dineway 0.1.48 → 0.2.0

package/dist/cli/index.mjs

@@ -1,51 +1,510 @@
 #!/usr/bin/env node
-import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-B-tbV751.mjs";
+import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-DB7CRfOF.mjs";
 import { t as createDatabase } from "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { l as listTablesLike } from "../dialect-helpers-fk43GbDb.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "../config-CVssduLe.mjs";
-import { n as slugify } from "../slugify-BzGxlOFx.mjs";
-import { t as ContentRepository } from "../content-QaryevFO.mjs";
-import { i as encodeBase64url } from "../base64-C1Q9yr0B.mjs";
-import "../types-DfuD0Afl.mjs";
-import { t as MediaRepository } from "../media-DUAjMfvR.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-CBmkmMuU.mjs";
-import { t as OptionsRepository } from "../options-BvJoSSJR.mjs";
-import "../redirect-C2zXRj3c.mjs";
-import "../request-cache-CYMbwZc6.mjs";
-import "../byline-registry-CUSvkasJ.mjs";
-import { t as BylineRepository } from "../byline-1ntDwv8c.mjs";
-import "../fts-manager-CIZlScg5.mjs";
-import { n as SchemaRegistry } from "../registry-CTkbIDB9.mjs";
-import { a as isMissingTableError } from "../loader-tg63WSY2.mjs";
-import "../settings-yLjz_I4T.mjs";
-import { n as VERSION } from "../version-xlzMSXF2.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-qh2P7RDX.mjs";
-import "../ssrf-DiKqWd3N.mjs";
-import { t as validateSeed } from "../validate-7SYRbz2f.mjs";
-import { t as applySeed } from "../apply-CX3no7XE.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-062Izo8i.mjs";
+import { i as encodeBase64url } from "../base64-F8-DUraK.mjs";
+import "../types-Dq1qT19x.mjs";
+import { o as isMissingTableError } from "../loader-CjWqjweO.mjs";
+import "../object-cache-D51qOseS.mjs";
+import { n as slugify } from "../slugify-KSsVD_D3.mjs";
+import { t as ContentRepository } from "../content-Bh4BDjv8.mjs";
+import { t as MediaRepository } from "../media-DMj0grzC.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-Dvsw6BOs.mjs";
+import { t as OptionsRepository } from "../options-DQPTH5n0.mjs";
+import "../redirect-BAjt4Z6b.mjs";
+import "../request-cache-D9GQBxMP.mjs";
+import "../byline-registry-87nNnYl4.mjs";
+import "../field-defs-cache-DRNdhBJv.mjs";
+import { t as BylineRepository } from "../byline-e51-fWRs.mjs";
+import "../content-refresh-CgutSUfO.mjs";
+import "../fts-manager-Crzypjqu.mjs";
+import { n as SchemaRegistry } from "../registry-CtyVedcN.mjs";
+import "../settings-BbqgHWpU.mjs";
+import { n as VERSION } from "../version-BTvfRGc6.mjs";
+import { a as reconcileManifestAccess, i as pluginManifestSchema } from "../manifest-schema-BxVPYMJR.mjs";
+import "../ssrf-DWe8jwAp.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CDZo2k8L.mjs";
+import { t as validateSeed } from "../validate-DNs0pTSc.mjs";
+import { t as applySeed } from "../apply-bZswmZPm.mjs";
 import { createHeaderAwareFetch, customHeadersInterceptor, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
-import { o as convertDataForRead } from "../transport-LSdZVXHF.mjs";
+import { t as convertDataForRead } from "../portable-text-dA_UlJwW.mjs";
 import { DinewayClient } from "../client/index.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { createHash } from "node:crypto";
+import { r as fileExists$11, t as bundleCommand } from "../bundle-7C_DpkEq.mjs";
+import { createHash, randomUUID } from "node:crypto";
 import { sql } from "kysely";
-import { imageSize } from "image-size";
 import { createGzipDecoder, unpackTar } from "modern-tar";
-import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
-import { pathToFileURL } from "node:url";
+import { createReadStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { defineCommand, runCommand, runMain } from "citty";
+import { createInterface } from "node:readline/promises";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
+import { ForgewayClient } from "@forgeway/sdk";
+import { access, chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { access, chmod, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { createInterface } from "node:readline/promises";
 import { spawn } from "node:child_process";
-import { pipeline } from "node:stream/promises";
-import { packTar } from "modern-tar/fs";
 
+//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
+const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
+const TRAILING_SLASH_PATTERN$3 = /\/$/;
+function getDinewayUserConfigDir() {
+	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
+}
+function getForgewayAccountSecretPath() {
+	return join(getDinewayUserConfigDir(), "forgeway.json");
+}
+function normalizePlatformApiUrl$1(platformApiUrl) {
+	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$3, "");
+}
+function normalizeEmail$2(email) {
+	return email.trim().toLowerCase();
+}
+function accountKey(platformApiUrl, email) {
+	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
+}
+function normalizeLookup(lookup) {
+	if (typeof lookup === "string") return { cwd: lookup };
+	return lookup ?? {};
+}
+async function readAccountStore() {
+	try {
+		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return { version: 1 };
+	}
+}
+async function writeAccountStore(store) {
+	await mkdir(getDinewayUserConfigDir(), {
+		recursive: true,
+		mode: 448
+	});
+	const file = getForgewayAccountSecretPath();
+	await writeFile(file, JSON.stringify({
+		...store,
+		version: 1
+	}, null, "	") + "\n", {
+		encoding: "utf-8",
+		mode: 384
+	});
+	await chmod(file, 384);
+}
+function accountMatches(credentials, lookup) {
+	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
+	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
+	return true;
+}
+async function readForgewayCredentials(lookup) {
+	const normalizedLookup = normalizeLookup(lookup);
+	const store = await readAccountStore();
+	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
+	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
+	if (accounts.length === 1) return accounts[0] ?? null;
+	return null;
+}
+async function writeForgewayCredentials(credentials, lookup) {
+	const normalizedLookup = normalizeLookup(lookup);
+	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
+	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
+	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
+	const key = accountKey(platformApiUrl, email);
+	const store = await readAccountStore();
+	store.accounts = {
+		...store.accounts,
+		[key]: {
+			...credentials,
+			platformApiUrl
+		}
+	};
+	store.lastAccountKey = key;
+	await writeAccountStore(store);
+}
+async function listForgewayCredentials(platformApiUrl) {
+	const lookup = platformApiUrl ? { platformApiUrl } : {};
+	const store = await readAccountStore();
+	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
+}
+
+//#endregion
+//#region src/cli/forgeway-account.ts
+const TRAILING_SLASH_PATTERN$2 = /\/$/;
+const SHADOW_EMAIL_PATTERN$2 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
+const DEFAULT_FORGEWAY_API_BASE_URL = "https://api.dineway.ai";
+const DEFAULT_DINEWAY_WEB_URL = "https://dineway.ai";
+function normalizeForgewayApiUrl(value) {
+	return (value || DEFAULT_FORGEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+}
+function normalizeDinewayWebUrl(value) {
+	return (value || DEFAULT_DINEWAY_WEB_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+}
+function normalizeForgewayEmail(value) {
+	return value?.trim().toLowerCase() ?? "";
+}
+function isShadowForgewayEmail(email) {
+	return Boolean(email && SHADOW_EMAIL_PATTERN$2.test(email));
+}
+function createForgewayAccountClient(platformApiUrl, accessToken) {
+	return new ForgewayClient({
+		baseUrl: normalizeForgewayApiUrl(platformApiUrl),
+		accessToken,
+		isServerMode: true,
+		auth: { detectOAuthCallback: false }
+	});
+}
+function normalizeForgewayUser$2(user) {
+	if (!user?.id || !user.email) throw new Error("Forgeway session response did not include a user email.");
+	return {
+		id: user.id,
+		name: user.profile?.name ?? user.name ?? user.email,
+		email: user.email,
+		avatarUrl: user.profile?.avatar_url ?? user.avatarUrl ?? user.avatar_url ?? null,
+		emailVerified: user.emailVerified ?? user.email_verified ?? false
+	};
+}
+function assertFormalForgewayUser(user) {
+	if (!user || user.emailVerified !== true || isShadowForgewayEmail(user.email)) throw new Error("Dineway account commands require a verified Forgeway account.");
+	return user;
+}
+async function readStoredForgewayAccount(lookup = {}) {
+	const platformApiUrl = normalizeForgewayApiUrl(lookup.platformApiUrl);
+	const email = normalizeForgewayEmail(lookup.email);
+	if (email) return readForgewayCredentials({
+		platformApiUrl,
+		email
+	});
+	const stored = await readForgewayCredentials({ platformApiUrl });
+	if (stored) return stored;
+	const accounts = (await listForgewayCredentials(platformApiUrl)).filter((credentials) => {
+		try {
+			assertFormalForgewayUser(credentials.user);
+			return true;
+		} catch {
+			return false;
+		}
+	});
+	return accounts.length === 1 ? accounts[0] ?? null : null;
+}
+async function refreshForgewayAccountCredentials(credentials) {
+	const user = assertFormalForgewayUser(credentials.user);
+	if (!credentials.refreshToken) throw new Error("Stored Forgeway account is missing a refresh token. Run `dineway account login`.");
+	const { data, error } = await createForgewayAccountClient(credentials.platformApiUrl).auth.refreshSession({ refreshToken: credentials.refreshToken });
+	if (error || !data?.accessToken) throw new Error(error?.message || "Failed to refresh Forgeway account. Run `dineway account login`.");
+	const refreshedUser = normalizeForgewayUser$2(data.user);
+	if (normalizeForgewayEmail(refreshedUser.email) !== normalizeForgewayEmail(user.email)) throw new Error("Forgeway refresh returned credentials for a different account.");
+	const updated = {
+		...credentials,
+		platformApiUrl: normalizeForgewayApiUrl(credentials.platformApiUrl),
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken ?? credentials.refreshToken,
+		user: {
+			...refreshedUser,
+			emailVerified: true
+		}
+	};
+	await writeForgewayCredentials(updated, {
+		platformApiUrl: updated.platformApiUrl,
+		email: updated.user?.email
+	});
+	return updated;
+}
+async function sendForgewayAccountLoginLink(input) {
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const webUrl = normalizeDinewayWebUrl(input.webUrl);
+	const redirectTo = new URL("/cli-auth", webUrl).toString();
+	const { error } = await createForgewayAccountClient(platformApiUrl).auth.sendPasswordlessSignInEmail({
+		email: input.email,
+		redirectTo
+	});
+	if (error) throw new Error(error.message || "Failed to send Forgeway account sign-in link.");
+}
+async function completeForgewayAccountLogin(input) {
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const { data, error } = await createForgewayAccountClient(platformApiUrl).auth.signInWithPasswordlessToken({ token: input.token });
+	if (error || !data?.accessToken || !data.refreshToken) throw new Error(error?.message || "Forgeway sign-in token is invalid or expired.");
+	const user = normalizeForgewayUser$2(data.user);
+	if (input.email && normalizeForgewayEmail(user.email) !== normalizeForgewayEmail(input.email)) throw new Error("Forgeway sign-in returned credentials for a different email.");
+	const credentials = {
+		platformApiUrl,
+		accessToken: data.accessToken,
+		refreshToken: data.refreshToken,
+		user: {
+			...user,
+			emailVerified: true
+		}
+	};
+	await writeForgewayCredentials(credentials, {
+		platformApiUrl,
+		email: credentials.user?.email
+	});
+	return credentials;
+}
+async function getForgewayDinewayAccount(credentials) {
+	const refreshed = await refreshForgewayAccountCredentials(credentials);
+	const { data, error } = await createForgewayAccountClient(refreshed.platformApiUrl, refreshed.accessToken).dineway.getAccount();
+	if (error || !data) throw new Error(error?.message || "Failed to fetch Dineway account status from Forgeway.");
+	return {
+		credentials: refreshed,
+		account: data
+	};
+}
+
+//#endregion
+//#region src/cli/output.ts
+/**
+* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
+*
+* Call this early in any command that uses `output()` with `--json`.
+* Safe to call multiple times — only applies the redirect once.
+*/
+function configureOutputMode(args) {
+	if (args.json || !process.stdout.isTTY) {
+		consola$1.options.stdout = process.stderr;
+		consola$1.options.stderr = process.stderr;
+	}
+}
+/**
+* Output data as JSON or pretty-printed.
+*
+* If stdout is not a TTY or --json is set, outputs JSON.
+* Otherwise, outputs a formatted representation.
+*/
+function output(data, args) {
+	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
+	else prettyPrint(data);
+}
+function prettyPrint(data, indent = 0) {
+	if (data === null || data === void 0) {
+		consola$1.log("(empty)");
+		return;
+	}
+	if (Array.isArray(data)) {
+		if (data.length === 0) {
+			consola$1.log("(no items)");
+			return;
+		}
+		for (const item of data) {
+			prettyPrint(item, indent);
+			if (indent === 0) consola$1.log("---");
+		}
+		return;
+	}
+	if (typeof data === "object") {
+		const obj = Object(data);
+		if ("items" in obj && Array.isArray(obj.items)) {
+			prettyPrint(obj.items, indent);
+			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
+			return;
+		}
+		const prefix = "  ".repeat(indent);
+		for (const [key, value] of Object.entries(obj)) {
+			if (value === null || value === void 0) continue;
+			if (typeof value === "object" && !Array.isArray(value)) {
+				consola$1.log(`${prefix}${key}:`);
+				prettyPrint(value, indent + 1);
+			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
+			else {
+				const str = typeof value === "string" ? value : JSON.stringify(value);
+				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
+				consola$1.log(`${prefix}${key}: ${display}`);
+			}
+		}
+		return;
+	}
+	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
+}
+
+//#endregion
+//#region src/cli/commands/account.ts
+async function promptLine(question) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return (await readline.question(question)).trim();
+	} finally {
+		readline.close();
+	}
+}
+function resolveApiUrl(args) {
+	return normalizeForgewayApiUrl(args["api-url"] ?? process.env.DINEWAY_API_BASE_URL ?? process.env.FORGEWAY_API_URL);
+}
+function outputAccountJson(value) {
+	console.log(JSON.stringify(value, null, "	"));
+}
+const accountLoginCommand = defineCommand({
+	meta: {
+		name: "login",
+		description: "Log in to the Dineway Web / Forgeway account used for paid services"
+	},
+	args: {
+		email: {
+			type: "string",
+			alias: "e",
+			description: "Forgeway account email"
+		},
+		token: {
+			type: "string",
+			description: "Passwordless sign-in token from the Dineway CLI auth page"
+		},
+		"api-url": {
+			type: "string",
+			description: "Forgeway API URL",
+			default: DEFAULT_FORGEWAY_API_BASE_URL
+		},
+		"web-url": {
+			type: "string",
+			description: "Dineway Web URL used for the email link",
+			default: DEFAULT_DINEWAY_WEB_URL
+		},
+		"send-link": {
+			type: "boolean",
+			description: "Send the email link and exit without prompting for the token"
+		},
+		json: {
+			type: "boolean",
+			description: "Output as JSON"
+		}
+	},
+	async run({ args }) {
+		configureOutputMode(args);
+		const platformApiUrl = resolveApiUrl(args);
+		const webUrl = normalizeDinewayWebUrl(args["web-url"]);
+		const email = normalizeForgewayEmail(args.email) || normalizeForgewayEmail(await promptLine("Dineway account email: "));
+		if (!email) {
+			consola$1.error("Email is required.");
+			process.exit(2);
+		}
+		try {
+			const existing = await readStoredForgewayAccount({
+				platformApiUrl,
+				email
+			});
+			if (existing && !args.token && !args["send-link"]) {
+				const { account } = await getForgewayDinewayAccount(existing);
+				if (args.json) outputAccountJson({
+					loggedIn: true,
+					platformApiUrl,
+					account
+				});
+				else {
+					consola$1.success(`Already logged in as ${pc.bold(account.account.email ?? email)}`);
+					consola$1.info(`Plan: ${pc.cyan(account.plan.name)}`);
+				}
+				return;
+			}
+			if (!args.token) {
+				await sendForgewayAccountLoginLink({
+					email,
+					platformApiUrl,
+					webUrl
+				});
+				if (args.json) outputAccountJson({
+					sent: true,
+					email,
+					platformApiUrl,
+					cliAuthUrl: new URL("/cli-auth", webUrl).toString()
+				});
+				else {
+					consola$1.success(`Sent Dineway account sign-in link to ${pc.bold(email)}`);
+					consola$1.info("Open the email link, copy the CLI token, then paste it here.");
+				}
+				if (args["send-link"]) return;
+			}
+			const { account } = await getForgewayDinewayAccount(await completeForgewayAccountLogin({
+				token: typeof args.token === "string" && args.token.trim() ? args.token.trim() : await promptLine("CLI token: "),
+				platformApiUrl,
+				email
+			}));
+			if (args.json) outputAccountJson({
+				loggedIn: true,
+				platformApiUrl,
+				account
+			});
+			else {
+				consola$1.success(`Logged in as ${pc.bold(account.account.email ?? email)}`);
+				consola$1.info(`Plan: ${pc.cyan(account.plan.name)}`);
+				consola$1.info(`Credits: ${account.credits.availableCredits.toLocaleString()}`);
+				consola$1.info(`Hosted sites: ${account.sites.usedHostedSites.toLocaleString()} / ${account.sites.hostedSiteLimitLabel}`);
+			}
+		} catch (error) {
+			consola$1.error(error instanceof Error ? error.message : "Dineway account login failed");
+			process.exit(2);
+		}
+	}
+});
+const accountStatusCommand = defineCommand({
+	meta: {
+		name: "status",
+		description: "Show Dineway Web / Forgeway account plan, credits, and hosted site slots"
+	},
+	args: {
+		email: {
+			type: "string",
+			alias: "e",
+			description: "Forgeway account email"
+		},
+		"api-url": {
+			type: "string",
+			description: "Forgeway API URL",
+			default: DEFAULT_FORGEWAY_API_BASE_URL
+		},
+		json: {
+			type: "boolean",
+			description: "Output as JSON"
+		}
+	},
+	async run({ args }) {
+		configureOutputMode(args);
+		const platformApiUrl = resolveApiUrl(args);
+		try {
+			const credentials = await readStoredForgewayAccount({
+				platformApiUrl,
+				email: normalizeForgewayEmail(args.email)
+			});
+			if (!credentials) {
+				if (args.json) outputAccountJson({
+					loggedIn: false,
+					platformApiUrl
+				});
+				else consola$1.error("Not logged in. Run: dineway account login");
+				process.exit(2);
+			}
+			const { account } = await getForgewayDinewayAccount(credentials);
+			if (args.json) {
+				outputAccountJson({
+					loggedIn: true,
+					platformApiUrl,
+					account
+				});
+				return;
+			}
+			consola$1.info(`Email: ${pc.bold(account.account.email ?? credentials.user?.email ?? "unknown")}`);
+			consola$1.info(`Plan:  ${pc.cyan(account.plan.name)}`);
+			consola$1.info(`Credits available: ${account.credits.availableCredits.toLocaleString()}`);
+			consola$1.info(`Hosted sites: ${account.sites.usedHostedSites.toLocaleString()} / ${account.sites.hostedSiteLimitLabel}`);
+			if (account.billing.subscription?.status) consola$1.info(`Billing: ${account.billing.subscription.status}`);
+		} catch (error) {
+			consola$1.error(error instanceof Error ? error.message : "Dineway account status failed");
+			process.exit(2);
+		}
+	}
+});
+const accountCommand = defineCommand({
+	meta: {
+		name: "account",
+		description: "Dineway Web account login, status, and billing helpers"
+	},
+	subCommands: {
+		login: accountLoginCommand,
+		status: accountStatusCommand
+	}
+});
+
+//#endregion
 //#region src/cli/credentials.ts
 /**
 * Credential storage for CLI auth tokens.
@@ -99,7 +558,7 @@ function findProjectRoot(from) {
 	}
 	return null;
 }
-function readStore$1() {
+function readStore() {
 	const path = getCredentialPath();
 	try {
 		if (existsSync(path)) {
@@ -109,7 +568,7 @@ function readStore$1() {
 	} catch {}
 	return {};
 }
-function writeStore$1(store) {
+function writeStore(store) {
 	mkdirSync(getConfigDir(), {
 		recursive: true,
 		mode: 448
@@ -124,7 +583,7 @@ function writeStore$1(store) {
 */
 function getCredentials(baseUrl) {
 	const key = resolveCredentialKey(baseUrl);
-	const cred = readStore$1()[key];
+	const cred = readStore()[key];
 	if (!cred || !("accessToken" in cred)) return null;
 	return cred;
 }
@@ -133,19 +592,19 @@ function getCredentials(baseUrl) {
 */
 function saveCredentials(baseUrl, cred) {
 	const key = resolveCredentialKey(baseUrl);
-	const store = readStore$1();
+	const store = readStore();
 	store[key] = cred;
-	writeStore$1(store);
+	writeStore(store);
 }
 /**
 * Remove credentials for a URL.
 */
 function removeCredentials(baseUrl) {
 	const key = resolveCredentialKey(baseUrl);
-	const store = readStore$1();
+	const store = readStore();
 	if (key in store) {
 		delete store[key];
-		writeStore$1(store);
+		writeStore(store);
 		return true;
 	}
 	return false;
@@ -162,7 +621,7 @@ function marketplaceKey(registryUrl) {
 */
 function getMarketplaceCredential(registryUrl) {
 	const key = marketplaceKey(registryUrl);
-	const cred = readStore$1()[key];
+	const cred = readStore()[key];
 	if (!cred || !("token" in cred)) return null;
 	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
 	return cred;
@@ -172,19 +631,19 @@ function getMarketplaceCredential(registryUrl) {
 */
 function saveMarketplaceCredential(registryUrl, cred) {
 	const key = marketplaceKey(registryUrl);
-	const store = readStore$1();
+	const store = readStore();
 	store[key] = cred;
-	writeStore$1(store);
+	writeStore(store);
 }
 /**
 * Remove marketplace credential for a registry URL.
 */
 function removeMarketplaceCredential(registryUrl) {
 	const key = marketplaceKey(registryUrl);
-	const store = readStore$1();
+	const store = readStore();
 	if (key in store) {
 		delete store[key];
-		writeStore$1(store);
+		writeStore(store);
 		return true;
 	}
 	return false;
@@ -303,125 +762,60 @@ const connectionArgs = {
 		description: "Auth token"
 	},
 	header: {
-		type: "string",
-		alias: "H",
-		description: "Custom header \"Name: Value\" (repeatable, or use DINEWAY_HEADERS env)"
-	},
-	json: {
-		type: "boolean",
-		description: "Output as JSON"
-	}
-};
-/**
-* Create a DinewayClient from CLI args, env vars, and stored credentials.
-*
-* Auth resolution order:
-* 1. --token flag
-* 2. DINEWAY_TOKEN env var
-* 3. Stored credentials (~/.config/dineway/auth.json)
-* 4. Dev bypass (if URL is localhost)
-*
-* Custom headers are merged from (in priority order):
-* 1. Stored credentials (persisted during `dineway login --header`)
-* 2. DINEWAY_HEADERS env var
-* 3. --header CLI flags
-*/
-function createClientFromArgs(args) {
-	const baseUrl = resolveDinewayBaseUrl(args.url);
-	let token = resolveDinewayToken(args.token);
-	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
-	const cred = !token ? getCredentials(baseUrl) : null;
-	const customHeaders = {
-		...cred?.customHeaders,
-		...resolveCustomHeaders()
-	};
-	const extraInterceptors = [];
-	if (Object.keys(customHeaders).length > 0) extraInterceptors.push(customHeadersInterceptor(customHeaders));
-	if (!token && cred) if (new Date(cred.expiresAt) > /* @__PURE__ */ new Date()) token = cred.accessToken;
-	else return new DinewayClient({
-		baseUrl,
-		token: cred.accessToken,
-		refreshToken: cred.refreshToken,
-		onTokenRefresh: (newAccessToken, expiresIn) => {
-			saveCredentials(baseUrl, {
-				...cred,
-				accessToken: newAccessToken,
-				expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-			});
-		},
-		interceptors: extraInterceptors
-	});
-	return new DinewayClient({
-		baseUrl,
-		token,
-		devBypass: !token && isLocal,
-		interceptors: extraInterceptors
-	});
-}
-
-//#endregion
-//#region src/cli/output.ts
-/**
-* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
-*
-* Call this early in any command that uses `output()` with `--json`.
-* Safe to call multiple times — only applies the redirect once.
-*/
-function configureOutputMode(args) {
-	if (args.json || !process.stdout.isTTY) {
-		consola$1.options.stdout = process.stderr;
-		consola$1.options.stderr = process.stderr;
-	}
-}
-/**
-* Output data as JSON or pretty-printed.
-*
-* If stdout is not a TTY or --json is set, outputs JSON.
-* Otherwise, outputs a formatted representation.
-*/
-function output(data, args) {
-	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-	else prettyPrint(data);
-}
-function prettyPrint(data, indent = 0) {
-	if (data === null || data === void 0) {
-		consola$1.log("(empty)");
-		return;
-	}
-	if (Array.isArray(data)) {
-		if (data.length === 0) {
-			consola$1.log("(no items)");
-			return;
-		}
-		for (const item of data) {
-			prettyPrint(item, indent);
-			if (indent === 0) consola$1.log("---");
-		}
-		return;
-	}
-	if (typeof data === "object") {
-		const obj = Object(data);
-		if ("items" in obj && Array.isArray(obj.items)) {
-			prettyPrint(obj.items, indent);
-			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
-			return;
-		}
-		const prefix = "  ".repeat(indent);
-		for (const [key, value] of Object.entries(obj)) {
-			if (value === null || value === void 0) continue;
-			if (typeof value === "object" && !Array.isArray(value)) {
-				consola$1.log(`${prefix}${key}:`);
-				prettyPrint(value, indent + 1);
-			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
-			else {
-				const str = typeof value === "string" ? value : JSON.stringify(value);
-				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
-				consola$1.log(`${prefix}${key}: ${display}`);
-			}
-		}
-		return;
+		type: "string",
+		alias: "H",
+		description: "Custom header \"Name: Value\" (repeatable, or use DINEWAY_HEADERS env)"
+	},
+	json: {
+		type: "boolean",
+		description: "Output as JSON"
 	}
-	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
+};
+/**
+* Create a DinewayClient from CLI args, env vars, and stored credentials.
+*
+* Auth resolution order:
+* 1. --token flag
+* 2. DINEWAY_TOKEN env var
+* 3. Stored credentials (~/.config/dineway/auth.json)
+* 4. Dev bypass (if URL is localhost)
+*
+* Custom headers are merged from (in priority order):
+* 1. Stored credentials (persisted during `dineway login --header`)
+* 2. DINEWAY_HEADERS env var
+* 3. --header CLI flags
+*/
+function createClientFromArgs(args) {
+	const baseUrl = resolveDinewayBaseUrl(args.url);
+	let token = resolveDinewayToken(args.token);
+	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
+	const cred = !token ? getCredentials(baseUrl) : null;
+	const customHeaders = {
+		...cred?.customHeaders,
+		...resolveCustomHeaders()
+	};
+	const extraInterceptors = [];
+	if (Object.keys(customHeaders).length > 0) extraInterceptors.push(customHeadersInterceptor(customHeaders));
+	if (!token && cred) if (new Date(cred.expiresAt) > /* @__PURE__ */ new Date()) token = cred.accessToken;
+	else return new DinewayClient({
+		baseUrl,
+		token: cred.accessToken,
+		refreshToken: cred.refreshToken,
+		onTokenRefresh: (newAccessToken, expiresIn) => {
+			saveCredentials(baseUrl, {
+				...cred,
+				accessToken: newAccessToken,
+				expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+			});
+		},
+		interceptors: extraInterceptors
+	});
+	return new DinewayClient({
+		baseUrl,
+		token,
+		devBypass: !token && isLocal,
+		interceptors: extraInterceptors
+	});
 }
 
 //#endregion
@@ -952,6 +1346,164 @@ const contentCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/paywall.ts
+const PAYWALL_MESSAGE_PATTERN = /\b(quota|credit|credits|upgrade|plan|billing|subscription|slot)\b/i;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null;
+}
+function stringField(record, key) {
+	const value = record[key];
+	return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function getNestedError(value) {
+	if (!isRecord$1(value)) return null;
+	const nested = value.error;
+	return isRecord$1(nested) ? nested : value;
+}
+function isHostedSitesResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized === "deploy:forgeway" || normalized === "dineway.hosted_sites" || normalized.includes("hosted_site");
+}
+function isCreditResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized.includes("credit") || normalized.includes("firecrawl") || normalized.includes("dataforseo");
+}
+function isQuotaResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized.includes("quota") || normalized.includes("place_search") || normalized.includes("place_get") || normalized.includes("/api/places");
+}
+function getCliPaywallRefreshStatus(paywall, account) {
+	if (isHostedSitesResource(paywall.resource)) {
+		const remainingHostedSites = account.sites?.remainingHostedSites;
+		if (remainingHostedSites === null || (remainingHostedSites ?? 0) > 0) return {
+			blocked: false,
+			message: "Hosted capacity is now available. Re-run the blocked command."
+		};
+		return {
+			blocked: true,
+			message: "There is still no hosted capacity. Complete checkout in Dineway Web."
+		};
+	}
+	if (isCreditResource(paywall.resource)) {
+		if ((account.credits?.availableCredits ?? 0) > 0) return {
+			blocked: false,
+			message: "Provider credits are now available. Re-run the blocked command."
+		};
+		return {
+			blocked: true,
+			message: "There are still no provider credits. Complete checkout or top up credits in Dineway Web."
+		};
+	}
+	if (isQuotaResource(paywall.resource)) return {
+		blocked: false,
+		message: "Account quota status refreshed. Re-run the blocked command when ready."
+	};
+	return {
+		blocked: false,
+		message: "Account status refreshed. Re-run the blocked command when ready."
+	};
+}
+function normalizeCliPaywallError(input) {
+	const error = input.error;
+	const status = error?.status ?? error?.statusCode;
+	const message = error?.message ?? (input.error instanceof Error ? input.error.message : "");
+	const body = error?.body;
+	const candidate = getNestedError(body) ?? getNestedError(input.error) ?? {};
+	if (stringField(candidate, "code") && stringField(candidate, "resource") && stringField(candidate, "reason") && typeof candidate.handoffRequired === "boolean") return {
+		code: stringField(candidate, "code") ?? "PAYWALL_REQUIRED",
+		resource: stringField(candidate, "resource") ?? input.resource,
+		reason: stringField(candidate, "reason") ?? input.reason ?? message,
+		requiredPlan: stringField(candidate, "requiredPlan"),
+		pricingUrl: stringField(candidate, "pricingUrl") ?? new URL("/pricing", normalizeDinewayWebUrl(input.webUrl)).toString(),
+		handoffRequired: candidate.handoffRequired === true
+	};
+	if ((status === 402 || status === 403 || status === 429) && PAYWALL_MESSAGE_PATTERN.test(message)) return {
+		code: status === 429 ? "QUOTA_EXCEEDED" : "PAYWALL_REQUIRED",
+		resource: input.resource,
+		reason: input.reason ?? message,
+		pricingUrl: new URL("/pricing", normalizeDinewayWebUrl(input.webUrl)).toString(),
+		handoffRequired: true
+	};
+	return null;
+}
+async function promptEnter(message) {
+	const readline = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		await readline.question(message);
+	} finally {
+		readline.close();
+	}
+}
+async function createHandoff(input) {
+	const credentials = await readStoredForgewayAccount({ platformApiUrl: input.platformApiUrl });
+	if (!credentials) return null;
+	const { credentials: refreshed } = await getForgewayDinewayAccount(credentials);
+	const response = await fetch(new URL("/api/dineway-web/handoffs", input.webUrl), {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${refreshed.accessToken}`,
+			"Content-Type": "application/json",
+			"X-Dineway-Request": "1"
+		},
+		body: JSON.stringify({
+			target: "pricing",
+			reason: input.paywall.reason,
+			context: {
+				resource: input.paywall.resource,
+				code: input.paywall.code,
+				requiredPlan: input.paywall.requiredPlan,
+				...input.context
+			}
+		})
+	});
+	const payload = await response.json().catch(() => null);
+	if (!response.ok || !payload?.success || !payload.data?.url) return null;
+	return payload.data.url;
+}
+async function handleCliPaywall(input) {
+	const paywall = normalizeCliPaywallError(input);
+	if (!paywall) return false;
+	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
+	const webUrl = normalizeDinewayWebUrl(input.webUrl ?? process.env.DINEWAY_WEB_URL);
+	let url = paywall.pricingUrl;
+	let handoffFailed = false;
+	try {
+		const handoffUrl = await createHandoff({
+			paywall,
+			platformApiUrl,
+			webUrl,
+			context: input.context
+		});
+		if (handoffUrl) url = handoffUrl;
+		else handoffFailed = true;
+	} catch {
+		handoffFailed = true;
+	}
+	consola$1.error(paywall.reason);
+	if (handoffFailed) consola$1.info(`Log in first: ${pc.cyan("dineway account login")}`);
+	consola$1.info(`Continue in Dineway Web: ${pc.cyan(url)}`);
+	if (!input.interactive) return true;
+	await promptEnter("Press Enter to continue after upgrading, or Ctrl-C to cancel.");
+	const credentials = await readStoredForgewayAccount({ platformApiUrl });
+	if (!credentials) {
+		consola$1.error("Still not logged in. Run: dineway account login");
+		return true;
+	}
+	try {
+		const { account } = await getForgewayDinewayAccount(credentials);
+		const status = getCliPaywallRefreshStatus(paywall, account);
+		if (status.blocked) consola$1.error(status.message);
+		else consola$1.info(status.message);
+	} catch {
+		consola$1.error("Account is still blocked. Complete checkout or top up credits in Dineway Web.");
+	}
+	return true;
+}
+
 //#endregion
 //#region src/cli/commands/deploy/utils/astro-adapter.ts
 const NODE_ADAPTER_PACKAGE = "@astrojs/node";
@@ -989,7 +1541,7 @@ function collectUploadIncludeFiles(directory = dinewayUploadsJoin(dinewayForgewa
 \t});
 }
 `;
-async function fileExists$11(path) {
+async function fileExists$10(path) {
 	try {
 		await access(path);
 		return true;
@@ -1150,7 +1702,7 @@ function configurePackageJson(pkg, adapter) {
 }
 async function configureAstroConfig(cwd, adapter, dryRun) {
 	const configPath = join(cwd, "astro.config.mjs");
-	if (!await fileExists$11(configPath)) return [];
+	if (!await fileExists$10(configPath)) return [];
 	const current = await readFile(configPath, "utf-8");
 	const next = configureAstroConfigSource(current, adapter);
 	if (next === current) return [{
@@ -1169,7 +1721,7 @@ async function configureAstroConfig(cwd, adapter, dryRun) {
 }
 async function configurePackage(cwd, adapter, dryRun) {
 	const packagePath = join(cwd, "package.json");
-	if (!await fileExists$11(packagePath)) return [];
+	if (!await fileExists$10(packagePath)) return [];
 	const current = await readFile(packagePath, "utf-8");
 	const nextPkg = configurePackageJson(JSON.parse(current), adapter);
 	const next = JSON.stringify(nextPkg, null, "	") + "\n";
@@ -1188,7 +1740,7 @@ async function configurePackage(cwd, adapter, dryRun) {
 	}];
 }
 async function configureAstroDeployAdapter(cwd, adapter, dryRun = false) {
-	if (!await fileExists$11(join(cwd, "astro.config.mjs"))) return [];
+	if (!await fileExists$10(join(cwd, "astro.config.mjs"))) return [];
 	return [...await configureAstroConfig(cwd, adapter, dryRun), ...await configurePackage(cwd, adapter, dryRun)];
 }
 
@@ -1278,7 +1830,7 @@ volumes:
 
 //#endregion
 //#region src/cli/commands/deploy/targets/docker.ts
-async function fileExists$10(path) {
+async function fileExists$9(path) {
 	try {
 		await access(path);
 		return true;
@@ -1288,7 +1840,7 @@ async function fileExists$10(path) {
 }
 async function writeGeneratedFile$2(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$10(path)) return {
+	if (await fileExists$9(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -1378,7 +1930,7 @@ const EDGE_HYPHENS_RE$2 = /^-|-$/g;
 const LINE_SPLIT_RE = /\r?\n/;
 const DEFAULT_REGION$1 = "iad";
 const FLY_VOLUME_NAME = "dineway_data";
-async function fileExists$9(path) {
+async function fileExists$8(path) {
 	try {
 		await access(path);
 		return true;
@@ -1388,7 +1940,7 @@ async function fileExists$9(path) {
 }
 async function writeGeneratedFile$1(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$9(path)) return {
+	if (await fileExists$8(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -1637,136 +2189,6 @@ async function writeForgewayDeployMetadata(cwd, metadata) {
 	});
 }
 
-//#endregion
-//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
-const DINEWAY_CONFIG_DIR_NAME = ".dineway";
-const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
-const TRAILING_SLASH_PATTERN$2 = /\/$/;
-function getDinewayConfigDir(cwd = process.cwd()) {
-	return join(cwd, DINEWAY_CONFIG_DIR_NAME);
-}
-function getDinewayUserConfigDir() {
-	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
-}
-function getForgewaySecretPath(cwd = process.cwd()) {
-	return join(getDinewayConfigDir(cwd), "forgeway.json");
-}
-function getForgewayAccountSecretPath() {
-	return join(getDinewayUserConfigDir(), "forgeway.json");
-}
-function normalizePlatformApiUrl$1(platformApiUrl) {
-	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$2, "");
-}
-function normalizeEmail$2(email) {
-	return email.trim().toLowerCase();
-}
-function accountKey(platformApiUrl, email) {
-	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
-}
-function normalizeLookup(lookup) {
-	if (typeof lookup === "string") return { cwd: lookup };
-	return lookup ?? {};
-}
-async function readStore(cwd = process.cwd()) {
-	try {
-		const raw = await readFile(getForgewaySecretPath(cwd), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-async function writeStore(store, cwd = process.cwd()) {
-	await mkdir(getDinewayConfigDir(cwd), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewaySecretPath(cwd);
-	await writeFile(file, JSON.stringify(store, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-async function readAccountStore() {
-	try {
-		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return { version: 1 };
-	}
-}
-async function writeAccountStore(store) {
-	await mkdir(getDinewayUserConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewayAccountSecretPath();
-	await writeFile(file, JSON.stringify({
-		...store,
-		version: 1
-	}, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-function accountMatches(credentials, lookup) {
-	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
-	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
-	return true;
-}
-async function readForgewayCredentials(lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const store = await readAccountStore();
-	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
-	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
-	if (accounts.length === 1) return accounts[0] ?? null;
-	return null;
-}
-async function writeForgewayCredentials(credentials, lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
-	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
-	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
-	const key = accountKey(platformApiUrl, email);
-	const store = await readAccountStore();
-	store.accounts = {
-		...store.accounts,
-		[key]: {
-			...credentials,
-			platformApiUrl
-		}
-	};
-	store.lastAccountKey = key;
-	await writeAccountStore(store);
-}
-async function listForgewayCredentials(platformApiUrl) {
-	const lookup = platformApiUrl ? { platformApiUrl } : {};
-	const store = await readAccountStore();
-	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
-}
-function shadowGrantKey(platformApiUrl, placeId) {
-	return `${platformApiUrl.replace(TRAILING_SLASH_PATTERN$2, "")}#${placeId ?? "__unbound__"}`;
-}
-async function readForgewayShadowGrant(platformApiUrl, placeId, cwd) {
-	const store = await readStore(cwd);
-	if (!store.shadowGrants) return null;
-	if (placeId) return store.shadowGrants[shadowGrantKey(platformApiUrl, placeId)] ?? null;
-	const lastKey = store.lastShadowGrantKey;
-	if (lastKey && store.shadowGrants[lastKey]?.platformApiUrl === platformApiUrl) return store.shadowGrants[lastKey];
-	return Object.values(store.shadowGrants).find((grant) => grant.platformApiUrl === platformApiUrl) ?? null;
-}
-async function writeForgewayShadowGrant(grant, cwd) {
-	const store = await readStore(cwd);
-	const key = shadowGrantKey(grant.platformApiUrl, grant.placeId);
-	store.shadowGrants = {
-		...store.shadowGrants,
-		[key]: grant
-	};
-	store.lastShadowGrantKey = key;
-	await writeStore(store, cwd);
-}
-
 //#endregion
 //#region src/cli/commands/deploy/targets/forgeway.ts
 const DEFAULT_DINEWAY_API_BASE_URL$1 = "https://api.dineway.ai";
@@ -1790,7 +2212,6 @@ const DINEWAY_PACKAGE_NAME = "dineway";
 const SEMVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+].*)?$/;
 const LOCAL_PACKAGE_SPEC_PATTERN = /^(?:workspace|file|link|portal):/;
 const SHADOW_EMAIL_PATTERN$1 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
-const OTP_PATTERN = /^\d{6}$/;
 const FOOD_TYPES = new Set([
 	"restaurant",
 	"cafe",
@@ -1850,7 +2271,7 @@ function normalizeForgewayUser$1(user) {
 function getFetch(deps) {
 	return deps.fetch ?? fetch;
 }
-async function fileExists$8(path) {
+async function fileExists$7(path) {
 	try {
 		await access(path);
 		return true;
@@ -1875,7 +2296,7 @@ function formatDuration(ms) {
 	if (ms < 1e3) return `${ms}ms`;
 	return `${Math.round(ms / 100) / 10}s`;
 }
-function formatBytes$1(bytes) {
+function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	const units = [
 		"KB",
@@ -1925,11 +2346,6 @@ async function parseErrorResponse(response) {
 function normalizeEmail$1(email) {
 	return email.trim().toLowerCase();
 }
-function normalizeOtp(otp) {
-	const value = otp.trim();
-	if (!OTP_PATTERN.test(value)) throw new Error("Forgeway email verification OTP must be a 6-digit numeric code.");
-	return value;
-}
 function isShadowEmail$1(email) {
 	return Boolean(email && SHADOW_EMAIL_PATTERN$1.test(email));
 }
@@ -1948,8 +2364,7 @@ async function refreshFormalAccessToken(context, deps) {
 		platformApiUrl: context.platformApiUrl,
 		accessToken: payload.accessToken,
 		refreshToken: payload.refreshToken ?? context.refreshToken,
-		...user ? { user } : {},
-		source: "shadow-email-upgrade"
+		...user ? { user } : {}
 	};
 	context.accessToken = updated.accessToken;
 	context.refreshToken = updated.refreshToken;
@@ -1961,30 +2376,6 @@ async function refreshFormalAccessToken(context, deps) {
 	});
 	return payload.accessToken;
 }
-async function refreshShadowAccessToken(context, deps) {
-	if (!context.refreshToken) throw new Error("Dineway shadow deploy grant is missing its refresh token.");
-	const response = await forgewayRequest(`${context.platformApiUrl}/api/auth/refresh?client_type=server`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({ refreshToken: context.refreshToken })
-	}, deps);
-	if (!response.ok) throw new Error("Failed to refresh Dineway shadow deploy grant. Run dineway deploy again.");
-	const payload = await response.json();
-	if (!payload.accessToken || !payload.refreshToken) throw new Error("Dineway shadow refresh response was missing tokens.");
-	context.accessToken = payload.accessToken;
-	context.refreshToken = payload.refreshToken;
-	await (deps.writeShadowGrant ?? writeForgewayShadowGrant)({
-		platformApiUrl: context.platformApiUrl,
-		placeId: context.placeId,
-		accessToken: payload.accessToken,
-		refreshToken: payload.refreshToken,
-		restaurantName: context.restaurantName,
-		city: context.city,
-		user: payload.user ? normalizeForgewayUser$1(payload.user) : void 0,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	}, context.projectDir);
-	return payload.accessToken;
-}
 async function promptText(question, initialValue, deps) {
 	if (deps.promptText) return await deps.promptText(question, initialValue);
 	if (!process.stdin.isTTY) return "";
@@ -2047,112 +2438,17 @@ function validatePublisherEmail(rawEmail) {
 	if (!email || isShadowEmail$1(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
 	return email;
 }
-async function resolveForgewayAccountEmail(options, saved, deps, preferredEmail) {
-	const suppliedEmail = options.email ?? getEnv("DINEWAY_EMAIL") ?? getEnv("FORGEWAY_EMAIL");
-	const savedEmail = savedPublisherEmail(saved);
-	if ((options.sendOtp || options.otp) && !suppliedEmail && !preferredEmail && !savedEmail) throw new Error("Forgeway OTP deploy requires --email or DINEWAY_EMAIL.");
-	return validatePublisherEmail(suppliedEmail ?? preferredEmail ?? savedEmail ?? await promptRequired("Dineway account email: ", void 0, deps, "Dineway account email is required. Pass --email or set DINEWAY_EMAIL."));
-}
-function isStoredFormalCredentialForEmail(stored, email) {
-	if (!stored?.accessToken || !stored.user) return false;
-	if (email && normalizeEmail$1(stored.user.email) !== email) return false;
-	if (stored.user.emailVerified !== true) return false;
-	if (isShadowEmail$1(stored.user.email)) return false;
-	return true;
-}
-function assertVerifiedFormalAccountUser(user, expectedEmail) {
-	if (!user || user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
-	if (expectedEmail && normalizeEmail$1(user.email) !== normalizeEmail$1(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
-	return user;
-}
-async function shadowUpgradeFetch(context, path, deps, options) {
-	const request = async (accessToken) => await forgewayRequest(`${context.platformApiUrl}${path}`, {
-		...options,
-		headers: {
-			"Content-Type": "application/json",
-			Authorization: `Bearer ${accessToken}`,
-			...options.headers
-		}
-	}, deps);
-	if (!context.accessToken) throw new Error("Dineway shadow deploy grant is missing its access token.");
-	let response = await request(context.accessToken);
-	if (response.status === 401) response = await request(await refreshShadowAccessToken(context, deps));
-	if (!response.ok) throw new ForgewayApiError(await parseErrorResponse(response), response.status);
-	return await response.json();
-}
-async function startShadowEmailUpgrade(context, email, deps) {
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/upgrade/email/start", deps, {
-		method: "POST",
-		body: JSON.stringify({ email })
-	});
-	if (payload.email && normalizeEmail$1(payload.email) !== email) throw new Error("Forgeway email verification response returned a different email.");
-	return payload;
-}
-async function verifyShadowEmailUpgrade(context, email, otp, deps) {
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/upgrade/email/verify", deps, {
-		method: "POST",
-		body: JSON.stringify({
-			email,
-			otp
-		})
-	});
-	if (!payload.accessToken || !payload.refreshToken || !payload.user) throw new Error("Forgeway email upgrade response was missing credentials.");
-	const user = normalizeForgewayUser$1(payload.user);
-	if (normalizeEmail$1(user.email) !== email) throw new Error("Forgeway email upgrade returned credentials for a different email.");
-	if (user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway email upgrade did not return a verified formal account.");
-	return {
-		platformApiUrl: context.platformApiUrl,
-		accessToken: payload.accessToken,
-		refreshToken: payload.refreshToken,
-		user,
-		source: "shadow-email-upgrade"
-	};
+function isStoredFormalCredentialForEmail(stored, email) {
+	if (!stored?.accessToken || !stored.user) return false;
+	if (email && normalizeEmail$1(stored.user.email) !== email) return false;
+	if (stored.user.emailVerified !== true) return false;
+	if (isShadowEmail$1(stored.user.email)) return false;
+	return true;
 }
-async function resolveFormalAccountCredentials(context, email, options, deps) {
-	const stored = await (deps.readCredentials ?? readForgewayCredentials)({
-		cwd: context.projectDir,
-		platformApiUrl: context.platformApiUrl,
-		email
-	});
-	if (!options.sendOtp && !options.otp && isStoredFormalCredentialForEmail(stored, email)) return {
-		status: "verified",
-		credentials: {
-			...stored,
-			platformApiUrl: context.platformApiUrl
-		}
-	};
-	if (options.sendOtp) {
-		const response = await startShadowEmailUpgrade(context, email, deps);
-		return {
-			status: "otp-sent",
-			email: response.email ? normalizeEmail$1(response.email) : email,
-			expiresAt: response.expiresAt
-		};
-	}
-	if (options.otp) {
-		const credentials = await verifyShadowEmailUpgrade(context, email, normalizeOtp(options.otp), deps);
-		await (deps.writeCredentials ?? writeForgewayCredentials)(credentials, {
-			cwd: context.projectDir,
-			platformApiUrl: context.platformApiUrl,
-			email
-		});
-		return {
-			status: "verified",
-			credentials
-		};
-	}
-	await startShadowEmailUpgrade(context, email, deps);
-	consola.info(`Sent Forgeway email verification code to ${email}`);
-	const credentials = await verifyShadowEmailUpgrade(context, email, await promptRequired("Email verification code: ", void 0, deps, "Email verification code is required."), deps);
-	await (deps.writeCredentials ?? writeForgewayCredentials)(credentials, {
-		cwd: context.projectDir,
-		platformApiUrl: context.platformApiUrl,
-		email
-	});
-	return {
-		status: "verified",
-		credentials
-	};
+function assertVerifiedFormalAccountUser(user, expectedEmail) {
+	if (!user || user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
+	if (expectedEmail && normalizeEmail$1(user.email) !== normalizeEmail$1(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
+	return user;
 }
 async function readCachedPublisherCredentials(cwd, platformApiUrl, email, deps) {
 	const credentials = await (deps.readCredentials ?? readForgewayCredentials)({
@@ -2218,7 +2514,6 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 	const context = {
 		projectDir: cwd,
 		platformApiUrl,
-		authKind: "formal-account",
 		accessToken: account.credentials.accessToken,
 		refreshToken: account.credentials.refreshToken,
 		user,
@@ -2232,7 +2527,7 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 		city: options.city
 	};
 	if (!context.placeId) {
-		const resolvedRestaurant = await resolveShadowRestaurantInfo(options, deps);
+		const resolvedRestaurant = await resolveRequiredRestaurantInfo(options, deps);
 		restaurant = resolvedRestaurant;
 		context.placeId = await resolvePlaceIdWithFormalSearch({
 			context,
@@ -2248,100 +2543,11 @@ async function resolveFormalProjectContext(cwd, options, deps) {
 		restaurant
 	};
 }
-async function resolveShadowProjectContext(cwd, options, deps, preferredEmail) {
-	const saved = await readSavedForgewayMetadata(cwd);
-	const platformApiUrl = resolvePlatformApiUrl(saved.platformApiUrl);
-	const savedPlaceId = options.placeId ?? getEnv("DINEWAY_PLACE_ID") ?? (typeof saved.placeId === "string" ? saved.placeId : void 0);
-	let grant = await (deps.readShadowGrant ?? readForgewayShadowGrant)(platformApiUrl, savedPlaceId, cwd);
-	let restaurant;
-	if (!grant) {
-		const shadowRestaurant = await resolveShadowRestaurantInfo(options, deps);
-		restaurant = shadowRestaurant;
-		if (options.dryRun) throw new Error("Forgeway deploy needs a Dineway shadow deploy grant. Run without --dry-run to create it.");
-		grant = await createShadowGrant({
-			platformApiUrl,
-			placeId: savedPlaceId,
-			restaurantName: shadowRestaurant.name,
-			city: shadowRestaurant.city,
-			cwd,
-			deps
-		});
-	} else restaurant = {
-		name: options.restaurantName ?? grant.restaurantName,
-		city: options.city ?? grant.city
-	};
-	if (!grant.placeId) {
-		const shadowRestaurant = restaurant?.name && restaurant.city ? {
-			name: restaurant.name,
-			city: restaurant.city
-		} : await resolveShadowRestaurantInfo(options, deps);
-		restaurant = shadowRestaurant;
-		grant = savedPlaceId ? await bindShadowGrantPlace({
-			platformApiUrl,
-			grant,
-			placeId: savedPlaceId,
-			restaurant: shadowRestaurant,
-			cwd,
-			deps
-		}) : await resolvePlaceIdWithShadowSearch({
-			platformApiUrl,
-			grant,
-			restaurant: shadowRestaurant,
-			cwd,
-			deps
-		});
-	}
-	if (!grant.placeId) throw new Error("Could not resolve a Dineway place id for Forgeway deploy.");
-	const shadowContext = {
-		projectDir: cwd,
-		platformApiUrl,
-		authKind: "shadow-grant",
-		accessToken: grant.accessToken,
-		refreshToken: grant.refreshToken,
-		user: grant.user,
-		ossHost: platformApiUrl,
-		placeId: grant.placeId,
-		restaurantName: restaurant.name,
-		city: restaurant.city
-	};
-	const credentialsResult = await resolveFormalAccountCredentials(shadowContext, await resolveForgewayAccountEmail(options, saved, deps, preferredEmail), options, deps);
-	if (credentialsResult.status === "otp-sent") return credentialsResult;
-	const { credentials } = credentialsResult;
-	return {
-		status: "ready",
-		context: {
-			...shadowContext,
-			authKind: "formal-account",
-			accessToken: credentials.accessToken,
-			refreshToken: credentials.refreshToken,
-			user: credentials.user,
-			ossHost: platformApiUrl
-		},
-		restaurant
-	};
-}
 async function resolveProjectContext(cwd, options, deps) {
-	let preferredEmail;
-	if (!options.sendOtp && !options.otp) {
-		const formal = await resolveFormalProjectContext(cwd, options, deps);
-		if (formal.status !== "missing") return formal;
-		preferredEmail = formal.email;
-	}
-	return await resolveShadowProjectContext(cwd, options, deps, preferredEmail);
-}
-async function createShadowUser(platformApiUrl, placeId, deps) {
-	const response = await forgewayRequest(`${platformApiUrl}/api/auth/users/shadow`, {
-		method: "POST",
-		headers: { "Content-Type": "application/json" },
-		body: JSON.stringify({
-			...placeId ? { placeId } : {},
-			language: "en"
-		})
-	}, deps);
-	if (!response.ok) throw new Error(await parseErrorResponse(response));
-	const payload = await response.json();
-	if (!payload.accessToken || !payload.refreshToken) throw new Error("Dineway shadow user response was missing tokens.");
-	return payload;
+	const formal = await resolveFormalProjectContext(cwd, options, deps);
+	if (formal.status !== "missing") return formal;
+	if (formal.email) throw new Error(`No verified Dineway account credentials were found for ${formal.email}. Run: dineway account login --email ${formal.email}`);
+	throw new Error("No verified Dineway account credentials were found. Run: dineway account login");
 }
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -2522,80 +2728,6 @@ function extractPlaceCandidates(payload) {
 	if (!Array.isArray(places)) throw new Error("Dineway place search response did not include places/results.");
 	return places.filter(isRecord);
 }
-function shadowContextFromGrant(cwd, platformApiUrl, grant, restaurant) {
-	return {
-		projectDir: cwd,
-		platformApiUrl,
-		authKind: "shadow-grant",
-		accessToken: grant.accessToken,
-		refreshToken: grant.refreshToken,
-		user: grant.user,
-		ossHost: platformApiUrl,
-		placeId: grant.placeId,
-		restaurantName: restaurant?.name ?? grant.restaurantName,
-		city: restaurant?.city ?? grant.city
-	};
-}
-function grantFromShadowContext(context, grant, overrides = {}) {
-	return {
-		...grant,
-		platformApiUrl: context.platformApiUrl,
-		accessToken: context.accessToken ?? grant.accessToken,
-		refreshToken: context.refreshToken ?? grant.refreshToken,
-		placeId: context.placeId ?? grant.placeId,
-		restaurantName: context.restaurantName ?? grant.restaurantName,
-		city: context.city ?? grant.city,
-		user: context.user ?? grant.user,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		...overrides
-	};
-}
-async function searchPlacesWithShadowGrant(options) {
-	const context = shadowContextFromGrant(options.cwd, options.platformApiUrl, options.grant, options.restaurant);
-	const payload = await shadowUpgradeFetch(context, "/api/places/search", options.deps, {
-		method: "POST",
-		body: JSON.stringify({ textQuery: `${options.restaurant.name} in ${options.restaurant.city}` })
-	});
-	return {
-		grant: grantFromShadowContext(context, options.grant),
-		candidates: extractPlaceCandidates(payload)
-	};
-}
-async function bindShadowGrantPlace(options) {
-	const context = shadowContextFromGrant(options.cwd, options.platformApiUrl, options.grant, options.restaurant);
-	const payload = await shadowUpgradeFetch(context, "/api/auth/users/shadow/place", options.deps, {
-		method: "POST",
-		body: JSON.stringify({
-			placeId: options.placeId,
-			language: "en"
-		})
-	});
-	const grant = grantFromShadowContext(context, options.grant, {
-		placeId: options.placeId,
-		accessToken: payload.accessToken ?? context.accessToken ?? options.grant.accessToken,
-		refreshToken: payload.refreshToken ?? context.refreshToken ?? options.grant.refreshToken,
-		restaurantName: options.restaurant.name,
-		city: options.restaurant.city,
-		user: payload.user ? normalizeForgewayUser$1(payload.user) : context.user ?? options.grant.user
-	});
-	await (options.deps.writeShadowGrant ?? writeForgewayShadowGrant)(grant, options.cwd);
-	return grant;
-}
-async function resolvePlaceIdWithShadowSearch(options) {
-	const { grant, candidates } = await searchPlacesWithShadowGrant(options);
-	if (candidates.length === 0) throw new Error(`Dineway place search returned no candidates for "${options.restaurant.name} in ${options.restaurant.city}".`);
-	const selected = selectPlaceCandidate(candidates, {
-		name: options.restaurant.name,
-		city: options.restaurant.city
-	});
-	const finalPlaceId = selected ? candidatePlaceId(selected.candidate) : "";
-	if (!PLACE_ID_PATTERN.test(finalPlaceId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
-	return await bindShadowGrantPlace({
-		...options,
-		grant,
-		placeId: finalPlaceId
-	});
-}
 async function resolvePlaceIdWithFormalSearch(options) {
 	const candidates = extractPlaceCandidates(await ossFetch(options.context, "/api/places/search", options.deps, {
 		method: "POST",
@@ -2610,22 +2742,6 @@ async function resolvePlaceIdWithFormalSearch(options) {
 	if (!PLACE_ID_PATTERN.test(finalPlaceId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
 	return finalPlaceId;
 }
-async function createShadowGrant(options) {
-	if (options.placeId && !PLACE_ID_PATTERN.test(options.placeId)) throw new Error("Could not resolve a valid Dineway place id for Forgeway deploy.");
-	const auth = await createShadowUser(options.platformApiUrl, options.placeId, options.deps);
-	const grant = {
-		platformApiUrl: options.platformApiUrl,
-		...options.placeId ? { placeId: options.placeId } : {},
-		accessToken: auth.accessToken,
-		refreshToken: auth.refreshToken,
-		restaurantName: options.restaurantName,
-		city: options.city,
-		user: auth.user ? normalizeForgewayUser$1(auth.user) : void 0,
-		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await (options.deps.writeShadowGrant ?? writeForgewayShadowGrant)(grant, options.cwd);
-	return grant;
-}
 async function ossFetch(context, path, deps, options = {}) {
 	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN$1, "")}${path}`, {
 		...options,
@@ -2638,7 +2754,7 @@ async function ossFetch(context, path, deps, options = {}) {
 	const token = context.accessToken;
 	if (!token) throw new Error("Forgeway deploy context is missing an authorization token.");
 	let response = await request(token);
-	if (response.status === 401) response = await request(context.authKind === "formal-account" ? await refreshFormalAccessToken(context, deps) : await refreshShadowAccessToken(context, deps));
+	if (response.status === 401) response = await request(await refreshFormalAccessToken(context, deps));
 	if (!response.ok) throw new ForgewayApiError(await parseErrorResponse(response), response.status);
 	return await response.json();
 }
@@ -2653,18 +2769,18 @@ function deriveForgewaySiteSlug(restaurantName, city) {
 async function resolveSeedPath$1(cwd, explicitSeedPath) {
 	if (explicitSeedPath) {
 		const resolved = resolve(cwd, explicitSeedPath);
-		if (!await fileExists$8(resolved)) throw new Error(`Seed file not found: ${explicitSeedPath}`);
+		if (!await fileExists$7(resolved)) throw new Error(`Seed file not found: ${explicitSeedPath}`);
 		return resolved;
 	}
 	const convention = resolve(cwd, ".dineway", "seed.json");
-	if (await fileExists$8(convention)) return convention;
+	if (await fileExists$7(convention)) return convention;
 	const pkg = await readDeployPackageJson(cwd).catch(() => null);
 	if (typeof pkg?.dineway?.seed === "string") {
 		const configured = resolve(cwd, pkg.dineway.seed);
-		if (await fileExists$8(configured)) return configured;
+		if (await fileExists$7(configured)) return configured;
 	}
 	const legacyConvention = resolve(cwd, "seed", "seed.json");
-	if (await fileExists$8(legacyConvention)) return legacyConvention;
+	if (await fileExists$7(legacyConvention)) return legacyConvention;
 	return null;
 }
 async function readSeedTitle(seedPath) {
@@ -2689,7 +2805,7 @@ async function resolveRestaurantInfo(options, seedPath, deps, requireForSlug, us
 		city
 	};
 }
-async function resolveShadowRestaurantInfo(options, deps) {
+async function resolveRequiredRestaurantInfo(options, deps) {
 	return {
 		name: options.restaurantName ?? await promptRequired("Restaurant name: ", void 0, deps, "Restaurant name is required. Pass --restaurant-name."),
 		city: options.city ?? await promptRequired("City: ", void 0, deps, "City is required. Pass --city.")
@@ -3032,7 +3148,7 @@ async function deploySiteProject(options) {
 	consola.start("Scanning deploy files");
 	const localFiles = await (options.deps.collectDeploymentFiles ?? collectDeploymentFiles)(options.sourceDir);
 	if (localFiles.length === 0) throw new Error("No deployable files found in the source directory.");
-	consola.success(`Scanned ${localFiles.length} files (${formatBytes$1(deploymentFileSize(localFiles))}) in ${formatDuration(Date.now() - scanStart)}`);
+	consola.success(`Scanned ${localFiles.length} files (${formatBytes(deploymentFileSize(localFiles))}) in ${formatDuration(Date.now() - scanStart)}`);
 	const createStart = Date.now();
 	consola.start("Creating Forgeway deployment");
 	const createResult = await ossFetch(options.context, `/api/deployments/sites/${encodeURIComponent(options.siteId)}/deploy`, options.deps, {
@@ -3051,7 +3167,7 @@ async function deploySiteProject(options) {
 	const pendingFiles = createResult.files.filter((file) => !file.uploadedAt);
 	const pendingSize = pendingFiles.reduce((total, file) => total + file.size, 0);
 	if (pendingFiles.length === 0) consola.success("No file uploads needed");
-	else consola.start(`Uploading ${pendingFiles.length} changed files (${formatBytes$1(pendingSize)})`);
+	else consola.start(`Uploading ${pendingFiles.length} changed files (${formatBytes(pendingSize)})`);
 	let uploadedCount = 0;
 	await runWithConcurrency(pendingFiles, DIRECT_UPLOAD_CONCURRENCY, async (manifestFile) => {
 		const localFile = localFileByPath.get(manifestFile.path);
@@ -3094,15 +3210,6 @@ function formatDinewayAdminBootstrapMessage(bootstrap) {
 		"CLI example: npx dineway whoami"
 	].join("\n");
 }
-function formatForgewayOtpSentMessage(email, expiresAt) {
-	const lines = [
-		`Sent Forgeway email verification code to ${email}.`,
-		"Run the Forgeway deploy command again with the same restaurant/site options and --otp <code>.",
-		`Example: npx dineway deploy forgeway --email ${email} --otp 123456`
-	];
-	if (expiresAt) lines.splice(1, 0, `Code expires at ${expiresAt}.`);
-	return lines.join("\n");
-}
 async function deployForgeway(cwd, options, deps = {}) {
 	if (options.dryRun) return { message: "[dry-run] Would resolve Forgeway project, create/reuse site, bind database, initialize Dineway, upload files, and start deployment." };
 	const sourceDir = resolve(cwd);
@@ -3112,9 +3219,7 @@ async function deployForgeway(cwd, options, deps = {}) {
 	if (database !== "none") await warnProjectDinewayRuntimeMismatch(cwd, deps.dinewayVersion ?? VERSION);
 	await ensureProjectGitignoreDinewayLocalState(cwd);
 	const verbose = isVerboseDeploy(options);
-	const project = await resolveProjectContext(cwd, options, deps);
-	if (project.status === "otp-sent") return { message: formatForgewayOtpSentMessage(project.email, project.expiresAt) };
-	const { context, restaurant } = project;
+	const { context, restaurant } = await resolveProjectContext(cwd, options, deps);
 	const seedPath = options.skipSeed ? null : await resolveSeedPath$1(cwd, options.seed);
 	if (options.skipSeed) consola.info("Skipping seed initialization by request");
 	await ensureRestaurantClaim(context, restaurant, deps);
@@ -3174,7 +3279,6 @@ const forgewayTarget = {
 	remoteBuild: true,
 	supportLevel: "stable",
 	async generateConfig(cwd, options) {
-		if (options.sendOtp) return [];
 		return await configureAstroDeployAdapter(cwd, "vercel", options.dryRun);
 	},
 	async deploy(cwd, options) {
@@ -3207,7 +3311,7 @@ pnpm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 `;
-async function fileExists$7(path) {
+async function fileExists$6(path) {
 	try {
 		await access(path);
 		return true;
@@ -3217,7 +3321,7 @@ async function fileExists$7(path) {
 }
 async function writeGeneratedFile(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$7(path)) return {
+	if (await fileExists$6(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -3350,7 +3454,7 @@ const gcpTarget = {
 			env: options.env,
 			stdio: "inherit"
 		});
-		if (result.code !== 0 && !await fileExists$7(join(cwd, "Dockerfile"))) {
+		if (result.code !== 0 && !await fileExists$6(join(cwd, "Dockerfile"))) {
 			await writeFile(join(cwd, "Dockerfile"), generateDockerfile(), "utf-8");
 			result = await runCommand$1("gcloud", deployArgs, {
 				cwd,
@@ -3369,7 +3473,7 @@ const gcpTarget = {
 
 //#endregion
 //#region src/cli/commands/deploy/utils/build.ts
-async function fileExists$6(path) {
+async function fileExists$5(path) {
 	try {
 		await access(path);
 		return true;
@@ -3378,19 +3482,19 @@ async function fileExists$6(path) {
 	}
 }
 async function detectBuildCommand(cwd) {
-	if (await fileExists$6(join(cwd, "pnpm-lock.yaml"))) return {
+	if (await fileExists$5(join(cwd, "pnpm-lock.yaml"))) return {
 		packageManager: "pnpm",
 		command: "pnpm",
 		args: ["build"],
 		display: "pnpm build"
 	};
-	if (await fileExists$6(join(cwd, "yarn.lock"))) return {
+	if (await fileExists$5(join(cwd, "yarn.lock"))) return {
 		packageManager: "yarn",
 		command: "yarn",
 		args: ["build"],
 		display: "yarn build"
 	};
-	if (await fileExists$6(join(cwd, "bun.lock")) || await fileExists$6(join(cwd, "bun.lockb"))) return {
+	if (await fileExists$5(join(cwd, "bun.lock")) || await fileExists$5(join(cwd, "bun.lockb"))) return {
 		packageManager: "bun",
 		command: "bun",
 		args: ["run", "build"],
@@ -3421,7 +3525,7 @@ const INVALID_RAILWAY_PROJECT_CHARS_RE = /[^a-z0-9-]+/g;
 const REPEATED_HYPHENS_RE = /-+/g;
 const EDGE_HYPHENS_RE = /^-|-$/g;
 const RAILWAY_BUILDER = "RAILPACK";
-async function fileExists$5(path) {
+async function fileExists$4(path) {
 	try {
 		await access(path);
 		return true;
@@ -3515,7 +3619,7 @@ const railwayTarget = {
 	async generateConfig(cwd, options) {
 		const generated = await configureAstroDeployAdapter(cwd, "node", options.dryRun);
 		const railwayPath = join(cwd, "railway.json");
-		if (await fileExists$5(railwayPath)) return [...generated, {
+		if (await fileExists$4(railwayPath)) return [...generated, {
 			path: "railway.json",
 			action: "exists"
 		}];
@@ -3706,16 +3810,6 @@ const deployCommand = defineCommand({
 			description: "Dineway account email for deploy authorization",
 			required: false
 		},
-		"send-otp": {
-			type: "boolean",
-			description: "Send a Forgeway email verification code and exit without prompting or deploying",
-			default: false
-		},
-		otp: {
-			type: "string",
-			description: "Forgeway email verification code for non-interactive deploy authorization",
-			required: false
-		},
 		"restaurant-name": {
 			type: "string",
 			description: "Restaurant name for first Forgeway site creation",
@@ -3763,8 +3857,6 @@ const deployCommand = defineCommand({
 			site: args.site,
 			placeId: args["place-id"],
 			email: args.email,
-			sendOtp: args["send-otp"],
-			otp: args.otp,
 			restaurantName: args["restaurant-name"],
 			city: args.city,
 			database: args.database,
@@ -3773,8 +3865,6 @@ const deployCommand = defineCommand({
 			forceDbInit: args["force-db-init"],
 			verbose: args.verbose
 		};
-		if ((options.sendOtp || options.otp) && target.name !== "forgeway") throw new Error("--send-otp and --otp are only supported for Forgeway deploys.");
-		if (options.sendOtp && options.otp) throw new Error("Use either --send-otp or --otp, not both.");
 		consola.start(`Preparing ${target.label} deploy`);
 		await ensureTargetCli(target, cwd, {
 			yes: options.yes,
@@ -3808,7 +3898,21 @@ const deployCommand = defineCommand({
 			consola.info("[dry-run] Would ensure Dineway local state entries in .gitignore");
 			consola.info(`[dry-run] Would save .dineway/deploy.json target=${target.name}`);
 		}
-		const result = await target.deploy(cwd, options);
+		const result = await target.deploy(cwd, options).catch(async (error) => {
+			if (await handleCliPaywall({
+				error,
+				resource: `deploy:${target.name}`,
+				platformApiUrl: process.env.DINEWAY_FORGEWAY_API_URL,
+				webUrl: process.env.DINEWAY_WEB_URL,
+				interactive: process.stdin.isTTY && !options.yes,
+				context: {
+					target: target.name,
+					site: options.site,
+					placeId: options.placeId
+				}
+			})) process.exit(2);
+			throw error;
+		});
 		if (result.url) consola.success(result.url);
 		consola.success(result.message);
 	}
@@ -3872,7 +3976,7 @@ async function readPackageJson$2(cwd) {
 		return null;
 	}
 }
-async function fileExists$4(path) {
+async function fileExists$3(path) {
 	try {
 		await access(path);
 		return true;
@@ -3919,7 +4023,7 @@ const devCommand = defineCommand({
 		}
 		const database = resolveCliDatabaseTarget(cwd, args.database);
 		consola.info(`Database: ${database.display}`);
-		if (database.localPath && !await fileExists$4(database.localPath)) consola.start("Database not found, initializing...");
+		if (database.localPath && !await fileExists$3(database.localPath)) consola.start("Database not found, initializing...");
 		const db = createDatabase({ url: database.url });
 		try {
 			consola.start("Checking database migrations...");
@@ -3958,8 +4062,8 @@ const devCommand = defineCommand({
 			"--port",
 			args.port
 		];
-		const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));
-		const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));
+		const pnpmLockExists = await fileExists$3(resolve(cwd, "pnpm-lock.yaml"));
+		const yarnLockExists = await fileExists$3(resolve(cwd, "yarn.lock"));
 		let cmd;
 		let cmdArgs;
 		if (pnpmLockExists) {
@@ -4003,7 +4107,7 @@ const devCommand = defineCommand({
 *
 * Diagnose database health: connection, migrations, schema integrity.
 */
-async function fileExists$3(path) {
+async function fileExists$2(path) {
 	try {
 		await access(path);
 		return true;
@@ -4016,7 +4120,7 @@ function printResult(result) {
 }
 async function checkDatabase(database) {
 	const results = [];
-	if (database.localPath && !await fileExists$3(database.localPath)) {
+	if (database.localPath && !await fileExists$2(database.localPath)) {
 		results.push({
 			name: "database",
 			status: "fail",
@@ -4070,7 +4174,7 @@ async function checkDatabase(database) {
 			});
 		} catch {}
 		try {
-			const count = (await sql`SELECT COUNT(id) as count FROM _dineway_users`.execute(db)).rows[0]?.count ?? 0;
+			const count = (await sql`SELECT COUNT(id) as count FROM users`.execute(db)).rows[0]?.count ?? 0;
 			results.push({
 				name: "users",
 				status: count > 0 ? "pass" : "warn",
@@ -4218,7 +4322,7 @@ async function exportSeed(db, withContent) {
 	const { bylines, idToSeedId: bylineIdToSeedId } = await exportBylines(db);
 	if (bylines.length > 0) seed.bylines = bylines;
 	if (withContent !== void 0) {
-		const collections = withContent === "" || withContent === "true" ? null : withContent.split(",").map((s) => s.trim()).filter(Boolean);
+		const collections = withContent === "" || withContent === "true" || withContent === "all" ? null : withContent.split(",").map((s) => s.trim()).filter(Boolean);
 		seed.content = await exportContent(db, seed.collections || [], collections, bylineIdToSeedId, i18nEnabled);
 	}
 	return seed;
@@ -4348,8 +4452,8 @@ async function exportTaxonomies(db, i18nEnabled) {
 	for (const def of defs) {
 		const defSeedId = i18nEnabled && def.locale ? `tax:${def.name}:${def.locale}` : `tax:${def.name}`;
 		const terms = await termRepo.findByName(def.name, { locale: def.locale });
-		const idToSlug = /* @__PURE__ */ new Map();
-		for (const term of terms) idToSlug.set(term.id, term.slug);
+		const groupToSlug = /* @__PURE__ */ new Map();
+		for (const term of terms) groupToSlug.set(term.translationGroup ?? term.id, term.slug);
 		const termGroupToSeedId = /* @__PURE__ */ new Map();
 		const seedTerms = [];
 		for (const term of terms) {
@@ -4360,7 +4464,7 @@ async function exportTaxonomies(db, i18nEnabled) {
 				label: term.label,
 				description: typeof term.data?.description === "string" ? term.data.description : void 0
 			};
-			if (term.parentId) seedTerm.parent = idToSlug.get(term.parentId);
+			if (term.parentId) seedTerm.parent = groupToSlug.get(term.parentId);
 			if (i18nEnabled && term.locale) {
 				seedTerm.locale = term.locale;
 				if (term.translationGroup) {
@@ -4649,7 +4753,7 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 *
 * Initialize database from template config in package.json
 */
-async function fileExists$2(path) {
+async function fileExists$1(path) {
 	try {
 		await access(path);
 		return true;
@@ -4749,7 +4853,7 @@ const initCommand = defineCommand({
 		if (alreadyInitialized && args.force) consola.warn("Re-initializing (--force)...");
 		if (config?.schema) {
 			const schemaPath = resolve(cwd, config.schema);
-			if (await fileExists$2(schemaPath)) {
+			if (await fileExists$1(schemaPath)) {
 				consola.start(`Running schema: ${config.schema}`);
 				try {
 					await runSqlFile(db, schemaPath);
@@ -5292,593 +5396,6 @@ const menuCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/commands/bundle-utils.ts
-/**
-* Bundle utility functions
-*
-* Shared logic extracted from the bundle command so it can be tested
-* without the CLI harness and tsdown dependency.
-*/
-const MAX_BUNDLE_SIZE = 256 * 1024;
-const MAX_FILE_SIZE = 128 * 1024;
-const MAX_FILE_COUNT = 20;
-const MAX_SCREENSHOTS = 5;
-const MAX_SCREENSHOT_WIDTH = 1920;
-const MAX_SCREENSHOT_HEIGHT = 1080;
-const ICON_SIZE = 256;
-function toFileImportSpecifier(filePath) {
-	return pathToFileURL(filePath).href;
-}
-/** Matches Node.js built-in imports in bundled output. */
-const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
-const LEADING_DOT_SLASH_RE = /^\.\//;
-const DIST_PREFIX_RE = /^dist\//;
-const MJS_EXT_RE = /\.m?js$/;
-const BUILD_OUTPUT_EXT_RE = /\.(?:mjs|js|cjs)$/;
-const TS_TO_TSX_RE = /\.ts$/;
-/** Node.js built-in modules that shouldn't appear in sandbox code */
-const NODE_BUILTINS = new Set([
-	"assert",
-	"buffer",
-	"child_process",
-	"cluster",
-	"crypto",
-	"dgram",
-	"dns",
-	"domain",
-	"events",
-	"fs",
-	"http",
-	"http2",
-	"https",
-	"inspector",
-	"module",
-	"net",
-	"os",
-	"path",
-	"perf_hooks",
-	"process",
-	"punycode",
-	"querystring",
-	"readline",
-	"repl",
-	"stream",
-	"string_decoder",
-	"sys",
-	"timers",
-	"tls",
-	"trace_events",
-	"tty",
-	"url",
-	"util",
-	"v8",
-	"vm",
-	"wasi",
-	"worker_threads",
-	"zlib"
-]);
-async function fileExists$1(path) {
-	try {
-		await access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Read image dimensions from a buffer.
-* Returns [width, height] or null if the format is unrecognized.
-*/
-function readImageDimensions(buf) {
-	try {
-		const result = imageSize(buf);
-		if (result.width != null && result.height != null) return [result.width, result.height];
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Extract manifest metadata from a ResolvedPlugin.
-* Strips functions (hooks, route handlers) and keeps only serializable metadata.
-*/
-function extractManifest(plugin) {
-	const hooks = [];
-	for (const [name, resolved] of Object.entries(plugin.hooks)) {
-		if (!resolved) continue;
-		if (resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5e3) {
-			const entry = { name };
-			if (resolved.exclusive) entry.exclusive = true;
-			if (resolved.priority !== 100) entry.priority = resolved.priority;
-			if (resolved.timeout !== 5e3) entry.timeout = resolved.timeout;
-			hooks.push(entry);
-		} else hooks.push(name);
-	}
-	return {
-		id: plugin.id,
-		version: plugin.version,
-		capabilities: plugin.capabilities,
-		allowedHosts: plugin.allowedHosts,
-		storage: plugin.storage,
-		hooks,
-		routes: Object.keys(plugin.routes),
-		admin: {
-			settingsSchema: plugin.admin.settingsSchema,
-			pages: plugin.admin.pages,
-			widgets: plugin.admin.widgets
-		}
-	};
-}
-/**
-* Scan bundled code for Node.js built-in imports.
-* Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
-* that appear in bundled ESM/CJS output (not source-level named imports).
-* Returns deduplicated array of built-in module names found.
-*/
-function findNodeBuiltinImports(code) {
-	const found = [];
-	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
-	let match;
-	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
-		const mod = match[1];
-		if (NODE_BUILTINS.has(mod)) found.push(mod);
-	}
-	return [...new Set(found)];
-}
-/**
-* Find a build output file by base name, checking common extensions.
-* tsdown may output .mjs, .js, or .cjs depending on format and config.
-*/
-async function findBuildOutput(dir, baseName) {
-	const normalizedBaseName = baseName.replace(BUILD_OUTPUT_EXT_RE, "");
-	for (const ext of [
-		".mjs",
-		".js",
-		".cjs"
-	]) {
-		const candidate = join(dir, `${normalizedBaseName}${ext}`);
-		if (await fileExists$1(candidate)) return candidate;
-	}
-}
-/**
-* Resolve a dist/built path back to its source .ts/.tsx equivalent.
-* E.g., "./dist/index.mjs" → "src/index.ts"
-*/
-async function resolveSourceEntry(pluginDir, distPath) {
-	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
-	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
-	const srcFull = resolve(pluginDir, srcPath);
-	if (await fileExists$1(srcFull)) return srcFull;
-	const tsxFull = resolve(pluginDir, srcPath.replace(TS_TO_TSX_RE, ".tsx"));
-	if (await fileExists$1(tsxFull)) return tsxFull;
-	const direct = resolve(pluginDir, cleaned);
-	if (await fileExists$1(direct)) return direct;
-}
-const TS_SOURCE_EXPORT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/;
-/**
-* Find package.json exports that point to source files instead of built output.
-* Returns an array of `{ exportPath, resolvedPath }` for each offending export.
-*/
-function findSourceExports(exports) {
-	const issues = [];
-	for (const [exportPath, exportValue] of Object.entries(exports)) {
-		const resolved = typeof exportValue === "string" ? exportValue : exportValue && typeof exportValue === "object" && "import" in exportValue ? exportValue.import : null;
-		if (resolved && TS_SOURCE_EXPORT_RE.test(resolved)) issues.push({
-			exportPath,
-			resolvedPath: resolved
-		});
-	}
-	return issues;
-}
-/**
-* Recursively walk a staging directory and return all regular files with
-* tarball-relative names.
-*/
-async function collectBundleEntries(dir) {
-	const entries = [];
-	await walkBundle(dir, "", entries);
-	return entries;
-}
-async function walkBundle(dir, prefix, into) {
-	const items = await readdir(dir, { withFileTypes: true });
-	for (const item of items) {
-		const fullPath = join(dir, item.name);
-		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
-		if (item.isFile()) {
-			const s = await stat(fullPath);
-			into.push({
-				name: relPath,
-				bytes: s.size
-			});
-		} else if (item.isDirectory()) await walkBundle(fullPath, relPath, into);
-	}
-}
-function totalBundleBytes(entries) {
-	let total = 0;
-	for (const entry of entries) total += entry.bytes;
-	return total;
-}
-/**
-* Enforce sandboxed plugin caps against decompressed bundle files:
-* total size, per-file size, and file count.
-*/
-function validateBundleSize(entries) {
-	const violations = [];
-	const total = totalBundleBytes(entries);
-	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`);
-	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
-	const oversized = entries.filter((entry) => entry.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
-	for (const entry of oversized) violations.push(`File ${entry.name} is ${formatBytes(entry.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`);
-	return violations;
-}
-function formatBytes(bytes) {
-	if (bytes < 1024) return `${bytes} B`;
-	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-	return `${(bytes / 1024 / 1024).toFixed(2)} MB`;
-}
-/**
-* Create a gzipped tarball from a directory.
-*/
-async function createTarball(sourceDir, outputPath) {
-	const { createGzip } = await import("node:zlib");
-	await pipeline(packTar(sourceDir), createGzip({ level: 9 }), createWriteStream(outputPath));
-}
-
-//#endregion
-//#region src/cli/commands/bundle.ts
-/**
-* dineway plugin bundle
-*
-* Produces a publishable plugin tarball from a plugin source directory.
-*
-* Steps:
-* 1. Resolve plugin entrypoint (finds definePlugin() export)
-* 2. Bundle backend code with tsdown → backend.js (single ES module, tree-shaken)
-* 3. Bundle admin code if present → admin.js
-* 4. Extract manifest from definePlugin() → manifest.json
-* 5. Collect assets (README.md, icon.png, screenshots/)
-* 6. Validate bundle (manifest schema, size limits, no Node.js builtins)
-* 7. Create tarball ({id}-{version}.tar.gz)
-*/
-var bundle_exports = /* @__PURE__ */ __exportAll({ bundleCommand: () => bundleCommand });
-const TS_EXT_RE = /\.tsx?$/;
-const SLASH_RE = /\//g;
-const LEADING_AT_RE = /^@/;
-const DINEWAY_SCOPE_RE = /^@dineway-ai\//;
-const bundleCommand = defineCommand({
-	meta: {
-		name: "bundle",
-		description: "Bundle a plugin for marketplace distribution"
-	},
-	args: {
-		dir: {
-			type: "string",
-			description: "Plugin directory (default: current directory)",
-			default: process.cwd()
-		},
-		outDir: {
-			type: "string",
-			alias: "o",
-			description: "Output directory for the tarball (default: ./dist)",
-			default: "dist"
-		},
-		validateOnly: {
-			type: "boolean",
-			description: "Run validation only, skip tarball creation",
-			default: false
-		}
-	},
-	async run({ args }) {
-		const pluginDir = resolve(args.dir);
-		const outDir = resolve(pluginDir, args.outDir);
-		const validateOnly = args.validateOnly;
-		consola.start(validateOnly ? "Validating plugin..." : "Bundling plugin...");
-		const pkgPath = join(pluginDir, "package.json");
-		if (!await fileExists$1(pkgPath)) {
-			consola.error("No package.json found in", pluginDir);
-			process.exit(1);
-		}
-		const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
-		let backendEntry;
-		let adminEntry;
-		if (pkg.exports) {
-			const sandboxExport = pkg.exports["./sandbox"];
-			if (typeof sandboxExport === "string") backendEntry = await resolveSourceEntry(pluginDir, sandboxExport);
-			else if (sandboxExport && typeof sandboxExport === "object" && "import" in sandboxExport) backendEntry = await resolveSourceEntry(pluginDir, sandboxExport.import);
-			const adminExport = pkg.exports["./admin"];
-			if (typeof adminExport === "string") adminEntry = await resolveSourceEntry(pluginDir, adminExport);
-			else if (adminExport && typeof adminExport === "object" && "import" in adminExport) adminEntry = await resolveSourceEntry(pluginDir, adminExport.import);
-		}
-		if (!backendEntry) {
-			const defaultSandbox = join(pluginDir, "src/sandbox-entry.ts");
-			if (await fileExists$1(defaultSandbox)) backendEntry = defaultSandbox;
-		}
-		let mainEntry;
-		if (pkg.exports?.["."] !== void 0) {
-			const mainExport = pkg.exports["."];
-			if (typeof mainExport === "string") mainEntry = await resolveSourceEntry(pluginDir, mainExport);
-			else if (mainExport && typeof mainExport === "object" && "import" in mainExport) mainEntry = await resolveSourceEntry(pluginDir, mainExport.import);
-		}
-		if (!mainEntry && pkg.main) mainEntry = await resolveSourceEntry(pluginDir, pkg.main);
-		if (!mainEntry) {
-			const defaultMain = join(pluginDir, "src/index.ts");
-			if (await fileExists$1(defaultMain)) mainEntry = defaultMain;
-		}
-		if (!mainEntry) {
-			consola.error("Cannot find plugin entrypoint. Expected src/index.ts or main/exports in package.json");
-			process.exit(1);
-		}
-		consola.info(`Main entry: ${mainEntry}`);
-		if (backendEntry) consola.info(`Backend entry: ${backendEntry}`);
-		if (adminEntry) consola.info(`Admin entry: ${adminEntry}`);
-		consola.start("Extracting plugin manifest...");
-		const { build } = await import("tsdown");
-		const tmpDir = join(pluginDir, ".dineway-bundle-tmp");
-		try {
-			await mkdir(tmpDir, { recursive: true });
-			await copyFile(pkgPath, join(tmpDir, "package.json"));
-			const mainOutDir = join(tmpDir, "main");
-			await build({
-				config: false,
-				entry: [mainEntry],
-				format: "esm",
-				outDir: mainOutDir,
-				dts: false,
-				platform: "node",
-				external: ["dineway", DINEWAY_SCOPE_RE]
-			});
-			const pluginNodeModules = join(pluginDir, "node_modules");
-			const tmpNodeModules = join(mainOutDir, "node_modules");
-			if (await fileExists$1(pluginNodeModules)) await symlink(pluginNodeModules, tmpNodeModules, "junction");
-			const mainOutputPath = await findBuildOutput(mainOutDir, basename(mainEntry).replace(TS_EXT_RE, ""));
-			if (!mainOutputPath) {
-				consola.error("Failed to build main entry — no output found in", mainOutDir);
-				process.exit(1);
-			}
-			const pluginModule = await import(toFileImportSpecifier(mainOutputPath));
-			let resolvedPlugin;
-			if (typeof pluginModule.createPlugin === "function") resolvedPlugin = pluginModule.createPlugin();
-			else if (typeof pluginModule.default === "function") resolvedPlugin = pluginModule.default();
-			else if (typeof pluginModule.default === "object" && pluginModule.default !== null) {
-				const defaultExport = pluginModule.default;
-				if ("id" in defaultExport && "version" in defaultExport) resolvedPlugin = defaultExport;
-			}
-			if (!resolvedPlugin) for (const [key, value] of Object.entries(pluginModule)) {
-				if (key === "default" || typeof value !== "function") continue;
-				try {
-					const result = value();
-					if (result && typeof result === "object" && "id" in result && "version" in result) {
-						resolvedPlugin = {
-							id: result.id,
-							version: result.version,
-							capabilities: result.capabilities ?? [],
-							allowedHosts: result.allowedHosts ?? [],
-							storage: result.storage ?? {},
-							hooks: {},
-							routes: {},
-							admin: {
-								pages: result.adminPages,
-								widgets: result.adminWidgets
-							}
-						};
-						if (backendEntry) {
-							const backendProbeDir = join(tmpDir, "backend-probe");
-							const probeShimDir = join(tmpDir, "probe-shims");
-							await mkdir(probeShimDir, { recursive: true });
-							await writeFile(join(probeShimDir, "dineway.mjs"), "export const definePlugin = (d) => d;\n");
-							await build({
-								config: false,
-								entry: [backendEntry],
-								format: "esm",
-								outDir: backendProbeDir,
-								dts: false,
-								platform: "neutral",
-								external: [],
-								alias: { dineway: join(probeShimDir, "dineway.mjs") },
-								treeshake: true
-							});
-							const backendProbePath = await findBuildOutput(backendProbeDir, basename(backendEntry).replace(TS_EXT_RE, ""));
-							if (backendProbePath) {
-								const standardDef = (await import(toFileImportSpecifier(backendProbePath))).default ?? {};
-								const hooks = standardDef.hooks;
-								const routes = standardDef.routes;
-								if (hooks) for (const hookName of Object.keys(hooks)) {
-									const hookEntry = hooks[hookName];
-									const isConfig = typeof hookEntry === "object" && hookEntry !== null && "handler" in hookEntry;
-									const config = isConfig ? hookEntry : {};
-									resolvedPlugin.hooks[hookName] = {
-										handler: isConfig ? hookEntry.handler : hookEntry,
-										priority: config.priority ?? 100,
-										timeout: config.timeout ?? 5e3,
-										dependencies: config.dependencies ?? [],
-										errorPolicy: config.errorPolicy ?? "abort",
-										exclusive: config.exclusive ?? false,
-										pluginId: result.id
-									};
-								}
-								if (routes) for (const [name, route] of Object.entries(routes)) {
-									const routeObj = route;
-									resolvedPlugin.routes[name] = {
-										handler: routeObj.handler,
-										public: routeObj.public
-									};
-								}
-							}
-						}
-						break;
-					}
-				} catch {}
-			}
-			if (!resolvedPlugin?.id || !resolvedPlugin?.version) {
-				consola.error("Could not extract plugin definition. Expected one of:\n  - createPlugin() export (native format)\n  - Descriptor factory function returning { id, version, ... } (standard format)");
-				process.exit(1);
-			}
-			const manifest = extractManifest(resolvedPlugin);
-			if (resolvedPlugin.admin?.entry) {
-				consola.error("Plugin declares adminEntry — React admin components require native/trusted mode. Use Block Kit for sandboxed admin pages, or remove adminEntry.");
-				process.exit(1);
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) {
-				consola.error("Plugin declares portableTextBlocks — these require native/trusted mode and cannot be bundled for the marketplace.");
-				process.exit(1);
-			}
-			consola.success(`Plugin: ${manifest.id}@${manifest.version}`);
-			consola.info(`  Capabilities: ${manifest.capabilities.length > 0 ? manifest.capabilities.join(", ") : "(none)"}`);
-			consola.info(`  Hooks: ${manifest.hooks.length > 0 ? manifest.hooks.map((h) => typeof h === "string" ? h : h.name).join(", ") : "(none)"}`);
-			consola.info(`  Routes: ${manifest.routes.length > 0 ? manifest.routes.map((r) => typeof r === "string" ? r : r.name).join(", ") : "(none)"}`);
-			const bundleDir = join(tmpDir, "bundle");
-			await mkdir(bundleDir, { recursive: true });
-			if (backendEntry) {
-				consola.start("Bundling backend...");
-				const shimDir = join(tmpDir, "shims");
-				await mkdir(shimDir, { recursive: true });
-				await writeFile(join(shimDir, "dineway.mjs"), "export const definePlugin = (d) => d;\n");
-				await build({
-					config: false,
-					entry: [backendEntry],
-					format: "esm",
-					outDir: join(tmpDir, "backend"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					alias: { dineway: join(shimDir, "dineway.mjs") },
-					minify: true,
-					treeshake: true
-				});
-				const backendBaseName = basename(backendEntry).replace(TS_EXT_RE, "");
-				const backendOutputPath = await findBuildOutput(join(tmpDir, "backend"), backendBaseName);
-				if (backendOutputPath) {
-					await copyFile(backendOutputPath, join(bundleDir, "backend.js"));
-					consola.success("Built backend.js");
-				} else {
-					consola.error("Backend build produced no output");
-					process.exit(1);
-				}
-			} else {
-				consola.warn("No sandbox entry found — bundle will have no backend.js");
-				consola.warn("  Add a \"sandbox-entry.ts\" in src/ or a \"./sandbox\" export in package.json");
-			}
-			if (adminEntry) {
-				consola.start("Bundling admin...");
-				await build({
-					config: false,
-					entry: [adminEntry],
-					format: "esm",
-					outDir: join(tmpDir, "admin"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					minify: true,
-					treeshake: true
-				});
-				const adminBaseName = basename(adminEntry).replace(TS_EXT_RE, "");
-				const adminOutputPath = await findBuildOutput(join(tmpDir, "admin"), adminBaseName);
-				if (adminOutputPath) {
-					await copyFile(adminOutputPath, join(bundleDir, "admin.js"));
-					consola.success("Built admin.js");
-				}
-			}
-			await writeFile(join(bundleDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-			consola.start("Collecting assets...");
-			const readmePath = join(pluginDir, "README.md");
-			if (await fileExists$1(readmePath)) {
-				await copyFile(readmePath, join(bundleDir, "README.md"));
-				consola.success("Included README.md");
-			}
-			const iconPath = join(pluginDir, "icon.png");
-			if (await fileExists$1(iconPath)) {
-				const dims = readImageDimensions(await readFile(iconPath));
-				if (!dims) consola.warn("icon.png is not a valid PNG — skipping");
-				else if (dims[0] !== ICON_SIZE || dims[1] !== ICON_SIZE) {
-					consola.warn(`icon.png is ${dims[0]}x${dims[1]}, expected ${ICON_SIZE}x${ICON_SIZE} — including anyway`);
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-				} else {
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-					consola.success("Included icon.png");
-				}
-			}
-			const screenshotsDir = join(pluginDir, "screenshots");
-			if (await fileExists$1(screenshotsDir)) {
-				const screenshotFiles = (await readdir(screenshotsDir)).filter((f) => {
-					const ext = extname(f).toLowerCase();
-					return ext === ".png" || ext === ".jpg" || ext === ".jpeg";
-				}).toSorted().slice(0, MAX_SCREENSHOTS);
-				if (screenshotFiles.length > 0) {
-					await mkdir(join(bundleDir, "screenshots"), { recursive: true });
-					for (const file of screenshotFiles) {
-						const filePath = join(screenshotsDir, file);
-						const dims = readImageDimensions(await readFile(filePath));
-						if (!dims) {
-							consola.warn(`screenshots/${file} — cannot read dimensions, skipping`);
-							continue;
-						}
-						if (dims[0] > MAX_SCREENSHOT_WIDTH || dims[1] > MAX_SCREENSHOT_HEIGHT) consola.warn(`screenshots/${file} is ${dims[0]}x${dims[1]}, max ${MAX_SCREENSHOT_WIDTH}x${MAX_SCREENSHOT_HEIGHT} — including anyway`);
-						await copyFile(filePath, join(bundleDir, "screenshots", file));
-					}
-					consola.success(`Included ${screenshotFiles.length} screenshot(s)`);
-				}
-			}
-			consola.start("Validating bundle...");
-			let hasErrors = false;
-			if (pkg.exports) for (const issue of findSourceExports(pkg.exports)) {
-				consola.error(`Export "${issue.exportPath}" points to source (${issue.resolvedPath}). Package exports must point to built files (e.g. dist/*.mjs). Add a build step and update the exports map.`);
-				hasErrors = true;
-			}
-			const backendPath = join(bundleDir, "backend.js");
-			if (await fileExists$1(backendPath)) {
-				const builtins = findNodeBuiltinImports(await readFile(backendPath, "utf-8"));
-				if (builtins.length > 0) {
-					consola.error(`backend.js imports Node.js built-in modules: ${builtins.join(", ")}`);
-					consola.error("Sandboxed plugins cannot use Node.js APIs");
-					hasErrors = true;
-				}
-			}
-			if (manifest.capabilities.includes("network:request:unrestricted")) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
-			else if (manifest.capabilities.includes("network:request") && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all fetch requests will be blocked");
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
-			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
-			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
-			const hasAdminPages = (manifest.admin?.pages?.length ?? 0) > 0;
-			const hasAdminWidgets = (manifest.admin?.widgets?.length ?? 0) > 0;
-			if (hasAdminPages || hasAdminWidgets) {
-				if (!manifest.routes.map((r) => typeof r === "string" ? r : r.name).includes("admin")) {
-					consola.error(`Plugin declares ${hasAdminPages ? "adminPages" : ""}${hasAdminPages && hasAdminWidgets ? " and " : ""}${hasAdminWidgets ? "adminWidgets" : ""} but the sandbox entry has no "admin" route. Add an admin route handler to serve Block Kit pages.`);
-					hasErrors = true;
-				}
-			}
-			const bundleEntries = await collectBundleEntries(bundleDir);
-			const sizeViolations = validateBundleSize(bundleEntries);
-			if (sizeViolations.length > 0) {
-				for (const violation of sizeViolations) consola.error(violation);
-				hasErrors = true;
-			} else consola.info(`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
-			if (hasErrors) {
-				consola.error("Bundle validation failed");
-				process.exit(1);
-			}
-			consola.success("Validation passed");
-			if (validateOnly) return;
-			await mkdir(outDir, { recursive: true });
-			const tarballName = `${manifest.id.replace(SLASH_RE, "-").replace(LEADING_AT_RE, "")}-${manifest.version}.tar.gz`;
-			const tarballPath = join(outDir, tarballName);
-			consola.start("Creating tarball...");
-			await createTarball(bundleDir, tarballPath);
-			const tarballSizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
-			const tarballBuf = await readFile(tarballPath);
-			const checksum = createHash("sha256").update(tarballBuf).digest("hex");
-			consola.success(`Created ${tarballName} (${tarballSizeKB}KB)`);
-			consola.info(`  SHA-256: ${checksum}`);
-			consola.info(`  Path: ${tarballPath}`);
-		} finally {
-			if (tmpDir.endsWith(".dineway-bundle-tmp")) await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-});
-
 //#endregion
 //#region src/cli/commands/plugin-init.ts
 /**
@@ -5954,7 +5471,7 @@ const pluginInitCommand = defineCommand({
 			process.exit(1);
 		}
 		const srcDir = join(targetDir, "src");
-		if (await fileExists$1(join(targetDir, "package.json"))) {
+		if (await fileExists$11(join(targetDir, "package.json"))) {
 			consola.error(`package.json already exists in ${targetDir}`);
 			process.exit(1);
 		}
@@ -6320,6 +5837,7 @@ async function pollGitHubDeviceFlow(tokenEndpoint, clientId, deviceCode, interva
 const manifestSummarySchema = pluginManifestSchema.pick({
 	id: true,
 	version: true,
+	declaredAccess: true,
 	capabilities: true,
 	allowedHosts: true
 });
@@ -6337,7 +5855,20 @@ async function readManifestFromTarball(tarballPath) {
 	const parsed = JSON.parse(content);
 	const result = manifestSummarySchema.safeParse(parsed);
 	if (!result.success) throw new Error(`Invalid manifest.json: ${result.error.message}`);
-	return result.data;
+	const reconciled = reconcileManifestAccess({
+		...result.data,
+		storage: {},
+		hooks: [],
+		routes: [],
+		admin: {}
+	});
+	return {
+		id: reconciled.id,
+		version: reconciled.version,
+		declaredAccess: reconciled.declaredAccess,
+		capabilities: reconciled.capabilities,
+		allowedHosts: reconciled.allowedHosts
+	};
 }
 const POLL_INTERVAL_MS = 3e3;
 const POLL_TIMEOUT_MS = 12e4;
@@ -6422,7 +5953,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await Promise.resolve().then(() => bundle_exports);
+				const { bundleCommand } = await import("../bundle-7C_DpkEq.mjs").then((n) => n.n);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");
@@ -7086,7 +6617,7 @@ const seedCommand = defineCommand({
 		},
 		"no-content": {
 			type: "boolean",
-			description: "Skip sample content",
+			description: "Skip sample data (content entries, bylines, taxonomy terms)",
 			default: false
 		},
 		"on-conflict": {
@@ -7304,13 +6835,15 @@ var ForgewaySeoGatewayClient = class {
 	}
 	async request(path, body, init) {
 		const credentials = await this.refreshAccessToken(await this.loadCredentials());
+		const method = init?.method ?? "POST";
 		const response = await this.fetchImpl(`${credentials.platformApiUrl}${path}`, {
-			method: init?.method ?? "POST",
+			method,
 			headers: {
 				Authorization: `Bearer ${credentials.accessToken}`,
-				"Content-Type": "application/json"
+				"Content-Type": "application/json",
+				"Idempotency-Key": init?.idempotencyKey ?? randomUUID()
 			},
-			body: init?.method === "GET" ? void 0 : JSON.stringify(body ?? {})
+			body: method === "GET" ? void 0 : JSON.stringify(body ?? {})
 		});
 		const payload = await parseJsonResponse(response);
 		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(payload, `Forgeway SEO request failed with status ${response.status}.`), response.status, payload);
@@ -7375,6 +6908,11 @@ async function runSeoRequest(args, path, body) {
 	try {
 		output(await new ForgewaySeoGatewayClient().request(path, body), args);
 	} catch (error) {
+		if (await handleCliPaywall({
+			error,
+			resource: path,
+			context: { providerPath: path }
+		})) process.exit(2);
 		consola$1.error(error instanceof Error ? error.message : "Unknown error");
 		process.exit(1);
 	}
@@ -7517,6 +7055,11 @@ const firecrawlCommand = defineCommand({
 					try {
 						output(await new ForgewaySeoGatewayClient().request(`/api/firecrawl/crawl/${encodeURIComponent(crawlId)}`, void 0, { method: "GET" }), args);
 					} catch (error) {
+						if (await handleCliPaywall({
+							error,
+							resource: `/api/firecrawl/crawl/${crawlId}`,
+							context: { providerPath: `/api/firecrawl/crawl/${crawlId}` }
+						})) process.exit(2);
 						consola$1.error(error instanceof Error ? error.message : "Unknown error");
 						process.exit(1);
 					}
@@ -7972,6 +7515,7 @@ runMain(defineCommand({
 	},
 	subCommands: {
 		init: initCommand,
+		account: accountCommand,
 		types: typesCommand,
 		dev: devCommand,
 		deploy: deployCommand,