dineway 0.1.49 → 0.2.1

package/dist/cli/index.mjs

@@ -1,150 +1,74 @@
 #!/usr/bin/env node
-import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-DzIpHGND.mjs";
+import { i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-BgmttQmD.mjs";
 import { t as createDatabase } from "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { l as listTablesLike } from "../dialect-helpers-fk43GbDb.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "../config-CVssduLe.mjs";
 import { i as encodeBase64url } from "../base64-F8-DUraK.mjs";
-import "../types-CSgR9nQB.mjs";
-import { a as isMissingTableError } from "../loader--GOYux8M.mjs";
-import { n as slugify } from "../slugify-BqebcqBg.mjs";
-import { t as ContentRepository } from "../content-CBxYGWfL.mjs";
-import { t as MediaRepository } from "../media-CbKyYukG.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-B169Nm6B.mjs";
-import { t as OptionsRepository } from "../options-LsPjZlqD.mjs";
-import "../redirect-CEACczxo.mjs";
-import "../request-cache-ho99schz.mjs";
-import "../byline-registry-4v6tXMNX.mjs";
-import { t as BylineRepository } from "../byline-BVC1lV6G.mjs";
-import "../fts-manager-B5l_qwrA.mjs";
-import { n as SchemaRegistry } from "../registry-D7HACema.mjs";
-import "../settings-CUXOxzsT.mjs";
-import { n as VERSION } from "../version-C4gfn0PJ.mjs";
-import { i as pluginManifestSchema } from "../manifest-schema-qh2P7RDX.mjs";
-import "../ssrf-DiKqWd3N.mjs";
-import { t as validateSeed } from "../validate-DWmPO6oj.mjs";
-import { t as applySeed } from "../apply-D_RlTYtC.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CeGpBFV2.mjs";
-import { createHeaderAwareFetch, customHeadersInterceptor, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
-import { o as convertDataForRead } from "../transport-LSdZVXHF.mjs";
-import { DinewayClient } from "../client/index.mjs";
+import "../types-ChxYDRvx.mjs";
+import { o as isMissingTableError } from "../loader-aWkkc1_o.mjs";
+import "../object-cache-D51qOseS.mjs";
+import { n as slugify } from "../slugify-KSsVD_D3.mjs";
+import { t as ContentRepository } from "../content-DJcAYFhz.mjs";
+import { t as MediaRepository } from "../media-CVMOoywq.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-0k_vRVsD.mjs";
+import { t as OptionsRepository } from "../options-DQPTH5n0.mjs";
+import "../redirect-ubhEqQCQ.mjs";
+import "../request-cache-CBFjCwSt.mjs";
+import "../byline-registry-Ba54M74c.mjs";
+import "../field-defs-cache-DL-T2XVS.mjs";
+import { t as BylineRepository } from "../byline-7xR185Ly.mjs";
+import "../content-refresh-B4ZCmxgd.mjs";
+import "../fts-manager-ewTGohf4.mjs";
+import { n as SchemaRegistry } from "../registry-BYYyb2tF.mjs";
+import "../settings-BECcAIRH.mjs";
+import { n as VERSION } from "../version-C3iVRuaF.mjs";
+import { a as reconcileManifestAccess, i as pluginManifestSchema } from "../manifest-schema-uA6pRFXi.mjs";
+import { n as resolveAndValidateExternalUrl, t as SsrfError } from "../ssrf-FJqwQzj4.mjs";
+import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-ZV5rd8yV.mjs";
+import { t as validateSeed } from "../validate-D1HL-oLR.mjs";
+import { t as applySeed } from "../apply-DjTqq6Ae.mjs";
+import { a as readSavedDeployTarget, c as listForgewayCredentials, i as readForgewayDeployMetadata, l as readForgewayCredentials, n as SeoProviderEvidenceService, o as writeDeployTarget, r as readDeployPackageJson, s as writeForgewayDeployMetadata, t as ForgewaySeoGatewayClient, u as writeForgewayCredentials } from "../forgeway-seo-client-G5ddhVHd.mjs";
+import { n as output, t as configureOutputMode } from "../output-DhBe5_Pi.mjs";
+import { createHeaderAwareFetch, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
+import { t as convertDataForRead } from "../portable-text-BASHceim.mjs";
+import { a as getMarketplaceCredential, c as resolveCredentialKey, i as getCredentials, l as saveCredentials, n as connectionArgs, o as removeCredentials, r as createClientFromArgs, s as removeMarketplaceCredential, u as saveMarketplaceCredential } from "../client-factory-BDD9azPJ.mjs";
+import { a as resolveDinewayBaseUrl, n as ensureProjectGitignoreDinewayLocalState, o as resolveDinewayToken, r as ensureProjectGitignoreEntry, s as upsertProjectEnv, t as DEFAULT_DINEWAY_URL } from "../project-env-DKibmuP8.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { createHash, randomUUID } from "node:crypto";
+import { r as fileExists$11, t as bundleCommand } from "../bundle-CEcdUa1s.mjs";
+import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { sql } from "kysely";
-import { imageSize } from "image-size";
 import { createGzipDecoder, unpackTar } from "modern-tar";
-import { createReadStream, createWriteStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
+import { createReadStream, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import sax from "sax";
 import { pathToFileURL } from "node:url";
 import { defineCommand, runCommand, runMain } from "citty";
 import { createInterface } from "node:readline/promises";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
 import { ForgewayClient } from "@forgeway/sdk";
-import { access, chmod, copyFile, mkdir, readFile, readdir, rm, stat, symlink, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
+import { access, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
-import { pipeline } from "node:stream/promises";
-import { packTar } from "modern-tar/fs";
+import { parse } from "parse5";
 
-//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
-const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
-const TRAILING_SLASH_PATTERN$3 = /\/$/;
-function getDinewayUserConfigDir() {
-	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
-}
-function getForgewayAccountSecretPath() {
-	return join(getDinewayUserConfigDir(), "forgeway.json");
-}
-function normalizePlatformApiUrl$1(platformApiUrl) {
-	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$3, "");
-}
-function normalizeEmail$2(email) {
-	return email.trim().toLowerCase();
-}
-function accountKey(platformApiUrl, email) {
-	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
-}
-function normalizeLookup(lookup) {
-	if (typeof lookup === "string") return { cwd: lookup };
-	return lookup ?? {};
-}
-async function readAccountStore() {
-	try {
-		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return { version: 1 };
-	}
-}
-async function writeAccountStore(store) {
-	await mkdir(getDinewayUserConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewayAccountSecretPath();
-	await writeFile(file, JSON.stringify({
-		...store,
-		version: 1
-	}, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-function accountMatches(credentials, lookup) {
-	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
-	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
-	return true;
-}
-async function readForgewayCredentials(lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const store = await readAccountStore();
-	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
-	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
-	if (accounts.length === 1) return accounts[0] ?? null;
-	return null;
-}
-async function writeForgewayCredentials(credentials, lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
-	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
-	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
-	const key = accountKey(platformApiUrl, email);
-	const store = await readAccountStore();
-	store.accounts = {
-		...store.accounts,
-		[key]: {
-			...credentials,
-			platformApiUrl
-		}
-	};
-	store.lastAccountKey = key;
-	await writeAccountStore(store);
-}
-async function listForgewayCredentials(platformApiUrl) {
-	const lookup = platformApiUrl ? { platformApiUrl } : {};
-	const store = await readAccountStore();
-	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
-}
-
-//#endregion
 //#region src/cli/forgeway-account.ts
-const TRAILING_SLASH_PATTERN$2 = /\/$/;
-const SHADOW_EMAIL_PATTERN$2 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
+const TRAILING_SLASH_PATTERN$1 = /\/$/;
+const SHADOW_EMAIL_PATTERN$1 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
 const DEFAULT_FORGEWAY_API_BASE_URL = "https://api.dineway.ai";
 const DEFAULT_DINEWAY_WEB_URL = "https://dineway.ai";
 function normalizeForgewayApiUrl(value) {
-	return (value || DEFAULT_FORGEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+	return (value || DEFAULT_FORGEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN$1, "");
 }
 function normalizeDinewayWebUrl(value) {
-	return (value || DEFAULT_DINEWAY_WEB_URL).replace(TRAILING_SLASH_PATTERN$2, "");
+	return (value || DEFAULT_DINEWAY_WEB_URL).replace(TRAILING_SLASH_PATTERN$1, "");
 }
 function normalizeForgewayEmail(value) {
 	return value?.trim().toLowerCase() ?? "";
 }
 function isShadowForgewayEmail(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN$2.test(email));
+	return Boolean(email && SHADOW_EMAIL_PATTERN$1.test(email));
 }
 function createForgewayAccountClient(platformApiUrl, accessToken) {
 	return new ForgewayClient({
@@ -154,7 +78,7 @@ function createForgewayAccountClient(platformApiUrl, accessToken) {
 		auth: { detectOAuthCallback: false }
 	});
 }
-function normalizeForgewayUser$2(user) {
+function normalizeForgewayUser$1(user) {
 	if (!user?.id || !user.email) throw new Error("Forgeway session response did not include a user email.");
 	return {
 		id: user.id,
@@ -192,7 +116,7 @@ async function refreshForgewayAccountCredentials(credentials) {
 	if (!credentials.refreshToken) throw new Error("Stored Forgeway account is missing a refresh token. Run `dineway account login`.");
 	const { data, error } = await createForgewayAccountClient(credentials.platformApiUrl).auth.refreshSession({ refreshToken: credentials.refreshToken });
 	if (error || !data?.accessToken) throw new Error(error?.message || "Failed to refresh Forgeway account. Run `dineway account login`.");
-	const refreshedUser = normalizeForgewayUser$2(data.user);
+	const refreshedUser = normalizeForgewayUser$1(data.user);
 	if (normalizeForgewayEmail(refreshedUser.email) !== normalizeForgewayEmail(user.email)) throw new Error("Forgeway refresh returned credentials for a different account.");
 	const updated = {
 		...credentials,
@@ -224,7 +148,7 @@ async function completeForgewayAccountLogin(input) {
 	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
 	const { data, error } = await createForgewayAccountClient(platformApiUrl).auth.signInWithPasswordlessToken({ token: input.token });
 	if (error || !data?.accessToken || !data.refreshToken) throw new Error(error?.message || "Forgeway sign-in token is invalid or expired.");
-	const user = normalizeForgewayUser$2(data.user);
+	const user = normalizeForgewayUser$1(data.user);
 	if (input.email && normalizeForgewayEmail(user.email) !== normalizeForgewayEmail(input.email)) throw new Error("Forgeway sign-in returned credentials for a different email.");
 	const credentials = {
 		platformApiUrl,
@@ -251,71 +175,6 @@ async function getForgewayDinewayAccount(credentials) {
 	};
 }
 
-//#endregion
-//#region src/cli/output.ts
-/**
-* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
-*
-* Call this early in any command that uses `output()` with `--json`.
-* Safe to call multiple times — only applies the redirect once.
-*/
-function configureOutputMode(args) {
-	if (args.json || !process.stdout.isTTY) {
-		consola$1.options.stdout = process.stderr;
-		consola$1.options.stderr = process.stderr;
-	}
-}
-/**
-* Output data as JSON or pretty-printed.
-*
-* If stdout is not a TTY or --json is set, outputs JSON.
-* Otherwise, outputs a formatted representation.
-*/
-function output(data, args) {
-	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-	else prettyPrint(data);
-}
-function prettyPrint(data, indent = 0) {
-	if (data === null || data === void 0) {
-		consola$1.log("(empty)");
-		return;
-	}
-	if (Array.isArray(data)) {
-		if (data.length === 0) {
-			consola$1.log("(no items)");
-			return;
-		}
-		for (const item of data) {
-			prettyPrint(item, indent);
-			if (indent === 0) consola$1.log("---");
-		}
-		return;
-	}
-	if (typeof data === "object") {
-		const obj = Object(data);
-		if ("items" in obj && Array.isArray(obj.items)) {
-			prettyPrint(obj.items, indent);
-			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
-			return;
-		}
-		const prefix = "  ".repeat(indent);
-		for (const [key, value] of Object.entries(obj)) {
-			if (value === null || value === void 0) continue;
-			if (typeof value === "object" && !Array.isArray(value)) {
-				consola$1.log(`${prefix}${key}:`);
-				prettyPrint(value, indent + 1);
-			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
-			else {
-				const str = typeof value === "string" ? value : JSON.stringify(value);
-				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
-				consola$1.log(`${prefix}${key}: ${display}`);
-			}
-		}
-		return;
-	}
-	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
-}
-
 //#endregion
 //#region src/cli/commands/account.ts
 async function promptLine(question) {
@@ -504,320 +363,6 @@ const accountCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/credentials.ts
-/**
-* Credential storage for CLI auth tokens.
-*
-* Stores OAuth tokens in ~/.config/dineway/auth.json.
-* Remote URLs are keyed by origin, local dev by project path.
-*/
-function getConfigDir() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	if (xdg) return join(xdg, "dineway");
-	return join(homedir(), ".config", "dineway");
-}
-function getCredentialPath() {
-	return join(getConfigDir(), "auth.json");
-}
-/**
-* Resolve the credential key for a given URL.
-*
-* Remote URLs are keyed by origin (e.g. "https://my-site.pages.dev").
-* Local dev instances are keyed by project path (e.g. "path:/Users/matt/sites/blog").
-*/
-function resolveCredentialKey(baseUrl) {
-	try {
-		const url = new URL(baseUrl);
-		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-			const projectPath = findProjectRoot(process.cwd());
-			if (projectPath) return `path:${projectPath}`;
-			return url.origin;
-		}
-		return url.origin;
-	} catch {
-		return baseUrl;
-	}
-}
-/**
-* Walk up from cwd to find the project root (directory containing astro.config.*).
-*/
-function findProjectRoot(from) {
-	let dir = resolve(from);
-	const root = resolve("/");
-	while (dir !== root) {
-		for (const name of [
-			"astro.config.ts",
-			"astro.config.mts",
-			"astro.config.js",
-			"astro.config.mjs"
-		]) if (existsSync(join(dir, name))) return dir;
-		const parent = resolve(dir, "..");
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-function readStore() {
-	const path = getCredentialPath();
-	try {
-		if (existsSync(path)) {
-			const content = readFileSync(path, "utf-8");
-			return JSON.parse(content);
-		}
-	} catch {}
-	return {};
-}
-function writeStore(store) {
-	mkdirSync(getConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	writeFileSync(getCredentialPath(), JSON.stringify(store, null, "	"), {
-		encoding: "utf-8",
-		mode: 384
-	});
-}
-/**
-* Get stored credentials for a URL.
-*/
-function getCredentials(baseUrl) {
-	const key = resolveCredentialKey(baseUrl);
-	const cred = readStore()[key];
-	if (!cred || !("accessToken" in cred)) return null;
-	return cred;
-}
-/**
-* Save credentials for a URL.
-*/
-function saveCredentials(baseUrl, cred) {
-	const key = resolveCredentialKey(baseUrl);
-	const store = readStore();
-	store[key] = cred;
-	writeStore(store);
-}
-/**
-* Remove credentials for a URL.
-*/
-function removeCredentials(baseUrl) {
-	const key = resolveCredentialKey(baseUrl);
-	const store = readStore();
-	if (key in store) {
-		delete store[key];
-		writeStore(store);
-		return true;
-	}
-	return false;
-}
-function marketplaceKey(registryUrl) {
-	try {
-		return `marketplace:${new URL(registryUrl).origin}`;
-	} catch {
-		return `marketplace:${registryUrl}`;
-	}
-}
-/**
-* Get stored marketplace credential for a registry URL.
-*/
-function getMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const cred = readStore()[key];
-	if (!cred || !("token" in cred)) return null;
-	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
-	return cred;
-}
-/**
-* Save marketplace credential for a registry URL.
-*/
-function saveMarketplaceCredential(registryUrl, cred) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	store[key] = cred;
-	writeStore(store);
-}
-/**
-* Remove marketplace credential for a registry URL.
-*/
-function removeMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	if (key in store) {
-		delete store[key];
-		writeStore(store);
-		return true;
-	}
-	return false;
-}
-
-//#endregion
-//#region src/cli/project-env.ts
-const DEFAULT_DINEWAY_URL = "http://localhost:4321";
-const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const LINE_SPLIT_PATTERN = /\r?\n/;
-const DINEWAY_LOCAL_STATE_GITIGNORE_COMMENT = "# Dineway local state";
-const DINEWAY_LOCAL_STATE_GITIGNORE_ENTRIES = [
-	".dineway/deploy.json",
-	".dineway/forgeway.json",
-	".dineway/types.ts",
-	".dineway/schema.json",
-	".dineway/uploads/"
-];
-const NEWLINE_PATTERN = /\r?\n/g;
-function parseDotenvValue(value) {
-	const trimmed = value.trim();
-	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") || trimmed.startsWith("'") && trimmed.endsWith("'")) return trimmed.slice(1, -1);
-	return trimmed;
-}
-function parseDotenv(text) {
-	const env = {};
-	for (const line of text.split(LINE_SPLIT_PATTERN)) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const normalized = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equalsIndex = normalized.indexOf("=");
-		if (equalsIndex <= 0) continue;
-		const key = normalized.slice(0, equalsIndex).trim();
-		if (!ENV_KEY_PATTERN.test(key)) continue;
-		env[key] = parseDotenvValue(normalized.slice(equalsIndex + 1));
-	}
-	return env;
-}
-function readProjectEnv(cwd = process.cwd()) {
-	const envPath = join(cwd, ".env");
-	if (!existsSync(envPath)) return {};
-	return parseDotenv(readFileSync(envPath, "utf-8"));
-}
-function getProjectEnvValue(name, cwd = process.cwd()) {
-	return process.env[name] ?? readProjectEnv(cwd)[name];
-}
-function resolveDinewayBaseUrl(url, cwd = process.cwd()) {
-	if (url && url !== DEFAULT_DINEWAY_URL) return url;
-	const projectEnv = readProjectEnv(cwd);
-	return process.env["DINEWAY_URL"] ?? process.env["DINEWAY_SITE_URL"] ?? projectEnv["DINEWAY_SITE_URL"] ?? projectEnv["DINEWAY_URL"] ?? url ?? DEFAULT_DINEWAY_URL;
-}
-function resolveDinewayToken(token, cwd = process.cwd()) {
-	return token ?? getProjectEnvValue("DINEWAY_TOKEN", cwd);
-}
-function formatEnvValue(value) {
-	return value.replace(NEWLINE_PATTERN, "");
-}
-async function upsertProjectEnv(cwd, values) {
-	const envPath = join(cwd, ".env");
-	const existing = await readFile(envPath, "utf-8").catch(() => "");
-	const lines = existing ? existing.split(LINE_SPLIT_PATTERN) : [];
-	const seen = /* @__PURE__ */ new Set();
-	const nextLines = lines.map((line) => {
-		const trimmed = line.trim();
-		const normalized = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equalsIndex = normalized.indexOf("=");
-		if (equalsIndex <= 0) return line;
-		const key = normalized.slice(0, equalsIndex).trim();
-		const value = values[key];
-		if (!(key in values) || value === void 0) return line;
-		seen.add(key);
-		return `${key}=${formatEnvValue(value)}`;
-	});
-	for (const [key, value] of Object.entries(values)) {
-		if (value === void 0 || seen.has(key)) continue;
-		nextLines.push(`${key}=${formatEnvValue(value)}`);
-	}
-	await writeFile(envPath, `${nextLines.filter((line, index) => line || index < nextLines.length - 1).join("\n")}\n`, "utf-8");
-}
-async function ensureProjectGitignoreEntry(cwd, entry) {
-	const gitignorePath = join(cwd, ".gitignore");
-	const existing = await readFile(gitignorePath, "utf-8").catch(() => "");
-	if (existing.split(LINE_SPLIT_PATTERN).map((line) => line.trim()).includes(entry)) return;
-	await writeFile(gitignorePath, `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${entry}\n`, "utf-8");
-}
-async function ensureProjectGitignoreDinewayLocalState(cwd) {
-	const gitignorePath = join(cwd, ".gitignore");
-	const existing = await readFile(gitignorePath, "utf-8").catch(() => "");
-	const lines = new Set(existing.split(LINE_SPLIT_PATTERN).map((line) => line.trim()));
-	const missingEntries = DINEWAY_LOCAL_STATE_GITIGNORE_ENTRIES.filter((entry) => !lines.has(entry));
-	if (missingEntries.length === 0) return;
-	const block = [DINEWAY_LOCAL_STATE_GITIGNORE_COMMENT, ...missingEntries].join("\n");
-	await writeFile(gitignorePath, `${existing}${existing.trim() ? existing.endsWith("\n") ? "\n" : "\n\n" : ""}${block}\n`, "utf-8");
-}
-
-//#endregion
-//#region src/cli/client-factory.ts
-var client_factory_exports = /* @__PURE__ */ __exportAll({
-	connectionArgs: () => connectionArgs,
-	createClientFromArgs: () => createClientFromArgs
-});
-/**
-* Shared connection args for all CLI commands that talk to a Dineway instance.
-* Spread into each command's `args` definition.
-*/
-const connectionArgs = {
-	url: {
-		type: "string",
-		alias: "u",
-		description: "Dineway instance URL",
-		default: DEFAULT_DINEWAY_URL
-	},
-	token: {
-		type: "string",
-		alias: "t",
-		description: "Auth token"
-	},
-	header: {
-		type: "string",
-		alias: "H",
-		description: "Custom header \"Name: Value\" (repeatable, or use DINEWAY_HEADERS env)"
-	},
-	json: {
-		type: "boolean",
-		description: "Output as JSON"
-	}
-};
-/**
-* Create a DinewayClient from CLI args, env vars, and stored credentials.
-*
-* Auth resolution order:
-* 1. --token flag
-* 2. DINEWAY_TOKEN env var
-* 3. Stored credentials (~/.config/dineway/auth.json)
-* 4. Dev bypass (if URL is localhost)
-*
-* Custom headers are merged from (in priority order):
-* 1. Stored credentials (persisted during `dineway login --header`)
-* 2. DINEWAY_HEADERS env var
-* 3. --header CLI flags
-*/
-function createClientFromArgs(args) {
-	const baseUrl = resolveDinewayBaseUrl(args.url);
-	let token = resolveDinewayToken(args.token);
-	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
-	const cred = !token ? getCredentials(baseUrl) : null;
-	const customHeaders = {
-		...cred?.customHeaders,
-		...resolveCustomHeaders()
-	};
-	const extraInterceptors = [];
-	if (Object.keys(customHeaders).length > 0) extraInterceptors.push(customHeadersInterceptor(customHeaders));
-	if (!token && cred) if (new Date(cred.expiresAt) > /* @__PURE__ */ new Date()) token = cred.accessToken;
-	else return new DinewayClient({
-		baseUrl,
-		token: cred.accessToken,
-		refreshToken: cred.refreshToken,
-		onTokenRefresh: (newAccessToken, expiresIn) => {
-			saveCredentials(baseUrl, {
-				...cred,
-				accessToken: newAccessToken,
-				expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-			});
-		},
-		interceptors: extraInterceptors
-	});
-	return new DinewayClient({
-		baseUrl,
-		token,
-		devBypass: !token && isLocal,
-		interceptors: extraInterceptors
-	});
-}
-
 //#endregion
 //#region src/cli/commands/auth.ts
 /**
@@ -1064,7 +609,7 @@ const createCommand$1 = defineCommand({
 		},
 		draft: {
 			type: "boolean",
-			description: "Keep as draft instead of auto-publishing"
+			description: "Explicitly create as Draft (the only supported creation mode)"
 		},
 		...connectionArgs
 	},
@@ -1079,7 +624,6 @@ const createCommand$1 = defineCommand({
 				locale: args.locale,
 				translationOf: args["translation-of"]
 			});
-			if (!args.draft) await client.publish(args.collection, item.id);
 			output(await client.get(args.collection, item.id), args);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -1122,7 +666,7 @@ const updateCommand = defineCommand({
 		},
 		draft: {
 			type: "boolean",
-			description: "Keep as draft instead of auto-publishing"
+			description: "Explicitly update the Draft (the only supported update mode)"
 		},
 		...connectionArgs
 	},
@@ -1136,7 +680,6 @@ const updateCommand = defineCommand({
 				_rev: args.rev,
 				locale: args.locale
 			});
-			if (!args.draft && updated.draftRevisionId) await client.publish(args.collection, updated.id);
 			output(await client.get(args.collection, updated.id), args);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -1190,12 +733,25 @@ const publishCommand$1 = defineCommand({
 			description: "Content item ID or slug",
 			required: true
 		},
+		"review-request": {
+			type: "string",
+			description: "Approved editorial Review Request ID for the exact Draft",
+			required: true
+		},
+		"release-authorization": {
+			type: "string",
+			description: "Approved release authorization ID for this token action",
+			required: true
+		},
 		...connectionArgs
 	},
 	async run({ args }) {
 		configureOutputMode(args);
 		try {
-			await createClientFromArgs(args).publish(args.collection, args.id);
+			await createClientFromArgs(args).publish(args.collection, args.id, {
+				reviewRequestId: args["review-request"],
+				releaseAuthorizationId: args["release-authorization"]
+			});
 			output({ success: true }, args);
 			consola$1.success(`Published ${args.collection}/${args.id}`);
 		} catch (error) {
@@ -1255,12 +811,26 @@ const scheduleCommand = defineCommand({
 			description: "ISO 8601 datetime to publish at",
 			required: true
 		},
+		"review-request": {
+			type: "string",
+			description: "Approved editorial Review Request ID for the exact Draft",
+			required: true
+		},
+		"release-authorization": {
+			type: "string",
+			description: "Approved release authorization ID for this token action",
+			required: true
+		},
 		...connectionArgs
 	},
 	async run({ args }) {
 		configureOutputMode(args);
 		try {
-			await createClientFromArgs(args).schedule(args.collection, args.id, { at: args.at });
+			await createClientFromArgs(args).schedule(args.collection, args.id, {
+				at: args.at,
+				reviewRequestId: args["review-request"],
+				releaseAuthorizationId: args["release-authorization"]
+			});
 			output({ success: true }, args);
 			consola$1.success(`Scheduled ${args.collection}/${args.id} for ${args.at}`);
 		} catch (error) {
@@ -1349,7 +919,7 @@ const contentCommand = defineCommand({
 //#endregion
 //#region src/cli/paywall.ts
 const PAYWALL_MESSAGE_PATTERN = /\b(quota|credit|credits|upgrade|plan|billing|subscription|slot)\b/i;
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null;
 }
 function stringField(record, key) {
@@ -1357,9 +927,9 @@ function stringField(record, key) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function getNestedError(value) {
-	if (!isRecord$1(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const nested = value.error;
-	return isRecord$1(nested) ? nested : value;
+	return isRecord$2(nested) ? nested : value;
 }
 function isHostedSitesResource(resource) {
 	const normalized = resource.toLowerCase();
@@ -1367,7 +937,11 @@ function isHostedSitesResource(resource) {
 }
 function isCreditResource(resource) {
 	const normalized = resource.toLowerCase();
-	return normalized.includes("credit") || normalized.includes("firecrawl") || normalized.includes("dataforseo") || normalized.startsWith("/api/");
+	return normalized.includes("credit") || normalized.includes("firecrawl") || normalized.includes("dataforseo");
+}
+function isQuotaResource(resource) {
+	const normalized = resource.toLowerCase();
+	return normalized.includes("quota") || normalized.includes("place_search") || normalized.includes("place_get") || normalized.includes("/api/places");
 }
 function getCliPaywallRefreshStatus(paywall, account) {
 	if (isHostedSitesResource(paywall.resource)) {
@@ -1391,6 +965,10 @@ function getCliPaywallRefreshStatus(paywall, account) {
 			message: "There are still no provider credits. Complete checkout or top up credits in Dineway Web."
 		};
 	}
+	if (isQuotaResource(paywall.resource)) return {
+		blocked: false,
+		message: "Account quota status refreshed. Re-run the blocked command when ready."
+	};
 	return {
 		blocked: false,
 		message: "Account status refreshed. Re-run the blocked command when ready."
@@ -1533,7 +1111,7 @@ function collectUploadIncludeFiles(directory = dinewayUploadsJoin(dinewayForgewa
 \t});
 }
 `;
-async function fileExists$11(path) {
+async function fileExists$10(path) {
 	try {
 		await access(path);
 		return true;
@@ -1694,7 +1272,7 @@ function configurePackageJson(pkg, adapter) {
 }
 async function configureAstroConfig(cwd, adapter, dryRun) {
 	const configPath = join(cwd, "astro.config.mjs");
-	if (!await fileExists$11(configPath)) return [];
+	if (!await fileExists$10(configPath)) return [];
 	const current = await readFile(configPath, "utf-8");
 	const next = configureAstroConfigSource(current, adapter);
 	if (next === current) return [{
@@ -1713,7 +1291,7 @@ async function configureAstroConfig(cwd, adapter, dryRun) {
 }
 async function configurePackage(cwd, adapter, dryRun) {
 	const packagePath = join(cwd, "package.json");
-	if (!await fileExists$11(packagePath)) return [];
+	if (!await fileExists$10(packagePath)) return [];
 	const current = await readFile(packagePath, "utf-8");
 	const nextPkg = configurePackageJson(JSON.parse(current), adapter);
 	const next = JSON.stringify(nextPkg, null, "	") + "\n";
@@ -1732,7 +1310,7 @@ async function configurePackage(cwd, adapter, dryRun) {
 	}];
 }
 async function configureAstroDeployAdapter(cwd, adapter, dryRun = false) {
-	if (!await fileExists$11(join(cwd, "astro.config.mjs"))) return [];
+	if (!await fileExists$10(join(cwd, "astro.config.mjs"))) return [];
 	return [...await configureAstroConfig(cwd, adapter, dryRun), ...await configurePackage(cwd, adapter, dryRun)];
 }
 
@@ -1822,7 +1400,7 @@ volumes:
 
 //#endregion
 //#region src/cli/commands/deploy/targets/docker.ts
-async function fileExists$10(path) {
+async function fileExists$9(path) {
 	try {
 		await access(path);
 		return true;
@@ -1832,7 +1410,7 @@ async function fileExists$10(path) {
 }
 async function writeGeneratedFile$2(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$10(path)) return {
+	if (await fileExists$9(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -1919,10 +1497,10 @@ const FLY_HOST_RE = /\b[a-z0-9][a-z0-9-]*\.fly\.dev\b/;
 const INVALID_FLY_APP_CHARS_RE = /[^a-z0-9-]+/g;
 const REPEATED_HYPHENS_RE$2 = /-+/g;
 const EDGE_HYPHENS_RE$2 = /^-|-$/g;
-const LINE_SPLIT_RE = /\r?\n/;
+const LINE_SPLIT_RE$1 = /\r?\n/;
 const DEFAULT_REGION$1 = "iad";
 const FLY_VOLUME_NAME = "dineway_data";
-async function fileExists$9(path) {
+async function fileExists$8(path) {
 	try {
 		await access(path);
 		return true;
@@ -1932,7 +1510,7 @@ async function fileExists$9(path) {
 }
 async function writeGeneratedFile$1(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$9(path)) return {
+	if (await fileExists$8(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -2011,7 +1589,7 @@ primary_region = "${region}"
 function parseFlyUrl(stdout) {
 	const direct = stdout.match(FLY_URL_RE);
 	if (direct) return direct[0];
-	for (const line of stdout.split(LINE_SPLIT_RE).filter(Boolean)) try {
+	for (const line of stdout.split(LINE_SPLIT_RE$1).filter(Boolean)) try {
 		const url = findFlyUrl(JSON.parse(line));
 		if (url) return url;
 	} catch {
@@ -2121,69 +1699,9 @@ const flyTarget = {
 	}
 };
 
-//#endregion
-//#region src/cli/commands/deploy/utils/config.ts
-const DINEWAY_DIR_NAME = ".dineway";
-const DEPLOY_STATE_FILE_NAME = "deploy.json";
-function deployStatePath(cwd) {
-	return join(cwd, DINEWAY_DIR_NAME, DEPLOY_STATE_FILE_NAME);
-}
-function emptyDeployState() {
-	return { version: 1 };
-}
-async function readDeployPackageJson(cwd) {
-	const content = await readFile(join(cwd, "package.json"), "utf-8");
-	return JSON.parse(content);
-}
-async function readDeployState(cwd) {
-	try {
-		const content = await readFile(deployStatePath(cwd), "utf-8");
-		return {
-			...emptyDeployState(),
-			...JSON.parse(content),
-			version: 1
-		};
-	} catch (error) {
-		if (error && typeof error === "object" && error.code === "ENOENT") return emptyDeployState();
-		throw error;
-	}
-}
-async function writeDeployState(cwd, state) {
-	await mkdir(join(cwd, DINEWAY_DIR_NAME), { recursive: true });
-	await writeFile(deployStatePath(cwd), JSON.stringify({
-		...state,
-		version: 1
-	}, null, "	") + "\n", "utf-8");
-}
-async function readSavedDeployTarget(cwd) {
-	return (await readDeployState(cwd)).target;
-}
-async function writeDeployTarget(cwd, target) {
-	await writeDeployState(cwd, {
-		...await readDeployState(cwd),
-		target
-	});
-}
-async function readForgewayDeployMetadata(cwd) {
-	return (await readDeployState(cwd)).targets?.forgeway ?? {};
-}
-async function writeForgewayDeployMetadata(cwd, metadata) {
-	const state = await readDeployState(cwd);
-	await writeDeployState(cwd, {
-		...state,
-		targets: {
-			...state.targets,
-			forgeway: {
-				...state.targets?.forgeway,
-				...metadata
-			}
-		}
-	});
-}
-
 //#endregion
 //#region src/cli/commands/deploy/targets/forgeway.ts
-const DEFAULT_DINEWAY_API_BASE_URL$1 = "https://api.dineway.ai";
+const DEFAULT_DINEWAY_API_BASE_URL = "https://api.dineway.ai";
 const DATABASE_ENV_VAR_NAMES = ["DINEWAY_DATABASE_URL", "DINEWAY_DATABASE_AUTH_TOKEN"];
 const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 3e5;
@@ -2198,12 +1716,12 @@ const NON_COMPARE_PATTERN = /[^\p{Letter}\p{Number}]+/gu;
 const LOCATION_PARTS_PATTERN = /[,;|/]+|\s+-\s+/u;
 const JWT_PATTERN = /[A-Za-z0-9_-]{32,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g;
 const TOKEN_ASSIGNMENT_PATTERN = /(DINEWAY_DATABASE_AUTH_TOKEN|DATABASE_AUTH_TOKEN|AUTH_TOKEN)=\S+/gi;
-const TRAILING_SLASH_PATTERN$1 = /\/$/;
+const TRAILING_SLASH_PATTERN = /\/$/;
 const BACKSLASH_PATTERN = /\\/g;
 const DINEWAY_PACKAGE_NAME = "dineway";
 const SEMVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+].*)?$/;
 const LOCAL_PACKAGE_SPEC_PATTERN = /^(?:workspace|file|link|portal):/;
-const SHADOW_EMAIL_PATTERN$1 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
+const SHADOW_EMAIL_PATTERN = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
 const FOOD_TYPES = new Set([
 	"restaurant",
 	"cafe",
@@ -2251,7 +1769,7 @@ var ForgewayApiError = class extends Error {
 		this.name = "ForgewayApiError";
 	}
 };
-function normalizeForgewayUser$1(user) {
+function normalizeForgewayUser(user) {
 	return {
 		id: user.id,
 		name: user.profile?.name ?? user.name ?? user.email,
@@ -2263,7 +1781,7 @@ function normalizeForgewayUser$1(user) {
 function getFetch(deps) {
 	return deps.fetch ?? fetch;
 }
-async function fileExists$8(path) {
+async function fileExists$7(path) {
 	try {
 		await access(path);
 		return true;
@@ -2272,7 +1790,7 @@ async function fileExists$8(path) {
 	}
 }
 function normalizePlatformApiUrl(value) {
-	return (value || DEFAULT_DINEWAY_API_BASE_URL$1).replace(TRAILING_SLASH_PATTERN$1, "");
+	return (value || DEFAULT_DINEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN, "");
 }
 function resolvePlatformApiUrl(savedPlatformApiUrl) {
 	return normalizePlatformApiUrl(getEnv("DINEWAY_API_BASE_URL") ?? (typeof savedPlatformApiUrl === "string" ? savedPlatformApiUrl : void 0));
@@ -2288,7 +1806,7 @@ function formatDuration(ms) {
 	if (ms < 1e3) return `${ms}ms`;
 	return `${Math.round(ms / 100) / 10}s`;
 }
-function formatBytes$1(bytes) {
+function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	const units = [
 		"KB",
@@ -2335,11 +1853,11 @@ async function parseErrorResponse(response) {
 	}
 	return `Forgeway request failed: ${response.status}`;
 }
-function normalizeEmail$1(email) {
+function normalizeEmail(email) {
 	return email.trim().toLowerCase();
 }
-function isShadowEmail$1(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN$1.test(email));
+function isShadowEmail(email) {
+	return Boolean(email && SHADOW_EMAIL_PATTERN.test(email));
 }
 async function refreshFormalAccessToken(context, deps) {
 	if (!context.refreshToken) throw new Error("Forgeway formal account refresh token is missing. Run dineway deploy again.");
@@ -2351,7 +1869,7 @@ async function refreshFormalAccessToken(context, deps) {
 	if (!response.ok) throw new Error("Failed to refresh Forgeway formal account credentials. Run dineway deploy again.");
 	const payload = await response.json();
 	if (!payload.accessToken) throw new Error("Forgeway refresh response was missing accessToken.");
-	const user = assertVerifiedFormalAccountUser(payload.user ? normalizeForgewayUser$1(payload.user) : context.user, context.user?.email);
+	const user = assertVerifiedFormalAccountUser(payload.user ? normalizeForgewayUser(payload.user) : context.user, context.user?.email);
 	const updated = {
 		platformApiUrl: context.platformApiUrl,
 		accessToken: payload.accessToken,
@@ -2398,7 +1916,7 @@ function getDependencySpec(pkg, name) {
 		if (typeof value === "string" && value.trim()) return value.trim();
 	}
 }
-async function readProjectPackage(cwd) {
+async function readProjectPackage$1(cwd) {
 	try {
 		return await readDeployPackageJson(cwd);
 	} catch {
@@ -2412,7 +1930,7 @@ function isDinewayDependencySpecCompatible(dependencySpec, cliVersion) {
 }
 async function warnProjectDinewayRuntimeMismatch(cwd, cliVersion = VERSION) {
 	if (!SEMVER_VERSION_PATTERN.test(cliVersion)) return;
-	const pkg = await readProjectPackage(cwd);
+	const pkg = await readProjectPackage$1(cwd);
 	if (!pkg) return;
 	const dependencySpec = getDependencySpec(pkg, DINEWAY_PACKAGE_NAME);
 	if (!dependencySpec) return;
@@ -2426,20 +1944,20 @@ function savedPublisherEmail(saved) {
 	return typeof saved.publisherEmail === "string" && saved.publisherEmail.trim() ? saved.publisherEmail : void 0;
 }
 function validatePublisherEmail(rawEmail) {
-	const email = normalizeEmail$1(rawEmail);
-	if (!email || isShadowEmail$1(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
+	const email = normalizeEmail(rawEmail);
+	if (!email || isShadowEmail(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
 	return email;
 }
 function isStoredFormalCredentialForEmail(stored, email) {
 	if (!stored?.accessToken || !stored.user) return false;
-	if (email && normalizeEmail$1(stored.user.email) !== email) return false;
+	if (email && normalizeEmail(stored.user.email) !== email) return false;
 	if (stored.user.emailVerified !== true) return false;
-	if (isShadowEmail$1(stored.user.email)) return false;
+	if (isShadowEmail(stored.user.email)) return false;
 	return true;
 }
 function assertVerifiedFormalAccountUser(user, expectedEmail) {
-	if (!user || user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
-	if (expectedEmail && normalizeEmail$1(user.email) !== normalizeEmail$1(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
+	if (!user || user.emailVerified !== true || isShadowEmail(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
+	if (expectedEmail && normalizeEmail(user.email) !== normalizeEmail(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
 	return user;
 }
 async function readCachedPublisherCredentials(cwd, platformApiUrl, email, deps) {
@@ -2472,14 +1990,14 @@ async function resolveCachedPublisherAccount(cwd, options, saved, platformApiUrl
 		platformApiUrl
 	});
 	if (isStoredFormalCredentialForEmail(singleCredentials)) return {
-		email: normalizeEmail$1(singleCredentials.user.email),
+		email: normalizeEmail(singleCredentials.user.email),
 		credentials: singleCredentials
 	};
 	const accounts = (await (deps.listCredentials ?? listForgewayCredentials)(platformApiUrl)).filter((credentials) => isStoredFormalCredentialForEmail(credentials));
 	if (accounts.length === 1) {
 		const credentials = accounts[0];
 		return {
-			email: normalizeEmail$1(credentials.user.email),
+			email: normalizeEmail(credentials.user.email),
 			credentials
 		};
 	}
@@ -2541,7 +2059,7 @@ async function resolveProjectContext(cwd, options, deps) {
 	if (formal.email) throw new Error(`No verified Dineway account credentials were found for ${formal.email}. Run: dineway account login --email ${formal.email}`);
 	throw new Error("No verified Dineway account credentials were found. Run: dineway account login");
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function scalarText(value) {
@@ -2554,7 +2072,7 @@ function uniqueStrings(values) {
 function displayText(value) {
 	if (typeof value === "string" || typeof value === "number") return String(value);
 	if (Array.isArray(value)) return value.map(displayText).filter(Boolean).join(" ");
-	if (isRecord(value)) return displayText(value.text) || displayText(value.name) || displayText(value.displayName) || displayText(value.longText) || displayText(value.shortText) || displayText(value.long_name) || displayText(value.short_name) || displayText(value.value);
+	if (isRecord$1(value)) return displayText(value.text) || displayText(value.name) || displayText(value.displayName) || displayText(value.longText) || displayText(value.shortText) || displayText(value.long_name) || displayText(value.short_name) || displayText(value.value);
 	return "";
 }
 function normalizeCompare(value) {
@@ -2572,7 +2090,7 @@ function candidateNameTexts(candidate) {
 	]);
 }
 function candidateAddressTexts(candidate) {
-	const addressComponents = Array.isArray(candidate.addressComponents) ? candidate.addressComponents.flatMap((component) => isRecord(component) ? [
+	const addressComponents = Array.isArray(candidate.addressComponents) ? candidate.addressComponents.flatMap((component) => isRecord$1(component) ? [
 		displayText(component.longText),
 		displayText(component.shortText),
 		displayText(component.long_name),
@@ -2714,11 +2232,11 @@ function selectPlaceCandidate(candidates, context) {
 	} : null;
 }
 function extractPlaceCandidates(payload) {
-	const root = isRecord(payload) ? payload : {};
-	const nestedData = isRecord(root.data) ? root.data : {};
+	const root = isRecord$1(payload) ? payload : {};
+	const nestedData = isRecord$1(root.data) ? root.data : {};
 	const places = root.places ?? root.results ?? nestedData.places ?? nestedData.results;
 	if (!Array.isArray(places)) throw new Error("Dineway place search response did not include places/results.");
-	return places.filter(isRecord);
+	return places.filter(isRecord$1);
 }
 async function resolvePlaceIdWithFormalSearch(options) {
 	const candidates = extractPlaceCandidates(await ossFetch(options.context, "/api/places/search", options.deps, {
@@ -2735,7 +2253,7 @@ async function resolvePlaceIdWithFormalSearch(options) {
 	return finalPlaceId;
 }
 async function ossFetch(context, path, deps, options = {}) {
-	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN$1, "")}${path}`, {
+	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN, "")}${path}`, {
 		...options,
 		headers: {
 			"Content-Type": "application/json",
@@ -2761,18 +2279,18 @@ function deriveForgewaySiteSlug(restaurantName, city) {
 async function resolveSeedPath$1(cwd, explicitSeedPath) {
 	if (explicitSeedPath) {
 		const resolved = resolve(cwd, explicitSeedPath);
-		if (!await fileExists$8(resolved)) throw new Error(`Seed file not found: ${explicitSeedPath}`);
+		if (!await fileExists$7(resolved)) throw new Error(`Seed file not found: ${explicitSeedPath}`);
 		return resolved;
 	}
 	const convention = resolve(cwd, ".dineway", "seed.json");
-	if (await fileExists$8(convention)) return convention;
+	if (await fileExists$7(convention)) return convention;
 	const pkg = await readDeployPackageJson(cwd).catch(() => null);
 	if (typeof pkg?.dineway?.seed === "string") {
 		const configured = resolve(cwd, pkg.dineway.seed);
-		if (await fileExists$8(configured)) return configured;
+		if (await fileExists$7(configured)) return configured;
 	}
 	const legacyConvention = resolve(cwd, "seed", "seed.json");
-	if (await fileExists$8(legacyConvention)) return legacyConvention;
+	if (await fileExists$7(legacyConvention)) return legacyConvention;
 	return null;
 }
 async function readSeedTitle(seedPath) {
@@ -3140,7 +2658,7 @@ async function deploySiteProject(options) {
 	consola.start("Scanning deploy files");
 	const localFiles = await (options.deps.collectDeploymentFiles ?? collectDeploymentFiles)(options.sourceDir);
 	if (localFiles.length === 0) throw new Error("No deployable files found in the source directory.");
-	consola.success(`Scanned ${localFiles.length} files (${formatBytes$1(deploymentFileSize(localFiles))}) in ${formatDuration(Date.now() - scanStart)}`);
+	consola.success(`Scanned ${localFiles.length} files (${formatBytes(deploymentFileSize(localFiles))}) in ${formatDuration(Date.now() - scanStart)}`);
 	const createStart = Date.now();
 	consola.start("Creating Forgeway deployment");
 	const createResult = await ossFetch(options.context, `/api/deployments/sites/${encodeURIComponent(options.siteId)}/deploy`, options.deps, {
@@ -3159,7 +2677,7 @@ async function deploySiteProject(options) {
 	const pendingFiles = createResult.files.filter((file) => !file.uploadedAt);
 	const pendingSize = pendingFiles.reduce((total, file) => total + file.size, 0);
 	if (pendingFiles.length === 0) consola.success("No file uploads needed");
-	else consola.start(`Uploading ${pendingFiles.length} changed files (${formatBytes$1(pendingSize)})`);
+	else consola.start(`Uploading ${pendingFiles.length} changed files (${formatBytes(pendingSize)})`);
 	let uploadedCount = 0;
 	await runWithConcurrency(pendingFiles, DIRECT_UPLOAD_CONCURRENCY, async (manifestFile) => {
 		const localFile = localFileByPath.get(manifestFile.path);
@@ -3250,7 +2768,7 @@ async function deployForgeway(cwd, options, deps = {}) {
 		deps,
 		verbose
 	});
-	if (context.user?.email) await writeForgewayDeployMetadata(cwd, { publisherEmail: normalizeEmail$1(context.user.email) });
+	if (context.user?.email) await writeForgewayDeployMetadata(cwd, { publisherEmail: normalizeEmail(context.user.email) });
 	const url = deployment.liveUrl ?? `https://${site.domain}`;
 	await (deps.writeProjectEnv ?? persistForgewayCliEnv)(cwd, {
 		siteUrl: url,
@@ -3303,7 +2821,7 @@ pnpm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 `;
-async function fileExists$7(path) {
+async function fileExists$6(path) {
 	try {
 		await access(path);
 		return true;
@@ -3313,7 +2831,7 @@ async function fileExists$7(path) {
 }
 async function writeGeneratedFile(cwd, relativePath, content, dryRun) {
 	const path = join(cwd, relativePath);
-	if (await fileExists$7(path)) return {
+	if (await fileExists$6(path)) return {
 		path: relativePath,
 		action: "exists"
 	};
@@ -3446,7 +2964,7 @@ const gcpTarget = {
 			env: options.env,
 			stdio: "inherit"
 		});
-		if (result.code !== 0 && !await fileExists$7(join(cwd, "Dockerfile"))) {
+		if (result.code !== 0 && !await fileExists$6(join(cwd, "Dockerfile"))) {
 			await writeFile(join(cwd, "Dockerfile"), generateDockerfile(), "utf-8");
 			result = await runCommand$1("gcloud", deployArgs, {
 				cwd,
@@ -3465,7 +2983,7 @@ const gcpTarget = {
 
 //#endregion
 //#region src/cli/commands/deploy/utils/build.ts
-async function fileExists$6(path) {
+async function fileExists$5(path) {
 	try {
 		await access(path);
 		return true;
@@ -3474,19 +2992,19 @@ async function fileExists$6(path) {
 	}
 }
 async function detectBuildCommand(cwd) {
-	if (await fileExists$6(join(cwd, "pnpm-lock.yaml"))) return {
+	if (await fileExists$5(join(cwd, "pnpm-lock.yaml"))) return {
 		packageManager: "pnpm",
 		command: "pnpm",
 		args: ["build"],
 		display: "pnpm build"
 	};
-	if (await fileExists$6(join(cwd, "yarn.lock"))) return {
+	if (await fileExists$5(join(cwd, "yarn.lock"))) return {
 		packageManager: "yarn",
 		command: "yarn",
 		args: ["build"],
 		display: "yarn build"
 	};
-	if (await fileExists$6(join(cwd, "bun.lock")) || await fileExists$6(join(cwd, "bun.lockb"))) return {
+	if (await fileExists$5(join(cwd, "bun.lock")) || await fileExists$5(join(cwd, "bun.lockb"))) return {
 		packageManager: "bun",
 		command: "bun",
 		args: ["run", "build"],
@@ -3517,7 +3035,7 @@ const INVALID_RAILWAY_PROJECT_CHARS_RE = /[^a-z0-9-]+/g;
 const REPEATED_HYPHENS_RE = /-+/g;
 const EDGE_HYPHENS_RE = /^-|-$/g;
 const RAILWAY_BUILDER = "RAILPACK";
-async function fileExists$5(path) {
+async function fileExists$4(path) {
 	try {
 		await access(path);
 		return true;
@@ -3611,7 +3129,7 @@ const railwayTarget = {
 	async generateConfig(cwd, options) {
 		const generated = await configureAstroDeployAdapter(cwd, "node", options.dryRun);
 		const railwayPath = join(cwd, "railway.json");
-		if (await fileExists$5(railwayPath)) return [...generated, {
+		if (await fileExists$4(railwayPath)) return [...generated, {
 			path: "railway.json",
 			action: "exists"
 		}];
@@ -3968,7 +3486,7 @@ async function readPackageJson$2(cwd) {
 		return null;
 	}
 }
-async function fileExists$4(path) {
+async function fileExists$3(path) {
 	try {
 		await access(path);
 		return true;
@@ -4015,7 +3533,7 @@ const devCommand = defineCommand({
 		}
 		const database = resolveCliDatabaseTarget(cwd, args.database);
 		consola.info(`Database: ${database.display}`);
-		if (database.localPath && !await fileExists$4(database.localPath)) consola.start("Database not found, initializing...");
+		if (database.localPath && !await fileExists$3(database.localPath)) consola.start("Database not found, initializing...");
 		const db = createDatabase({ url: database.url });
 		try {
 			consola.start("Checking database migrations...");
@@ -4032,7 +3550,7 @@ const devCommand = defineCommand({
 			const remoteUrl = pkg.dineway?.url || process.env.DINEWAY_URL;
 			if (!remoteUrl) consola.warn("No remote URL configured. Set DINEWAY_URL or dineway.url in package.json");
 			else try {
-				const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);
+				const { createClientFromArgs } = await import("../client-factory-BDD9azPJ.mjs").then((n) => n.t);
 				const client = createClientFromArgs({ url: remoteUrl });
 				const schema = await client.schemaExport();
 				const types = await client.schemaTypes();
@@ -4054,8 +3572,8 @@ const devCommand = defineCommand({
 			"--port",
 			args.port
 		];
-		const pnpmLockExists = await fileExists$4(resolve(cwd, "pnpm-lock.yaml"));
-		const yarnLockExists = await fileExists$4(resolve(cwd, "yarn.lock"));
+		const pnpmLockExists = await fileExists$3(resolve(cwd, "pnpm-lock.yaml"));
+		const yarnLockExists = await fileExists$3(resolve(cwd, "yarn.lock"));
 		let cmd;
 		let cmdArgs;
 		if (pnpmLockExists) {
@@ -4099,7 +3617,7 @@ const devCommand = defineCommand({
 *
 * Diagnose database health: connection, migrations, schema integrity.
 */
-async function fileExists$3(path) {
+async function fileExists$2(path) {
 	try {
 		await access(path);
 		return true;
@@ -4112,7 +3630,7 @@ function printResult(result) {
 }
 async function checkDatabase(database) {
 	const results = [];
-	if (database.localPath && !await fileExists$3(database.localPath)) {
+	if (database.localPath && !await fileExists$2(database.localPath)) {
 		results.push({
 			name: "database",
 			status: "fail",
@@ -4166,7 +3684,7 @@ async function checkDatabase(database) {
 			});
 		} catch {}
 		try {
-			const count = (await sql`SELECT COUNT(id) as count FROM _dineway_users`.execute(db)).rows[0]?.count ?? 0;
+			const count = (await sql`SELECT COUNT(id) as count FROM users`.execute(db)).rows[0]?.count ?? 0;
 			results.push({
 				name: "users",
 				status: count > 0 ? "pass" : "warn",
@@ -4314,7 +3832,7 @@ async function exportSeed(db, withContent) {
 	const { bylines, idToSeedId: bylineIdToSeedId } = await exportBylines(db);
 	if (bylines.length > 0) seed.bylines = bylines;
 	if (withContent !== void 0) {
-		const collections = withContent === "" || withContent === "true" ? null : withContent.split(",").map((s) => s.trim()).filter(Boolean);
+		const collections = withContent === "" || withContent === "true" || withContent === "all" ? null : withContent.split(",").map((s) => s.trim()).filter(Boolean);
 		seed.content = await exportContent(db, seed.collections || [], collections, bylineIdToSeedId, i18nEnabled);
 	}
 	return seed;
@@ -4444,8 +3962,8 @@ async function exportTaxonomies(db, i18nEnabled) {
 	for (const def of defs) {
 		const defSeedId = i18nEnabled && def.locale ? `tax:${def.name}:${def.locale}` : `tax:${def.name}`;
 		const terms = await termRepo.findByName(def.name, { locale: def.locale });
-		const idToSlug = /* @__PURE__ */ new Map();
-		for (const term of terms) idToSlug.set(term.id, term.slug);
+		const groupToSlug = /* @__PURE__ */ new Map();
+		for (const term of terms) groupToSlug.set(term.translationGroup ?? term.id, term.slug);
 		const termGroupToSeedId = /* @__PURE__ */ new Map();
 		const seedTerms = [];
 		for (const term of terms) {
@@ -4456,7 +3974,7 @@ async function exportTaxonomies(db, i18nEnabled) {
 				label: term.label,
 				description: typeof term.data?.description === "string" ? term.data.description : void 0
 			};
-			if (term.parentId) seedTerm.parent = idToSlug.get(term.parentId);
+			if (term.parentId) seedTerm.parent = groupToSlug.get(term.parentId);
 			if (i18nEnabled && term.locale) {
 				seedTerm.locale = term.locale;
 				if (term.translationGroup) {
@@ -4745,7 +4263,7 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 *
 * Initialize database from template config in package.json
 */
-async function fileExists$2(path) {
+async function fileExists$1(path) {
 	try {
 		await access(path);
 		return true;
@@ -4845,7 +4363,7 @@ const initCommand = defineCommand({
 		if (alreadyInitialized && args.force) consola.warn("Re-initializing (--force)...");
 		if (config?.schema) {
 			const schemaPath = resolve(cwd, config.schema);
-			if (await fileExists$2(schemaPath)) {
+			if (await fileExists$1(schemaPath)) {
 				consola.start(`Running schema: ${config.schema}`);
 				try {
 					await runSqlFile(db, schemaPath);
@@ -5389,606 +4907,19 @@ const menuCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/commands/bundle-utils.ts
+//#region src/cli/commands/plugin-init.ts
 /**
-* Bundle utility functions
+* dineway plugin init
 *
-* Shared logic extracted from the bundle command so it can be tested
-* without the CLI harness and tsdown dependency.
-*/
-const MAX_BUNDLE_SIZE = 256 * 1024;
-const MAX_FILE_SIZE = 128 * 1024;
-const MAX_FILE_COUNT = 20;
-const MAX_SCREENSHOTS = 5;
-const MAX_SCREENSHOT_WIDTH = 1920;
-const MAX_SCREENSHOT_HEIGHT = 1080;
-const ICON_SIZE = 256;
-function toFileImportSpecifier(filePath) {
-	return pathToFileURL(filePath).href;
-}
-/** Matches Node.js built-in imports in bundled output. */
-const NODE_BUILTIN_IMPORT_RE = /(?:import|export|require)\s*(?:\(|[^(]*?\bfrom\s+)["'](?:node:)?([a-z_]+)(?:\/[^"']*)?\s*["']\)?/g;
-const LEADING_DOT_SLASH_RE = /^\.\//;
-const DIST_PREFIX_RE = /^dist\//;
-const MJS_EXT_RE = /\.m?js$/;
-const BUILD_OUTPUT_EXT_RE = /\.(?:mjs|js|cjs)$/;
-const TS_TO_TSX_RE = /\.ts$/;
-/** Node.js built-in modules that shouldn't appear in sandbox code */
-const NODE_BUILTINS = new Set([
-	"assert",
-	"buffer",
-	"child_process",
-	"cluster",
-	"crypto",
-	"dgram",
-	"dns",
-	"domain",
-	"events",
-	"fs",
-	"http",
-	"http2",
-	"https",
-	"inspector",
-	"module",
-	"net",
-	"os",
-	"path",
-	"perf_hooks",
-	"process",
-	"punycode",
-	"querystring",
-	"readline",
-	"repl",
-	"stream",
-	"string_decoder",
-	"sys",
-	"timers",
-	"tls",
-	"trace_events",
-	"tty",
-	"url",
-	"util",
-	"v8",
-	"vm",
-	"wasi",
-	"worker_threads",
-	"zlib"
-]);
-async function fileExists$1(path) {
-	try {
-		await access(path);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Read image dimensions from a buffer.
-* Returns [width, height] or null if the format is unrecognized.
-*/
-function readImageDimensions(buf) {
-	try {
-		const result = imageSize(buf);
-		if (result.width != null && result.height != null) return [result.width, result.height];
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Extract manifest metadata from a ResolvedPlugin.
-* Strips functions (hooks, route handlers) and keeps only serializable metadata.
-*/
-function extractManifest(plugin) {
-	const hooks = [];
-	for (const [name, resolved] of Object.entries(plugin.hooks)) {
-		if (!resolved) continue;
-		if (resolved.exclusive || resolved.priority !== 100 || resolved.timeout !== 5e3) {
-			const entry = { name };
-			if (resolved.exclusive) entry.exclusive = true;
-			if (resolved.priority !== 100) entry.priority = resolved.priority;
-			if (resolved.timeout !== 5e3) entry.timeout = resolved.timeout;
-			hooks.push(entry);
-		} else hooks.push(name);
-	}
-	return {
-		id: plugin.id,
-		version: plugin.version,
-		capabilities: plugin.capabilities,
-		allowedHosts: plugin.allowedHosts,
-		storage: plugin.storage,
-		hooks,
-		routes: Object.keys(plugin.routes),
-		admin: {
-			settingsSchema: plugin.admin.settingsSchema,
-			pages: plugin.admin.pages,
-			widgets: plugin.admin.widgets
-		}
-	};
-}
-/**
-* Scan bundled code for Node.js built-in imports.
-* Matches require("node:xxx"), require("xxx"), import("node:xxx") — the patterns
-* that appear in bundled ESM/CJS output (not source-level named imports).
-* Returns deduplicated array of built-in module names found.
-*/
-function findNodeBuiltinImports(code) {
-	const found = [];
-	NODE_BUILTIN_IMPORT_RE.lastIndex = 0;
-	let match;
-	while ((match = NODE_BUILTIN_IMPORT_RE.exec(code)) !== null) {
-		const mod = match[1];
-		if (NODE_BUILTINS.has(mod)) found.push(mod);
-	}
-	return [...new Set(found)];
-}
-/**
-* Find a build output file by base name, checking common extensions.
-* tsdown may output .mjs, .js, or .cjs depending on format and config.
-*/
-async function findBuildOutput(dir, baseName) {
-	const normalizedBaseName = baseName.replace(BUILD_OUTPUT_EXT_RE, "");
-	for (const ext of [
-		".mjs",
-		".js",
-		".cjs"
-	]) {
-		const candidate = join(dir, `${normalizedBaseName}${ext}`);
-		if (await fileExists$1(candidate)) return candidate;
-	}
-}
-/**
-* Resolve a dist/built path back to its source .ts/.tsx equivalent.
-* E.g., "./dist/index.mjs" → "src/index.ts"
-*/
-async function resolveSourceEntry(pluginDir, distPath) {
-	const cleaned = distPath.replace(LEADING_DOT_SLASH_RE, "");
-	const srcPath = cleaned.replace(DIST_PREFIX_RE, "src/").replace(MJS_EXT_RE, ".ts");
-	const srcFull = resolve(pluginDir, srcPath);
-	if (await fileExists$1(srcFull)) return srcFull;
-	const tsxFull = resolve(pluginDir, srcPath.replace(TS_TO_TSX_RE, ".tsx"));
-	if (await fileExists$1(tsxFull)) return tsxFull;
-	const direct = resolve(pluginDir, cleaned);
-	if (await fileExists$1(direct)) return direct;
-}
-const TS_SOURCE_EXPORT_RE = /\.(?:ts|tsx|mts|cts|jsx)$/;
-/**
-* Find package.json exports that point to source files instead of built output.
-* Returns an array of `{ exportPath, resolvedPath }` for each offending export.
-*/
-function findSourceExports(exports) {
-	const issues = [];
-	for (const [exportPath, exportValue] of Object.entries(exports)) {
-		const resolved = typeof exportValue === "string" ? exportValue : exportValue && typeof exportValue === "object" && "import" in exportValue ? exportValue.import : null;
-		if (resolved && TS_SOURCE_EXPORT_RE.test(resolved)) issues.push({
-			exportPath,
-			resolvedPath: resolved
-		});
-	}
-	return issues;
-}
-/**
-* Recursively walk a staging directory and return all regular files with
-* tarball-relative names.
-*/
-async function collectBundleEntries(dir) {
-	const entries = [];
-	await walkBundle(dir, "", entries);
-	return entries;
-}
-async function walkBundle(dir, prefix, into) {
-	const items = await readdir(dir, { withFileTypes: true });
-	for (const item of items) {
-		const fullPath = join(dir, item.name);
-		const relPath = prefix ? `${prefix}/${item.name}` : item.name;
-		if (item.isFile()) {
-			const s = await stat(fullPath);
-			into.push({
-				name: relPath,
-				bytes: s.size
-			});
-		} else if (item.isDirectory()) await walkBundle(fullPath, relPath, into);
-	}
-}
-function totalBundleBytes(entries) {
-	let total = 0;
-	for (const entry of entries) total += entry.bytes;
-	return total;
-}
-/**
-* Enforce sandboxed plugin caps against decompressed bundle files:
-* total size, per-file size, and file count.
-*/
-function validateBundleSize(entries) {
-	const violations = [];
-	const total = totalBundleBytes(entries);
-	if (total > MAX_BUNDLE_SIZE) violations.push(`Bundle size ${formatBytes(total)} exceeds maximum of ${formatBytes(MAX_BUNDLE_SIZE)}.`);
-	if (entries.length > MAX_FILE_COUNT) violations.push(`Bundle contains ${entries.length} files, exceeds maximum of ${MAX_FILE_COUNT}.`);
-	const oversized = entries.filter((entry) => entry.bytes > MAX_FILE_SIZE).toSorted((a, b) => a.name.localeCompare(b.name));
-	for (const entry of oversized) violations.push(`File ${entry.name} is ${formatBytes(entry.bytes)}, exceeds per-file maximum of ${formatBytes(MAX_FILE_SIZE)}.`);
-	return violations;
-}
-function formatBytes(bytes) {
-	if (bytes < 1024) return `${bytes} B`;
-	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-	return `${(bytes / 1024 / 1024).toFixed(2)} MB`;
-}
-/**
-* Create a gzipped tarball from a directory.
-*/
-async function createTarball(sourceDir, outputPath) {
-	const { createGzip } = await import("node:zlib");
-	await pipeline(packTar(sourceDir), createGzip({ level: 9 }), createWriteStream(outputPath));
-}
-
-//#endregion
-//#region src/cli/commands/bundle.ts
-/**
-* dineway plugin bundle
-*
-* Produces a publishable plugin tarball from a plugin source directory.
-*
-* Steps:
-* 1. Resolve plugin entrypoint (finds definePlugin() export)
-* 2. Bundle backend code with tsdown → backend.js (single ES module, tree-shaken)
-* 3. Bundle admin code if present → admin.js
-* 4. Extract manifest from definePlugin() → manifest.json
-* 5. Collect assets (README.md, icon.png, screenshots/)
-* 6. Validate bundle (manifest schema, size limits, no Node.js builtins)
-* 7. Create tarball ({id}-{version}.tar.gz)
-*/
-var bundle_exports = /* @__PURE__ */ __exportAll({ bundleCommand: () => bundleCommand });
-const TS_EXT_RE = /\.tsx?$/;
-const SLASH_RE = /\//g;
-const LEADING_AT_RE = /^@/;
-const DINEWAY_SCOPE_RE = /^@dineway-ai\//;
-const bundleCommand = defineCommand({
-	meta: {
-		name: "bundle",
-		description: "Bundle a plugin for marketplace distribution"
-	},
-	args: {
-		dir: {
-			type: "string",
-			description: "Plugin directory (default: current directory)",
-			default: process.cwd()
-		},
-		outDir: {
-			type: "string",
-			alias: "o",
-			description: "Output directory for the tarball (default: ./dist)",
-			default: "dist"
-		},
-		validateOnly: {
-			type: "boolean",
-			description: "Run validation only, skip tarball creation",
-			default: false
-		}
-	},
-	async run({ args }) {
-		const pluginDir = resolve(args.dir);
-		const outDir = resolve(pluginDir, args.outDir);
-		const validateOnly = args.validateOnly;
-		consola.start(validateOnly ? "Validating plugin..." : "Bundling plugin...");
-		const pkgPath = join(pluginDir, "package.json");
-		if (!await fileExists$1(pkgPath)) {
-			consola.error("No package.json found in", pluginDir);
-			process.exit(1);
-		}
-		const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
-		let backendEntry;
-		let adminEntry;
-		if (pkg.exports) {
-			const sandboxExport = pkg.exports["./sandbox"];
-			if (typeof sandboxExport === "string") backendEntry = await resolveSourceEntry(pluginDir, sandboxExport);
-			else if (sandboxExport && typeof sandboxExport === "object" && "import" in sandboxExport) backendEntry = await resolveSourceEntry(pluginDir, sandboxExport.import);
-			const adminExport = pkg.exports["./admin"];
-			if (typeof adminExport === "string") adminEntry = await resolveSourceEntry(pluginDir, adminExport);
-			else if (adminExport && typeof adminExport === "object" && "import" in adminExport) adminEntry = await resolveSourceEntry(pluginDir, adminExport.import);
-		}
-		if (!backendEntry) {
-			const defaultSandbox = join(pluginDir, "src/sandbox-entry.ts");
-			if (await fileExists$1(defaultSandbox)) backendEntry = defaultSandbox;
-		}
-		let mainEntry;
-		if (pkg.exports?.["."] !== void 0) {
-			const mainExport = pkg.exports["."];
-			if (typeof mainExport === "string") mainEntry = await resolveSourceEntry(pluginDir, mainExport);
-			else if (mainExport && typeof mainExport === "object" && "import" in mainExport) mainEntry = await resolveSourceEntry(pluginDir, mainExport.import);
-		}
-		if (!mainEntry && pkg.main) mainEntry = await resolveSourceEntry(pluginDir, pkg.main);
-		if (!mainEntry) {
-			const defaultMain = join(pluginDir, "src/index.ts");
-			if (await fileExists$1(defaultMain)) mainEntry = defaultMain;
-		}
-		if (!mainEntry) {
-			consola.error("Cannot find plugin entrypoint. Expected src/index.ts or main/exports in package.json");
-			process.exit(1);
-		}
-		consola.info(`Main entry: ${mainEntry}`);
-		if (backendEntry) consola.info(`Backend entry: ${backendEntry}`);
-		if (adminEntry) consola.info(`Admin entry: ${adminEntry}`);
-		consola.start("Extracting plugin manifest...");
-		const { build } = await import("tsdown");
-		const tmpDir = join(pluginDir, ".dineway-bundle-tmp");
-		try {
-			await mkdir(tmpDir, { recursive: true });
-			await copyFile(pkgPath, join(tmpDir, "package.json"));
-			const mainOutDir = join(tmpDir, "main");
-			await build({
-				config: false,
-				entry: [mainEntry],
-				format: "esm",
-				outDir: mainOutDir,
-				dts: false,
-				platform: "node",
-				external: ["dineway", DINEWAY_SCOPE_RE]
-			});
-			const pluginNodeModules = join(pluginDir, "node_modules");
-			const tmpNodeModules = join(mainOutDir, "node_modules");
-			if (await fileExists$1(pluginNodeModules)) await symlink(pluginNodeModules, tmpNodeModules, "junction");
-			const mainOutputPath = await findBuildOutput(mainOutDir, basename(mainEntry).replace(TS_EXT_RE, ""));
-			if (!mainOutputPath) {
-				consola.error("Failed to build main entry — no output found in", mainOutDir);
-				process.exit(1);
-			}
-			const pluginModule = await import(toFileImportSpecifier(mainOutputPath));
-			let resolvedPlugin;
-			if (typeof pluginModule.createPlugin === "function") resolvedPlugin = pluginModule.createPlugin();
-			else if (typeof pluginModule.default === "function") resolvedPlugin = pluginModule.default();
-			else if (typeof pluginModule.default === "object" && pluginModule.default !== null) {
-				const defaultExport = pluginModule.default;
-				if ("id" in defaultExport && "version" in defaultExport) resolvedPlugin = defaultExport;
-			}
-			if (!resolvedPlugin) for (const [key, value] of Object.entries(pluginModule)) {
-				if (key === "default" || typeof value !== "function") continue;
-				try {
-					const result = value();
-					if (result && typeof result === "object" && "id" in result && "version" in result) {
-						resolvedPlugin = {
-							id: result.id,
-							version: result.version,
-							capabilities: result.capabilities ?? [],
-							allowedHosts: result.allowedHosts ?? [],
-							storage: result.storage ?? {},
-							hooks: {},
-							routes: {},
-							admin: {
-								pages: result.adminPages,
-								widgets: result.adminWidgets
-							}
-						};
-						if (backendEntry) {
-							const backendProbeDir = join(tmpDir, "backend-probe");
-							const probeShimDir = join(tmpDir, "probe-shims");
-							await mkdir(probeShimDir, { recursive: true });
-							await writeFile(join(probeShimDir, "dineway.mjs"), "export const definePlugin = (d) => d;\n");
-							await build({
-								config: false,
-								entry: [backendEntry],
-								format: "esm",
-								outDir: backendProbeDir,
-								dts: false,
-								platform: "neutral",
-								external: [],
-								alias: { dineway: join(probeShimDir, "dineway.mjs") },
-								treeshake: true
-							});
-							const backendProbePath = await findBuildOutput(backendProbeDir, basename(backendEntry).replace(TS_EXT_RE, ""));
-							if (backendProbePath) {
-								const standardDef = (await import(toFileImportSpecifier(backendProbePath))).default ?? {};
-								const hooks = standardDef.hooks;
-								const routes = standardDef.routes;
-								if (hooks) for (const hookName of Object.keys(hooks)) {
-									const hookEntry = hooks[hookName];
-									const isConfig = typeof hookEntry === "object" && hookEntry !== null && "handler" in hookEntry;
-									const config = isConfig ? hookEntry : {};
-									resolvedPlugin.hooks[hookName] = {
-										handler: isConfig ? hookEntry.handler : hookEntry,
-										priority: config.priority ?? 100,
-										timeout: config.timeout ?? 5e3,
-										dependencies: config.dependencies ?? [],
-										errorPolicy: config.errorPolicy ?? "abort",
-										exclusive: config.exclusive ?? false,
-										pluginId: result.id
-									};
-								}
-								if (routes) for (const [name, route] of Object.entries(routes)) {
-									const routeObj = route;
-									resolvedPlugin.routes[name] = {
-										handler: routeObj.handler,
-										public: routeObj.public
-									};
-								}
-							}
-						}
-						break;
-					}
-				} catch {}
-			}
-			if (!resolvedPlugin?.id || !resolvedPlugin?.version) {
-				consola.error("Could not extract plugin definition. Expected one of:\n  - createPlugin() export (native format)\n  - Descriptor factory function returning { id, version, ... } (standard format)");
-				process.exit(1);
-			}
-			const manifest = extractManifest(resolvedPlugin);
-			if (resolvedPlugin.admin?.entry) {
-				consola.error("Plugin declares adminEntry — React admin components require native/trusted mode. Use Block Kit for sandboxed admin pages, or remove adminEntry.");
-				process.exit(1);
-			}
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) {
-				consola.error("Plugin declares portableTextBlocks — these require native/trusted mode and cannot be bundled for the marketplace.");
-				process.exit(1);
-			}
-			consola.success(`Plugin: ${manifest.id}@${manifest.version}`);
-			consola.info(`  Capabilities: ${manifest.capabilities.length > 0 ? manifest.capabilities.join(", ") : "(none)"}`);
-			consola.info(`  Hooks: ${manifest.hooks.length > 0 ? manifest.hooks.map((h) => typeof h === "string" ? h : h.name).join(", ") : "(none)"}`);
-			consola.info(`  Routes: ${manifest.routes.length > 0 ? manifest.routes.map((r) => typeof r === "string" ? r : r.name).join(", ") : "(none)"}`);
-			const bundleDir = join(tmpDir, "bundle");
-			await mkdir(bundleDir, { recursive: true });
-			if (backendEntry) {
-				consola.start("Bundling backend...");
-				const shimDir = join(tmpDir, "shims");
-				await mkdir(shimDir, { recursive: true });
-				await writeFile(join(shimDir, "dineway.mjs"), "export const definePlugin = (d) => d;\n");
-				await build({
-					config: false,
-					entry: [backendEntry],
-					format: "esm",
-					outDir: join(tmpDir, "backend"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					alias: { dineway: join(shimDir, "dineway.mjs") },
-					minify: true,
-					treeshake: true
-				});
-				const backendBaseName = basename(backendEntry).replace(TS_EXT_RE, "");
-				const backendOutputPath = await findBuildOutput(join(tmpDir, "backend"), backendBaseName);
-				if (backendOutputPath) {
-					await copyFile(backendOutputPath, join(bundleDir, "backend.js"));
-					consola.success("Built backend.js");
-				} else {
-					consola.error("Backend build produced no output");
-					process.exit(1);
-				}
-			} else {
-				consola.warn("No sandbox entry found — bundle will have no backend.js");
-				consola.warn("  Add a \"sandbox-entry.ts\" in src/ or a \"./sandbox\" export in package.json");
-			}
-			if (adminEntry) {
-				consola.start("Bundling admin...");
-				await build({
-					config: false,
-					entry: [adminEntry],
-					format: "esm",
-					outDir: join(tmpDir, "admin"),
-					dts: false,
-					platform: "neutral",
-					external: [],
-					minify: true,
-					treeshake: true
-				});
-				const adminBaseName = basename(adminEntry).replace(TS_EXT_RE, "");
-				const adminOutputPath = await findBuildOutput(join(tmpDir, "admin"), adminBaseName);
-				if (adminOutputPath) {
-					await copyFile(adminOutputPath, join(bundleDir, "admin.js"));
-					consola.success("Built admin.js");
-				}
-			}
-			await writeFile(join(bundleDir, "manifest.json"), JSON.stringify(manifest, null, 2));
-			consola.start("Collecting assets...");
-			const readmePath = join(pluginDir, "README.md");
-			if (await fileExists$1(readmePath)) {
-				await copyFile(readmePath, join(bundleDir, "README.md"));
-				consola.success("Included README.md");
-			}
-			const iconPath = join(pluginDir, "icon.png");
-			if (await fileExists$1(iconPath)) {
-				const dims = readImageDimensions(await readFile(iconPath));
-				if (!dims) consola.warn("icon.png is not a valid PNG — skipping");
-				else if (dims[0] !== ICON_SIZE || dims[1] !== ICON_SIZE) {
-					consola.warn(`icon.png is ${dims[0]}x${dims[1]}, expected ${ICON_SIZE}x${ICON_SIZE} — including anyway`);
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-				} else {
-					await copyFile(iconPath, join(bundleDir, "icon.png"));
-					consola.success("Included icon.png");
-				}
-			}
-			const screenshotsDir = join(pluginDir, "screenshots");
-			if (await fileExists$1(screenshotsDir)) {
-				const screenshotFiles = (await readdir(screenshotsDir)).filter((f) => {
-					const ext = extname(f).toLowerCase();
-					return ext === ".png" || ext === ".jpg" || ext === ".jpeg";
-				}).toSorted().slice(0, MAX_SCREENSHOTS);
-				if (screenshotFiles.length > 0) {
-					await mkdir(join(bundleDir, "screenshots"), { recursive: true });
-					for (const file of screenshotFiles) {
-						const filePath = join(screenshotsDir, file);
-						const dims = readImageDimensions(await readFile(filePath));
-						if (!dims) {
-							consola.warn(`screenshots/${file} — cannot read dimensions, skipping`);
-							continue;
-						}
-						if (dims[0] > MAX_SCREENSHOT_WIDTH || dims[1] > MAX_SCREENSHOT_HEIGHT) consola.warn(`screenshots/${file} is ${dims[0]}x${dims[1]}, max ${MAX_SCREENSHOT_WIDTH}x${MAX_SCREENSHOT_HEIGHT} — including anyway`);
-						await copyFile(filePath, join(bundleDir, "screenshots", file));
-					}
-					consola.success(`Included ${screenshotFiles.length} screenshot(s)`);
-				}
-			}
-			consola.start("Validating bundle...");
-			let hasErrors = false;
-			if (pkg.exports) for (const issue of findSourceExports(pkg.exports)) {
-				consola.error(`Export "${issue.exportPath}" points to source (${issue.resolvedPath}). Package exports must point to built files (e.g. dist/*.mjs). Add a build step and update the exports map.`);
-				hasErrors = true;
-			}
-			const backendPath = join(bundleDir, "backend.js");
-			if (await fileExists$1(backendPath)) {
-				const builtins = findNodeBuiltinImports(await readFile(backendPath, "utf-8"));
-				if (builtins.length > 0) {
-					consola.error(`backend.js imports Node.js built-in modules: ${builtins.join(", ")}`);
-					consola.error("Sandboxed plugins cannot use Node.js APIs");
-					hasErrors = true;
-				}
-			}
-			if (manifest.capabilities.includes("network:request:unrestricted")) consola.warn("Plugin declares unrestricted network access (network:request:unrestricted) — it can make requests to any host");
-			else if (manifest.capabilities.includes("network:request") && manifest.allowedHosts.length === 0) consola.warn("Plugin declares network:request capability but no allowedHosts — all fetch requests will be blocked");
-			if (resolvedPlugin.admin?.portableTextBlocks && resolvedPlugin.admin.portableTextBlocks.length > 0) consola.warn("Plugin declares portableTextBlocks — these require trusted mode and will be ignored in sandboxed plugins");
-			if (resolvedPlugin.admin?.entry) consola.warn("Plugin declares admin.entry — custom React components require trusted mode. Use Block Kit for sandboxed admin pages");
-			if (resolvedPlugin.hooks["page:fragments"]) consola.warn("Plugin declares page:fragments hook — this is trusted-only and will not work in sandboxed mode");
-			const hasAdminPages = (manifest.admin?.pages?.length ?? 0) > 0;
-			const hasAdminWidgets = (manifest.admin?.widgets?.length ?? 0) > 0;
-			if (hasAdminPages || hasAdminWidgets) {
-				if (!manifest.routes.map((r) => typeof r === "string" ? r : r.name).includes("admin")) {
-					consola.error(`Plugin declares ${hasAdminPages ? "adminPages" : ""}${hasAdminPages && hasAdminWidgets ? " and " : ""}${hasAdminWidgets ? "adminWidgets" : ""} but the sandbox entry has no "admin" route. Add an admin route handler to serve Block Kit pages.`);
-					hasErrors = true;
-				}
-			}
-			const bundleEntries = await collectBundleEntries(bundleDir);
-			const sizeViolations = validateBundleSize(bundleEntries);
-			if (sizeViolations.length > 0) {
-				for (const violation of sizeViolations) consola.error(violation);
-				hasErrors = true;
-			} else consola.info(`Bundle size: ${formatBytes(totalBundleBytes(bundleEntries))} across ${bundleEntries.length} file${bundleEntries.length === 1 ? "" : "s"}`);
-			if (hasErrors) {
-				consola.error("Bundle validation failed");
-				process.exit(1);
-			}
-			consola.success("Validation passed");
-			if (validateOnly) return;
-			await mkdir(outDir, { recursive: true });
-			const tarballName = `${manifest.id.replace(SLASH_RE, "-").replace(LEADING_AT_RE, "")}-${manifest.version}.tar.gz`;
-			const tarballPath = join(outDir, tarballName);
-			consola.start("Creating tarball...");
-			await createTarball(bundleDir, tarballPath);
-			const tarballSizeKB = ((await stat(tarballPath)).size / 1024).toFixed(1);
-			const tarballBuf = await readFile(tarballPath);
-			const checksum = createHash("sha256").update(tarballBuf).digest("hex");
-			consola.success(`Created ${tarballName} (${tarballSizeKB}KB)`);
-			consola.info(`  SHA-256: ${checksum}`);
-			consola.info(`  Path: ${tarballPath}`);
-		} finally {
-			if (tmpDir.endsWith(".dineway-bundle-tmp")) await rm(tmpDir, {
-				recursive: true,
-				force: true
-			});
-		}
-	}
-});
-
-//#endregion
-//#region src/cli/commands/plugin-init.ts
-/**
-* dineway plugin init
-*
-* Scaffold a new Dineway plugin. Generates the sandboxed-format boilerplate:
-*   src/index.ts         -- descriptor factory
-*   src/sandbox-entry.ts -- definePlugin({ hooks, routes })
-*   package.json
-*   tsconfig.json
-*
-* Use --format=native (or --native) to generate native-format boilerplate
-* instead (createPlugin + React admin). When neither is passed and stdout
-* is a TTY, the user is prompted to choose.
+* Scaffold a new Dineway plugin. Generates the sandboxed-format boilerplate:
+*   src/index.ts         -- descriptor factory
+*   src/sandbox-entry.ts -- definePlugin({ hooks, routes })
+*   package.json
+*   tsconfig.json
+*
+* Use --format=native (or --native) to generate native-format boilerplate
+* instead (createPlugin + React admin). When neither is passed and stdout
+* is a TTY, the user is prompted to choose.
 */
 const SLUG_RE = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const SCOPE_RE = /^@[^/]+\//;
@@ -6050,7 +4981,7 @@ const pluginInitCommand = defineCommand({
 			process.exit(1);
 		}
 		const srcDir = join(targetDir, "src");
-		if (await fileExists$1(join(targetDir, "package.json"))) {
+		if (await fileExists$11(join(targetDir, "package.json"))) {
 			consola.error(`package.json already exists in ${targetDir}`);
 			process.exit(1);
 		}
@@ -6416,6 +5347,7 @@ async function pollGitHubDeviceFlow(tokenEndpoint, clientId, deviceCode, interva
 const manifestSummarySchema = pluginManifestSchema.pick({
 	id: true,
 	version: true,
+	declaredAccess: true,
 	capabilities: true,
 	allowedHosts: true
 });
@@ -6433,7 +5365,20 @@ async function readManifestFromTarball(tarballPath) {
 	const parsed = JSON.parse(content);
 	const result = manifestSummarySchema.safeParse(parsed);
 	if (!result.success) throw new Error(`Invalid manifest.json: ${result.error.message}`);
-	return result.data;
+	const reconciled = reconcileManifestAccess({
+		...result.data,
+		storage: {},
+		hooks: [],
+		routes: [],
+		admin: {}
+	});
+	return {
+		id: reconciled.id,
+		version: reconciled.version,
+		declaredAccess: reconciled.declaredAccess,
+		capabilities: reconciled.capabilities,
+		allowedHosts: reconciled.allowedHosts
+	};
 }
 const POLL_INTERVAL_MS = 3e3;
 const POLL_TIMEOUT_MS = 12e4;
@@ -6518,7 +5463,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await Promise.resolve().then(() => bundle_exports);
+				const { bundleCommand } = await import("../bundle-CEcdUa1s.mjs").then((n) => n.n);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");
@@ -7182,7 +6127,7 @@ const seedCommand = defineCommand({
 		},
 		"no-content": {
 			type: "boolean",
-			description: "Skip sample content",
+			description: "Skip sample data (content entries, bylines, taxonomy terms)",
 			default: false
 		},
 		"on-conflict": {
@@ -7288,141 +6233,714 @@ const seedCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/forgeway-seo-client.ts
-const DEFAULT_DINEWAY_API_BASE_URL = "https://api.dineway.ai";
-const TRAILING_SLASH_PATTERN = /\/$/;
-const SHADOW_EMAIL_PATTERN = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
-var ForgewaySeoApiError = class extends Error {
-	constructor(message, status, body) {
-		super(message);
-		this.status = status;
-		this.body = body;
-		this.name = "ForgewaySeoApiError";
+//#region src/seo/local-crawl.ts
+const CONTRACT_VERSION = 1;
+const USER_AGENT = "DinewayContentCrawler/1.0";
+const DEFAULT_PAGE_LIMIT = 100;
+const MAX_PAGE_LIMIT = 500;
+const DEFAULT_MAX_DEPTH = 3;
+const MAX_DEPTH = 10;
+const DEFAULT_CONCURRENCY = 4;
+const MAX_CONCURRENCY = 10;
+const DEFAULT_TIMEOUT_MS = 1e4;
+const MAX_TIMEOUT_MS = 6e4;
+const DEFAULT_MAX_BYTES = 1e6;
+const MAX_RESOURCE_BYTES = 1e7;
+const MAX_SITEMAPS = 20;
+const MAX_REDIRECTS = 5;
+const MAX_TEXT_EXCERPT = 2e4;
+const LINE_SPLIT_RE = /\r?\n/;
+const COMMENT_RE = /#.*$/;
+const WHITESPACE_RE = /\s+/g;
+const WORD_RE = /[\p{L}\p{N}]+(?:['’-][\p{L}\p{N}]+)*/gu;
+const REGEXP_SPECIAL_RE = /[.*+?^${}()|[\]\\]/g;
+async function crawlLocalSite(options) {
+	const normalized = normalizeOptions(options);
+	if (!normalized.allowPrivateNetwork) await resolveAndValidateExternalUrl(normalized.startUrl.href, { resolver: normalized.dnsResolver });
+	const origin = normalized.startUrl.origin;
+	const skipped = /* @__PURE__ */ new Map();
+	const robots = await loadRobots(normalized);
+	const sitemapResult = normalized.sitemap === "skip" ? {
+		sources: [],
+		urls: []
+	} : await loadSitemaps(normalized, robots.sitemaps);
+	const queue = [];
+	const queued = /* @__PURE__ */ new Set();
+	const enqueue = (candidate, depth, discoveredFrom) => {
+		const url = normalizeUrl(candidate, normalized.startUrl, normalized.keepQuery);
+		if (!url || url.origin !== origin || queued.has(url.href)) return;
+		const pathDecision = pathEligibility(url, normalized);
+		if (pathDecision) {
+			skipped.set(url.href, {
+				url: url.href,
+				reason: pathDecision
+			});
+			return;
+		}
+		if (!robotsAllows(url, robots.rules)) {
+			skipped.set(url.href, {
+				url: url.href,
+				reason: "robots_disallowed"
+			});
+			return;
+		}
+		queued.add(url.href);
+		queue.push({
+			url: url.href,
+			depth,
+			discoveredFrom
+		});
+	};
+	if (normalized.sitemap !== "only") enqueue(normalized.startUrl.href, 0, "start");
+	for (const url of sitemapResult.urls) enqueue(url, 0, "sitemap");
+	const pages = [];
+	let cursor = 0;
+	while (cursor < queue.length && pages.length < normalized.pageLimit) {
+		const remaining = normalized.pageLimit - pages.length;
+		const batch = queue.slice(cursor, cursor + Math.min(normalized.concurrency, remaining));
+		cursor += batch.length;
+		const resources = await Promise.all(batch.map(async (item) => ({
+			item,
+			resource: await fetchResource(item.url, normalized)
+		})));
+		for (const { item, resource } of resources) {
+			const page = pageFromResource(item, resource, normalized);
+			pages.push(page);
+			if (normalized.sitemap !== "only" && !page.error && page.contentType?.includes("text/html") && item.depth < normalized.maxDepth) for (const link of page.internalLinks) enqueue(link.url, item.depth + 1, item.url);
+		}
+	}
+	const edges = pages.flatMap((page) => page.internalLinks.map((link) => ({
+		from: page.url,
+		...link
+	})));
+	const brokenInternalUrls = uniqueSorted(pages.filter((page) => page.httpStatus !== null && page.httpStatus >= 400).filter((page) => edges.some((edge) => edge.url === page.url)).map((page) => page.url));
+	const incoming = new Set(edges.map((edge) => edge.url));
+	const orphanUrls = uniqueSorted(pages.filter((page) => page.url !== normalized.startUrl.href && page.httpStatus !== null && page.httpStatus < 400 && page.contentType?.includes("text/html") && !incoming.has(page.url)).map((page) => page.url));
+	const successfulHtml = pages.filter((page) => page.httpStatus !== null && page.httpStatus < 400 && page.contentType?.includes("text/html"));
+	return {
+		contractVersion: CONTRACT_VERSION,
+		startUrl: normalized.startUrl.href,
+		origin,
+		crawledAt: normalized.now().toISOString(),
+		options: {
+			pageLimit: normalized.pageLimit,
+			maxDepth: normalized.maxDepth,
+			concurrency: normalized.concurrency,
+			include: normalized.includeValues,
+			exclude: normalized.excludeValues,
+			timeoutMs: normalized.timeoutMs,
+			maxBytesPerResource: normalized.maxBytesPerResource,
+			sitemap: normalized.sitemap,
+			keepQuery: normalized.keepQuery,
+			allowPrivateNetwork: normalized.allowPrivateNetwork
+		},
+		sources: {
+			robots: robots.source,
+			sitemaps: sitemapResult.sources
+		},
+		pages,
+		skipped: [...skipped.values()].toSorted((left, right) => left.url.localeCompare(right.url)),
+		linkGraph: {
+			edges,
+			orphanUrls,
+			brokenInternalUrls,
+			duplicateTitles: duplicateGroups(successfulHtml, "title"),
+			duplicateDescriptions: duplicateGroups(successfulHtml, "description"),
+			duplicateContent: duplicateGroups(successfulHtml, "contentSha256")
+		},
+		summary: {
+			fetchedPages: pages.length,
+			htmlPages: pages.filter((page) => page.contentType?.includes("text/html")).length,
+			brokenPages: pages.filter((page) => page.httpStatus !== null && page.httpStatus >= 400).length,
+			orphanPages: orphanUrls.length,
+			skippedUrls: skipped.size,
+			errorPages: pages.filter((page) => page.error).length,
+			pageLimitReached: pages.length === normalized.pageLimit && cursor < queue.length
+		}
+	};
+}
+function normalizeOptions(options) {
+	const startUrl = normalizeUrl(options.startUrl, void 0, options.keepQuery === true);
+	if (!startUrl) throw new Error("startUrl must be an absolute HTTP or HTTPS URL without credentials");
+	const pageLimit = boundedInteger(options.pageLimit, DEFAULT_PAGE_LIMIT, 1, MAX_PAGE_LIMIT, "pageLimit");
+	const maxDepth = boundedInteger(options.maxDepth, DEFAULT_MAX_DEPTH, 0, MAX_DEPTH, "maxDepth");
+	const concurrency = boundedInteger(options.concurrency, DEFAULT_CONCURRENCY, 1, MAX_CONCURRENCY, "concurrency");
+	const timeoutMs = boundedInteger(options.timeoutMs, DEFAULT_TIMEOUT_MS, 100, MAX_TIMEOUT_MS, "timeoutMs");
+	const maxBytesPerResource = boundedInteger(options.maxBytesPerResource, DEFAULT_MAX_BYTES, 1024, MAX_RESOURCE_BYTES, "maxBytesPerResource");
+	const sitemap = options.sitemap ?? "include";
+	if (![
+		"include",
+		"skip",
+		"only"
+	].includes(sitemap)) throw new Error("sitemap must be include, skip, or only");
+	const includeValues = normalizePatterns(options.include ?? []);
+	const excludeValues = normalizePatterns(options.exclude ?? []);
+	return {
+		startUrl,
+		pageLimit,
+		maxDepth,
+		concurrency,
+		include: includeValues.map(pathMatcher),
+		exclude: excludeValues.map(pathMatcher),
+		includeValues,
+		excludeValues,
+		timeoutMs,
+		maxBytesPerResource,
+		sitemap,
+		keepQuery: options.keepQuery === true,
+		allowPrivateNetwork: options.allowPrivateNetwork === true,
+		dnsResolver: options.dnsResolver,
+		fetch: options.fetch ?? globalThis.fetch,
+		now: options.now ?? (() => /* @__PURE__ */ new Date())
+	};
+}
+function boundedInteger(value, fallback, minimum, maximum, name) {
+	const normalized = value ?? fallback;
+	if (!Number.isInteger(normalized) || normalized < minimum || normalized > maximum) throw new Error(`${name} must be an integer from ${minimum} to ${maximum}`);
+	return normalized;
+}
+function normalizePatterns(values) {
+	return uniqueSorted(values.map((value) => value.trim()).filter((value) => {
+		if (!value.startsWith("/") || value.length > 255) throw new Error("include and exclude patterns must be path globs starting with /");
+		return true;
+	}));
+}
+function pathMatcher(value) {
+	let source = "^";
+	for (let index = 0; index < value.length; index += 1) {
+		const character = value[index];
+		if (character === "*" && value[index + 1] === "*") {
+			source += ".*";
+			index += 1;
+		} else if (character === "*") source += "[^/]*";
+		else source += escapeRegExp(character ?? "");
 	}
-};
-function normalizeApiUrl(value) {
-	return (value || DEFAULT_DINEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN, "");
+	return {
+		value,
+		pattern: new RegExp(`${source}$`)
+	};
 }
-function resolveForgewaySeoApiUrl(savedPlatformApiUrl, cwd = process.cwd()) {
-	return normalizeApiUrl(getProjectEnvValue("DINEWAY_API_BASE_URL", cwd) ?? (typeof savedPlatformApiUrl === "string" ? savedPlatformApiUrl : void 0));
+function pathEligibility(url, options) {
+	const path = url.pathname;
+	if (options.include.length > 0 && !options.include.some((item) => item.pattern.test(path))) return "not_included";
+	if (options.exclude.some((item) => item.pattern.test(path))) return "excluded";
+	return null;
 }
-function normalizeEmail(value) {
-	return value?.trim().toLowerCase() ?? "";
+async function loadRobots(options) {
+	const url = new URL("/robots.txt", options.startUrl.origin).href;
+	const resource = await fetchResource(url, options);
+	if (!resource.response) return {
+		source: {
+			url,
+			status: "temporarily_unavailable",
+			httpStatus: null,
+			error: resource.error ?? "fetch_failed"
+		},
+		rules: [],
+		sitemaps: []
+	};
+	if (resource.response.status === 404) return {
+		source: {
+			url,
+			status: "not_found",
+			httpStatus: 404
+		},
+		rules: [],
+		sitemaps: []
+	};
+	if (!resource.response.ok || resource.error) return {
+		source: {
+			url,
+			status: "temporarily_unavailable",
+			httpStatus: resource.response.status,
+			error: resource.error ?? `http_${resource.response.status}`
+		},
+		rules: [],
+		sitemaps: []
+	};
+	const parsed = parseRobots(resource.body);
+	return {
+		source: {
+			url,
+			status: "available",
+			httpStatus: resource.response.status
+		},
+		rules: parsed.rules,
+		sitemaps: parsed.sitemaps
+	};
 }
-function isShadowEmail(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN.test(email));
+function parseRobots(body) {
+	const groups = [];
+	const sitemaps = [];
+	let current = {
+		agents: [],
+		rules: []
+	};
+	for (const rawLine of body.split(LINE_SPLIT_RE)) {
+		const line = rawLine.replace(COMMENT_RE, "").trim();
+		if (!line) continue;
+		const separator = line.indexOf(":");
+		if (separator < 0) continue;
+		const field = line.slice(0, separator).trim().toLowerCase();
+		const value = line.slice(separator + 1).trim();
+		if (field === "sitemap" && value) {
+			sitemaps.push(value);
+			continue;
+		}
+		if (field === "user-agent") {
+			if (current.rules.length > 0) {
+				groups.push(current);
+				current = {
+					agents: [],
+					rules: []
+				};
+			}
+			current.agents.push(value.toLowerCase());
+			continue;
+		}
+		if ((field === "allow" || field === "disallow") && current.agents.length > 0 && value) current.rules.push({
+			type: field,
+			path: value
+		});
+	}
+	if (current.agents.length > 0 || current.rules.length > 0) groups.push(current);
+	const crawlerName = USER_AGENT.split("/")[0]?.toLowerCase() ?? "dinewaycontentcrawler";
+	const exact = groups.filter((group) => group.agents.includes(crawlerName));
+	return {
+		rules: (exact.length > 0 ? exact : groups.filter((group) => group.agents.includes("*"))).flatMap((group) => group.rules),
+		sitemaps: uniqueSorted(sitemaps)
+	};
 }
-function assertFormalUser(user) {
-	if (!user || user.emailVerified !== true || isShadowEmail(user.email)) throw new Error("Forgeway SEO provider access requires verified formal Forgeway credentials. Run `dineway deploy forgeway` and complete email verification first.");
-	return user;
+function robotsAllows(url, rules) {
+	const path = `${url.pathname}${url.search}`;
+	const matching = rules.filter((rule) => robotsRuleMatches(path, rule.path)).toSorted((left, right) => right.path.length - left.path.length);
+	if (matching.length === 0) return true;
+	const longest = matching[0]?.path.length ?? 0;
+	return matching.some((rule) => rule.path.length === longest && rule.type === "allow");
 }
-function normalizeForgewayUser(user, fallback) {
-	if (!user?.id || !user.email) return fallback;
+function robotsRuleMatches(path, rulePath) {
+	const anchored = rulePath.endsWith("$");
+	const pattern = escapeRegExp(anchored ? rulePath.slice(0, -1) : rulePath).replaceAll("\\*", ".*");
+	return new RegExp(`^${pattern}${anchored ? "$" : ""}`).test(path);
+}
+async function loadSitemaps(options, robotsSitemaps) {
+	const queue = (robotsSitemaps.length > 0 ? robotsSitemaps : [new URL("/sitemap.xml", options.startUrl.origin).href]).map((value) => normalizeUrl(value, options.startUrl, options.keepQuery)).filter((value) => value !== null && value.origin === options.startUrl.origin).map((value) => value.href);
+	const seen = /* @__PURE__ */ new Set();
+	const sources = [];
+	const urls = [];
+	while (queue.length > 0 && seen.size < MAX_SITEMAPS) {
+		const url = queue.shift();
+		if (!url || seen.has(url)) continue;
+		seen.add(url);
+		const resource = await fetchResource(url, options);
+		if (!resource.response) {
+			sources.push({
+				url,
+				status: "temporarily_unavailable",
+				httpStatus: null,
+				error: resource.error ?? "fetch_failed"
+			});
+			continue;
+		}
+		if (resource.response.status === 404) {
+			sources.push({
+				url,
+				status: "not_found",
+				httpStatus: 404
+			});
+			continue;
+		}
+		if (!resource.response.ok || resource.error) {
+			sources.push({
+				url,
+				status: "temporarily_unavailable",
+				httpStatus: resource.response.status,
+				error: resource.error ?? `http_${resource.response.status}`
+			});
+			continue;
+		}
+		try {
+			const parsed = parseSitemap(resource.body);
+			sources.push({
+				url,
+				status: "available",
+				httpStatus: resource.response.status
+			});
+			for (const location of parsed.locations) {
+				const normalized = normalizeUrl(location, options.startUrl, options.keepQuery);
+				if (!normalized || normalized.origin !== options.startUrl.origin) continue;
+				if (parsed.kind === "index") queue.push(normalized.href);
+				else urls.push(normalized.href);
+			}
+		} catch {
+			sources.push({
+				url,
+				status: "invalid",
+				httpStatus: resource.response.status,
+				error: "invalid_sitemap_xml"
+			});
+		}
+	}
 	return {
-		id: user.id,
-		name: user.profile?.name ?? user.name ?? user.email,
-		email: user.email,
-		avatarUrl: user.profile?.avatar_url ?? user.avatarUrl ?? user.avatar_url ?? null,
-		emailVerified: user.emailVerified ?? user.email_verified ?? false
+		sources,
+		urls: uniqueSorted(urls)
+	};
+}
+function parseSitemap(body) {
+	const parser = sax.parser(true, {
+		trim: true,
+		normalize: true
+	});
+	let root = null;
+	let inLocation = false;
+	let location = "";
+	const locations = [];
+	parser.onopentag = (node) => {
+		const name = node.name.toLowerCase();
+		root ??= name;
+		if (name === "loc") {
+			inLocation = true;
+			location = "";
+		}
+	};
+	parser.ontext = (text) => {
+		if (inLocation) location += text;
+	};
+	parser.oncdata = (text) => {
+		if (inLocation) location += text;
+	};
+	parser.onclosetag = (name) => {
+		if (name.toLowerCase() !== "loc") return;
+		inLocation = false;
+		if (location.trim()) locations.push(location.trim());
+	};
+	parser.write(body).close();
+	if (root !== "urlset" && root !== "sitemapindex") throw new Error("Unsupported sitemap root");
+	return {
+		kind: root === "sitemapindex" ? "index" : "urls",
+		locations
 	};
 }
-async function parseJsonResponse(response) {
-	const text = await response.text();
-	if (!text) return {};
+async function fetchResource(url, options) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
 	try {
-		return JSON.parse(text);
-	} catch {
-		return { message: text };
-	}
-}
-function errorMessage(body, fallback) {
-	if (typeof body !== "object" || body === null) return fallback;
-	const record = body;
-	if (typeof record.message === "string") return record.message;
-	if (typeof record.error === "string") return record.error;
-	const nestedError = record.error;
-	if (typeof nestedError === "object" && nestedError !== null) {
-		const message = nestedError.message;
-		if (typeof message === "string") return message;
-	}
-	return fallback;
-}
-var ForgewaySeoGatewayClient = class {
-	fetchImpl;
-	readCredentials;
-	writeCredentials;
-	cwd;
-	constructor(deps = {}) {
-		this.fetchImpl = deps.fetch ?? fetch;
-		this.readCredentials = deps.readCredentials ?? readForgewayCredentials;
-		this.writeCredentials = deps.writeCredentials ?? writeForgewayCredentials;
-		this.cwd = deps.cwd ?? process.cwd();
-	}
-	async loadCredentials() {
-		const metadata = await readForgewayDeployMetadata(this.cwd).catch(() => ({}));
-		const platformApiUrl = resolveForgewaySeoApiUrl(metadata.platformApiUrl, this.cwd);
-		const credentials = await this.readCredentials({
-			cwd: this.cwd,
-			platformApiUrl,
-			email: typeof metadata.publisherEmail === "string" ? metadata.publisherEmail : void 0
-		});
-		if (!credentials?.accessToken) throw new Error("Forgeway SEO provider access requires stored Forgeway credentials. Run `dineway deploy forgeway` first.");
-		assertFormalUser(credentials.user);
-		if (!credentials.refreshToken) throw new Error("Forgeway SEO provider access requires a stored formal-account refresh token. Run `dineway deploy forgeway` again.");
+		let currentUrl = url;
+		let response = null;
+		for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects += 1) {
+			if (!options.allowPrivateNetwork) await resolveAndValidateExternalUrl(currentUrl, { resolver: options.dnsResolver });
+			response = await options.fetch(currentUrl, {
+				headers: {
+					accept: "text/html,application/xml,text/xml,text/plain;q=0.8",
+					"user-agent": USER_AGENT
+				},
+				redirect: "manual",
+				signal: controller.signal
+			});
+			const location = response.headers.get("location");
+			if (response.status < 300 || response.status >= 400 || !location) break;
+			const next = normalizeUrl(location, new URL(currentUrl), options.keepQuery);
+			if (!next) return {
+				response,
+				finalUrl: currentUrl,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "invalid_redirect"
+			};
+			if (next.origin !== options.startUrl.origin) return {
+				response,
+				finalUrl: next.href,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "cross_origin_redirect"
+			};
+			if (redirects === MAX_REDIRECTS) return {
+				response,
+				finalUrl: next.href,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "too_many_redirects"
+			};
+			currentUrl = next.href;
+		}
+		if (!response) throw new Error("No response");
+		const finalUrl = response.url || currentUrl;
+		const contentType = response.headers.get("content-type");
+		const declaredLength = Number(response.headers.get("content-length"));
+		if (Number.isFinite(declaredLength) && declaredLength > options.maxBytesPerResource) return {
+			response,
+			finalUrl,
+			contentType,
+			body: "",
+			bytes: 0,
+			error: "resource_too_large"
+		};
+		const body = await readBoundedBody(response, options.maxBytesPerResource);
+		return {
+			response,
+			finalUrl,
+			contentType,
+			body: body.text,
+			bytes: body.bytes
+		};
+	} catch (error) {
 		return {
-			...credentials,
-			platformApiUrl: resolveForgewaySeoApiUrl(credentials.platformApiUrl, this.cwd)
+			response: null,
+			finalUrl: url,
+			contentType: null,
+			body: "",
+			bytes: 0,
+			error: error instanceof ResourceTooLargeError ? "resource_too_large" : fetchError(error)
 		};
+	} finally {
+		clearTimeout(timeout);
 	}
-	async refreshAccessToken(credentials) {
-		const response = await this.fetchImpl(`${credentials.platformApiUrl}/api/auth/refresh?client_type=server`, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ refreshToken: credentials.refreshToken })
-		});
-		const body = await parseJsonResponse(response);
-		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(body, "Failed to refresh Forgeway formal account credentials. Run `dineway deploy forgeway` again."), response.status, body);
-		if (!body.accessToken) throw new Error("Forgeway refresh response was missing accessToken.");
-		const user = assertFormalUser(normalizeForgewayUser(body.user, credentials.user));
-		if (credentials.user?.email && normalizeEmail(user.email) !== normalizeEmail(credentials.user.email)) throw new Error("Forgeway refresh returned credentials for a different email.");
-		const updated = {
-			...credentials,
-			accessToken: body.accessToken,
-			refreshToken: body.refreshToken ?? credentials.refreshToken,
-			user
+}
+async function readBoundedBody(response, limit) {
+	if (!response.body) return {
+		text: "",
+		bytes: 0
+	};
+	const reader = response.body.getReader();
+	const chunks = [];
+	let bytes = 0;
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		bytes += result.value.byteLength;
+		if (bytes > limit) {
+			await reader.cancel();
+			throw new ResourceTooLargeError();
+		}
+		chunks.push(result.value);
+	}
+	const combined = new Uint8Array(bytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		combined.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		text: new TextDecoder().decode(combined),
+		bytes
+	};
+}
+var ResourceTooLargeError = class extends Error {};
+function fetchError(error) {
+	if (error instanceof SsrfError) return "private_network_blocked";
+	if (error instanceof Error && error.name === "AbortError") return "timeout";
+	return "fetch_failed";
+}
+function pageFromResource(item, resource, options) {
+	const base = {
+		url: item.url,
+		finalUrl: resource.finalUrl,
+		depth: item.depth,
+		discoveredFrom: item.discoveredFrom,
+		httpStatus: resource.response?.status ?? null,
+		contentType: resource.contentType,
+		bytes: resource.bytes
+	};
+	const empty = {
+		title: null,
+		description: null,
+		canonicalUrl: null,
+		robots: null,
+		language: null,
+		headings: {
+			h1: [],
+			h2: [],
+			h3: []
+		},
+		wordCount: 0,
+		contentSha256: null,
+		textExcerpt: "",
+		textTruncated: false,
+		internalLinks: [],
+		externalLinks: [],
+		structuredDataBlocks: 0,
+		renderingRecommended: false
+	};
+	if (resource.error) return {
+		...base,
+		...empty,
+		error: resource.error
+	};
+	const final = normalizeUrl(resource.finalUrl, void 0, options.keepQuery);
+	if (!final || final.origin !== options.startUrl.origin) return {
+		...base,
+		...empty,
+		error: "cross_origin_redirect"
+	};
+	if (!resource.contentType?.includes("text/html")) return {
+		...base,
+		...empty
+	};
+	try {
+		return {
+			...base,
+			...parseHtml(resource.body, final, options.keepQuery)
+		};
+	} catch {
+		return {
+			...base,
+			...empty,
+			error: "invalid_html"
 		};
-		await this.writeCredentials(updated, {
-			cwd: this.cwd,
-			platformApiUrl: updated.platformApiUrl,
-			email: user.email
-		});
-		return updated;
 	}
-	async request(path, body, init) {
-		const credentials = await this.refreshAccessToken(await this.loadCredentials());
-		const method = init?.method ?? "POST";
-		const response = await this.fetchImpl(`${credentials.platformApiUrl}${path}`, {
-			method,
-			headers: {
-				Authorization: `Bearer ${credentials.accessToken}`,
-				"Content-Type": "application/json",
-				"Idempotency-Key": init?.idempotencyKey ?? randomUUID()
-			},
-			body: method === "GET" ? void 0 : JSON.stringify(body ?? {})
-		});
-		const payload = await parseJsonResponse(response);
-		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(payload, `Forgeway SEO request failed with status ${response.status}.`), response.status, payload);
-		return payload;
+}
+function parseHtml(body, pageUrl, keepQuery) {
+	const document = parse(body);
+	let title = null;
+	let description = null;
+	let canonicalUrl = null;
+	let robots = null;
+	let language = null;
+	let structuredDataBlocks = 0;
+	let scriptBlocks = 0;
+	const headings = {
+		h1: [],
+		h2: [],
+		h3: []
+	};
+	const internalLinks = [];
+	const externalLinks = [];
+	walk(document, (element) => {
+		const attributes = new Map(element.attrs.map((attribute) => [attribute.name, attribute.value]));
+		if (element.tagName === "html") language = cleanText(attributes.get("lang")) || language;
+		if (element.tagName === "title" && title === null) title = cleanText(textContent(element));
+		if (element.tagName === "meta") {
+			const name = attributes.get("name")?.toLowerCase();
+			if (name === "description" && description === null) description = cleanText(attributes.get("content"));
+			if ((name === "robots" || name === "googlebot") && robots === null) robots = cleanText(attributes.get("content"));
+		}
+		if (element.tagName === "link") {
+			if ((attributes.get("rel")?.toLowerCase().split(WHITESPACE_RE) ?? []).includes("canonical") && canonicalUrl === null) canonicalUrl = normalizeUrl(attributes.get("href") ?? "", pageUrl, keepQuery)?.href ?? null;
+		}
+		if (element.tagName === "h1" || element.tagName === "h2" || element.tagName === "h3") {
+			const value = cleanText(textContent(element));
+			if (value) headings[element.tagName].push(value);
+		}
+		if (element.tagName === "script") {
+			scriptBlocks += 1;
+			if (attributes.get("type")?.toLowerCase() === "application/ld+json") structuredDataBlocks += 1;
+		}
+		if (element.tagName === "a") {
+			const link = normalizeUrl(attributes.get("href") ?? "", pageUrl, keepQuery);
+			if (!link) return;
+			const item = {
+				url: link.href,
+				anchor: cleanText(textContent(element)) ?? ""
+			};
+			if (link.origin === pageUrl.origin) internalLinks.push(item);
+			else externalLinks.push(item);
+		}
+	});
+	const visibleText = cleanText(textContent(document)) ?? "";
+	const wordCount = countWords(visibleText);
+	const textExcerpt = visibleText.slice(0, MAX_TEXT_EXCERPT);
+	return {
+		title,
+		description,
+		canonicalUrl,
+		robots,
+		language,
+		headings,
+		wordCount,
+		contentSha256: createHash("sha256").update(visibleText).digest("hex"),
+		textExcerpt,
+		textTruncated: textExcerpt.length < visibleText.length,
+		internalLinks: uniqueLinks(internalLinks),
+		externalLinks: uniqueLinks(externalLinks),
+		structuredDataBlocks,
+		renderingRecommended: wordCount < 20 && scriptBlocks > 0
+	};
+}
+function walk(node, visit) {
+	if (isElement(node)) visit(node);
+	if (!("childNodes" in node)) return;
+	for (const child of node.childNodes) walk(child, visit);
+}
+function textContent(node, hidden = false) {
+	if ("value" in node) return hidden ? "" : node.value;
+	const nextHidden = hidden || isElement(node) && [
+		"script",
+		"style",
+		"noscript",
+		"template",
+		"svg",
+		"head"
+	].includes(node.tagName);
+	if (!("childNodes" in node)) return "";
+	return node.childNodes.map((child) => textContent(child, nextHidden)).join(" ");
+}
+function isElement(node) {
+	return "tagName" in node;
+}
+function normalizeUrl(value, base, keepQuery = false) {
+	try {
+		const url = base ? new URL(value, base) : new URL(value);
+		if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password) return null;
+		url.hash = "";
+		if (!keepQuery) url.search = "";
+		if (!url.pathname) url.pathname = "/";
+		return url;
+	} catch {
+		return null;
 	}
-};
+}
+function cleanText(value) {
+	if (!value) return null;
+	return value.replaceAll(WHITESPACE_RE, " ").trim() || null;
+}
+function countWords(value) {
+	return value.match(WORD_RE)?.length ?? 0;
+}
+function uniqueLinks(links) {
+	const seen = /* @__PURE__ */ new Set();
+	return links.filter((link) => {
+		const key = `${link.url}\u0000${link.anchor}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function duplicateGroups(pages, field) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const page of pages) {
+		const value = page[field];
+		if (!value) continue;
+		const key = field === "contentSha256" ? value : value.toLocaleLowerCase();
+		const group = groups.get(key) ?? {
+			value,
+			urls: []
+		};
+		group.urls.push(page.url);
+		groups.set(key, group);
+	}
+	return [...groups.values()].filter((group) => group.urls.length > 1).map((group) => ({
+		value: group.value,
+		urls: uniqueSorted(group.urls)
+	})).toSorted((left, right) => left.value.localeCompare(right.value));
+}
+function uniqueSorted(values) {
+	return [...new Set(values)].toSorted((left, right) => left.localeCompare(right));
+}
+function escapeRegExp(value) {
+	return value.replace(REGEXP_SPECIAL_RE, "\\$&");
+}
 
 //#endregion
 //#region src/cli/commands/seo.ts
+const jsonArgs = { json: {
+	type: "boolean",
+	description: "Output as JSON"
+} };
 const hostedProviderArgs = {
-	json: {
-		type: "boolean",
-		description: "Output as JSON"
-	},
+	...jsonArgs,
 	"force-refresh": {
 		type: "boolean",
 		description: "Bypass Forgeway SEO provider cache"
@@ -7468,416 +6986,515 @@ function requireArg(value, name) {
 	if (!normalized) throw new Error(`${name} is required.`);
 	return normalized;
 }
-async function runSeoRequest(args, path, body) {
-	configureOutputMode(args);
-	try {
-		output(await new ForgewaySeoGatewayClient().request(path, body), args);
-	} catch (error) {
-		if (await handleCliPaywall({
-			error,
-			resource: path,
-			context: { providerPath: path }
-		})) process.exit(2);
-		consola$1.error(error instanceof Error ? error.message : "Unknown error");
-		process.exit(1);
-	}
+function sitemapMode(value) {
+	const mode = toStringValue(value) ?? "include";
+	if (mode === "include" || mode === "skip" || mode === "only") return mode;
+	throw new Error("sitemap must be include, skip, or only.");
 }
-const firecrawlCommand = defineCommand({
+const crawlCommand = defineCommand({
 	meta: {
-		name: "firecrawl",
-		description: "Forgeway-hosted Firecrawl workflows"
+		name: "crawl",
+		description: "Deterministic site crawl controls"
 	},
-	subCommands: {
-		scrape: defineCommand({
-			meta: {
-				name: "scrape",
-				description: "Scrape one URL through Forgeway-hosted Firecrawl"
+	subCommands: { local: defineCommand({
+		meta: {
+			name: "local",
+			description: "Crawl one site locally and return bounded structural evidence"
+		},
+		args: {
+			url: {
+				type: "positional",
+				description: "First-party site URL",
+				required: true
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "URL to scrape",
-					required: true
-				},
-				...hostedProviderArgs,
-				formats: {
-					type: "string",
-					description: "Comma-separated Firecrawl formats",
-					default: "markdown"
-				},
-				"only-main-content": {
-					type: "boolean",
-					description: "Return main content only",
-					default: true
-				},
-				"timeout-ms": {
-					type: "string",
-					description: "Provider timeout in milliseconds",
-					default: "60000"
-				}
+			...jsonArgs,
+			limit: {
+				type: "string",
+				description: "Maximum pages",
+				default: "100"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/scrape", {
-					url: requireArg(args.url, "url"),
-					formats: formats(args.formats),
-					onlyMainContent: args["only-main-content"] !== false,
-					timeoutMs: toNumberValue(args["timeout-ms"], 6e4),
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		map: defineCommand({
-			meta: {
-				name: "map",
-				description: "Map URLs through Forgeway-hosted Firecrawl"
+			"max-depth": {
+				type: "string",
+				description: "Maximum link discovery depth",
+				default: "3"
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "Base URL to map",
-					required: true
-				},
-				...hostedProviderArgs,
-				search: {
-					type: "string",
-					description: "Optional relevance search term"
-				},
-				sitemap: {
-					type: "string",
-					description: "Sitemap mode: skip, include, or only",
-					default: "include"
-				},
-				limit: {
-					type: "string",
-					description: "Maximum URLs",
-					default: "100"
-				},
-				"include-subdomains": {
-					type: "boolean",
-					description: "Include subdomains"
-				},
-				"ignore-query-parameters": {
-					type: "boolean",
-					description: "Ignore query parameters",
-					default: true
-				}
+			concurrency: {
+				type: "string",
+				description: "Maximum concurrent page requests",
+				default: "4"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/map", {
-					url: requireArg(args.url, "url"),
-					search: toStringValue(args.search),
-					sitemap: toStringValue(args.sitemap) ?? "include",
-					limit: toNumberValue(args.limit, 100),
-					includeSubdomains: args["include-subdomains"] === true,
-					ignoreQueryParameters: args["ignore-query-parameters"] !== false,
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		crawl: defineCommand({
-			meta: {
-				name: "crawl",
-				description: "Start a bounded Firecrawl crawl, or check status with --id"
+			include: {
+				type: "string",
+				description: "Comma-separated path globs to include"
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "Base URL to crawl"
-				},
-				...hostedProviderArgs,
-				id: {
-					type: "string",
-					description: "Existing Firecrawl crawl id to check"
-				},
-				limit: {
-					type: "string",
-					description: "Maximum pages",
-					default: "25"
-				},
-				"max-depth": {
-					type: "string",
-					description: "Maximum discovery depth",
-					default: "3"
-				},
-				"allow-subdomains": {
-					type: "boolean",
-					description: "Allow subdomains"
-				},
-				"allow-external-links": {
-					type: "boolean",
-					description: "Allow external links"
-				},
-				formats: {
-					type: "string",
-					description: "Comma-separated scrape formats",
-					default: "markdown"
-				}
+			exclude: {
+				type: "string",
+				description: "Comma-separated path globs to exclude"
 			},
-			async run({ args }) {
-				const crawlId = toStringValue(args.id);
-				if (crawlId) {
-					configureOutputMode(args);
-					try {
-						output(await new ForgewaySeoGatewayClient().request(`/api/firecrawl/crawl/${encodeURIComponent(crawlId)}`, void 0, { method: "GET" }), args);
-					} catch (error) {
-						if (await handleCliPaywall({
-							error,
-							resource: `/api/firecrawl/crawl/${crawlId}`,
-							context: { providerPath: `/api/firecrawl/crawl/${crawlId}` }
-						})) process.exit(2);
-						consola$1.error(error instanceof Error ? error.message : "Unknown error");
-						process.exit(1);
-					}
-					return;
-				}
-				await runSeoRequest(args, "/api/firecrawl/crawl", {
-					url: requireArg(args.url, "url"),
-					limit: toNumberValue(args.limit, 25),
-					maxDiscoveryDepth: toNumberValue(args["max-depth"], 3),
-					allowExternalLinks: args["allow-external-links"] === true,
-					allowSubdomains: args["allow-subdomains"] === true,
-					scrapeFormats: formats(args.formats),
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		search: defineCommand({
-			meta: {
-				name: "search",
-				description: "Search through Forgeway-hosted Firecrawl"
+			"timeout-ms": {
+				type: "string",
+				description: "Per-resource timeout in milliseconds",
+				default: "10000"
 			},
-			args: {
-				query: {
-					type: "positional",
-					description: "Search query",
-					required: true
-				},
-				...hostedProviderArgs,
-				limit: {
-					type: "string",
-					description: "Maximum results",
-					default: "10"
-				},
-				scrape: {
-					type: "boolean",
-					description: "Scrape result markdown"
-				}
+			"max-bytes": {
+				type: "string",
+				description: "Maximum bytes per fetched resource",
+				default: "1000000"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/search", {
-					query: requireArg(args.query, "query"),
-					limit: toNumberValue(args.limit, 10),
-					scrape: args.scrape === true,
-					forceRefresh: forceRefresh(args)
-				});
+			sitemap: {
+				type: "string",
+				description: "Sitemap mode: include, skip, or only",
+				default: "include"
+			},
+			"keep-query": {
+				type: "boolean",
+				description: "Keep query parameters in page identity"
+			},
+			"allow-private-network": {
+				type: "boolean",
+				description: "Allow an explicitly selected localhost or private origin"
 			}
-		})
-	}
+		},
+		async run({ args }) {
+			configureOutputMode(args);
+			try {
+				output(await crawlLocalSite({
+					startUrl: requireArg(args.url, "url"),
+					pageLimit: toNumberValue(args.limit, 100),
+					maxDepth: toNumberValue(args["max-depth"], 3),
+					concurrency: toNumberValue(args.concurrency, 4),
+					include: formats(args.include) ?? [],
+					exclude: formats(args.exclude) ?? [],
+					timeoutMs: toNumberValue(args["timeout-ms"], 1e4),
+					maxBytesPerResource: toNumberValue(args["max-bytes"], 1e6),
+					sitemap: sitemapMode(args.sitemap),
+					keepQuery: args["keep-query"] === true,
+					allowPrivateNetwork: args["allow-private-network"] === true
+				}), args);
+			} catch (error) {
+				consola$1.error(error instanceof Error ? error.message : "Local site crawl failed");
+				process.exit(1);
+			}
+		}
+	}) }
 });
+function dataForSeoDevice(value) {
+	const normalized = toStringValue(value) ?? "desktop";
+	if (normalized === "desktop" || normalized === "mobile") return normalized;
+	throw new Error("device must be desktop or mobile.");
+}
+function aiScrapePlatform(value) {
+	const normalized = toStringValue(value) ?? "chat_gpt";
+	if (normalized === "chat_gpt" || normalized === "gemini" || normalized === "perplexity") return normalized;
+	throw new Error("platform must be chat_gpt, gemini, or perplexity.");
+}
+function aiMentionPlatform(value) {
+	const normalized = toStringValue(value) ?? "google";
+	if (normalized === "google" || normalized === "chat_gpt") return normalized;
+	throw new Error("platform must be google or chat_gpt.");
+}
 function dataForSeoBase(args) {
 	return {
 		locationCode: toNumberValue(args["location-code"], 2840),
 		languageCode: toStringValue(args["language-code"]) ?? "en",
-		device: toStringValue(args.device) ?? "desktop",
+		device: dataForSeoDevice(args.device),
 		forceRefresh: forceRefresh(args)
 	};
 }
-const dataForSeoSerpCommand = defineCommand({
-	meta: {
-		name: "serp",
-		description: "Fetch Google organic SERP data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Keyword",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		depth: {
-			type: "string",
-			description: "SERP depth",
-			default: "10"
+function createSeoCommand(options = {}) {
+	const providerService = options.providerService ?? new SeoProviderEvidenceService(new ForgewaySeoGatewayClient());
+	async function runSeoRequest(args, resource, request) {
+		configureOutputMode(args);
+		try {
+			output(await request(), args);
+		} catch (error) {
+			if (await handleCliPaywall({
+				error,
+				resource,
+				context: { providerPath: resource }
+			})) process.exit(2);
+			consola$1.error(error instanceof Error ? error.message : "Unknown error");
+			process.exit(1);
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/serp", {
-			keyword: requireArg(args.keyword, "keyword"),
-			depth: toNumberValue(args.depth, 10),
-			...dataForSeoBase(args)
-		});
 	}
-});
-const dataForSeoMapsCommand = defineCommand({
-	meta: {
-		name: "maps",
-		description: "Fetch Google Maps SERP data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Keyword",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		depth: {
-			type: "string",
-			description: "Maps depth",
-			default: "10"
+	const firecrawlCommand = defineCommand({
+		meta: {
+			name: "firecrawl",
+			description: "Forgeway-hosted Firecrawl workflows"
+		},
+		subCommands: {
+			scrape: defineCommand({
+				meta: {
+					name: "scrape",
+					description: "Scrape one URL through Forgeway-hosted Firecrawl"
+				},
+				args: {
+					url: {
+						type: "positional",
+						description: "URL to scrape",
+						required: true
+					},
+					...hostedProviderArgs,
+					formats: {
+						type: "string",
+						description: "Comma-separated Firecrawl formats",
+						default: "markdown"
+					},
+					"only-main-content": {
+						type: "boolean",
+						description: "Return main content only",
+						default: true
+					},
+					"timeout-ms": {
+						type: "string",
+						description: "Provider timeout in milliseconds",
+						default: "60000"
+					}
+				},
+				async run({ args }) {
+					await runSeoRequest(args, "/api/firecrawl/scrape", () => providerService.firecrawlScrape({
+						url: requireArg(args.url, "url"),
+						formats: formats(args.formats) ?? ["markdown"],
+						onlyMainContent: args["only-main-content"] !== false,
+						timeoutMs: toNumberValue(args["timeout-ms"], 6e4),
+						forceRefresh: forceRefresh(args)
+					}));
+				}
+			}),
+			map: defineCommand({
+				meta: {
+					name: "map",
+					description: "Map URLs through Forgeway-hosted Firecrawl"
+				},
+				args: {
+					url: {
+						type: "positional",
+						description: "Base URL to map",
+						required: true
+					},
+					...hostedProviderArgs,
+					search: {
+						type: "string",
+						description: "Optional relevance search term"
+					},
+					sitemap: {
+						type: "string",
+						description: "Sitemap mode: skip, include, or only",
+						default: "include"
+					},
+					limit: {
+						type: "string",
+						description: "Maximum URLs",
+						default: "100"
+					},
+					"include-subdomains": {
+						type: "boolean",
+						description: "Include subdomains"
+					},
+					"ignore-query-parameters": {
+						type: "boolean",
+						description: "Ignore query parameters",
+						default: true
+					}
+				},
+				async run({ args }) {
+					await runSeoRequest(args, "/api/firecrawl/map", () => providerService.firecrawlMap({
+						url: requireArg(args.url, "url"),
+						search: toStringValue(args.search),
+						sitemap: sitemapMode(args.sitemap),
+						limit: toNumberValue(args.limit, 100),
+						includeSubdomains: args["include-subdomains"] === true,
+						ignoreQueryParameters: args["ignore-query-parameters"] !== false,
+						forceRefresh: forceRefresh(args)
+					}));
+				}
+			}),
+			crawl: defineCommand({
+				meta: {
+					name: "crawl",
+					description: "Start a bounded Firecrawl crawl, or check status with --id"
+				},
+				args: {
+					url: {
+						type: "positional",
+						description: "Base URL to crawl",
+						required: false
+					},
+					...hostedProviderArgs,
+					id: {
+						type: "string",
+						description: "Existing Firecrawl crawl id to check"
+					},
+					limit: {
+						type: "string",
+						description: "Maximum pages",
+						default: "25"
+					},
+					"max-depth": {
+						type: "string",
+						description: "Maximum discovery depth",
+						default: "3"
+					},
+					"allow-subdomains": {
+						type: "boolean",
+						description: "Allow subdomains"
+					},
+					"allow-external-links": {
+						type: "boolean",
+						description: "Allow external links"
+					},
+					formats: {
+						type: "string",
+						description: "Comma-separated scrape formats",
+						default: "markdown"
+					}
+				},
+				async run({ args }) {
+					const crawlId = toStringValue(args.id);
+					if (crawlId) {
+						await runSeoRequest(args, `/api/firecrawl/crawl/${crawlId}`, () => providerService.firecrawlCrawlStatus({ id: crawlId }));
+						return;
+					}
+					await runSeoRequest(args, "/api/firecrawl/crawl", () => providerService.firecrawlCrawlStart({
+						url: requireArg(args.url, "url"),
+						limit: toNumberValue(args.limit, 25),
+						maxDiscoveryDepth: toNumberValue(args["max-depth"], 3),
+						allowExternalLinks: args["allow-external-links"] === true,
+						allowSubdomains: args["allow-subdomains"] === true,
+						scrapeFormats: formats(args.formats) ?? ["markdown"],
+						forceRefresh: forceRefresh(args)
+					}));
+				}
+			}),
+			search: defineCommand({
+				meta: {
+					name: "search",
+					description: "Search through Forgeway-hosted Firecrawl"
+				},
+				args: {
+					query: {
+						type: "positional",
+						description: "Search query",
+						required: true
+					},
+					...hostedProviderArgs,
+					limit: {
+						type: "string",
+						description: "Maximum results",
+						default: "10"
+					},
+					scrape: {
+						type: "boolean",
+						description: "Scrape result markdown"
+					}
+				},
+				async run({ args }) {
+					await runSeoRequest(args, "/api/firecrawl/search", () => providerService.firecrawlSearch({
+						query: requireArg(args.query, "query"),
+						limit: toNumberValue(args.limit, 10),
+						scrape: args.scrape === true,
+						forceRefresh: forceRefresh(args)
+					}));
+				}
+			})
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/maps", {
-			keyword: requireArg(args.keyword, "keyword"),
-			depth: toNumberValue(args.depth, 10),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoKeywordsCommand = defineCommand({
-	meta: {
-		name: "keywords",
-		description: "Fetch keyword suggestions"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Seed keyword",
-			required: true
+	});
+	const dataForSeoSerpCommand = defineCommand({
+		meta: {
+			name: "serp",
+			description: "Fetch Google organic SERP data"
+		},
+		args: {
+			keyword: {
+				type: "positional",
+				description: "Keyword",
+				required: true
+			},
+			...dataForSeoCommonArgs,
+			depth: {
+				type: "string",
+				description: "SERP depth",
+				default: "10"
+			}
 		},
-		...dataForSeoCommonArgs,
-		limit: {
-			type: "string",
-			description: "Maximum suggestions",
-			default: "20"
+		async run({ args }) {
+			await runSeoRequest(args, "/api/dataforseo/serp", () => providerService.dataForSeoSerp({
+				keyword: requireArg(args.keyword, "keyword"),
+				depth: toNumberValue(args.depth, 10),
+				...dataForSeoBase(args)
+			}));
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/keywords", {
-			keyword: requireArg(args.keyword, "keyword"),
-			limit: toNumberValue(args.limit, 20),
-			includeSerpInfo: true,
-			includeSeedKeyword: true,
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoCompetitorsCommand = defineCommand({
-	meta: {
-		name: "competitors",
-		description: "Fetch competitor-domain data"
-	},
-	args: {
-		domain: {
-			type: "positional",
-			description: "Target domain",
-			required: true
+	});
+	const dataForSeoMapsCommand = defineCommand({
+		meta: {
+			name: "maps",
+			description: "Fetch Google Maps SERP data"
+		},
+		args: {
+			keyword: {
+				type: "positional",
+				description: "Keyword",
+				required: true
+			},
+			...dataForSeoCommonArgs,
+			depth: {
+				type: "string",
+				description: "Maps depth",
+				default: "10"
+			}
 		},
-		...dataForSeoCommonArgs,
-		limit: {
-			type: "string",
-			description: "Maximum competitors",
-			default: "20"
+		async run({ args }) {
+			await runSeoRequest(args, "/api/dataforseo/maps", () => providerService.dataForSeoMaps({
+				keyword: requireArg(args.keyword, "keyword"),
+				depth: toNumberValue(args.depth, 10),
+				...dataForSeoBase(args)
+			}));
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/competitors", {
-			targetDomain: requireArg(args.domain, "domain"),
-			limit: toNumberValue(args.limit, 20),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoAiScrapeCommand = defineCommand({
-	meta: {
-		name: "ai-scrape",
-		description: "Fetch DataForSEO AI scraper response data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "AI search keyword",
-			required: true
+	});
+	const dataForSeoKeywordsCommand = defineCommand({
+		meta: {
+			name: "keywords",
+			description: "Fetch keyword suggestions"
+		},
+		args: {
+			keyword: {
+				type: "positional",
+				description: "Seed keyword",
+				required: true
+			},
+			...dataForSeoCommonArgs,
+			limit: {
+				type: "string",
+				description: "Maximum suggestions",
+				default: "20"
+			}
 		},
-		...dataForSeoCommonArgs,
-		platform: {
-			type: "string",
-			description: "AI platform: chat_gpt, gemini, or perplexity",
-			default: "chat_gpt"
+		async run({ args }) {
+			await runSeoRequest(args, "/api/dataforseo/keywords", () => providerService.dataForSeoKeywords({
+				keyword: requireArg(args.keyword, "keyword"),
+				limit: toNumberValue(args.limit, 20),
+				...dataForSeoBase(args)
+			}));
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/ai-scrape", {
-			keyword: requireArg(args.keyword, "keyword"),
-			platform: toStringValue(args.platform) ?? "chat_gpt",
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoAiMentionsCommand = defineCommand({
-	meta: {
-		name: "ai-mentions",
-		description: "Fetch DataForSEO LLM mention data"
-	},
-	args: {
-		...dataForSeoCommonArgs,
-		domain: {
-			type: "string",
-			description: "Target domain"
+	});
+	const dataForSeoCompetitorsCommand = defineCommand({
+		meta: {
+			name: "competitors",
+			description: "Fetch competitor-domain data"
+		},
+		args: {
+			domain: {
+				type: "positional",
+				description: "Target domain",
+				required: true
+			},
+			...dataForSeoCommonArgs,
+			limit: {
+				type: "string",
+				description: "Maximum competitors",
+				default: "20"
+			}
 		},
-		keyword: {
-			type: "string",
-			description: "Target keyword"
+		async run({ args }) {
+			await runSeoRequest(args, "/api/dataforseo/competitors", () => providerService.dataForSeoCompetitors({
+				domain: requireArg(args.domain, "domain"),
+				limit: toNumberValue(args.limit, 20),
+				...dataForSeoBase(args)
+			}));
+		}
+	});
+	const dataForSeoAiScrapeCommand = defineCommand({
+		meta: {
+			name: "ai-scrape",
+			description: "Fetch DataForSEO AI scraper response data"
+		},
+		args: {
+			keyword: {
+				type: "positional",
+				description: "AI search keyword",
+				required: true
+			},
+			...dataForSeoCommonArgs,
+			platform: {
+				type: "string",
+				description: "AI platform: chat_gpt, gemini, or perplexity",
+				default: "chat_gpt"
+			}
 		},
-		platform: {
-			type: "string",
-			description: "Mention platform: google or chat_gpt",
-			default: "google"
+		async run({ args }) {
+			await runSeoRequest(args, "/api/dataforseo/ai-scrape", () => providerService.dataForSeoAiScrape({
+				keyword: requireArg(args.keyword, "keyword"),
+				platform: aiScrapePlatform(args.platform),
+				...dataForSeoBase(args)
+			}));
+		}
+	});
+	const dataForSeoAiMentionsCommand = defineCommand({
+		meta: {
+			name: "ai-mentions",
+			description: "Fetch DataForSEO LLM mention data"
+		},
+		args: {
+			...dataForSeoCommonArgs,
+			domain: {
+				type: "string",
+				description: "Target domain"
+			},
+			keyword: {
+				type: "string",
+				description: "Target keyword"
+			},
+			platform: {
+				type: "string",
+				description: "Mention platform: google or chat_gpt",
+				default: "google"
+			},
+			limit: {
+				type: "string",
+				description: "Maximum mentions",
+				default: "20"
+			}
 		},
-		limit: {
-			type: "string",
-			description: "Maximum mentions",
-			default: "20"
+		async run({ args }) {
+			if (!toStringValue(args.domain) && !toStringValue(args.keyword)) {
+				consola$1.error("domain or keyword is required.");
+				process.exit(1);
+			}
+			await runSeoRequest(args, "/api/dataforseo/ai-mentions", () => providerService.dataForSeoAiMentions({
+				domain: toStringValue(args.domain),
+				keyword: toStringValue(args.keyword),
+				platform: aiMentionPlatform(args.platform),
+				limit: toNumberValue(args.limit, 20),
+				...dataForSeoBase(args)
+			}));
 		}
-	},
-	async run({ args }) {
-		if (!toStringValue(args.domain) && !toStringValue(args.keyword)) {
-			consola$1.error("domain or keyword is required.");
-			process.exit(1);
+	});
+	return defineCommand({
+		meta: {
+			name: "seo",
+			description: "Local site evidence and hosted SEO provider workflows"
+		},
+		subCommands: {
+			crawl: crawlCommand,
+			firecrawl: firecrawlCommand,
+			dataforseo: defineCommand({
+				meta: {
+					name: "dataforseo",
+					description: "Forgeway-hosted DataForSEO workflows"
+				},
+				subCommands: {
+					serp: dataForSeoSerpCommand,
+					maps: dataForSeoMapsCommand,
+					keywords: dataForSeoKeywordsCommand,
+					competitors: dataForSeoCompetitorsCommand,
+					"ai-scrape": dataForSeoAiScrapeCommand,
+					"ai-mentions": dataForSeoAiMentionsCommand
+				}
+			})
 		}
-		await runSeoRequest(args, "/api/dataforseo/ai-mentions", {
-			targetDomain: toStringValue(args.domain),
-			keyword: toStringValue(args.keyword),
-			platform: toStringValue(args.platform) ?? "google",
-			limit: toNumberValue(args.limit, 20),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoCommand = defineCommand({
-	meta: {
-		name: "dataforseo",
-		description: "Forgeway-hosted DataForSEO workflows"
-	},
-	subCommands: {
-		serp: dataForSeoSerpCommand,
-		maps: dataForSeoMapsCommand,
-		keywords: dataForSeoKeywordsCommand,
-		competitors: dataForSeoCompetitorsCommand,
-		"ai-scrape": dataForSeoAiScrapeCommand,
-		"ai-mentions": dataForSeoAiMentionsCommand
-	}
-});
-const seoCommand = defineCommand({
-	meta: {
-		name: "seo",
-		description: "Hosted SEO provider workflows through Forgeway"
-	},
-	subCommands: {
-		firecrawl: firecrawlCommand,
-		dataforseo: dataForSeoCommand
-	}
-});
+	});
+}
+const seoCommand = createSeoCommand();
 
 //#endregion
 //#region src/cli/commands/taxonomy.ts
@@ -8047,6 +7664,88 @@ const typesCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/contributions.ts
+const DINEWAY_PLUGIN_PACKAGE = /^(?:@dineway-ai\/plugin-|dineway-plugin-)/;
+const CLI_COMMAND_NAME = /^[a-z][a-z0-9-]*$/;
+async function discoverDinewayCliContributions(cwd = process.cwd()) {
+	const projectPackage = await findProjectPackage(cwd);
+	if (!projectPackage) return [];
+	const { packagePath, project } = projectPackage;
+	const requireFromProject = createRequire(packagePath);
+	const packageNames = new Set([
+		...Object.keys(project.dependencies ?? {}),
+		...Object.keys(project.devDependencies ?? {}),
+		...Object.keys(project.optionalDependencies ?? {})
+	]);
+	const contributions = [];
+	for (const packageName of [...packageNames].filter(isDinewayPluginPackage).toSorted()) {
+		const specifier = `${packageName}/cli`;
+		let modulePath;
+		try {
+			modulePath = requireFromProject.resolve(specifier);
+		} catch (error) {
+			if (isMissingContribution(error)) continue;
+			throw error;
+		}
+		const loaded = await import(pathToFileURL(modulePath).href);
+		const value = loaded.dinewayCliContribution ?? loaded.default;
+		if (!isDinewayCliContribution(value)) throw new Error(`${specifier} does not export a valid Dineway CLI contribution`);
+		contributions.push({
+			packageName,
+			commands: value.commands
+		});
+	}
+	return contributions;
+}
+async function findProjectPackage(from) {
+	let directory = resolve(from);
+	while (true) {
+		const packagePath = join(directory, "package.json");
+		const project = await readProjectPackage(packagePath);
+		if (project) return {
+			packagePath,
+			project
+		};
+		const parent = dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function mergeDinewayCliContributions(builtIns, contributions) {
+	const commands = { ...builtIns };
+	for (const contribution of contributions) for (const [name, command] of Object.entries(contribution.commands).toSorted(([left], [right]) => left.localeCompare(right))) {
+		if (commands[name]) throw new Error(`Dineway CLI command "${name}" from ${contribution.packageName} conflicts with an existing command`);
+		commands[name] = command;
+	}
+	return commands;
+}
+async function readProjectPackage(path) {
+	try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		return isRecord(parsed) ? parsed : null;
+	} catch (error) {
+		if (isFileNotFound(error)) return null;
+		throw error;
+	}
+}
+function isDinewayPluginPackage(packageName) {
+	return DINEWAY_PLUGIN_PACKAGE.test(packageName);
+}
+function isDinewayCliContribution(value) {
+	if (!isRecord(value) || !isRecord(value.commands)) return false;
+	return Object.entries(value.commands).every(([name, command]) => CLI_COMMAND_NAME.test(name) && isRecord(command));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMissingContribution(error) {
+	return error instanceof Error && "code" in error && (error.code === "MODULE_NOT_FOUND" || error.code === "ERR_PACKAGE_PATH_NOT_EXPORTED");
+}
+function isFileNotFound(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
 //#endregion
 //#region src/cli/index.ts
 /**
@@ -8072,36 +7771,40 @@ const typesCommand = defineCommand({
 * - deploy: Deploy a standard Dineway Node server through a provider CLI
 * - plugin: Plugin management (init, bundle, validate, publish, login, logout)
 */
-runMain(defineCommand({
-	meta: {
-		name: "dineway",
-		version: "0.0.0",
-		description: "CLI for Dineway Agentic Web builder"
-	},
-	subCommands: {
-		init: initCommand,
-		account: accountCommand,
-		types: typesCommand,
-		dev: devCommand,
-		deploy: deployCommand,
-		doctor: doctorCommand,
-		seed: seedCommand,
-		"export-seed": exportSeedCommand,
-		secrets: secretsCommand,
-		auth: authCommand,
-		login: loginCommand,
-		logout: logoutCommand,
-		whoami: whoamiCommand,
-		content: contentCommand,
-		schema: schemaCommand,
-		media: mediaCommand,
-		search: searchCommand,
-		seo: seoCommand,
-		taxonomy: taxonomyCommand,
-		menu: menuCommand,
-		plugin: pluginCommand
-	}
-}));
+const builtInCommands = {
+	init: initCommand,
+	account: accountCommand,
+	types: typesCommand,
+	dev: devCommand,
+	deploy: deployCommand,
+	doctor: doctorCommand,
+	seed: seedCommand,
+	"export-seed": exportSeedCommand,
+	secrets: secretsCommand,
+	auth: authCommand,
+	login: loginCommand,
+	logout: logoutCommand,
+	whoami: whoamiCommand,
+	content: contentCommand,
+	schema: schemaCommand,
+	media: mediaCommand,
+	search: searchCommand,
+	seo: seoCommand,
+	taxonomy: taxonomyCommand,
+	menu: menuCommand,
+	plugin: pluginCommand
+};
+async function createDinewayCliCommand(cwd = process.cwd()) {
+	return defineCommand({
+		meta: {
+			name: "dineway",
+			version: "0.0.0",
+			description: "CLI for Dineway Agentic Web builder"
+		},
+		subCommands: mergeDinewayCliContributions(builtInCommands, await discoverDinewayCliContributions(cwd))
+	});
+}
+createDinewayCliCommand().then((main) => runMain(main));
 
 //#endregion
-export {  };
+export { createDinewayCliCommand };