		refreshToken: payload.refreshToken,
-		restaurantName: context.restaurantName,
-		city: context.city,
-		user: payload.user ? normalizeForgewayUser$1(payload.user) : void 0,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	}, context.projectDir);
-	return payload.accessToken;
-}
 async function promptText(question, initialValue, deps) {
 	if (deps.promptText) return await deps.promptText(question, initialValue);
 	if (!process.stdin.isTTY) return "";
@@ -2047,12 +2430,6 @@ function validatePublisherEmail(rawEmail) {
 	if (!email || isShadowEmail$1(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
 	return email;
 }
-async function resolveForgewayAccountEmail(options, saved, deps, preferredEmail) {
-	const suppliedEmail = options.email ?? getEnv("DINEWAY_EMAIL") ?? getEnv("FORGEWAY_EMAIL");
-	const savedEmail = savedPublisherEmail(saved);
-	if ((options.sendOtp || options.otp) && !suppliedEmail && !preferredEmail && !savedEmail) throw new Error("Forgeway OTP deploy requires --email or DINEWAY_EMAIL.");
-	return validatePublisherEmail(suppliedEmail ?? preferredEmail ?? savedEmail ?? await promptRequired("Dineway account email: ", void 0, deps, "Dineway account email is required. Pass --email or set DINEWAY_EMAIL."));
-}
 function isStoredFormalCredentialForEmail(stored, email) {
 	if (!stored?.accessToken || !stored.user) return false;
 	if (email && normalizeEmail$1(stored.user.email) !== email) return false;
@@ -2065,95 +2442,6 @@ function assertVerifiedFormalAccountUser(user, expectedEmail) {
 	if (expectedEmail && normalizeEmail$1(user.email) !== normalizeEmail$1(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
 	return user;
 }
-async function shadowUpgradeFetch(context, path, deps, options) {
-	const request = async (accessToken) => await forgewayRequest(`${context.platformApiUrl}${path}`, {
-		...options,
-		headers: {
-			"Content-Type": "application/json",
-			Authorization: `Bearer ${accessToken}`,
-			...options.headers
-		}
-	}, deps);
-	if (!context.accessToken) throw new Error("Dineway shadow deploy grant is missing its access token.");
-	let response = await request(context.accessToken);
-	if (response.status === 401) response = await request(await refreshShadowAccessToken(context, deps));
-	if (!response.ok) throw new ForgewayApiError(await parseErrorResponse(response), response.status);
-	return await response.json();
-}
-async function startShadowEmailUpgrade(context, email, deps) {
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/upgrade/email/start", deps, {
-		method: "POST",
-		body: JSON.stringify({ email })
-	});
-	if (payload.email && normalizeEmail$1(payload.email) !== email) throw new Error("Forgeway email verification response returned a different email.");
-	return payload;
-}
-async function verifyShadowEmailUpgrade(context, email, otp, deps) {
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/upgrade/email/verify", deps, {
-		method: "POST",
-		body: JSON.stringify({
-			email,
-			otp
-		})
-	});
-	if (!payload.accessToken || !payload.refreshToken || !payload.user) throw new Error("Forgeway email upgrade response was missing credentials.");
-	const user = normalizeForgewayUser$1(payload.user);
-	if (normalizeEmail$1(user.email) !== email) throw new Error("Forgeway email upgrade returned credentials for a different email.");
-	if (user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway email upgrade did not return a verified formal account.");
-	return {
-		platformApiUrl: context.platformApiUrl,
-		accessToken: payload.accessToken,
-		refreshToken: payload.refreshToken,
-		user,
-		source: "shadow-email-upgrade"
-	};
-}
-async function resolveFormalAccountCredentials(context, email, options, deps) {
-	const stored = await (deps.readCredentials ?? readForgewayCredentials)({
-		cwd: context.projectDir,
-		platformApiUrl: context.platformApiUrl,
-		email
-	});
-	if (!options.sendOtp && !options.otp && isStoredFormalCredentialForEmail(stored, email)) return {
-		status: "verified",
-		credentials: {
-			...stored,
-			platformApiUrl: context.platformApiUrl
-		}
-	};
-	if (options.sendOtp) {
-		const response = await startShadowEmailUpgrade(context, email, deps);
-		return {
-			status: "otp-sent",
-			email: response.email ? normalizeEmail$1(response.email) : email,
-			expiresAt: response.expiresAt
-		};
-	}
-	if (options.otp) {
-		const credentials = await verifyShadowEmailUpgrade(context, email, normalizeOtp(options.otp), deps);
-		await (deps.writeCredentials ?? writeForgewayCredentials)(credentials, {
-			cwd: context.projectDir,
-			platformApiUrl: context.platformApiUrl,
-			email
-		});
-		return {
-			status: "verified",
-			credentials
-		};
-	}
-	await startShadowEmailUpgrade(context, email, deps);
-	consola.info(`Sent Forgeway email verification code to ${email}`);
-	const credentials = await verifyShadowEmailUpgrade(context, email, await promptRequired("Email verification code: ", void 0, deps, "Email verification code is required."), deps);
-	await (deps.writeCredentials ?? writeForgewayCredentials)(credentials, {
-		cwd: context.projectDir,
-		platformApiUrl: context.platformApiUrl,
-		email
-	});
-	return {
-		status: "verified",
-		credentials
-	};
-}
 async function readCachedPublisherCredentials(cwd, platformApiUrl, email, deps) {
 	const credentials = await (deps.readCredentials ?? readForgewayCredentials)({
 		cwd,
@@ -2218,7 +2506,6 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 	const context = {
 		projectDir: cwd,
 		platformApiUrl,
-		authKind: "formal-account",
 		accessToken: account.credentials.accessToken,
 		refreshToken: account.credentials.refreshToken,
 		user,
@@ -2232,7 +2519,7 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 		city: options.city
 	};
 	if (!context.placeId) {
-		const resolvedRestaurant = await resolveShadowRestaurantInfo(options, deps);
+		const resolvedRestaurant = await resolveRequiredRestaurantInfo(options, deps);
 		restaurant = resolvedRestaurant;
 		context.placeId = await resolvePlaceIdWithFormalSearch({
 			context,
@@ -2248,100 +2535,11 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 		restaurant
 	};
 }
-async function resolveShadowProjectContext(cwd, options, deps, preferredEmail) {
-	const saved = await readSavedForgewayMetadata(cwd);
-	const platformApiUrl = resolvePlatformApiUrl(saved.platformApiUrl);
-	const savedPlaceId = options.placeId ?? getEnv("DINEWAY_PLACE_ID") ?? (typeof saved.placeId === "string" ? saved.placeId : void 0);
-	let grant = await (deps.readShadowGrant ?? readForgewayShadowGrant)(platformApiUrl, savedPlaceId, cwd);
-	let restaurant;
-	if (!grant) {
-		const shadowRestaurant = await resolveShadowRestaurantInfo(options, deps);
-		restaurant = shadowRestaurant;
-		if (options.dryRun) throw new Error("Forgeway deploy needs a Dineway shadow deploy grant. Run without --dry-run to create it.");
-		grant = await createShadowGrant({
-			platformApiUrl,
-			placeId: savedPlaceId,
-			restaurantName: shadowRestaurant.name,
-			city: shadowRestaurant.city,
-			cwd,
-			deps
-		});
-	} else restaurant = {
-		name: options.restaurantName ?? grant.restaurantName,
-		city: options.city ?? grant.city
-	};
-	if (!grant.placeId) {
-		const shadowRestaurant = restaurant?.name && restaurant.city ? {
-			name: restaurant.name,
-			city: restaurant.city
-		} : await resolveShadowRestaurantInfo(options, deps);
-		restaurant = shadowRestaurant;
-		grant = savedPlaceId ? await bindShadowGrantPlace({
-			platformApiUrl,
-			grant,
-			placeId: savedPlaceId,
-			restaurant: shadowRestaurant,
-			cwd,
-			deps
-		}) : await resolvePlaceIdWithShadowSearch({
-			platformApiUrl,
-			grant,
-			restaurant: shadowRestaurant,
-			cwd,
-			deps
-		});
-	}
-	if (!grant.placeId) throw new Error("Could not resolve a Dineway place id for Forgeway deploy.");
-	const shadowContext = {
-		projectDir: cwd,
-		platformApiUrl,
-		authKind: "shadow-grant",
-		accessToken: grant.accessToken,
-		refreshToken: grant.refreshToken,
-		user: grant.user,
-		ossHost: platformApiUrl,
-		placeId: grant.placeId,
-		restaurantName: restaurant.name,
-		city: restaurant.city
-	};
-	const credentialsResult = await resolveFormalAccountCredentials(shadowContext, await resolveForgewayAccountEmail(options, saved, deps, preferredEmail), options, deps);
-	if (credentialsResult.status === "otp-sent") return credentialsResult;
-	const { credentials } = credentialsResult;
-	return {
-		status: "ready",
-		context: {
-			...shadowContext,
-			authKind: "formal-account",
-			accessToken: credentials.accessToken,
-			refreshToken: credentials.refreshToken,
-			user: credentials.user,
-			ossHost: platformApiUrl
-		},
-		restaurant
-	};
-}
 async function resolveProjectContext(cwd, options, deps) {
-	let preferredEmail;
-	if (!options.sendOtp && !options.otp) {
-		const formal = await resolveFormalProjectContext(cwd, options, deps);
-		if (formal.status !== "missing") return formal;
-		preferredEmail = formal.email;
-	}
-	return await resolveShadowProjectContext(cwd, options, deps, preferredEmail);
-}
-async function createShadowUser(platformApiUrl, placeId, deps) {
-	const response = await forgewayRequest(`${platformApiUrl}/api/auth/users/shadow`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			...placeId ? { placeId } : {},
-			language: "en"
-		})
-	}, deps);
-	if (!response.ok) throw new Error(await parseErrorResponse(response));
-	const payload = await response.json();
-	if (!payload.accessToken || !payload.refreshToken) throw new Error("Dineway shadow user response was missing tokens.");
-	return payload;
+	const formal = await resolveFormalProjectContext(cwd, options, deps);
+	if (formal.status !== "missing") return formal;
+	if (formal.email) throw new Error(`No verified Dineway account credentials were found for ${formal.email}. Run: dineway account login --email ${formal.email}`);
+	throw new Error("No verified Dineway account credentials were found. Run: dineway account login");
 }
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2522,80 +2720,6 @@ function extractPlaceCandidates(payload) {
 	if (!Array.isArray(places)) throw new Error("Dineway place search response did not include places/results.");
 	return places.filter(isRecord);
 }
-function shadowContextFromGrant(cwd, platformApiUrl, grant, restaurant) {
-	return {
-		projectDir: cwd,
-		platformApiUrl,
-		authKind: "shadow-grant",
-		accessToken: grant.accessToken,
-		refreshToken: grant.refreshToken,
-		user: grant.user,
-		ossHost: platformApiUrl,
-		placeId: grant.placeId,
-		restaurantName: restaurant?.name ?? grant.restaurantName,
-		city: restaurant?.city ?? grant.city
-	};
-}
-function grantFromShadowContext(context, grant, overrides = {}) {
-	return {
-		...grant,
-		platformApiUrl: context.platformApiUrl,
-		accessToken: context.accessToken ?? grant.accessToken,
-		refreshToken: context.refreshToken ?? grant.refreshToken,
-		placeId: context.placeId ?? grant.placeId,
-		restaurantName: context.restaurantName ?? grant.restaurantName,
-		city: context.city ?? grant.city,
-		user: context.user ?? grant.user,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		...overrides
-	};
-}
-async function searchPlacesWithShadowGrant(options) {
-	const context = shadowContextFromGrant(options.cwd, options.platformApiUrl, options.grant, options.restaurant);
-	const payload = await shadowUpgradeFetch(context, "/api/places/search", options.deps, {
-		method: "POST",
-		body: JSON.stringify({ textQuery: `${options.restaurant.name} in ${options.restaurant.city}` })
-	});
-	return {
-		grant: grantFromShadowContext(context, options.grant),
-		candidates: extractPlaceCandidates(payload)
-	};
-}
-async function bindShadowGrantPlace(options) {
-	const context = shadowContextFromGrant(options.cwd, options.platformApiUrl, options.grant, options.restaurant);
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/place", options.deps, {
-		method: "POST",
-		body: JSON.stringify({
-			placeId: options.placeId,
-			language: "en"
-		})
-	});
-	const grant = grantFromShadowContext(context, options.grant, {
-		placeId: options.placeId,
-		accessToken: payload.accessToken ?? context.accessToken ?? options.grant.accessToken,
-		refreshToken: payload.refreshToken ?? context.refreshToken ?? options.grant.refreshToken,
-		restaurantName: options.restaurant.name,
-		city: options.restaurant.city,
-		user: payload.user ? normalizeForgewayUser$1(payload.user) : context.user ?? options.grant.user
-	});
-	await (options.deps.writeShadowGrant ?? writeForgewayShadowGrant)(grant, options.cwd);
-	return grant;
-}
-async function resolvePlaceIdWithShadowSearch(options) {
-	const { grant, candidates } = await searchPlacesWithShadowGrant(options);
-	if (candidates.length === 0) throw new Error(`Dineway place search returned no candidates for "${options.restaurant.name} in ${options.restaurant.city}".`);
-	const selected = selectPlaceCandidate(candidates, {
-		name: options.restaurant.name,
-		city: options.restaurant.city
-	});
-	const finalPlaceId = selected ? candidatePlaceId(selected.candidate) : "";
-	if (!PLACE_ID_PATTERN.test(finalPlaceId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
-	return await bindShadowGrantPlace({
-		...options,
-		grant,
-		placeId: finalPlaceId
-	});
-}
 async function resolvePlaceIdWithFormalSearch(options) {
 	const candidates = extractPlaceCandidates(await ossFetch(options.context, "/api/places/search", options.deps, {
 		method: "POST",
@@ -2610,22 +2734,6 @@ async function resolvePlaceIdWithFormalSearch(options) {
 	if (!PLACE_ID_PATTERN.test(finalPlaceId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
 	return finalPlaceId;
 }
-async function createShadowGrant(options) {
-	if (options.placeId && !PLACE_ID_PATTERN.test(options.placeId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
-	const auth = await createShadowUser(options.platformApiUrl, options.placeId, options.deps);
-	const grant = {
-		platformApiUrl: options.platformApiUrl,
-		...options.placeId ? { placeId: options.placeId } : {},
-		accessToken: auth.accessToken,
-		refreshToken: auth.refreshToken,
-		restaurantName: options.restaurantName,
-		city: options.city,
-		user: auth.user ? normalizeForgewayUser$1(auth.user) : void 0,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await (options.deps.writeShadowGrant ?? writeForgewayShadowGrant)(grant, options.cwd);
-	return grant;
-}
 async function ossFetch(context, path, deps, options = {}) {
 	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN$1, "")}${path}`, {
 		...options,
@@ -2638,7 +2746,7 @@ async function ossFetch(context, path, deps, options = {}) {
 	const token = context.accessToken;
 	if (!token) throw new Error("Forgeway deploy context is missing an authorization token.");
 	let response = await request(token);
-	if (response.status === 401) response = await request(context.authKind === "formal-account" ? await refreshFormalAccessToken(context, deps) : await refreshShadowAccessToken(context, deps));
+	if (response.status === 401) response = await request(await refreshFormalAccessToken(context, deps));
 	if (!response.ok) throw new ForgewayApiError(await parseErrorResponse(response), response.status);
 	return await response.json();
 }
@@ -2689,7 +2797,7 @@ async function resolveRestaurantInfo(options, seedPath, deps, requireForSlug, us
 		city
 	};
 }
-async function resolveShadowRestaurantInfo(options, deps) {
+async function resolveRequiredRestaurantInfo(options, deps) {
 	return {
 		name: options.restaurantName ?? await promptRequired("Restaurant name: ", void 0, deps, "Restaurant name is required. Pass --restaurant-name."),
 		city: options.city ?? await promptRequired("City: ", void 0, deps, "City is required. Pass --city.")
@@ -3094,15 +3202,6 @@ function formatDinewayAdminBootstrapMessage(bootstrap) {
 		"CLI example: npx dineway whoami"
 	].join("\n");
 }
-function formatForgewayOtpSentMessage(email, expiresAt) {
-	const lines = [
-		`Sent Forgeway email verification code to ${email}.`,
-		"Run the Forgeway deploy command again with the same restaurant/site options and --otp <code>.",
-		`Example: npx dineway deploy forgeway --email ${email} --otp 123456`
-	];
-	if (expiresAt) lines.splice(1, 0, `Code expires at ${expiresAt}.`);
-	return lines.join("\n");
-}
 async function deployForgeway(cwd, options, deps = {}) {
 	if (options.dryRun) return { message: "[dry-run] Would resolve Forgeway project, create/reuse site, bind database, initialize Dineway, upload files, and start deployment." };
 	const sourceDir = resolve(cwd);
@@ -3112,9 +3211,7 @@ async function deployForgeway(cwd, options, deps = {}) {
 	if (database !== "none") await warnProjectDinewayRuntimeMismatch(cwd, deps.dinewayVersion ?? VERSION);
 	await ensureProjectGitignoreDinewayLocalState(cwd);
 	const verbose = isVerboseDeploy(options);
-	const project = await resolveProjectContext(cwd, options, deps);
-	if (project.status === "otp-sent") return { message: formatForgewayOtpSentMessage(project.email, project.expiresAt) };
-	const { context, restaurant } = project;
+	const { context, restaurant } = await resolveProjectContext(cwd, options, deps);
 	const seedPath = options.skipSeed ? null : await resolveSeedPath$1(cwd, options.seed);
 	if (options.skipSeed) consola.info("Skipping seed initialization by request");
 	await ensureRestaurantClaim(context, restaurant, deps);
@@ -3174,7 +3271,6 @@ const forgewayTarget = {
 	remoteBuild: true,
 	supportLevel: "stable",
 	async generateConfig(cwd, options) {
-		if (options.sendOtp) return [];
 		return await configureAstroDeployAdapter(cwd, "vercel", options.dryRun);
 	},
 	async deploy(cwd, options) {
@@ -3706,16 +3802,6 @@ const deployCommand = defineCommand({
 			description: "Dineway account email for deploy authorization",
 			required: false
 		},
-		"send-otp": {
-			type: "boolean",
-			description: "Send a Forgeway email verification code and exit without prompting or deploying",
-			default: false
-		},
-		otp: {
-			type: "string",
-			description: "Forgeway email verification code for non-interactive deploy authorization",
-			required: false
-		},
 		"restaurant-name": {
 			type: "string",
 			description: "Restaurant name for first Forgeway site creation",
@@ -3763,8 +3849,6 @@ const deployCommand = defineCommand({
 			site: args.site,
 			placeId: args["place-id"],
 			email: args.email,
-			sendOtp: args["send-otp"],
-			otp: args.otp,
 			restaurantName: args["restaurant-name"],
 			city: args.city,
 			database: args.database,
@@ -3773,8 +3857,6 @@ const deployCommand = defineCommand({
 			forceDbInit: args["force-db-init"],
 			verbose: args.verbose
 		};
-		if ((options.sendOtp || options.otp) && target.name !== "forgeway") throw new Error("--send-otp and --otp are only supported for Forgeway deploys.");
-		if (options.sendOtp && options.otp) throw new Error("Use either --send-otp or --otp, not both.");
 		consola.start(`Preparing ${target.label} deploy`);
 		await ensureTargetCli(target, cwd, {
 			yes: options.yes,
@@ -3808,7 +3890,21 @@ const deployCommand = defineCommand({
 			consola.info("[dry-run] Would ensure Dineway local state entries in .gitignore");
 			consola.info(`[dry-run] Would save .dineway/deploy.json target=${target.name}`);
 		}
-		const result = await target.deploy(cwd, options);
+		const result = await target.deploy(cwd, options).catch(async (error) => {
+			if (await handleCliPaywall({
+				error,
+				resource: `deploy:${target.name}`,
+				platformApiUrl: process.env.DINEWAY_FORGEWAY_API_URL,
+				webUrl: process.env.DINEWAY_WEB_URL,
+				interactive: process.stdin.isTTY && !options.yes,
+				context: {
+					target: target.name,
+					site: options.site,
+					placeId: options.placeId
+				}
+			})) process.exit(2);
+			throw error;
+		});
 		if (result.url) consola.success(result.url);
 		consola.success(result.message);
 	}
@@ -7304,13 +7400,15 @@ var ForgewaySeoGatewayClient = class {
 	}
 	async request(path, body, init) {
 		const credentials = await this.refreshAccessToken(await this.loadCredentials());
+		const method = init?.method ?? "POST";
 		const response = await this.fetchImpl(`${credentials.platformApiUrl}${path}`, {
-			method: init?.method ?? "POST",
+			method,
 			headers: {
 				Authorization: `Bearer ${credentials.accessToken}`,
-				"Content-Type": "application/json"
+				"Content-Type": "application/json",
+				"Idempotency-Key": init?.idempotencyKey ?? randomUUID()
 			},
-			body: init?.method === "GET" ? void 0 : JSON.stringify(body ?? {})
+			body: method === "GET" ? void 0 : JSON.stringify(body ?? {})
 		});
 		const payload = await parseJsonResponse(response);
 		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(payload, `Forgeway SEO request failed with status ${response.status}.`), response.status, payload);
@@ -7375,6 +7473,11 @@ async function runSeoRequest(args, path, body) {
 	try {
 		output(await new ForgewaySeoGatewayClient().request(path, body), args);
 	} catch (error) {
+		if (await handleCliPaywall({
+			error,
+			resource: path,
+			context: { providerPath: path }
+		})) process.exit(2);
 		consola$1.error(error instanceof Error ? error.message : "Unknown error");
 		process.exit(1);
 	}
@@ -7517,6 +7620,11 @@ const firecrawlCommand = defineCommand({
 					try {
 						output(await new ForgewaySeoGatewayClient().request(`/api/firecrawl/crawl/${encodeURIComponent(crawlId)}`, void 0, { method: "GET" }), args);
 					} catch (error) {
+						if (await handleCliPaywall({
+							error,
+							resource: `/api/firecrawl/crawl/${crawlId}`,
+							context: { providerPath: `/api/firecrawl/crawl/${crawlId}` }
+						})) process.exit(2);
 						consola$1.error(error instanceof Error ? error.message : "Unknown error");
 						process.exit(1);
 					}
@@ -7972,6 +8080,7 @@ runMain(defineCommand({
 	},
 	subCommands: {
 		init: initCommand,
+		account: accountCommand,
 		types: typesCommand,
 		dev: devCommand,
 		deploy: deployCommand,