dineway 0.2.0 → 0.2.2

package/dist/cli/index.mjs

@@ -1,322 +1,57 @@
 #!/usr/bin/env node
-import { a as __exportAll, i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-DB7CRfOF.mjs";
+import { i as runMigrations, n as getMigrationStatus, t as getMigrationFingerprint } from "../runner-BfWbi9YY.mjs";
 import { t as createDatabase } from "../connection-CiJWiWya.mjs";
 import { t as validateIdentifier } from "../validate-VPnKoIzW.mjs";
 import { l as listTablesLike } from "../dialect-helpers-fk43GbDb.mjs";
 import { n as getI18nConfig, r as isI18nEnabled } from "../config-CVssduLe.mjs";
 import { i as encodeBase64url } from "../base64-F8-DUraK.mjs";
-import "../types-Dq1qT19x.mjs";
-import { o as isMissingTableError } from "../loader-CjWqjweO.mjs";
+import "../types-Bshd_6wQ.mjs";
+import { o as isMissingTableError } from "../loader-WHf22FwU.mjs";
 import "../object-cache-D51qOseS.mjs";
 import { n as slugify } from "../slugify-KSsVD_D3.mjs";
-import { t as ContentRepository } from "../content-Bh4BDjv8.mjs";
-import { t as MediaRepository } from "../media-DMj0grzC.mjs";
-import { t as TaxonomyRepository } from "../taxonomy-Dvsw6BOs.mjs";
+import { t as ContentRepository } from "../content-Cbl8HbIR.mjs";
+import { t as MediaRepository } from "../media-B4m-cnmj.mjs";
+import { t as TaxonomyRepository } from "../taxonomy-CCo2plmV.mjs";
 import { t as OptionsRepository } from "../options-DQPTH5n0.mjs";
-import "../redirect-BAjt4Z6b.mjs";
-import "../request-cache-D9GQBxMP.mjs";
-import "../byline-registry-87nNnYl4.mjs";
-import "../field-defs-cache-DRNdhBJv.mjs";
-import { t as BylineRepository } from "../byline-e51-fWRs.mjs";
-import "../content-refresh-CgutSUfO.mjs";
-import "../fts-manager-Crzypjqu.mjs";
-import { n as SchemaRegistry } from "../registry-CtyVedcN.mjs";
-import "../settings-BbqgHWpU.mjs";
-import { n as VERSION } from "../version-BTvfRGc6.mjs";
-import { a as reconcileManifestAccess, i as pluginManifestSchema } from "../manifest-schema-BxVPYMJR.mjs";
-import "../ssrf-DWe8jwAp.mjs";
-import { n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CDZo2k8L.mjs";
-import { t as validateSeed } from "../validate-DNs0pTSc.mjs";
-import { t as applySeed } from "../apply-bZswmZPm.mjs";
-import { createHeaderAwareFetch, customHeadersInterceptor, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
-import { t as convertDataForRead } from "../portable-text-dA_UlJwW.mjs";
-import { DinewayClient } from "../client/index.mjs";
+import "../redirect-DoDgOWIA.mjs";
+import "../request-cache-CBFjCwSt.mjs";
+import "../byline-registry-Ba54M74c.mjs";
+import "../field-defs-cache-CiXP3eO3.mjs";
+import { t as BylineRepository } from "../byline-BJa1MyKB.mjs";
+import "../content-refresh-BmkilU5M.mjs";
+import "../fts-manager-Zo9uhGel.mjs";
+import { n as SchemaRegistry } from "../registry-SEJqFliS.mjs";
+import "../settings-SVDAB7_W.mjs";
+import { n as VERSION } from "../version-DEAV9k58.mjs";
+import { i as parseEncryptionKeys, n as fingerprintKey, r as generateEncryptionKey, t as DinewaySecretsError } from "../secrets-CpGpyGcO.mjs";
+import { t as IntegrationCredentialStore } from "../store-CCfMD6nw.mjs";
+import { a as reconcileManifestAccess, i as pluginManifestSchema } from "../manifest-schema-DKa3ZaJL.mjs";
+import { n as resolveAndValidateExternalUrl, t as SsrfError } from "../ssrf-BZHvtFEv.mjs";
+import { t as validateSeed } from "../validate-qKzI3BCv.mjs";
+import { t as applySeed } from "../apply-DHT0l398.mjs";
+import { createHeaderAwareFetch, isRedirectResponse, resolveCustomHeaders } from "../client/external-auth-headers.mjs";
+import { t as convertDataForRead } from "../portable-text-BASHceim.mjs";
+import { _ as readForgewayCredentials, a as InvalidForgewayAccountCredentialsError, c as getForgewayDinewayAccount, d as normalizeForgewayEmail, f as readStoredForgewayAccount, g as listForgewayCredentials, h as sendForgewayAccountLoginLink, i as DEFAULT_FORGEWAY_API_BASE_URL, l as normalizeDinewayWebUrl, m as removeStoredForgewayAccount, n as DinewayToolsService, o as completeForgewayAccountLogin, p as refreshForgewayAccountCredentials, r as DEFAULT_DINEWAY_WEB_URL, s as createForgewayAccountClient, t as DinewayToolsError, u as normalizeForgewayApiUrl, v as writeForgewayCredentials } from "../service-CY0aH6eI.mjs";
+import { n as output, t as configureOutputMode } from "../output-13u4dvu-.mjs";
+import { _ as saveMarketplaceCredential, a as ensureProjectGitignoreDinewayLocalState, c as resolveDinewayBaseUrl, d as getCredentials, f as getMarketplaceCredential, g as saveCredentials, h as resolveCredentialKey, i as DEFAULT_DINEWAY_URL, l as resolveDinewayToken, m as removeMarketplaceCredential, n as connectionArgs, o as ensureProjectGitignoreEntry, p as removeCredentials, r as createClientFromArgs, s as readProjectEnv, u as upsertProjectEnv } from "../client-factory-DEtHApCc.mjs";
 import { LocalStorage } from "../storage/local.mjs";
-import { r as fileExists$11, t as bundleCommand } from "../bundle-7C_DpkEq.mjs";
-import { createHash, randomUUID } from "node:crypto";
+import { r as fileExists$11, t as bundleCommand } from "../bundle-CIrUlrkQ.mjs";
+import { createRequire } from "node:module";
+import { createHash } from "node:crypto";
 import { sql } from "kysely";
 import { createGzipDecoder, unpackTar } from "modern-tar";
-import { createReadStream, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { createReadStream, existsSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import sax from "sax";
+import { pathToFileURL } from "node:url";
 import { defineCommand, runCommand, runMain } from "citty";
 import { createInterface } from "node:readline/promises";
 import consola, { consola as consola$1 } from "consola";
 import pc from "picocolors";
-import { ForgewayClient } from "@forgeway/sdk";
-import { access, chmod, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
+import { access, mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
 import { spawn } from "node:child_process";
+import { parse } from "parse5";
 
-//#region src/cli/commands/deploy/utils/forgeway-secrets.ts
-const DINEWAY_USER_CONFIG_DIR_NAME = "dineway";
-const TRAILING_SLASH_PATTERN$3 = /\/$/;
-function getDinewayUserConfigDir() {
-	return join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), DINEWAY_USER_CONFIG_DIR_NAME);
-}
-function getForgewayAccountSecretPath() {
-	return join(getDinewayUserConfigDir(), "forgeway.json");
-}
-function normalizePlatformApiUrl$1(platformApiUrl) {
-	return platformApiUrl.replace(TRAILING_SLASH_PATTERN$3, "");
-}
-function normalizeEmail$2(email) {
-	return email.trim().toLowerCase();
-}
-function accountKey(platformApiUrl, email) {
-	return `${normalizePlatformApiUrl$1(platformApiUrl)}#${normalizeEmail$2(email)}`;
-}
-function normalizeLookup(lookup) {
-	if (typeof lookup === "string") return { cwd: lookup };
-	return lookup ?? {};
-}
-async function readAccountStore() {
-	try {
-		const raw = await readFile(getForgewayAccountSecretPath(), "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return { version: 1 };
-	}
-}
-async function writeAccountStore(store) {
-	await mkdir(getDinewayUserConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	const file = getForgewayAccountSecretPath();
-	await writeFile(file, JSON.stringify({
-		...store,
-		version: 1
-	}, null, "	") + "\n", {
-		encoding: "utf-8",
-		mode: 384
-	});
-	await chmod(file, 384);
-}
-function accountMatches(credentials, lookup) {
-	if (lookup.platformApiUrl && normalizePlatformApiUrl$1(credentials.platformApiUrl) !== normalizePlatformApiUrl$1(lookup.platformApiUrl)) return false;
-	if (lookup.email && normalizeEmail$2(credentials.user?.email ?? "") !== normalizeEmail$2(lookup.email)) return false;
-	return true;
-}
-async function readForgewayCredentials(lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const store = await readAccountStore();
-	const accounts = Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, normalizedLookup));
-	if (normalizedLookup.platformApiUrl && normalizedLookup.email) return store.accounts?.[accountKey(normalizedLookup.platformApiUrl, normalizedLookup.email)] ?? null;
-	if (accounts.length === 1) return accounts[0] ?? null;
-	return null;
-}
-async function writeForgewayCredentials(credentials, lookup) {
-	const normalizedLookup = normalizeLookup(lookup);
-	const platformApiUrl = normalizePlatformApiUrl$1(normalizedLookup.platformApiUrl ?? credentials.platformApiUrl);
-	const email = normalizeEmail$2(normalizedLookup.email ?? credentials.user?.email ?? "");
-	if (!email) throw new Error("Forgeway credentials require a user email before they can be stored.");
-	const key = accountKey(platformApiUrl, email);
-	const store = await readAccountStore();
-	store.accounts = {
-		...store.accounts,
-		[key]: {
-			...credentials,
-			platformApiUrl
-		}
-	};
-	store.lastAccountKey = key;
-	await writeAccountStore(store);
-}
-async function listForgewayCredentials(platformApiUrl) {
-	const lookup = platformApiUrl ? { platformApiUrl } : {};
-	const store = await readAccountStore();
-	return Object.values(store.accounts ?? {}).filter((credentials) => accountMatches(credentials, lookup));
-}
-
-//#endregion
-//#region src/cli/forgeway-account.ts
-const TRAILING_SLASH_PATTERN$2 = /\/$/;
-const SHADOW_EMAIL_PATTERN$2 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
-const DEFAULT_FORGEWAY_API_BASE_URL = "https://api.dineway.ai";
-const DEFAULT_DINEWAY_WEB_URL = "https://dineway.ai";
-function normalizeForgewayApiUrl(value) {
-	return (value || DEFAULT_FORGEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN$2, "");
-}
-function normalizeDinewayWebUrl(value) {
-	return (value || DEFAULT_DINEWAY_WEB_URL).replace(TRAILING_SLASH_PATTERN$2, "");
-}
-function normalizeForgewayEmail(value) {
-	return value?.trim().toLowerCase() ?? "";
-}
-function isShadowForgewayEmail(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN$2.test(email));
-}
-function createForgewayAccountClient(platformApiUrl, accessToken) {
-	return new ForgewayClient({
-		baseUrl: normalizeForgewayApiUrl(platformApiUrl),
-		accessToken,
-		isServerMode: true,
-		auth: { detectOAuthCallback: false }
-	});
-}
-function normalizeForgewayUser$2(user) {
-	if (!user?.id || !user.email) throw new Error("Forgeway session response did not include a user email.");
-	return {
-		id: user.id,
-		name: user.profile?.name ?? user.name ?? user.email,
-		email: user.email,
-		avatarUrl: user.profile?.avatar_url ?? user.avatarUrl ?? user.avatar_url ?? null,
-		emailVerified: user.emailVerified ?? user.email_verified ?? false
-	};
-}
-function assertFormalForgewayUser(user) {
-	if (!user || user.emailVerified !== true || isShadowForgewayEmail(user.email)) throw new Error("Dineway account commands require a verified Forgeway account.");
-	return user;
-}
-async function readStoredForgewayAccount(lookup = {}) {
-	const platformApiUrl = normalizeForgewayApiUrl(lookup.platformApiUrl);
-	const email = normalizeForgewayEmail(lookup.email);
-	if (email) return readForgewayCredentials({
-		platformApiUrl,
-		email
-	});
-	const stored = await readForgewayCredentials({ platformApiUrl });
-	if (stored) return stored;
-	const accounts = (await listForgewayCredentials(platformApiUrl)).filter((credentials) => {
-		try {
-			assertFormalForgewayUser(credentials.user);
-			return true;
-		} catch {
-			return false;
-		}
-	});
-	return accounts.length === 1 ? accounts[0] ?? null : null;
-}
-async function refreshForgewayAccountCredentials(credentials) {
-	const user = assertFormalForgewayUser(credentials.user);
-	if (!credentials.refreshToken) throw new Error("Stored Forgeway account is missing a refresh token. Run `dineway account login`.");
-	const { data, error } = await createForgewayAccountClient(credentials.platformApiUrl).auth.refreshSession({ refreshToken: credentials.refreshToken });
-	if (error || !data?.accessToken) throw new Error(error?.message || "Failed to refresh Forgeway account. Run `dineway account login`.");
-	const refreshedUser = normalizeForgewayUser$2(data.user);
-	if (normalizeForgewayEmail(refreshedUser.email) !== normalizeForgewayEmail(user.email)) throw new Error("Forgeway refresh returned credentials for a different account.");
-	const updated = {
-		...credentials,
-		platformApiUrl: normalizeForgewayApiUrl(credentials.platformApiUrl),
-		accessToken: data.accessToken,
-		refreshToken: data.refreshToken ?? credentials.refreshToken,
-		user: {
-			...refreshedUser,
-			emailVerified: true
-		}
-	};
-	await writeForgewayCredentials(updated, {
-		platformApiUrl: updated.platformApiUrl,
-		email: updated.user?.email
-	});
-	return updated;
-}
-async function sendForgewayAccountLoginLink(input) {
-	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
-	const webUrl = normalizeDinewayWebUrl(input.webUrl);
-	const redirectTo = new URL("/cli-auth", webUrl).toString();
-	const { error } = await createForgewayAccountClient(platformApiUrl).auth.sendPasswordlessSignInEmail({
-		email: input.email,
-		redirectTo
-	});
-	if (error) throw new Error(error.message || "Failed to send Forgeway account sign-in link.");
-}
-async function completeForgewayAccountLogin(input) {
-	const platformApiUrl = normalizeForgewayApiUrl(input.platformApiUrl);
-	const { data, error } = await createForgewayAccountClient(platformApiUrl).auth.signInWithPasswordlessToken({ token: input.token });
-	if (error || !data?.accessToken || !data.refreshToken) throw new Error(error?.message || "Forgeway sign-in token is invalid or expired.");
-	const user = normalizeForgewayUser$2(data.user);
-	if (input.email && normalizeForgewayEmail(user.email) !== normalizeForgewayEmail(input.email)) throw new Error("Forgeway sign-in returned credentials for a different email.");
-	const credentials = {
-		platformApiUrl,
-		accessToken: data.accessToken,
-		refreshToken: data.refreshToken,
-		user: {
-			...user,
-			emailVerified: true
-		}
-	};
-	await writeForgewayCredentials(credentials, {
-		platformApiUrl,
-		email: credentials.user?.email
-	});
-	return credentials;
-}
-async function getForgewayDinewayAccount(credentials) {
-	const refreshed = await refreshForgewayAccountCredentials(credentials);
-	const { data, error } = await createForgewayAccountClient(refreshed.platformApiUrl, refreshed.accessToken).dineway.getAccount();
-	if (error || !data) throw new Error(error?.message || "Failed to fetch Dineway account status from Forgeway.");
-	return {
-		credentials: refreshed,
-		account: data
-	};
-}
-
-//#endregion
-//#region src/cli/output.ts
-/**
-* Redirect consola output to stderr so it doesn't pollute JSON on stdout.
-*
-* Call this early in any command that uses `output()` with `--json`.
-* Safe to call multiple times — only applies the redirect once.
-*/
-function configureOutputMode(args) {
-	if (args.json || !process.stdout.isTTY) {
-		consola$1.options.stdout = process.stderr;
-		consola$1.options.stderr = process.stderr;
-	}
-}
-/**
-* Output data as JSON or pretty-printed.
-*
-* If stdout is not a TTY or --json is set, outputs JSON.
-* Otherwise, outputs a formatted representation.
-*/
-function output(data, args) {
-	if (args.json || !process.stdout.isTTY) process.stdout.write(JSON.stringify(data, null, 2) + "\n");
-	else prettyPrint(data);
-}
-function prettyPrint(data, indent = 0) {
-	if (data === null || data === void 0) {
-		consola$1.log("(empty)");
-		return;
-	}
-	if (Array.isArray(data)) {
-		if (data.length === 0) {
-			consola$1.log("(no items)");
-			return;
-		}
-		for (const item of data) {
-			prettyPrint(item, indent);
-			if (indent === 0) consola$1.log("---");
-		}
-		return;
-	}
-	if (typeof data === "object") {
-		const obj = Object(data);
-		if ("items" in obj && Array.isArray(obj.items)) {
-			prettyPrint(obj.items, indent);
-			if (typeof obj.nextCursor === "string") consola$1.log(`\nNext cursor: ${obj.nextCursor}`);
-			return;
-		}
-		const prefix = "  ".repeat(indent);
-		for (const [key, value] of Object.entries(obj)) {
-			if (value === null || value === void 0) continue;
-			if (typeof value === "object" && !Array.isArray(value)) {
-				consola$1.log(`${prefix}${key}:`);
-				prettyPrint(value, indent + 1);
-			} else if (Array.isArray(value)) consola$1.log(`${prefix}${key}: [${value.length} items]`);
-			else {
-				const str = typeof value === "string" ? value : JSON.stringify(value);
-				const display = str.length > 80 ? str.slice(0, 77) + "..." : str;
-				consola$1.log(`${prefix}${key}: ${display}`);
-			}
-		}
-		return;
-	}
-	consola$1.log(typeof data === "string" ? data : JSON.stringify(data));
-}
-
-//#endregion
 //#region src/cli/commands/account.ts
 async function promptLine(question) {
 	const readline = createInterface({
@@ -378,12 +113,14 @@ const accountLoginCommand = defineCommand({
 			consola$1.error("Email is required.");
 			process.exit(2);
 		}
+		let validatingStoredAccount = false;
 		try {
 			const existing = await readStoredForgewayAccount({
 				platformApiUrl,
 				email
 			});
 			if (existing && !args.token && !args["send-link"]) {
+				validatingStoredAccount = true;
 				const { account } = await getForgewayDinewayAccount(existing);
 				if (args.json) outputAccountJson({
 					loggedIn: true,
@@ -431,6 +168,15 @@ const accountLoginCommand = defineCommand({
 				consola$1.info(`Hosted sites: ${account.sites.usedHostedSites.toLocaleString()} / ${account.sites.hostedSiteLimitLabel}`);
 			}
 		} catch (error) {
+			if (validatingStoredAccount && error instanceof InvalidForgewayAccountCredentialsError) {
+				await removeStoredForgewayAccount({
+					platformApiUrl,
+					email
+				});
+				consola$1.error("Stored Dineway account credentials were invalid and have been cleared.");
+				consola$1.info(`Run ${pc.cyan(`dineway account login --email ${email}`)} again to sign in.`);
+				process.exit(2);
+			}
 			consola$1.error(error instanceof Error ? error.message : "Dineway account login failed");
 			process.exit(2);
 		}
@@ -504,320 +250,6 @@ const accountCommand = defineCommand({
 	}
 });
 
-//#endregion
-//#region src/cli/credentials.ts
-/**
-* Credential storage for CLI auth tokens.
-*
-* Stores OAuth tokens in ~/.config/dineway/auth.json.
-* Remote URLs are keyed by origin, local dev by project path.
-*/
-function getConfigDir() {
-	const xdg = process.env["XDG_CONFIG_HOME"];
-	if (xdg) return join(xdg, "dineway");
-	return join(homedir(), ".config", "dineway");
-}
-function getCredentialPath() {
-	return join(getConfigDir(), "auth.json");
-}
-/**
-* Resolve the credential key for a given URL.
-*
-* Remote URLs are keyed by origin (e.g. "https://my-site.pages.dev").
-* Local dev instances are keyed by project path (e.g. "path:/Users/matt/sites/blog").
-*/
-function resolveCredentialKey(baseUrl) {
-	try {
-		const url = new URL(baseUrl);
-		if (url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]") {
-			const projectPath = findProjectRoot(process.cwd());
-			if (projectPath) return `path:${projectPath}`;
-			return url.origin;
-		}
-		return url.origin;
-	} catch {
-		return baseUrl;
-	}
-}
-/**
-* Walk up from cwd to find the project root (directory containing astro.config.*).
-*/
-function findProjectRoot(from) {
-	let dir = resolve(from);
-	const root = resolve("/");
-	while (dir !== root) {
-		for (const name of [
-			"astro.config.ts",
-			"astro.config.mts",
-			"astro.config.js",
-			"astro.config.mjs"
-		]) if (existsSync(join(dir, name))) return dir;
-		const parent = resolve(dir, "..");
-		if (parent === dir) break;
-		dir = parent;
-	}
-	return null;
-}
-function readStore() {
-	const path = getCredentialPath();
-	try {
-		if (existsSync(path)) {
-			const content = readFileSync(path, "utf-8");
-			return JSON.parse(content);
-		}
-	} catch {}
-	return {};
-}
-function writeStore(store) {
-	mkdirSync(getConfigDir(), {
-		recursive: true,
-		mode: 448
-	});
-	writeFileSync(getCredentialPath(), JSON.stringify(store, null, "	"), {
-		encoding: "utf-8",
-		mode: 384
-	});
-}
-/**
-* Get stored credentials for a URL.
-*/
-function getCredentials(baseUrl) {
-	const key = resolveCredentialKey(baseUrl);
-	const cred = readStore()[key];
-	if (!cred || !("accessToken" in cred)) return null;
-	return cred;
-}
-/**
-* Save credentials for a URL.
-*/
-function saveCredentials(baseUrl, cred) {
-	const key = resolveCredentialKey(baseUrl);
-	const store = readStore();
-	store[key] = cred;
-	writeStore(store);
-}
-/**
-* Remove credentials for a URL.
-*/
-function removeCredentials(baseUrl) {
-	const key = resolveCredentialKey(baseUrl);
-	const store = readStore();
-	if (key in store) {
-		delete store[key];
-		writeStore(store);
-		return true;
-	}
-	return false;
-}
-function marketplaceKey(registryUrl) {
-	try {
-		return `marketplace:${new URL(registryUrl).origin}`;
-	} catch {
-		return `marketplace:${registryUrl}`;
-	}
-}
-/**
-* Get stored marketplace credential for a registry URL.
-*/
-function getMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const cred = readStore()[key];
-	if (!cred || !("token" in cred)) return null;
-	if (new Date(cred.expiresAt) < /* @__PURE__ */ new Date()) return null;
-	return cred;
-}
-/**
-* Save marketplace credential for a registry URL.
-*/
-function saveMarketplaceCredential(registryUrl, cred) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	store[key] = cred;
-	writeStore(store);
-}
-/**
-* Remove marketplace credential for a registry URL.
-*/
-function removeMarketplaceCredential(registryUrl) {
-	const key = marketplaceKey(registryUrl);
-	const store = readStore();
-	if (key in store) {
-		delete store[key];
-		writeStore(store);
-		return true;
-	}
-	return false;
-}
-
-//#endregion
-//#region src/cli/project-env.ts
-const DEFAULT_DINEWAY_URL = "http://localhost:4321";
-const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
-const LINE_SPLIT_PATTERN = /\r?\n/;
-const DINEWAY_LOCAL_STATE_GITIGNORE_COMMENT = "# Dineway local state";
-const DINEWAY_LOCAL_STATE_GITIGNORE_ENTRIES = [
-	".dineway/deploy.json",
-	".dineway/forgeway.json",
-	".dineway/types.ts",
-	".dineway/schema.json",
-	".dineway/uploads/"
-];
-const NEWLINE_PATTERN = /\r?\n/g;
-function parseDotenvValue(value) {
-	const trimmed = value.trim();
-	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") || trimmed.startsWith("'") && trimmed.endsWith("'")) return trimmed.slice(1, -1);
-	return trimmed;
-}
-function parseDotenv(text) {
-	const env = {};
-	for (const line of text.split(LINE_SPLIT_PATTERN)) {
-		const trimmed = line.trim();
-		if (!trimmed || trimmed.startsWith("#")) continue;
-		const normalized = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equalsIndex = normalized.indexOf("=");
-		if (equalsIndex <= 0) continue;
-		const key = normalized.slice(0, equalsIndex).trim();
-		if (!ENV_KEY_PATTERN.test(key)) continue;
-		env[key] = parseDotenvValue(normalized.slice(equalsIndex + 1));
-	}
-	return env;
-}
-function readProjectEnv(cwd = process.cwd()) {
-	const envPath = join(cwd, ".env");
-	if (!existsSync(envPath)) return {};
-	return parseDotenv(readFileSync(envPath, "utf-8"));
-}
-function getProjectEnvValue(name, cwd = process.cwd()) {
-	return process.env[name] ?? readProjectEnv(cwd)[name];
-}
-function resolveDinewayBaseUrl(url, cwd = process.cwd()) {
-	if (url && url !== DEFAULT_DINEWAY_URL) return url;
-	const projectEnv = readProjectEnv(cwd);
-	return process.env["DINEWAY_URL"] ?? process.env["DINEWAY_SITE_URL"] ?? projectEnv["DINEWAY_SITE_URL"] ?? projectEnv["DINEWAY_URL"] ?? url ?? DEFAULT_DINEWAY_URL;
-}
-function resolveDinewayToken(token, cwd = process.cwd()) {
-	return token ?? getProjectEnvValue("DINEWAY_TOKEN", cwd);
-}
-function formatEnvValue(value) {
-	return value.replace(NEWLINE_PATTERN, "");
-}
-async function upsertProjectEnv(cwd, values) {
-	const envPath = join(cwd, ".env");
-	const existing = await readFile(envPath, "utf-8").catch(() => "");
-	const lines = existing ? existing.split(LINE_SPLIT_PATTERN) : [];
-	const seen = /* @__PURE__ */ new Set();
-	const nextLines = lines.map((line) => {
-		const trimmed = line.trim();
-		const normalized = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
-		const equalsIndex = normalized.indexOf("=");
-		if (equalsIndex <= 0) return line;
-		const key = normalized.slice(0, equalsIndex).trim();
-		const value = values[key];
-		if (!(key in values) || value === void 0) return line;
-		seen.add(key);
-		return `${key}=${formatEnvValue(value)}`;
-	});
-	for (const [key, value] of Object.entries(values)) {
-		if (value === void 0 || seen.has(key)) continue;
-		nextLines.push(`${key}=${formatEnvValue(value)}`);
-	}
-	await writeFile(envPath, `${nextLines.filter((line, index) => line || index < nextLines.length - 1).join("\n")}\n`, "utf-8");
-}
-async function ensureProjectGitignoreEntry(cwd, entry) {
-	const gitignorePath = join(cwd, ".gitignore");
-	const existing = await readFile(gitignorePath, "utf-8").catch(() => "");
-	if (existing.split(LINE_SPLIT_PATTERN).map((line) => line.trim()).includes(entry)) return;
-	await writeFile(gitignorePath, `${existing}${existing && !existing.endsWith("\n") ? "\n" : ""}${entry}\n`, "utf-8");
-}
-async function ensureProjectGitignoreDinewayLocalState(cwd) {
-	const gitignorePath = join(cwd, ".gitignore");
-	const existing = await readFile(gitignorePath, "utf-8").catch(() => "");
-	const lines = new Set(existing.split(LINE_SPLIT_PATTERN).map((line) => line.trim()));
-	const missingEntries = DINEWAY_LOCAL_STATE_GITIGNORE_ENTRIES.filter((entry) => !lines.has(entry));
-	if (missingEntries.length === 0) return;
-	const block = [DINEWAY_LOCAL_STATE_GITIGNORE_COMMENT, ...missingEntries].join("\n");
-	await writeFile(gitignorePath, `${existing}${existing.trim() ? existing.endsWith("\n") ? "\n" : "\n\n" : ""}${block}\n`, "utf-8");
-}
-
-//#endregion
-//#region src/cli/client-factory.ts
-var client_factory_exports = /* @__PURE__ */ __exportAll({
-	connectionArgs: () => connectionArgs,
-	createClientFromArgs: () => createClientFromArgs
-});
-/**
-* Shared connection args for all CLI commands that talk to a Dineway instance.
-* Spread into each command's `args` definition.
-*/
-const connectionArgs = {
-	url: {
-		type: "string",
-		alias: "u",
-		description: "Dineway instance URL",
-		default: DEFAULT_DINEWAY_URL
-	},
-	token: {
-		type: "string",
-		alias: "t",
-		description: "Auth token"
-	},
-	header: {
-		type: "string",
-		alias: "H",
-		description: "Custom header \"Name: Value\" (repeatable, or use DINEWAY_HEADERS env)"
-	},
-	json: {
-		type: "boolean",
-		description: "Output as JSON"
-	}
-};
-/**
-* Create a DinewayClient from CLI args, env vars, and stored credentials.
-*
-* Auth resolution order:
-* 1. --token flag
-* 2. DINEWAY_TOKEN env var
-* 3. Stored credentials (~/.config/dineway/auth.json)
-* 4. Dev bypass (if URL is localhost)
-*
-* Custom headers are merged from (in priority order):
-* 1. Stored credentials (persisted during `dineway login --header`)
-* 2. DINEWAY_HEADERS env var
-* 3. --header CLI flags
-*/
-function createClientFromArgs(args) {
-	const baseUrl = resolveDinewayBaseUrl(args.url);
-	let token = resolveDinewayToken(args.token);
-	const isLocal = baseUrl.includes("localhost") || baseUrl.includes("127.0.0.1");
-	const cred = !token ? getCredentials(baseUrl) : null;
-	const customHeaders = {
-		...cred?.customHeaders,
-		...resolveCustomHeaders()
-	};
-	const extraInterceptors = [];
-	if (Object.keys(customHeaders).length > 0) extraInterceptors.push(customHeadersInterceptor(customHeaders));
-	if (!token && cred) if (new Date(cred.expiresAt) > /* @__PURE__ */ new Date()) token = cred.accessToken;
-	else return new DinewayClient({
-		baseUrl,
-		token: cred.accessToken,
-		refreshToken: cred.refreshToken,
-		onTokenRefresh: (newAccessToken, expiresIn) => {
-			saveCredentials(baseUrl, {
-				...cred,
-				accessToken: newAccessToken,
-				expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
-			});
-		},
-		interceptors: extraInterceptors
-	});
-	return new DinewayClient({
-		baseUrl,
-		token,
-		devBypass: !token && isLocal,
-		interceptors: extraInterceptors
-	});
-}
-
 //#endregion
 //#region src/cli/commands/auth.ts
 /**
@@ -1064,7 +496,7 @@ const createCommand$1 = defineCommand({
 		},
 		draft: {
 			type: "boolean",
-			description: "Keep as draft instead of auto-publishing"
+			description: "Explicitly create as Draft (the only supported creation mode)"
 		},
 		...connectionArgs
 	},
@@ -1079,7 +511,6 @@ const createCommand$1 = defineCommand({
 				locale: args.locale,
 				translationOf: args["translation-of"]
 			});
-			if (!args.draft) await client.publish(args.collection, item.id);
 			output(await client.get(args.collection, item.id), args);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -1122,7 +553,7 @@ const updateCommand = defineCommand({
 		},
 		draft: {
 			type: "boolean",
-			description: "Keep as draft instead of auto-publishing"
+			description: "Explicitly update the Draft (the only supported update mode)"
 		},
 		...connectionArgs
 	},
@@ -1136,7 +567,6 @@ const updateCommand = defineCommand({
 				_rev: args.rev,
 				locale: args.locale
 			});
-			if (!args.draft && updated.draftRevisionId) await client.publish(args.collection, updated.id);
 			output(await client.get(args.collection, updated.id), args);
 		} catch (error) {
 			consola$1.error(error instanceof Error ? error.message : "Unknown error");
@@ -1190,12 +620,25 @@ const publishCommand$1 = defineCommand({
 			description: "Content item ID or slug",
 			required: true
 		},
+		"review-request": {
+			type: "string",
+			description: "Approved editorial Review Request ID for the exact Draft",
+			required: true
+		},
+		"release-authorization": {
+			type: "string",
+			description: "Approved release authorization ID for this token action",
+			required: true
+		},
 		...connectionArgs
 	},
 	async run({ args }) {
 		configureOutputMode(args);
 		try {
-			await createClientFromArgs(args).publish(args.collection, args.id);
+			await createClientFromArgs(args).publish(args.collection, args.id, {
+				reviewRequestId: args["review-request"],
+				releaseAuthorizationId: args["release-authorization"]
+			});
 			output({ success: true }, args);
 			consola$1.success(`Published ${args.collection}/${args.id}`);
 		} catch (error) {
@@ -1255,12 +698,26 @@ const scheduleCommand = defineCommand({
 			description: "ISO 8601 datetime to publish at",
 			required: true
 		},
+		"review-request": {
+			type: "string",
+			description: "Approved editorial Review Request ID for the exact Draft",
+			required: true
+		},
+		"release-authorization": {
+			type: "string",
+			description: "Approved release authorization ID for this token action",
+			required: true
+		},
 		...connectionArgs
 	},
 	async run({ args }) {
 		configureOutputMode(args);
 		try {
-			await createClientFromArgs(args).schedule(args.collection, args.id, { at: args.at });
+			await createClientFromArgs(args).schedule(args.collection, args.id, {
+				at: args.at,
+				reviewRequestId: args["review-request"],
+				releaseAuthorizationId: args["release-authorization"]
+			});
 			output({ success: true }, args);
 			consola$1.success(`Scheduled ${args.collection}/${args.id} for ${args.at}`);
 		} catch (error) {
@@ -1349,7 +806,7 @@ const contentCommand = defineCommand({
 //#endregion
 //#region src/cli/paywall.ts
 const PAYWALL_MESSAGE_PATTERN = /\b(quota|credit|credits|upgrade|plan|billing|subscription|slot)\b/i;
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null;
 }
 function stringField(record, key) {
@@ -1357,9 +814,9 @@ function stringField(record, key) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
 function getNestedError(value) {
-	if (!isRecord$1(value)) return null;
+	if (!isRecord$2(value)) return null;
 	const nested = value.error;
-	return isRecord$1(nested) ? nested : value;
+	return isRecord$2(nested) ? nested : value;
 }
 function isHostedSitesResource(resource) {
 	const normalized = resource.toLowerCase();
@@ -1927,7 +1384,7 @@ const FLY_HOST_RE = /\b[a-z0-9][a-z0-9-]*\.fly\.dev\b/;
 const INVALID_FLY_APP_CHARS_RE = /[^a-z0-9-]+/g;
 const REPEATED_HYPHENS_RE$2 = /-+/g;
 const EDGE_HYPHENS_RE$2 = /^-|-$/g;
-const LINE_SPLIT_RE = /\r?\n/;
+const LINE_SPLIT_RE$1 = /\r?\n/;
 const DEFAULT_REGION$1 = "iad";
 const FLY_VOLUME_NAME = "dineway_data";
 async function fileExists$8(path) {
@@ -2019,7 +1476,7 @@ primary_region = "${region}"
 function parseFlyUrl(stdout) {
 	const direct = stdout.match(FLY_URL_RE);
 	if (direct) return direct[0];
-	for (const line of stdout.split(LINE_SPLIT_RE).filter(Boolean)) try {
+	for (const line of stdout.split(LINE_SPLIT_RE$1).filter(Boolean)) try {
 		const url = findFlyUrl(JSON.parse(line));
 		if (url) return url;
 	} catch {
@@ -2191,7 +1648,7 @@ async function writeForgewayDeployMetadata(cwd, metadata) {
 
 //#endregion
 //#region src/cli/commands/deploy/targets/forgeway.ts
-const DEFAULT_DINEWAY_API_BASE_URL$1 = "https://api.dineway.ai";
+const DEFAULT_DINEWAY_API_BASE_URL = "https://api.dineway.ai";
 const DATABASE_ENV_VAR_NAMES = ["DINEWAY_DATABASE_URL", "DINEWAY_DATABASE_AUTH_TOKEN"];
 const POLL_INTERVAL_MS$1 = 5e3;
 const POLL_TIMEOUT_MS$1 = 3e5;
@@ -2206,12 +1663,12 @@ const NON_COMPARE_PATTERN = /[^\p{Letter}\p{Number}]+/gu;
 const LOCATION_PARTS_PATTERN = /[,;|/]+|\s+-\s+/u;
 const JWT_PATTERN = /[A-Za-z0-9_-]{32,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g;
 const TOKEN_ASSIGNMENT_PATTERN = /(DINEWAY_DATABASE_AUTH_TOKEN|DATABASE_AUTH_TOKEN|AUTH_TOKEN)=\S+/gi;
-const TRAILING_SLASH_PATTERN$1 = /\/$/;
+const TRAILING_SLASH_PATTERN = /\/$/;
 const BACKSLASH_PATTERN = /\\/g;
 const DINEWAY_PACKAGE_NAME = "dineway";
 const SEMVER_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:[-+].*)?$/;
 const LOCAL_PACKAGE_SPEC_PATTERN = /^(?:workspace|file|link|portal):/;
-const SHADOW_EMAIL_PATTERN$1 = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
+const SHADOW_EMAIL_PATTERN = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
 const FOOD_TYPES = new Set([
 	"restaurant",
 	"cafe",
@@ -2259,7 +1716,7 @@ var ForgewayApiError = class extends Error {
 		this.name = "ForgewayApiError";
 	}
 };
-function normalizeForgewayUser$1(user) {
+function normalizeForgewayUser(user) {
 	return {
 		id: user.id,
 		name: user.profile?.name ?? user.name ?? user.email,
@@ -2280,7 +1737,7 @@ async function fileExists$7(path) {
 	}
 }
 function normalizePlatformApiUrl(value) {
-	return (value || DEFAULT_DINEWAY_API_BASE_URL$1).replace(TRAILING_SLASH_PATTERN$1, "");
+	return (value || DEFAULT_DINEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN, "");
 }
 function resolvePlatformApiUrl(savedPlatformApiUrl) {
 	return normalizePlatformApiUrl(getEnv("DINEWAY_API_BASE_URL") ?? (typeof savedPlatformApiUrl === "string" ? savedPlatformApiUrl : void 0));
@@ -2343,11 +1800,11 @@ async function parseErrorResponse(response) {
 	}
 	return `Forgeway request failed: ${response.status}`;
 }
-function normalizeEmail$1(email) {
+function normalizeEmail(email) {
 	return email.trim().toLowerCase();
 }
-function isShadowEmail$1(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN$1.test(email));
+function isShadowEmail(email) {
+	return Boolean(email && SHADOW_EMAIL_PATTERN.test(email));
 }
 async function refreshFormalAccessToken(context, deps) {
 	if (!context.refreshToken) throw new Error("Forgeway formal account refresh token is missing. Run dineway deploy again.");
@@ -2359,7 +1816,7 @@ async function refreshFormalAccessToken(context, deps) {
 	if (!response.ok) throw new Error("Failed to refresh Forgeway formal account credentials. Run dineway deploy again.");
 	const payload = await response.json();
 	if (!payload.accessToken) throw new Error("Forgeway refresh response was missing accessToken.");
-	const user = assertVerifiedFormalAccountUser(payload.user ? normalizeForgewayUser$1(payload.user) : context.user, context.user?.email);
+	const user = assertVerifiedFormalAccountUser(payload.user ? normalizeForgewayUser(payload.user) : context.user, context.user?.email);
 	const updated = {
 		platformApiUrl: context.platformApiUrl,
 		accessToken: payload.accessToken,
@@ -2406,7 +1863,7 @@ function getDependencySpec(pkg, name) {
 		if (typeof value === "string" && value.trim()) return value.trim();
 	}
 }
-async function readProjectPackage(cwd) {
+async function readProjectPackage$1(cwd) {
 	try {
 		return await readDeployPackageJson(cwd);
 	} catch {
@@ -2420,7 +1877,7 @@ function isDinewayDependencySpecCompatible(dependencySpec, cliVersion) {
 }
 async function warnProjectDinewayRuntimeMismatch(cwd, cliVersion = VERSION) {
 	if (!SEMVER_VERSION_PATTERN.test(cliVersion)) return;
-	const pkg = await readProjectPackage(cwd);
+	const pkg = await readProjectPackage$1(cwd);
 	if (!pkg) return;
 	const dependencySpec = getDependencySpec(pkg, DINEWAY_PACKAGE_NAME);
 	if (!dependencySpec) return;
@@ -2434,20 +1891,20 @@ function savedPublisherEmail(saved) {
 	return typeof saved.publisherEmail === "string" && saved.publisherEmail.trim() ? saved.publisherEmail : void 0;
 }
 function validatePublisherEmail(rawEmail) {
-	const email = normalizeEmail$1(rawEmail);
-	if (!email || isShadowEmail$1(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
+	const email = normalizeEmail(rawEmail);
+	if (!email || isShadowEmail(email)) throw new Error("Dineway account email must be a real owner email, not a shadow user email.");
 	return email;
 }
 function isStoredFormalCredentialForEmail(stored, email) {
 	if (!stored?.accessToken || !stored.user) return false;
-	if (email && normalizeEmail$1(stored.user.email) !== email) return false;
+	if (email && normalizeEmail(stored.user.email) !== email) return false;
 	if (stored.user.emailVerified !== true) return false;
-	if (isShadowEmail$1(stored.user.email)) return false;
+	if (isShadowEmail(stored.user.email)) return false;
 	return true;
 }
 function assertVerifiedFormalAccountUser(user, expectedEmail) {
-	if (!user || user.emailVerified !== true || isShadowEmail$1(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
-	if (expectedEmail && normalizeEmail$1(user.email) !== normalizeEmail$1(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
+	if (!user || user.emailVerified !== true || isShadowEmail(user.email)) throw new Error("Forgeway formal account credentials require a verified formal account.");
+	if (expectedEmail && normalizeEmail(user.email) !== normalizeEmail(expectedEmail)) throw new Error("Forgeway refresh returned credentials for a different email.");
 	return user;
 }
 async function readCachedPublisherCredentials(cwd, platformApiUrl, email, deps) {
@@ -2480,14 +1937,14 @@ async function resolveCachedPublisherAccount(cwd, options, saved, platformApiUrl
 		platformApiUrl
 	});
 	if (isStoredFormalCredentialForEmail(singleCredentials)) return {
-		email: normalizeEmail$1(singleCredentials.user.email),
+		email: normalizeEmail(singleCredentials.user.email),
 		credentials: singleCredentials
 	};
 	const accounts = (await (deps.listCredentials ?? listForgewayCredentials)(platformApiUrl)).filter((credentials) => isStoredFormalCredentialForEmail(credentials));
 	if (accounts.length === 1) {
 		const credentials = accounts[0];
 		return {
-			email: normalizeEmail$1(credentials.user.email),
+			email: normalizeEmail(credentials.user.email),
 			credentials
 		};
 	}
@@ -2549,7 +2006,7 @@ async function resolveProjectContext(cwd, options, deps) {
 	if (formal.email) throw new Error(`No verified Dineway account credentials were found for ${formal.email}. Run: dineway account login --email ${formal.email}`);
 	throw new Error("No verified Dineway account credentials were found. Run: dineway account login");
 }
-function isRecord(value) {
+function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function scalarText(value) {
@@ -2562,7 +2019,7 @@ function uniqueStrings(values) {
 function displayText(value) {
 	if (typeof value === "string" || typeof value === "number") return String(value);
 	if (Array.isArray(value)) return value.map(displayText).filter(Boolean).join(" ");
-	if (isRecord(value)) return displayText(value.text) || displayText(value.name) || displayText(value.displayName) || displayText(value.longText) || displayText(value.shortText) || displayText(value.long_name) || displayText(value.short_name) || displayText(value.value);
+	if (isRecord$1(value)) return displayText(value.text) || displayText(value.name) || displayText(value.displayName) || displayText(value.longText) || displayText(value.shortText) || displayText(value.long_name) || displayText(value.short_name) || displayText(value.value);
 	return "";
 }
 function normalizeCompare(value) {
@@ -2580,7 +2037,7 @@ function candidateNameTexts(candidate) {
 	]);
 }
 function candidateAddressTexts(candidate) {
-	const addressComponents = Array.isArray(candidate.addressComponents) ? candidate.addressComponents.flatMap((component) => isRecord(component) ? [
+	const addressComponents = Array.isArray(candidate.addressComponents) ? candidate.addressComponents.flatMap((component) => isRecord$1(component) ? [
 		displayText(component.longText),
 		displayText(component.shortText),
 		displayText(component.long_name),
@@ -2722,11 +2179,11 @@ function selectPlaceCandidate(candidates, context) {
 	} : null;
 }
 function extractPlaceCandidates(payload) {
-	const root = isRecord(payload) ? payload : {};
-	const nestedData = isRecord(root.data) ? root.data : {};
+	const root = isRecord$1(payload) ? payload : {};
+	const nestedData = isRecord$1(root.data) ? root.data : {};
 	const places = root.places ?? root.results ?? nestedData.places ?? nestedData.results;
 	if (!Array.isArray(places)) throw new Error("Dineway place search response did not include places/results.");
-	return places.filter(isRecord);
+	return places.filter(isRecord$1);
 }
 async function resolvePlaceIdWithFormalSearch(options) {
 	const candidates = extractPlaceCandidates(await ossFetch(options.context, "/api/places/search", options.deps, {
@@ -2743,7 +2200,7 @@ async function resolvePlaceIdWithFormalSearch(options) {
 	return finalPlaceId;
 }
 async function ossFetch(context, path, deps, options = {}) {
-	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN$1, "")}${path}`, {
+	const request = async (token) => await forgewayRequest(`${context.ossHost.replace(TRAILING_SLASH_PATTERN, "")}${path}`, {
 		...options,
 		headers: {
 			"Content-Type": "application/json",
@@ -3258,7 +2715,7 @@ async function deployForgeway(cwd, options, deps = {}) {
 		deps,
 		verbose
 	});
-	if (context.user?.email) await writeForgewayDeployMetadata(cwd, { publisherEmail: normalizeEmail$1(context.user.email) });
+	if (context.user?.email) await writeForgewayDeployMetadata(cwd, { publisherEmail: normalizeEmail(context.user.email) });
 	const url = deployment.liveUrl ?? `https://${site.domain}`;
 	await (deps.writeProjectEnv ?? persistForgewayCliEnv)(cwd, {
 		siteUrl: url,
@@ -4040,7 +3497,7 @@ const devCommand = defineCommand({
 			const remoteUrl = pkg.dineway?.url || process.env.DINEWAY_URL;
 			if (!remoteUrl) consola.warn("No remote URL configured. Set DINEWAY_URL or dineway.url in package.json");
 			else try {
-				const { createClientFromArgs } = await Promise.resolve().then(() => client_factory_exports);
+				const { createClientFromArgs } = await import("../client-factory-DEtHApCc.mjs").then((n) => n.t);
 				const client = createClientFromArgs({ url: remoteUrl });
 				const schema = await client.schemaExport();
 				const types = await client.schemaTypes();
@@ -4746,6 +4203,76 @@ async function getTaxonomyAssignments(taxonomyRepo, collection, entryId) {
 	return result;
 }
 
+//#endregion
+//#region src/integration-credentials/environment-import.ts
+const INTEGRATION_CREDENTIAL_IMPORT_MARKER = "dineway:integration_credentials_environment_import_v1";
+const INTEGRATION_TOKEN_ENV_SOURCES = [
+	["akta", "AKTA_API_KEY"],
+	["apify", "APIFY_API_TOKEN"],
+	["apollo", "APOLLO_API_KEY"],
+	["bundle-social", "BUNDLE_SOCIAL_API_KEY"],
+	["context.dev", "CONTEXT_DEV_API_KEY"],
+	["elevenlabs", "ELEVENLABS_API_KEY"],
+	["exa", "EXA_API_KEY"],
+	["firecrawl", "FIRECRAWL_API_KEY"],
+	["google-places", "GOOGLE_PLACES_API_KEY"],
+	["minimax", "MINIMAX_API_KEY"],
+	["pdl", "PDL_API_KEY"],
+	["semrush", "SEMRUSH_V4_API_KEY"],
+	["tabapi", "TABAPI_API_KEY"],
+	["tikhub", "TIKHUB_API_KEY"]
+];
+async function importIntegrationCredentialsFromEnvironment(db, env) {
+	if (await new OptionsRepository(db).exists(INTEGRATION_CREDENTIAL_IMPORT_MARKER)) return {
+		status: "already_completed",
+		providers: []
+	};
+	const credentials = collectEnvironmentCredentials(env);
+	const keys = await parseEncryptionKeys(env.DINEWAY_ENCRYPTION_KEY);
+	if (credentials.length > 0 && (!keys || keys.length === 0)) throw new DinewaySecretsError("DINEWAY_ENCRYPTION_KEY is required to import Integration credentials.", "ENCRYPTION_KEY_REQUIRED");
+	await db.transaction().execute(async (trx) => {
+		const store = new IntegrationCredentialStore(trx, { keys: keys ?? [] });
+		for (const entry of credentials) await store.set(entry.provider, entry.credential, "environment");
+		await new OptionsRepository(trx).set(INTEGRATION_CREDENTIAL_IMPORT_MARKER, {
+			completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			providerCount: credentials.length
+		});
+	});
+	return {
+		status: credentials.length > 0 ? "imported" : "completed_empty",
+		providers: credentials.map((entry) => entry.provider)
+	};
+}
+function collectEnvironmentCredentials(env) {
+	const credentials = [];
+	for (const [provider, variable] of INTEGRATION_TOKEN_ENV_SOURCES) {
+		const value = nonEmpty(env[variable]);
+		if (value) credentials.push({
+			provider,
+			credential: {
+				type: "token",
+				value
+			}
+		});
+	}
+	const username = nonEmpty(env.DATAFORSEO_LOGIN);
+	const password = nonEmpty(env.DATAFORSEO_PASSWORD);
+	if (username && !password || !username && password) throw new DinewaySecretsError("DATAFORSEO_LOGIN and DATAFORSEO_PASSWORD must both be set for the initial Integration import.", "INCOMPLETE_INTEGRATION_CREDENTIAL");
+	if (username && password) credentials.push({
+		provider: "dataforseo",
+		credential: {
+			type: "basic",
+			username,
+			password
+		}
+	});
+	return credentials;
+}
+function nonEmpty(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : null;
+}
+
 //#endregion
 //#region src/cli/commands/init.ts
 /**
@@ -4844,6 +4371,17 @@ const initCommand = defineCommand({
 			await db.destroy();
 			process.exit(1);
 		}
+		try {
+			const imported = await importIntegrationCredentialsFromEnvironment(db, {
+				...readProjectEnv(cwd),
+				...process.env
+			});
+			if (imported.status === "imported") consola.success(`Imported Integration configuration for ${imported.providers.length} providers`);
+		} catch (error) {
+			consola.error("Integration configuration import failed. No provider credentials were stored.", error);
+			await db.destroy();
+			process.exit(1);
+		}
 		const alreadyInitialized = await isAlreadyInitialized(db);
 		if (alreadyInitialized && !args.force) {
 			await db.destroy();
@@ -5953,7 +5491,7 @@ const publishCommand = defineCommand({
 			const pluginDir = resolve(args.dir);
 			try {
 				const { runCommand } = await import("citty");
-				const { bundleCommand } = await import("../bundle-7C_DpkEq.mjs").then((n) => n.n);
+				const { bundleCommand } = await import("../bundle-CIrUlrkQ.mjs").then((n) => n.n);
 				await runCommand(bundleCommand, { rawArgs: ["--dir", pluginDir] });
 			} catch {
 				consola.error("Build failed");
@@ -6723,164 +6261,712 @@ const seedCommand = defineCommand({
 });
 
 //#endregion
-//#region src/cli/forgeway-seo-client.ts
-const DEFAULT_DINEWAY_API_BASE_URL = "https://api.dineway.ai";
-const TRAILING_SLASH_PATTERN = /\/$/;
-const SHADOW_EMAIL_PATTERN = /^shadow_[a-f0-9]{16}@dineway\.ai$/i;
-var ForgewaySeoApiError = class extends Error {
-	constructor(message, status, body) {
-		super(message);
-		this.status = status;
-		this.body = body;
-		this.name = "ForgewaySeoApiError";
-	}
-};
-function normalizeApiUrl(value) {
-	return (value || DEFAULT_DINEWAY_API_BASE_URL).replace(TRAILING_SLASH_PATTERN, "");
+//#region src/seo/local-crawl.ts
+const CONTRACT_VERSION = 1;
+const USER_AGENT = "DinewayContentCrawler/1.0";
+const DEFAULT_PAGE_LIMIT = 100;
+const MAX_PAGE_LIMIT = 500;
+const DEFAULT_MAX_DEPTH = 3;
+const MAX_DEPTH = 10;
+const DEFAULT_CONCURRENCY = 4;
+const MAX_CONCURRENCY = 10;
+const DEFAULT_TIMEOUT_MS = 1e4;
+const MAX_TIMEOUT_MS = 6e4;
+const DEFAULT_MAX_BYTES = 1e6;
+const MAX_RESOURCE_BYTES = 1e7;
+const MAX_SITEMAPS = 20;
+const MAX_REDIRECTS = 5;
+const MAX_TEXT_EXCERPT = 2e4;
+const LINE_SPLIT_RE = /\r?\n/;
+const COMMENT_RE = /#.*$/;
+const WHITESPACE_RE = /\s+/g;
+const WORD_RE = /[\p{L}\p{N}]+(?:['’-][\p{L}\p{N}]+)*/gu;
+const REGEXP_SPECIAL_RE = /[.*+?^${}()|[\]\\]/g;
+async function crawlLocalSite(options) {
+	const normalized = normalizeOptions(options);
+	if (!normalized.allowPrivateNetwork) await resolveAndValidateExternalUrl(normalized.startUrl.href, { resolver: normalized.dnsResolver });
+	const origin = normalized.startUrl.origin;
+	const skipped = /* @__PURE__ */ new Map();
+	const robots = await loadRobots(normalized);
+	const sitemapResult = normalized.sitemap === "skip" ? {
+		sources: [],
+		urls: []
+	} : await loadSitemaps(normalized, robots.sitemaps);
+	const queue = [];
+	const queued = /* @__PURE__ */ new Set();
+	const enqueue = (candidate, depth, discoveredFrom) => {
+		const url = normalizeUrl(candidate, normalized.startUrl, normalized.keepQuery);
+		if (!url || url.origin !== origin || queued.has(url.href)) return;
+		const pathDecision = pathEligibility(url, normalized);
+		if (pathDecision) {
+			skipped.set(url.href, {
+				url: url.href,
+				reason: pathDecision
+			});
+			return;
+		}
+		if (!robotsAllows(url, robots.rules)) {
+			skipped.set(url.href, {
+				url: url.href,
+				reason: "robots_disallowed"
+			});
+			return;
+		}
+		queued.add(url.href);
+		queue.push({
+			url: url.href,
+			depth,
+			discoveredFrom
+		});
+	};
+	if (normalized.sitemap !== "only") enqueue(normalized.startUrl.href, 0, "start");
+	for (const url of sitemapResult.urls) enqueue(url, 0, "sitemap");
+	const pages = [];
+	let cursor = 0;
+	while (cursor < queue.length && pages.length < normalized.pageLimit) {
+		const remaining = normalized.pageLimit - pages.length;
+		const batch = queue.slice(cursor, cursor + Math.min(normalized.concurrency, remaining));
+		cursor += batch.length;
+		const resources = await Promise.all(batch.map(async (item) => ({
+			item,
+			resource: await fetchResource(item.url, normalized)
+		})));
+		for (const { item, resource } of resources) {
+			const page = pageFromResource(item, resource, normalized);
+			pages.push(page);
+			if (normalized.sitemap !== "only" && !page.error && page.contentType?.includes("text/html") && item.depth < normalized.maxDepth) for (const link of page.internalLinks) enqueue(link.url, item.depth + 1, item.url);
+		}
+	}
+	const edges = pages.flatMap((page) => page.internalLinks.map((link) => ({
+		from: page.url,
+		...link
+	})));
+	const brokenInternalUrls = uniqueSorted(pages.filter((page) => page.httpStatus !== null && page.httpStatus >= 400).filter((page) => edges.some((edge) => edge.url === page.url)).map((page) => page.url));
+	const incoming = new Set(edges.map((edge) => edge.url));
+	const orphanUrls = uniqueSorted(pages.filter((page) => page.url !== normalized.startUrl.href && page.httpStatus !== null && page.httpStatus < 400 && page.contentType?.includes("text/html") && !incoming.has(page.url)).map((page) => page.url));
+	const successfulHtml = pages.filter((page) => page.httpStatus !== null && page.httpStatus < 400 && page.contentType?.includes("text/html"));
+	return {
+		contractVersion: CONTRACT_VERSION,
+		startUrl: normalized.startUrl.href,
+		origin,
+		crawledAt: normalized.now().toISOString(),
+		options: {
+			pageLimit: normalized.pageLimit,
+			maxDepth: normalized.maxDepth,
+			concurrency: normalized.concurrency,
+			include: normalized.includeValues,
+			exclude: normalized.excludeValues,
+			timeoutMs: normalized.timeoutMs,
+			maxBytesPerResource: normalized.maxBytesPerResource,
+			sitemap: normalized.sitemap,
+			keepQuery: normalized.keepQuery,
+			allowPrivateNetwork: normalized.allowPrivateNetwork
+		},
+		sources: {
+			robots: robots.source,
+			sitemaps: sitemapResult.sources
+		},
+		pages,
+		skipped: [...skipped.values()].toSorted((left, right) => left.url.localeCompare(right.url)),
+		linkGraph: {
+			edges,
+			orphanUrls,
+			brokenInternalUrls,
+			duplicateTitles: duplicateGroups(successfulHtml, "title"),
+			duplicateDescriptions: duplicateGroups(successfulHtml, "description"),
+			duplicateContent: duplicateGroups(successfulHtml, "contentSha256")
+		},
+		summary: {
+			fetchedPages: pages.length,
+			htmlPages: pages.filter((page) => page.contentType?.includes("text/html")).length,
+			brokenPages: pages.filter((page) => page.httpStatus !== null && page.httpStatus >= 400).length,
+			orphanPages: orphanUrls.length,
+			skippedUrls: skipped.size,
+			errorPages: pages.filter((page) => page.error).length,
+			pageLimitReached: pages.length === normalized.pageLimit && cursor < queue.length
+		}
+	};
 }
-function resolveForgewaySeoApiUrl(savedPlatformApiUrl, cwd = process.cwd()) {
-	return normalizeApiUrl(getProjectEnvValue("DINEWAY_API_BASE_URL", cwd) ?? (typeof savedPlatformApiUrl === "string" ? savedPlatformApiUrl : void 0));
+function normalizeOptions(options) {
+	const startUrl = normalizeUrl(options.startUrl, void 0, options.keepQuery === true);
+	if (!startUrl) throw new Error("startUrl must be an absolute HTTP or HTTPS URL without credentials");
+	const pageLimit = boundedInteger(options.pageLimit, DEFAULT_PAGE_LIMIT, 1, MAX_PAGE_LIMIT, "pageLimit");
+	const maxDepth = boundedInteger(options.maxDepth, DEFAULT_MAX_DEPTH, 0, MAX_DEPTH, "maxDepth");
+	const concurrency = boundedInteger(options.concurrency, DEFAULT_CONCURRENCY, 1, MAX_CONCURRENCY, "concurrency");
+	const timeoutMs = boundedInteger(options.timeoutMs, DEFAULT_TIMEOUT_MS, 100, MAX_TIMEOUT_MS, "timeoutMs");
+	const maxBytesPerResource = boundedInteger(options.maxBytesPerResource, DEFAULT_MAX_BYTES, 1024, MAX_RESOURCE_BYTES, "maxBytesPerResource");
+	const sitemap = options.sitemap ?? "include";
+	if (![
+		"include",
+		"skip",
+		"only"
+	].includes(sitemap)) throw new Error("sitemap must be include, skip, or only");
+	const includeValues = normalizePatterns(options.include ?? []);
+	const excludeValues = normalizePatterns(options.exclude ?? []);
+	return {
+		startUrl,
+		pageLimit,
+		maxDepth,
+		concurrency,
+		include: includeValues.map(pathMatcher),
+		exclude: excludeValues.map(pathMatcher),
+		includeValues,
+		excludeValues,
+		timeoutMs,
+		maxBytesPerResource,
+		sitemap,
+		keepQuery: options.keepQuery === true,
+		allowPrivateNetwork: options.allowPrivateNetwork === true,
+		dnsResolver: options.dnsResolver,
+		fetch: options.fetch ?? globalThis.fetch,
+		now: options.now ?? (() => /* @__PURE__ */ new Date())
+	};
 }
-function normalizeEmail(value) {
-	return value?.trim().toLowerCase() ?? "";
+function boundedInteger(value, fallback, minimum, maximum, name) {
+	const normalized = value ?? fallback;
+	if (!Number.isInteger(normalized) || normalized < minimum || normalized > maximum) throw new Error(`${name} must be an integer from ${minimum} to ${maximum}`);
+	return normalized;
 }
-function isShadowEmail(email) {
-	return Boolean(email && SHADOW_EMAIL_PATTERN.test(email));
+function normalizePatterns(values) {
+	return uniqueSorted(values.map((value) => value.trim()).filter((value) => {
+		if (!value.startsWith("/") || value.length > 255) throw new Error("include and exclude patterns must be path globs starting with /");
+		return true;
+	}));
 }
-function assertFormalUser(user) {
-	if (!user || user.emailVerified !== true || isShadowEmail(user.email)) throw new Error("Forgeway SEO provider access requires verified formal Forgeway credentials. Run `dineway deploy forgeway` and complete email verification first.");
-	return user;
+function pathMatcher(value) {
+	let source = "^";
+	for (let index = 0; index < value.length; index += 1) {
+		const character = value[index];
+		if (character === "*" && value[index + 1] === "*") {
+			source += ".*";
+			index += 1;
+		} else if (character === "*") source += "[^/]*";
+		else source += escapeRegExp(character ?? "");
+	}
+	return {
+		value,
+		pattern: new RegExp(`${source}$`)
+	};
 }
-function normalizeForgewayUser(user, fallback) {
-	if (!user?.id || !user.email) return fallback;
+function pathEligibility(url, options) {
+	const path = url.pathname;
+	if (options.include.length > 0 && !options.include.some((item) => item.pattern.test(path))) return "not_included";
+	if (options.exclude.some((item) => item.pattern.test(path))) return "excluded";
+	return null;
+}
+async function loadRobots(options) {
+	const url = new URL("/robots.txt", options.startUrl.origin).href;
+	const resource = await fetchResource(url, options);
+	if (!resource.response) return {
+		source: {
+			url,
+			status: "temporarily_unavailable",
+			httpStatus: null,
+			error: resource.error ?? "fetch_failed"
+		},
+		rules: [],
+		sitemaps: []
+	};
+	if (resource.response.status === 404) return {
+		source: {
+			url,
+			status: "not_found",
+			httpStatus: 404
+		},
+		rules: [],
+		sitemaps: []
+	};
+	if (!resource.response.ok || resource.error) return {
+		source: {
+			url,
+			status: "temporarily_unavailable",
+			httpStatus: resource.response.status,
+			error: resource.error ?? `http_${resource.response.status}`
+		},
+		rules: [],
+		sitemaps: []
+	};
+	const parsed = parseRobots(resource.body);
 	return {
-		id: user.id,
-		name: user.profile?.name ?? user.name ?? user.email,
-		email: user.email,
-		avatarUrl: user.profile?.avatar_url ?? user.avatarUrl ?? user.avatar_url ?? null,
-		emailVerified: user.emailVerified ?? user.email_verified ?? false
+		source: {
+			url,
+			status: "available",
+			httpStatus: resource.response.status
+		},
+		rules: parsed.rules,
+		sitemaps: parsed.sitemaps
 	};
 }
-async function parseJsonResponse(response) {
-	const text = await response.text();
-	if (!text) return {};
-	try {
-		return JSON.parse(text);
-	} catch {
-		return { message: text };
-	}
-}
-function errorMessage(body, fallback) {
-	if (typeof body !== "object" || body === null) return fallback;
-	const record = body;
-	if (typeof record.message === "string") return record.message;
-	if (typeof record.error === "string") return record.error;
-	const nestedError = record.error;
-	if (typeof nestedError === "object" && nestedError !== null) {
-		const message = nestedError.message;
-		if (typeof message === "string") return message;
-	}
-	return fallback;
-}
-var ForgewaySeoGatewayClient = class {
-	fetchImpl;
-	readCredentials;
-	writeCredentials;
-	cwd;
-	constructor(deps = {}) {
-		this.fetchImpl = deps.fetch ?? fetch;
-		this.readCredentials = deps.readCredentials ?? readForgewayCredentials;
-		this.writeCredentials = deps.writeCredentials ?? writeForgewayCredentials;
-		this.cwd = deps.cwd ?? process.cwd();
-	}
-	async loadCredentials() {
-		const metadata = await readForgewayDeployMetadata(this.cwd).catch(() => ({}));
-		const platformApiUrl = resolveForgewaySeoApiUrl(metadata.platformApiUrl, this.cwd);
-		const credentials = await this.readCredentials({
-			cwd: this.cwd,
-			platformApiUrl,
-			email: typeof metadata.publisherEmail === "string" ? metadata.publisherEmail : void 0
+function parseRobots(body) {
+	const groups = [];
+	const sitemaps = [];
+	let current = {
+		agents: [],
+		rules: []
+	};
+	for (const rawLine of body.split(LINE_SPLIT_RE)) {
+		const line = rawLine.replace(COMMENT_RE, "").trim();
+		if (!line) continue;
+		const separator = line.indexOf(":");
+		if (separator < 0) continue;
+		const field = line.slice(0, separator).trim().toLowerCase();
+		const value = line.slice(separator + 1).trim();
+		if (field === "sitemap" && value) {
+			sitemaps.push(value);
+			continue;
+		}
+		if (field === "user-agent") {
+			if (current.rules.length > 0) {
+				groups.push(current);
+				current = {
+					agents: [],
+					rules: []
+				};
+			}
+			current.agents.push(value.toLowerCase());
+			continue;
+		}
+		if ((field === "allow" || field === "disallow") && current.agents.length > 0 && value) current.rules.push({
+			type: field,
+			path: value
 		});
-		if (!credentials?.accessToken) throw new Error("Forgeway SEO provider access requires stored Forgeway credentials. Run `dineway deploy forgeway` first.");
-		assertFormalUser(credentials.user);
-		if (!credentials.refreshToken) throw new Error("Forgeway SEO provider access requires a stored formal-account refresh token. Run `dineway deploy forgeway` again.");
+	}
+	if (current.agents.length > 0 || current.rules.length > 0) groups.push(current);
+	const crawlerName = USER_AGENT.split("/")[0]?.toLowerCase() ?? "dinewaycontentcrawler";
+	const exact = groups.filter((group) => group.agents.includes(crawlerName));
+	return {
+		rules: (exact.length > 0 ? exact : groups.filter((group) => group.agents.includes("*"))).flatMap((group) => group.rules),
+		sitemaps: uniqueSorted(sitemaps)
+	};
+}
+function robotsAllows(url, rules) {
+	const path = `${url.pathname}${url.search}`;
+	const matching = rules.filter((rule) => robotsRuleMatches(path, rule.path)).toSorted((left, right) => right.path.length - left.path.length);
+	if (matching.length === 0) return true;
+	const longest = matching[0]?.path.length ?? 0;
+	return matching.some((rule) => rule.path.length === longest && rule.type === "allow");
+}
+function robotsRuleMatches(path, rulePath) {
+	const anchored = rulePath.endsWith("$");
+	const pattern = escapeRegExp(anchored ? rulePath.slice(0, -1) : rulePath).replaceAll("\\*", ".*");
+	return new RegExp(`^${pattern}${anchored ? "$" : ""}`).test(path);
+}
+async function loadSitemaps(options, robotsSitemaps) {
+	const queue = (robotsSitemaps.length > 0 ? robotsSitemaps : [new URL("/sitemap.xml", options.startUrl.origin).href]).map((value) => normalizeUrl(value, options.startUrl, options.keepQuery)).filter((value) => value !== null && value.origin === options.startUrl.origin).map((value) => value.href);
+	const seen = /* @__PURE__ */ new Set();
+	const sources = [];
+	const urls = [];
+	while (queue.length > 0 && seen.size < MAX_SITEMAPS) {
+		const url = queue.shift();
+		if (!url || seen.has(url)) continue;
+		seen.add(url);
+		const resource = await fetchResource(url, options);
+		if (!resource.response) {
+			sources.push({
+				url,
+				status: "temporarily_unavailable",
+				httpStatus: null,
+				error: resource.error ?? "fetch_failed"
+			});
+			continue;
+		}
+		if (resource.response.status === 404) {
+			sources.push({
+				url,
+				status: "not_found",
+				httpStatus: 404
+			});
+			continue;
+		}
+		if (!resource.response.ok || resource.error) {
+			sources.push({
+				url,
+				status: "temporarily_unavailable",
+				httpStatus: resource.response.status,
+				error: resource.error ?? `http_${resource.response.status}`
+			});
+			continue;
+		}
+		try {
+			const parsed = parseSitemap(resource.body);
+			sources.push({
+				url,
+				status: "available",
+				httpStatus: resource.response.status
+			});
+			for (const location of parsed.locations) {
+				const normalized = normalizeUrl(location, options.startUrl, options.keepQuery);
+				if (!normalized || normalized.origin !== options.startUrl.origin) continue;
+				if (parsed.kind === "index") queue.push(normalized.href);
+				else urls.push(normalized.href);
+			}
+		} catch {
+			sources.push({
+				url,
+				status: "invalid",
+				httpStatus: resource.response.status,
+				error: "invalid_sitemap_xml"
+			});
+		}
+	}
+	return {
+		sources,
+		urls: uniqueSorted(urls)
+	};
+}
+function parseSitemap(body) {
+	const parser = sax.parser(true, {
+		trim: true,
+		normalize: true
+	});
+	let root = null;
+	let inLocation = false;
+	let location = "";
+	const locations = [];
+	parser.onopentag = (node) => {
+		const name = node.name.toLowerCase();
+		root ??= name;
+		if (name === "loc") {
+			inLocation = true;
+			location = "";
+		}
+	};
+	parser.ontext = (text) => {
+		if (inLocation) location += text;
+	};
+	parser.oncdata = (text) => {
+		if (inLocation) location += text;
+	};
+	parser.onclosetag = (name) => {
+		if (name.toLowerCase() !== "loc") return;
+		inLocation = false;
+		if (location.trim()) locations.push(location.trim());
+	};
+	parser.write(body).close();
+	if (root !== "urlset" && root !== "sitemapindex") throw new Error("Unsupported sitemap root");
+	return {
+		kind: root === "sitemapindex" ? "index" : "urls",
+		locations
+	};
+}
+async function fetchResource(url, options) {
+	const controller = new AbortController();
+	const timeout = setTimeout(() => controller.abort(), options.timeoutMs);
+	try {
+		let currentUrl = url;
+		let response = null;
+		for (let redirects = 0; redirects <= MAX_REDIRECTS; redirects += 1) {
+			if (!options.allowPrivateNetwork) await resolveAndValidateExternalUrl(currentUrl, { resolver: options.dnsResolver });
+			response = await options.fetch(currentUrl, {
+				headers: {
+					accept: "text/html,application/xml,text/xml,text/plain;q=0.8",
+					"user-agent": USER_AGENT
+				},
+				redirect: "manual",
+				signal: controller.signal
+			});
+			const location = response.headers.get("location");
+			if (response.status < 300 || response.status >= 400 || !location) break;
+			const next = normalizeUrl(location, new URL(currentUrl), options.keepQuery);
+			if (!next) return {
+				response,
+				finalUrl: currentUrl,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "invalid_redirect"
+			};
+			if (next.origin !== options.startUrl.origin) return {
+				response,
+				finalUrl: next.href,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "cross_origin_redirect"
+			};
+			if (redirects === MAX_REDIRECTS) return {
+				response,
+				finalUrl: next.href,
+				contentType: response.headers.get("content-type"),
+				body: "",
+				bytes: 0,
+				error: "too_many_redirects"
+			};
+			currentUrl = next.href;
+		}
+		if (!response) throw new Error("No response");
+		const finalUrl = response.url || currentUrl;
+		const contentType = response.headers.get("content-type");
+		const declaredLength = Number(response.headers.get("content-length"));
+		if (Number.isFinite(declaredLength) && declaredLength > options.maxBytesPerResource) return {
+			response,
+			finalUrl,
+			contentType,
+			body: "",
+			bytes: 0,
+			error: "resource_too_large"
+		};
+		const body = await readBoundedBody(response, options.maxBytesPerResource);
 		return {
-			...credentials,
-			platformApiUrl: resolveForgewaySeoApiUrl(credentials.platformApiUrl, this.cwd)
+			response,
+			finalUrl,
+			contentType,
+			body: body.text,
+			bytes: body.bytes
 		};
+	} catch (error) {
+		return {
+			response: null,
+			finalUrl: url,
+			contentType: null,
+			body: "",
+			bytes: 0,
+			error: error instanceof ResourceTooLargeError ? "resource_too_large" : fetchError(error)
+		};
+	} finally {
+		clearTimeout(timeout);
 	}
-	async refreshAccessToken(credentials) {
-		const response = await this.fetchImpl(`${credentials.platformApiUrl}/api/auth/refresh?client_type=server`, {
-			method: "POST",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify({ refreshToken: credentials.refreshToken })
-		});
-		const body = await parseJsonResponse(response);
-		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(body, "Failed to refresh Forgeway formal account credentials. Run `dineway deploy forgeway` again."), response.status, body);
-		if (!body.accessToken) throw new Error("Forgeway refresh response was missing accessToken.");
-		const user = assertFormalUser(normalizeForgewayUser(body.user, credentials.user));
-		if (credentials.user?.email && normalizeEmail(user.email) !== normalizeEmail(credentials.user.email)) throw new Error("Forgeway refresh returned credentials for a different email.");
-		const updated = {
-			...credentials,
-			accessToken: body.accessToken,
-			refreshToken: body.refreshToken ?? credentials.refreshToken,
-			user
+}
+async function readBoundedBody(response, limit) {
+	if (!response.body) return {
+		text: "",
+		bytes: 0
+	};
+	const reader = response.body.getReader();
+	const chunks = [];
+	let bytes = 0;
+	while (true) {
+		const result = await reader.read();
+		if (result.done) break;
+		bytes += result.value.byteLength;
+		if (bytes > limit) {
+			await reader.cancel();
+			throw new ResourceTooLargeError();
+		}
+		chunks.push(result.value);
+	}
+	const combined = new Uint8Array(bytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		combined.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return {
+		text: new TextDecoder().decode(combined),
+		bytes
+	};
+}
+var ResourceTooLargeError = class extends Error {};
+function fetchError(error) {
+	if (error instanceof SsrfError) return "private_network_blocked";
+	if (error instanceof Error && error.name === "AbortError") return "timeout";
+	return "fetch_failed";
+}
+function pageFromResource(item, resource, options) {
+	const base = {
+		url: item.url,
+		finalUrl: resource.finalUrl,
+		depth: item.depth,
+		discoveredFrom: item.discoveredFrom,
+		httpStatus: resource.response?.status ?? null,
+		contentType: resource.contentType,
+		bytes: resource.bytes
+	};
+	const empty = {
+		title: null,
+		description: null,
+		canonicalUrl: null,
+		robots: null,
+		language: null,
+		headings: {
+			h1: [],
+			h2: [],
+			h3: []
+		},
+		wordCount: 0,
+		contentSha256: null,
+		textExcerpt: "",
+		textTruncated: false,
+		internalLinks: [],
+		externalLinks: [],
+		structuredDataBlocks: 0,
+		renderingRecommended: false
+	};
+	if (resource.error) return {
+		...base,
+		...empty,
+		error: resource.error
+	};
+	const final = normalizeUrl(resource.finalUrl, void 0, options.keepQuery);
+	if (!final || final.origin !== options.startUrl.origin) return {
+		...base,
+		...empty,
+		error: "cross_origin_redirect"
+	};
+	if (!resource.contentType?.includes("text/html")) return {
+		...base,
+		...empty
+	};
+	try {
+		return {
+			...base,
+			...parseHtml(resource.body, final, options.keepQuery)
+		};
+	} catch {
+		return {
+			...base,
+			...empty,
+			error: "invalid_html"
 		};
-		await this.writeCredentials(updated, {
-			cwd: this.cwd,
-			platformApiUrl: updated.platformApiUrl,
-			email: user.email
-		});
-		return updated;
 	}
-	async request(path, body, init) {
-		const credentials = await this.refreshAccessToken(await this.loadCredentials());
-		const method = init?.method ?? "POST";
-		const response = await this.fetchImpl(`${credentials.platformApiUrl}${path}`, {
-			method,
-			headers: {
-				Authorization: `Bearer ${credentials.accessToken}`,
-				"Content-Type": "application/json",
-				"Idempotency-Key": init?.idempotencyKey ?? randomUUID()
-			},
-			body: method === "GET" ? void 0 : JSON.stringify(body ?? {})
-		});
-		const payload = await parseJsonResponse(response);
-		if (!response.ok) throw new ForgewaySeoApiError(errorMessage(payload, `Forgeway SEO request failed with status ${response.status}.`), response.status, payload);
-		return payload;
+}
+function parseHtml(body, pageUrl, keepQuery) {
+	const document = parse(body);
+	let title = null;
+	let description = null;
+	let canonicalUrl = null;
+	let robots = null;
+	let language = null;
+	let structuredDataBlocks = 0;
+	let scriptBlocks = 0;
+	const headings = {
+		h1: [],
+		h2: [],
+		h3: []
+	};
+	const internalLinks = [];
+	const externalLinks = [];
+	walk(document, (element) => {
+		const attributes = new Map(element.attrs.map((attribute) => [attribute.name, attribute.value]));
+		if (element.tagName === "html") language = cleanText(attributes.get("lang")) || language;
+		if (element.tagName === "title" && title === null) title = cleanText(textContent(element));
+		if (element.tagName === "meta") {
+			const name = attributes.get("name")?.toLowerCase();
+			if (name === "description" && description === null) description = cleanText(attributes.get("content"));
+			if ((name === "robots" || name === "googlebot") && robots === null) robots = cleanText(attributes.get("content"));
+		}
+		if (element.tagName === "link") {
+			if ((attributes.get("rel")?.toLowerCase().split(WHITESPACE_RE) ?? []).includes("canonical") && canonicalUrl === null) canonicalUrl = normalizeUrl(attributes.get("href") ?? "", pageUrl, keepQuery)?.href ?? null;
+		}
+		if (element.tagName === "h1" || element.tagName === "h2" || element.tagName === "h3") {
+			const value = cleanText(textContent(element));
+			if (value) headings[element.tagName].push(value);
+		}
+		if (element.tagName === "script") {
+			scriptBlocks += 1;
+			if (attributes.get("type")?.toLowerCase() === "application/ld+json") structuredDataBlocks += 1;
+		}
+		if (element.tagName === "a") {
+			const link = normalizeUrl(attributes.get("href") ?? "", pageUrl, keepQuery);
+			if (!link) return;
+			const item = {
+				url: link.href,
+				anchor: cleanText(textContent(element)) ?? ""
+			};
+			if (link.origin === pageUrl.origin) internalLinks.push(item);
+			else externalLinks.push(item);
+		}
+	});
+	const visibleText = cleanText(textContent(document)) ?? "";
+	const wordCount = countWords(visibleText);
+	const textExcerpt = visibleText.slice(0, MAX_TEXT_EXCERPT);
+	return {
+		title,
+		description,
+		canonicalUrl,
+		robots,
+		language,
+		headings,
+		wordCount,
+		contentSha256: createHash("sha256").update(visibleText).digest("hex"),
+		textExcerpt,
+		textTruncated: textExcerpt.length < visibleText.length,
+		internalLinks: uniqueLinks(internalLinks),
+		externalLinks: uniqueLinks(externalLinks),
+		structuredDataBlocks,
+		renderingRecommended: wordCount < 20 && scriptBlocks > 0
+	};
+}
+function walk(node, visit) {
+	if (isElement(node)) visit(node);
+	if (!("childNodes" in node)) return;
+	for (const child of node.childNodes) walk(child, visit);
+}
+function textContent(node, hidden = false) {
+	if ("value" in node) return hidden ? "" : node.value;
+	const nextHidden = hidden || isElement(node) && [
+		"script",
+		"style",
+		"noscript",
+		"template",
+		"svg",
+		"head"
+	].includes(node.tagName);
+	if (!("childNodes" in node)) return "";
+	return node.childNodes.map((child) => textContent(child, nextHidden)).join(" ");
+}
+function isElement(node) {
+	return "tagName" in node;
+}
+function normalizeUrl(value, base, keepQuery = false) {
+	try {
+		const url = base ? new URL(value, base) : new URL(value);
+		if (url.protocol !== "http:" && url.protocol !== "https:" || url.username || url.password) return null;
+		url.hash = "";
+		if (!keepQuery) url.search = "";
+		if (!url.pathname) url.pathname = "/";
+		return url;
+	} catch {
+		return null;
 	}
-};
+}
+function cleanText(value) {
+	if (!value) return null;
+	return value.replaceAll(WHITESPACE_RE, " ").trim() || null;
+}
+function countWords(value) {
+	return value.match(WORD_RE)?.length ?? 0;
+}
+function uniqueLinks(links) {
+	const seen = /* @__PURE__ */ new Set();
+	return links.filter((link) => {
+		const key = `${link.url}\u0000${link.anchor}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function duplicateGroups(pages, field) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const page of pages) {
+		const value = page[field];
+		if (!value) continue;
+		const key = field === "contentSha256" ? value : value.toLocaleLowerCase();
+		const group = groups.get(key) ?? {
+			value,
+			urls: []
+		};
+		group.urls.push(page.url);
+		groups.set(key, group);
+	}
+	return [...groups.values()].filter((group) => group.urls.length > 1).map((group) => ({
+		value: group.value,
+		urls: uniqueSorted(group.urls)
+	})).toSorted((left, right) => left.value.localeCompare(right.value));
+}
+function uniqueSorted(values) {
+	return [...new Set(values)].toSorted((left, right) => left.localeCompare(right));
+}
+function escapeRegExp(value) {
+	return value.replace(REGEXP_SPECIAL_RE, "\\$&");
+}
 
 //#endregion
 //#region src/cli/commands/seo.ts
-const hostedProviderArgs = {
-	json: {
-		type: "boolean",
-		description: "Output as JSON"
-	},
-	"force-refresh": {
-		type: "boolean",
-		description: "Bypass Forgeway SEO provider cache"
-	}
-};
-const dataForSeoCommonArgs = {
-	...hostedProviderArgs,
-	"location-code": {
-		type: "string",
-		description: "DataForSEO location code",
-		default: "2840"
-	},
-	"language-code": {
-		type: "string",
-		description: "DataForSEO language code",
-		default: "en"
-	},
-	device: {
-		type: "string",
-		description: "Device type: desktop or mobile",
-		default: "desktop"
-	}
-};
+const jsonArgs = { json: {
+	type: "boolean",
+	description: "Output as JSON"
+} };
 function toStringValue(value) {
 	return typeof value === "string" && value.trim() ? value.trim() : void 0;
 }
@@ -6890,9 +6976,6 @@ function toNumberValue(value, fallback) {
 	const parsed = Number(raw);
 	return Number.isFinite(parsed) ? parsed : fallback;
 }
-function forceRefresh(args) {
-	return args["force-refresh"] === true;
-}
 function formats(value) {
 	const raw = toStringValue(value);
 	if (!raw) return void 0;
@@ -6903,416 +6986,108 @@ function requireArg(value, name) {
 	if (!normalized) throw new Error(`${name} is required.`);
 	return normalized;
 }
-async function runSeoRequest(args, path, body) {
-	configureOutputMode(args);
-	try {
-		output(await new ForgewaySeoGatewayClient().request(path, body), args);
-	} catch (error) {
-		if (await handleCliPaywall({
-			error,
-			resource: path,
-			context: { providerPath: path }
-		})) process.exit(2);
-		consola$1.error(error instanceof Error ? error.message : "Unknown error");
-		process.exit(1);
-	}
+function sitemapMode(value) {
+	const mode = toStringValue(value) ?? "include";
+	if (mode === "include" || mode === "skip" || mode === "only") return mode;
+	throw new Error("sitemap must be include, skip, or only.");
 }
-const firecrawlCommand = defineCommand({
+const crawlCommand = defineCommand({
 	meta: {
-		name: "firecrawl",
-		description: "Forgeway-hosted Firecrawl workflows"
+		name: "crawl",
+		description: "Deterministic site crawl controls"
 	},
-	subCommands: {
-		scrape: defineCommand({
-			meta: {
-				name: "scrape",
-				description: "Scrape one URL through Forgeway-hosted Firecrawl"
+	subCommands: { local: defineCommand({
+		meta: {
+			name: "local",
+			description: "Crawl one site locally and return bounded structural evidence"
+		},
+		args: {
+			url: {
+				type: "positional",
+				description: "First-party site URL",
+				required: true
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "URL to scrape",
-					required: true
-				},
-				...hostedProviderArgs,
-				formats: {
-					type: "string",
-					description: "Comma-separated Firecrawl formats",
-					default: "markdown"
-				},
-				"only-main-content": {
-					type: "boolean",
-					description: "Return main content only",
-					default: true
-				},
-				"timeout-ms": {
-					type: "string",
-					description: "Provider timeout in milliseconds",
-					default: "60000"
-				}
+			...jsonArgs,
+			limit: {
+				type: "string",
+				description: "Maximum pages",
+				default: "100"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/scrape", {
-					url: requireArg(args.url, "url"),
-					formats: formats(args.formats),
-					onlyMainContent: args["only-main-content"] !== false,
-					timeoutMs: toNumberValue(args["timeout-ms"], 6e4),
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		map: defineCommand({
-			meta: {
-				name: "map",
-				description: "Map URLs through Forgeway-hosted Firecrawl"
+			"max-depth": {
+				type: "string",
+				description: "Maximum link discovery depth",
+				default: "3"
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "Base URL to map",
-					required: true
-				},
-				...hostedProviderArgs,
-				search: {
-					type: "string",
-					description: "Optional relevance search term"
-				},
-				sitemap: {
-					type: "string",
-					description: "Sitemap mode: skip, include, or only",
-					default: "include"
-				},
-				limit: {
-					type: "string",
-					description: "Maximum URLs",
-					default: "100"
-				},
-				"include-subdomains": {
-					type: "boolean",
-					description: "Include subdomains"
-				},
-				"ignore-query-parameters": {
-					type: "boolean",
-					description: "Ignore query parameters",
-					default: true
-				}
+			concurrency: {
+				type: "string",
+				description: "Maximum concurrent page requests",
+				default: "4"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/map", {
-					url: requireArg(args.url, "url"),
-					search: toStringValue(args.search),
-					sitemap: toStringValue(args.sitemap) ?? "include",
-					limit: toNumberValue(args.limit, 100),
-					includeSubdomains: args["include-subdomains"] === true,
-					ignoreQueryParameters: args["ignore-query-parameters"] !== false,
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		crawl: defineCommand({
-			meta: {
-				name: "crawl",
-				description: "Start a bounded Firecrawl crawl, or check status with --id"
+			include: {
+				type: "string",
+				description: "Comma-separated path globs to include"
 			},
-			args: {
-				url: {
-					type: "positional",
-					description: "Base URL to crawl"
-				},
-				...hostedProviderArgs,
-				id: {
-					type: "string",
-					description: "Existing Firecrawl crawl id to check"
-				},
-				limit: {
-					type: "string",
-					description: "Maximum pages",
-					default: "25"
-				},
-				"max-depth": {
-					type: "string",
-					description: "Maximum discovery depth",
-					default: "3"
-				},
-				"allow-subdomains": {
-					type: "boolean",
-					description: "Allow subdomains"
-				},
-				"allow-external-links": {
-					type: "boolean",
-					description: "Allow external links"
-				},
-				formats: {
-					type: "string",
-					description: "Comma-separated scrape formats",
-					default: "markdown"
-				}
+			exclude: {
+				type: "string",
+				description: "Comma-separated path globs to exclude"
 			},
-			async run({ args }) {
-				const crawlId = toStringValue(args.id);
-				if (crawlId) {
-					configureOutputMode(args);
-					try {
-						output(await new ForgewaySeoGatewayClient().request(`/api/firecrawl/crawl/${encodeURIComponent(crawlId)}`, void 0, { method: "GET" }), args);
-					} catch (error) {
-						if (await handleCliPaywall({
-							error,
-							resource: `/api/firecrawl/crawl/${crawlId}`,
-							context: { providerPath: `/api/firecrawl/crawl/${crawlId}` }
-						})) process.exit(2);
-						consola$1.error(error instanceof Error ? error.message : "Unknown error");
-						process.exit(1);
-					}
-					return;
-				}
-				await runSeoRequest(args, "/api/firecrawl/crawl", {
-					url: requireArg(args.url, "url"),
-					limit: toNumberValue(args.limit, 25),
-					maxDiscoveryDepth: toNumberValue(args["max-depth"], 3),
-					allowExternalLinks: args["allow-external-links"] === true,
-					allowSubdomains: args["allow-subdomains"] === true,
-					scrapeFormats: formats(args.formats),
-					forceRefresh: forceRefresh(args)
-				});
-			}
-		}),
-		search: defineCommand({
-			meta: {
-				name: "search",
-				description: "Search through Forgeway-hosted Firecrawl"
+			"timeout-ms": {
+				type: "string",
+				description: "Per-resource timeout in milliseconds",
+				default: "10000"
 			},
-			args: {
-				query: {
-					type: "positional",
-					description: "Search query",
-					required: true
-				},
-				...hostedProviderArgs,
-				limit: {
-					type: "string",
-					description: "Maximum results",
-					default: "10"
-				},
-				scrape: {
-					type: "boolean",
-					description: "Scrape result markdown"
-				}
+			"max-bytes": {
+				type: "string",
+				description: "Maximum bytes per fetched resource",
+				default: "1000000"
 			},
-			async run({ args }) {
-				await runSeoRequest(args, "/api/firecrawl/search", {
-					query: requireArg(args.query, "query"),
-					limit: toNumberValue(args.limit, 10),
-					scrape: args.scrape === true,
-					forceRefresh: forceRefresh(args)
-				});
+			sitemap: {
+				type: "string",
+				description: "Sitemap mode: include, skip, or only",
+				default: "include"
+			},
+			"keep-query": {
+				type: "boolean",
+				description: "Keep query parameters in page identity"
+			},
+			"allow-private-network": {
+				type: "boolean",
+				description: "Allow an explicitly selected localhost or private origin"
 			}
-		})
-	}
-});
-function dataForSeoBase(args) {
-	return {
-		locationCode: toNumberValue(args["location-code"], 2840),
-		languageCode: toStringValue(args["language-code"]) ?? "en",
-		device: toStringValue(args.device) ?? "desktop",
-		forceRefresh: forceRefresh(args)
-	};
-}
-const dataForSeoSerpCommand = defineCommand({
-	meta: {
-		name: "serp",
-		description: "Fetch Google organic SERP data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Keyword",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		depth: {
-			type: "string",
-			description: "SERP depth",
-			default: "10"
-		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/serp", {
-			keyword: requireArg(args.keyword, "keyword"),
-			depth: toNumberValue(args.depth, 10),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoMapsCommand = defineCommand({
-	meta: {
-		name: "maps",
-		description: "Fetch Google Maps SERP data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Keyword",
-			required: true
 		},
-		...dataForSeoCommonArgs,
-		depth: {
-			type: "string",
-			description: "Maps depth",
-			default: "10"
-		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/maps", {
-			keyword: requireArg(args.keyword, "keyword"),
-			depth: toNumberValue(args.depth, 10),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoKeywordsCommand = defineCommand({
-	meta: {
-		name: "keywords",
-		description: "Fetch keyword suggestions"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "Seed keyword",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		limit: {
-			type: "string",
-			description: "Maximum suggestions",
-			default: "20"
-		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/keywords", {
-			keyword: requireArg(args.keyword, "keyword"),
-			limit: toNumberValue(args.limit, 20),
-			includeSerpInfo: true,
-			includeSeedKeyword: true,
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoCompetitorsCommand = defineCommand({
-	meta: {
-		name: "competitors",
-		description: "Fetch competitor-domain data"
-	},
-	args: {
-		domain: {
-			type: "positional",
-			description: "Target domain",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		limit: {
-			type: "string",
-			description: "Maximum competitors",
-			default: "20"
-		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/competitors", {
-			targetDomain: requireArg(args.domain, "domain"),
-			limit: toNumberValue(args.limit, 20),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoAiScrapeCommand = defineCommand({
-	meta: {
-		name: "ai-scrape",
-		description: "Fetch DataForSEO AI scraper response data"
-	},
-	args: {
-		keyword: {
-			type: "positional",
-			description: "AI search keyword",
-			required: true
-		},
-		...dataForSeoCommonArgs,
-		platform: {
-			type: "string",
-			description: "AI platform: chat_gpt, gemini, or perplexity",
-			default: "chat_gpt"
+		async run({ args }) {
+			configureOutputMode(args);
+			try {
+				output(await crawlLocalSite({
+					startUrl: requireArg(args.url, "url"),
+					pageLimit: toNumberValue(args.limit, 100),
+					maxDepth: toNumberValue(args["max-depth"], 3),
+					concurrency: toNumberValue(args.concurrency, 4),
+					include: formats(args.include) ?? [],
+					exclude: formats(args.exclude) ?? [],
+					timeoutMs: toNumberValue(args["timeout-ms"], 1e4),
+					maxBytesPerResource: toNumberValue(args["max-bytes"], 1e6),
+					sitemap: sitemapMode(args.sitemap),
+					keepQuery: args["keep-query"] === true,
+					allowPrivateNetwork: args["allow-private-network"] === true
+				}), args);
+			} catch (error) {
+				consola$1.error(error instanceof Error ? error.message : "Local site crawl failed");
+				process.exit(1);
+			}
 		}
-	},
-	async run({ args }) {
-		await runSeoRequest(args, "/api/dataforseo/ai-scrape", {
-			keyword: requireArg(args.keyword, "keyword"),
-			platform: toStringValue(args.platform) ?? "chat_gpt",
-			...dataForSeoBase(args)
-		});
-	}
+	}) }
 });
-const dataForSeoAiMentionsCommand = defineCommand({
-	meta: {
-		name: "ai-mentions",
-		description: "Fetch DataForSEO LLM mention data"
-	},
-	args: {
-		...dataForSeoCommonArgs,
-		domain: {
-			type: "string",
-			description: "Target domain"
-		},
-		keyword: {
-			type: "string",
-			description: "Target keyword"
-		},
-		platform: {
-			type: "string",
-			description: "Mention platform: google or chat_gpt",
-			default: "google"
+function createSeoCommand() {
+	return defineCommand({
+		meta: {
+			name: "seo",
+			description: "Deterministic local SEO evidence"
 		},
-		limit: {
-			type: "string",
-			description: "Maximum mentions",
-			default: "20"
-		}
-	},
-	async run({ args }) {
-		if (!toStringValue(args.domain) && !toStringValue(args.keyword)) {
-			consola$1.error("domain or keyword is required.");
-			process.exit(1);
-		}
-		await runSeoRequest(args, "/api/dataforseo/ai-mentions", {
-			targetDomain: toStringValue(args.domain),
-			keyword: toStringValue(args.keyword),
-			platform: toStringValue(args.platform) ?? "google",
-			limit: toNumberValue(args.limit, 20),
-			...dataForSeoBase(args)
-		});
-	}
-});
-const dataForSeoCommand = defineCommand({
-	meta: {
-		name: "dataforseo",
-		description: "Forgeway-hosted DataForSEO workflows"
-	},
-	subCommands: {
-		serp: dataForSeoSerpCommand,
-		maps: dataForSeoMapsCommand,
-		keywords: dataForSeoKeywordsCommand,
-		competitors: dataForSeoCompetitorsCommand,
-		"ai-scrape": dataForSeoAiScrapeCommand,
-		"ai-mentions": dataForSeoAiMentionsCommand
-	}
-});
-const seoCommand = defineCommand({
-	meta: {
-		name: "seo",
-		description: "Hosted SEO provider workflows through Forgeway"
-	},
-	subCommands: {
-		firecrawl: firecrawlCommand,
-		dataforseo: dataForSeoCommand
-	}
-});
+		subCommands: { crawl: crawlCommand }
+	});
+}
+const seoCommand = createSeoCommand();
 
 //#endregion
 //#region src/cli/commands/taxonomy.ts
@@ -7431,6 +7206,449 @@ const taxonomyCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/commands/tools.ts
+const ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const CREDENTIAL_HEADER_PATTERN = /^(authorization|proxy-authorization|x-api-key|api-key|apikey|token|access-token|private-key)$/i;
+const accountArgs = {
+	email: {
+		type: "string",
+		alias: "e",
+		description: "Forgeway account email"
+	},
+	"api-url": {
+		type: "string",
+		description: "Forgeway API URL",
+		default: DEFAULT_FORGEWAY_API_BASE_URL
+	},
+	json: {
+		type: "boolean",
+		description: "Output the complete JSON response"
+	}
+};
+const endpointArgs = {
+	provider: {
+		type: "string",
+		alias: "p",
+		description: "Provider slug",
+		required: true
+	},
+	endpoint: {
+		type: "string",
+		alias: "e",
+		description: "Provider endpoint path",
+		required: true
+	}
+};
+const credentialReferenceArgs = {
+	"credential-token-env": {
+		type: "string",
+		description: "Environment variable containing a request-scoped provider token"
+	},
+	"credential-basic-username-env": {
+		type: "string",
+		description: "Environment variable containing a request-scoped basic-auth username"
+	},
+	"credential-basic-password-env": {
+		type: "string",
+		description: "Environment variable containing a request-scoped basic-auth password"
+	}
+};
+function createToolsCommand(options = {}) {
+	const createService = options.createService ?? createCliToolsService;
+	return defineCommand({
+		meta: {
+			name: "tools",
+			description: "Discover, inspect, and run Forgeway Integration endpoints"
+		},
+		subCommands: {
+			discover: defineCommand({
+				meta: {
+					name: "discover",
+					description: "Find Forgeway Integration endpoints from a natural-language need"
+				},
+				args: {
+					...accountArgs,
+					query: {
+						type: "string",
+						alias: "q",
+						description: "Natural-language endpoint need",
+						required: true
+					},
+					limit: {
+						type: "string",
+						alias: "l",
+						description: "Maximum results (1-100)"
+					},
+					"min-score": {
+						type: "string",
+						description: "Minimum relevance score (0-1)"
+					}
+				},
+				async run({ args }) {
+					await executeToolsCommand(args, async (resolvedArgs) => {
+						const result = await (await createService(resolvedArgs)).discover({
+							query: requiredString(resolvedArgs.query, "query"),
+							limit: optionalNumber(resolvedArgs.limit, "limit", {
+								integer: true,
+								min: 1,
+								max: 100
+							}) ?? 10,
+							minScore: optionalNumber(resolvedArgs["min-score"], "min-score", {
+								min: 0,
+								max: 1
+							})
+						});
+						emitResult(result, discoverSummary(result), resolvedArgs);
+					});
+				}
+			}),
+			inspect: defineCommand({
+				meta: {
+					name: "inspect",
+					description: "Inspect an endpoint schema, output, credits, cache, and risk contract"
+				},
+				args: {
+					...accountArgs,
+					...endpointArgs
+				},
+				async run({ args }) {
+					await executeToolsCommand(args, async (resolvedArgs) => {
+						const result = await (await createService(resolvedArgs)).inspect(endpointRequest(resolvedArgs));
+						emitResult(result, inspectSummary(result), resolvedArgs);
+					});
+				}
+			}),
+			run: defineCommand({
+				meta: {
+					name: "run",
+					description: "Run one inspected Forgeway Integration endpoint"
+				},
+				args: {
+					...accountArgs,
+					...endpointArgs,
+					...credentialReferenceArgs,
+					input: {
+						type: "string",
+						alias: "i",
+						description: "Body JSON"
+					},
+					"input-file": {
+						type: "string",
+						alias: "f",
+						description: "Read body JSON from a file"
+					},
+					query: {
+						type: "string",
+						description: "Query parameters JSON object"
+					},
+					path: {
+						type: "string",
+						description: "Path parameters JSON object"
+					},
+					header: {
+						type: "string",
+						description: "Non-credential header parameters JSON object"
+					},
+					wait: {
+						type: "boolean",
+						alias: "w",
+						description: "Wait for a terminal run state"
+					},
+					"wait-timeout": {
+						type: "string",
+						description: "Maximum wait in seconds",
+						default: "300"
+					},
+					output: {
+						type: "string",
+						alias: "o",
+						description: "Write provider output as JSON"
+					},
+					"force-refresh": {
+						type: "boolean",
+						description: "Bypass eligible Forgeway cache"
+					},
+					"confirm-side-effect": {
+						type: "boolean",
+						description: "Confirm the inspected endpoint's external side effect"
+					},
+					"idempotency-key": {
+						type: "string",
+						description: "Stable idempotency key required for side-effecting endpoints"
+					}
+				},
+				async run({ args }) {
+					await executeToolsCommand(args, async (resolvedArgs) => {
+						if (resolvedArgs["confirm-side-effect"] && !resolvedArgs["idempotency-key"]) throw new DinewayToolsError("--confirm-side-effect requires --idempotency-key.", "IDEMPOTENCY_KEY_REQUIRED");
+						const service = await createService(resolvedArgs);
+						const result = await service.run({
+							...endpointRequest(resolvedArgs),
+							input: await parseEndpointInput(resolvedArgs),
+							credential: resolveInlineCredential(resolvedArgs),
+							forceRefresh: resolvedArgs["force-refresh"] === true,
+							confirmSideEffect: resolvedArgs["confirm-side-effect"] === true
+						}, { idempotencyKey: optionalString(resolvedArgs["idempotency-key"]) });
+						const finalResult = resolvedArgs.wait ? await service.waitForRun(result.runId, { timeoutMs: requiredNumber(resolvedArgs["wait-timeout"], "wait-timeout", { min: 1 }) * 1e3 }) : result;
+						if (resolvedArgs.output) await writeFile(resolvedArgs.output, JSON.stringify(finalResult.output ?? finalResult.artifact ?? finalResult, null, 2) + "\n", "utf-8");
+						emitResult(finalResult, runSummary(finalResult), resolvedArgs);
+					});
+				}
+			}),
+			runs: defineCommand({
+				meta: {
+					name: "runs",
+					description: "List, get, poll, and stop Integration runs"
+				},
+				subCommands: {
+					list: defineCommand({
+						meta: {
+							name: "list",
+							description: "List recent Forgeway Integration runs"
+						},
+						args: {
+							...accountArgs,
+							limit: {
+								type: "string",
+								alias: "l",
+								description: "Maximum runs (1-100)"
+							},
+							cursor: {
+								type: "string",
+								description: "Pagination cursor"
+							}
+						},
+						async run({ args }) {
+							await executeToolsCommand(args, async (resolvedArgs) => {
+								const result = await (await createService(resolvedArgs)).listRuns({
+									limit: optionalNumber(resolvedArgs.limit, "limit", {
+										integer: true,
+										min: 1,
+										max: 100
+									}),
+									cursor: optionalString(resolvedArgs.cursor)
+								});
+								emitResult(result, runsSummary(result.items, result.nextCursor), resolvedArgs);
+							});
+						}
+					}),
+					get: defineCommand({
+						meta: {
+							name: "get",
+							description: "Get or poll one Forgeway Integration run"
+						},
+						args: {
+							...accountArgs,
+							"run-id": {
+								type: "string",
+								alias: "r",
+								description: "Run ID",
+								required: true
+							},
+							wait: {
+								type: "boolean",
+								alias: "w",
+								description: "Wait for a terminal run state"
+							},
+							"wait-timeout": {
+								type: "string",
+								description: "Maximum wait in seconds",
+								default: "300"
+							}
+						},
+						async run({ args }) {
+							await executeToolsCommand(args, async (resolvedArgs) => {
+								const service = await createService(resolvedArgs);
+								const runId = requiredString(resolvedArgs["run-id"], "run-id");
+								const result = resolvedArgs.wait ? await service.waitForRun(runId, { timeoutMs: requiredNumber(resolvedArgs["wait-timeout"], "wait-timeout", { min: 1 }) * 1e3 }) : await service.getRun(runId);
+								emitResult(result, runSummary(result), resolvedArgs);
+							});
+						}
+					}),
+					stop: defineCommand({
+						meta: {
+							name: "stop",
+							description: "Request cancellation for a stoppable Integration run"
+						},
+						args: {
+							...accountArgs,
+							...credentialReferenceArgs,
+							"run-id": {
+								type: "string",
+								alias: "r",
+								description: "Run ID",
+								required: true
+							}
+						},
+						async run({ args }) {
+							await executeToolsCommand(args, async (resolvedArgs) => {
+								const result = await (await createService(resolvedArgs)).stopRun(requiredString(resolvedArgs["run-id"], "run-id"), { credential: resolveInlineCredential(resolvedArgs) });
+								emitResult(result, result, resolvedArgs);
+							});
+						}
+					})
+				}
+			})
+		}
+	});
+}
+const toolsCommand = createToolsCommand();
+async function createCliToolsService(args) {
+	const credentials = await readStoredForgewayAccount({
+		platformApiUrl: normalizeForgewayApiUrl(optionalString(args["api-url"]) ?? process.env["DINEWAY_API_BASE_URL"] ?? process.env["FORGEWAY_API_URL"]),
+		email: normalizeForgewayEmail(optionalString(args.email))
+	});
+	if (!credentials) throw new DinewayToolsError("Dineway Tools requires a verified Forgeway account. Run `dineway account login`.", "FORGEWAY_ACCOUNT_REQUIRED");
+	const refreshed = await refreshForgewayAccountCredentials(credentials);
+	return new DinewayToolsService(createForgewayAccountClient(refreshed.platformApiUrl, refreshed.accessToken).integration);
+}
+async function executeToolsCommand(args, operation) {
+	configureOutputMode(args);
+	try {
+		await operation(args);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "Dineway Tools request failed.";
+		consola$1.error(message);
+		process.exitCode = 2;
+	}
+}
+function endpointRequest(args) {
+	const endpoint = requiredString(args.endpoint, "endpoint");
+	if (!endpoint.startsWith("/")) throw new DinewayToolsError("Endpoint must start with '/'.", "INVALID_ENDPOINT");
+	return {
+		provider: requiredString(args.provider, "provider"),
+		endpoint
+	};
+}
+async function parseEndpointInput(args) {
+	if (args.input && args["input-file"]) throw new DinewayToolsError("Choose either --input or --input-file, not both.", "DUPLICATE_BODY_INPUT");
+	const body = args["input-file"] ? parseJson(await readFile(args["input-file"], "utf-8"), "input-file") : args.input ? parseJson(args.input, "input") : void 0;
+	const queryParams = parseJsonObject(args.query, "query");
+	const pathParams = parseJsonObject(args.path, "path");
+	const headerParams = parseHeaderParams(args.header);
+	return {
+		...body === void 0 ? {} : { body },
+		...queryParams ? { queryParams } : {},
+		...pathParams ? { pathParams } : {},
+		...headerParams ? { headerParams } : {}
+	};
+}
+function resolveInlineCredential(args) {
+	const tokenEnv = optionalString(args["credential-token-env"]);
+	const usernameEnv = optionalString(args["credential-basic-username-env"]);
+	const passwordEnv = optionalString(args["credential-basic-password-env"]);
+	if (tokenEnv && (usernameEnv || passwordEnv)) throw new DinewayToolsError("Choose either token or basic credential environment references, not both.", "CREDENTIAL_MODE_CONFLICT");
+	if (usernameEnv && !passwordEnv || !usernameEnv && passwordEnv) throw new DinewayToolsError("Basic credential username and password environment references must be provided together.", "INCOMPLETE_BASIC_CREDENTIAL");
+	if (tokenEnv) return {
+		type: "token",
+		value: readCredentialEnvironmentValue(tokenEnv)
+	};
+	if (usernameEnv && passwordEnv) return {
+		type: "basic",
+		username: readCredentialEnvironmentValue(usernameEnv),
+		password: readCredentialEnvironmentValue(passwordEnv)
+	};
+}
+function readCredentialEnvironmentValue(name) {
+	if (!ENV_NAME_PATTERN.test(name)) throw new DinewayToolsError(`Invalid credential environment variable name: ${name}`, "INVALID_CREDENTIAL_ENV_NAME");
+	const value = process.env[name];
+	if (!value) throw new DinewayToolsError(`Credential environment variable ${name} is not set.`, "CREDENTIAL_ENV_MISSING");
+	return value;
+}
+function parseHeaderParams(raw) {
+	const value = parseJsonObject(raw, "header");
+	if (!value) return void 0;
+	for (const name of Object.keys(value)) if (CREDENTIAL_HEADER_PATTERN.test(name)) throw new DinewayToolsError("Credential headers are not allowed. Use environment credential references.", "CREDENTIAL_HEADER_FORBIDDEN");
+	return value;
+}
+function parseJsonObject(raw, label) {
+	if (raw === void 0) return void 0;
+	const value = parseJson(requiredString(raw, label), label);
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new DinewayToolsError(`--${label} must be a JSON object.`, "INVALID_JSON_OBJECT");
+	return value;
+}
+function parseJson(raw, label) {
+	try {
+		const value = JSON.parse(raw);
+		if (!isIntegrationJsonValue(value)) throw new Error("Unsupported JSON value");
+		return value;
+	} catch {
+		throw new DinewayToolsError(`--${label} contains invalid JSON.`, "INVALID_JSON");
+	}
+}
+function isIntegrationJsonValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return value.every(isIntegrationJsonValue);
+	if (typeof value !== "object") return false;
+	return Object.values(value).every(isIntegrationJsonValue);
+}
+function requiredString(value, label) {
+	const resolved = optionalString(value);
+	if (!resolved) throw new DinewayToolsError(`--${label} is required.`, "MISSING_ARGUMENT");
+	return resolved;
+}
+function optionalString(value) {
+	return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function optionalNumber(value, label, options) {
+	return value === void 0 ? void 0 : requiredNumber(value, label, options);
+}
+function requiredNumber(value, label, options) {
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || options.integer && !Number.isInteger(parsed) || options.min !== void 0 && parsed < options.min || options.max !== void 0 && parsed > options.max) throw new DinewayToolsError(`--${label} has an invalid numeric value.`, "INVALID_NUMBER");
+	return parsed;
+}
+function emitResult(full, human, args) {
+	output(args.json || !process.stdout.isTTY ? full : human, args);
+}
+function discoverSummary(result) {
+	return {
+		query: result.query,
+		count: result.count,
+		items: result.results.map(({ endpoint, score }) => ({
+			provider: endpoint.provider,
+			endpoint: endpoint.endpoint,
+			name: endpoint.displayName,
+			score: Number(score.toFixed(3)),
+			estimatedCredits: endpoint.pricing.estimatedCredits,
+			risk: endpoint.risk.level
+		}))
+	};
+}
+function inspectSummary(result) {
+	return {
+		provider: result.provider,
+		endpoint: result.endpoint,
+		method: result.method,
+		name: result.displayName,
+		pricing: result.pricing,
+		cache: result.cache,
+		risk: result.risk,
+		async: result.async,
+		input: result.input
+	};
+}
+function runSummary(result) {
+	return {
+		runId: result.runId,
+		provider: result.provider,
+		endpoint: result.endpoint,
+		status: result.status,
+		stoppable: result.stoppable,
+		cache: result.cache,
+		billing: result.billing,
+		artifact: result.artifact,
+		error: result.error
+	};
+}
+function runsSummary(items, nextCursor) {
+	return {
+		items: items.map(runSummary),
+		...nextCursor ? { nextCursor } : {}
+	};
+}
+
 //#endregion
 //#region src/cli/commands/types.ts
 /**
@@ -7482,6 +7700,88 @@ const typesCommand = defineCommand({
 	}
 });
 
+//#endregion
+//#region src/cli/contributions.ts
+const DINEWAY_PLUGIN_PACKAGE = /^(?:@dineway-ai\/plugin-|dineway-plugin-)/;
+const CLI_COMMAND_NAME = /^[a-z][a-z0-9-]*$/;
+async function discoverDinewayCliContributions(cwd = process.cwd()) {
+	const projectPackage = await findProjectPackage(cwd);
+	if (!projectPackage) return [];
+	const { packagePath, project } = projectPackage;
+	const requireFromProject = createRequire(packagePath);
+	const packageNames = new Set([
+		...Object.keys(project.dependencies ?? {}),
+		...Object.keys(project.devDependencies ?? {}),
+		...Object.keys(project.optionalDependencies ?? {})
+	]);
+	const contributions = [];
+	for (const packageName of [...packageNames].filter(isDinewayPluginPackage).toSorted()) {
+		const specifier = `${packageName}/cli`;
+		let modulePath;
+		try {
+			modulePath = requireFromProject.resolve(specifier);
+		} catch (error) {
+			if (isMissingContribution(error)) continue;
+			throw error;
+		}
+		const loaded = await import(pathToFileURL(modulePath).href);
+		const value = loaded.dinewayCliContribution ?? loaded.default;
+		if (!isDinewayCliContribution(value)) throw new Error(`${specifier} does not export a valid Dineway CLI contribution`);
+		contributions.push({
+			packageName,
+			commands: value.commands
+		});
+	}
+	return contributions;
+}
+async function findProjectPackage(from) {
+	let directory = resolve(from);
+	while (true) {
+		const packagePath = join(directory, "package.json");
+		const project = await readProjectPackage(packagePath);
+		if (project) return {
+			packagePath,
+			project
+		};
+		const parent = dirname(directory);
+		if (parent === directory) return null;
+		directory = parent;
+	}
+}
+function mergeDinewayCliContributions(builtIns, contributions) {
+	const commands = { ...builtIns };
+	for (const contribution of contributions) for (const [name, command] of Object.entries(contribution.commands).toSorted(([left], [right]) => left.localeCompare(right))) {
+		if (commands[name]) throw new Error(`Dineway CLI command "${name}" from ${contribution.packageName} conflicts with an existing command`);
+		commands[name] = command;
+	}
+	return commands;
+}
+async function readProjectPackage(path) {
+	try {
+		const parsed = JSON.parse(await readFile(path, "utf8"));
+		return isRecord(parsed) ? parsed : null;
+	} catch (error) {
+		if (isFileNotFound(error)) return null;
+		throw error;
+	}
+}
+function isDinewayPluginPackage(packageName) {
+	return DINEWAY_PLUGIN_PACKAGE.test(packageName);
+}
+function isDinewayCliContribution(value) {
+	if (!isRecord(value) || !isRecord(value.commands)) return false;
+	return Object.entries(value.commands).every(([name, command]) => CLI_COMMAND_NAME.test(name) && isRecord(command));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isMissingContribution(error) {
+	return error instanceof Error && "code" in error && (error.code === "MODULE_NOT_FOUND" || error.code === "ERR_PACKAGE_PATH_NOT_EXPORTED");
+}
+function isFileNotFound(error) {
+	return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
 //#endregion
 //#region src/cli/index.ts
 /**
@@ -7507,36 +7807,41 @@ const typesCommand = defineCommand({
 * - deploy: Deploy a standard Dineway Node server through a provider CLI
 * - plugin: Plugin management (init, bundle, validate, publish, login, logout)
 */
-runMain(defineCommand({
-	meta: {
-		name: "dineway",
-		version: "0.0.0",
-		description: "CLI for Dineway Agentic Web builder"
-	},
-	subCommands: {
-		init: initCommand,
-		account: accountCommand,
-		types: typesCommand,
-		dev: devCommand,
-		deploy: deployCommand,
-		doctor: doctorCommand,
-		seed: seedCommand,
-		"export-seed": exportSeedCommand,
-		secrets: secretsCommand,
-		auth: authCommand,
-		login: loginCommand,
-		logout: logoutCommand,
-		whoami: whoamiCommand,
-		content: contentCommand,
-		schema: schemaCommand,
-		media: mediaCommand,
-		search: searchCommand,
-		seo: seoCommand,
-		taxonomy: taxonomyCommand,
-		menu: menuCommand,
-		plugin: pluginCommand
-	}
-}));
+const builtInCommands = {
+	init: initCommand,
+	account: accountCommand,
+	types: typesCommand,
+	dev: devCommand,
+	deploy: deployCommand,
+	doctor: doctorCommand,
+	seed: seedCommand,
+	"export-seed": exportSeedCommand,
+	secrets: secretsCommand,
+	auth: authCommand,
+	login: loginCommand,
+	logout: logoutCommand,
+	whoami: whoamiCommand,
+	content: contentCommand,
+	schema: schemaCommand,
+	media: mediaCommand,
+	search: searchCommand,
+	tools: toolsCommand,
+	seo: seoCommand,
+	taxonomy: taxonomyCommand,
+	menu: menuCommand,
+	plugin: pluginCommand
+};
+async function createDinewayCliCommand(cwd = process.cwd()) {
+	return defineCommand({
+		meta: {
+			name: "dineway",
+			version: "0.0.0",
+			description: "CLI for Dineway Agentic Web builder"
+		},
+		subCommands: mergeDinewayCliContributions(builtInCommands, await discoverDinewayCliContributions(cwd))
+	});
+}
+createDinewayCliCommand().then((main) => runMain(main));
 
 //#endregion
-export {  };
+export { createDinewayCliCommand };