@tryvitris/website-harness 0.1.0-beta.8 → 1.0.1

package/bin/chunks/{chunk-DYKLM4I3.js → chunk-M72KKZIB.js}

@@ -7,12 +7,12 @@ import {
 import {
   gatherBlankOnboard,
   persistOnboard
-} from "./chunk-PYCRUMCT.js";
+} from "./chunk-54QPYUM2.js";
 import {
   persistSiteInputs,
   recordManagedKit,
   resolveSiteInputsLive
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import {
   initialState,
   parseGraphYaml
@@ -151,7 +151,9 @@ Preserved custom website from ${fromArg}.
 2. npx playwright install chromium
 3. npm run go
 4. npm run preview
-5. npm run deploy (temporary Cloudflare preview)
+5. npm run deploy (build and verify locally, then upload a temporary Cloudflare preview)
+
+Local builds and direct uploads are the default. GitHub stores source; no deployment workflow runs automatically. Keep dist/ and release bundles out of Git.
 
 Custom source: preserved/. Verification: agent/reviews/preserve.json. See AGENTS.md and the installed harness docs/PRESERVE.md. Run vitris forms inspect and vitris forms setup to register and connect contact forms; backendOrigin alone does not enable submission or notifications. See docs/CONTACT-FORMS.md.
 `);
@@ -161,10 +163,14 @@ Run npm run go to capture and verify the existing client-facing site. Keep its a
 
 Repair source in preserved/ when agent/reviews/preserve.json reports a failure; run npm run go again. Never change reference screenshots or hashes to make a check pass. Do not overwrite source by recapturing. onboarding/preserve.json records the source and captured routes. Contact forms require explicit registration and public launch.json forms bindings. backendOrigin alone does not enable delivery. Default previews show a notice without submitting. See docs/CONTACT-FORMS.md.
 
-Use npm run deploy for a temporary Cloudflare preview after verification. Production and customer domains are outside this mode. Scaffold a later redesign separately from the same source URL.
+Use npm run deploy to build and verify locally and directly upload a temporary Cloudflare preview. Keep dist/ and release bundles out of Git. Hosted automation is opt-in; deployment/github-actions.yml.example is inactive by default. Production and customer domains are outside this mode. Scaffold a later redesign separately from the same source URL.
 `);
   }
-  const workflow = join(dest, ".github", "workflows", "deploy.yml");
+  if (mode === "preserve") {
+    const instructions = join(dest, "AGENTS.md");
+    writeFileSync(instructions, readFileSync(instructions, "utf8") + "\nFor a requested sibling business admin, read agent/refs/admin.md and the installed harness docs/ADMIN.md. Use vitris admin setup --plan then reviewed --apply. Preserve current forms and backend identity; cloud provisioning, authentication and deployment remain separate.\n");
+  }
+  const workflow = join(dest, "deployment", "github-actions.yml.example");
   if (existsSync(workflow)) {
     if (mode === "preserve") {
       writeFileSync(workflow, `name: Preserve preview
@@ -198,6 +204,18 @@ jobs:
     copyMarkdown: gathered.copyMarkdown
   });
   persistSiteInputs(dest, inputs);
+  if (opts.admin) {
+    writeFileSync(join(dest, "ADMIN-SETUP.md"), `# Optional business admin
+
+Read node_modules/@tryvitris/website-harness/docs/ADMIN.md and agent/refs/admin.md.
+
+Prepare a separate sibling installation after confirming the exact website origin, existing tenant ID and backend origin:
+
+vitris admin setup --site . --dir ../${slug}-admin --domain admin.CUSTOMER_DOMAIN --website https://www.CUSTOMER_DOMAIN --tenant EXISTING_TENANT_ID --backend-origin https://BACKEND --plan
+
+Review artifacts/admin/setup-plan.json, then repeat with --apply and a dedicated VITRIS_ADMIN_API_TOKEN in the operator environment. This opt-in has created instructions only. No backend, grant, account, collection, authentication, DNS or cloud resources have been changed.
+`);
+  }
   const graphPath = join(dest, "agent", "graph.yaml");
   if (existsSync(graphPath)) {
     const graph = parseGraphYaml(readFileSync(graphPath, "utf8"));
@@ -210,7 +228,7 @@ jobs:
   return {
     ok: true,
     exitCode: EXIT_CODES.SUCCESS,
-    summary: `Created site ${slug} at ${dest}`,
+    summary: `Created site ${slug} at ${dest}${opts.admin ? "; optional admin next steps: ADMIN-SETUP.md" : ""}`,
     data: { dest, slug, name }
   };
 }

package/bin/chunks/{chunk-FEFLSJM5.js → chunk-RE4GOHSU.js}

@@ -1,7 +1,7 @@
 import {
   capturePreservedSite,
   verifyPreservedSite
-} from "./chunk-R2WRQDVE.js";
+} from "./chunk-65LRZIBP.js";
 import {
   AGENT_RUNTIME_HISTORY_ENTRIES
 } from "./chunk-34H54KEY.js";
@@ -68,7 +68,7 @@ import {
   verifyAllowedWrites,
   withMutationLock,
   writeVisualProbe
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import {
   QUESTION_VERSION,
   questionSemanticsHash
@@ -253,7 +253,7 @@ function scaffoldNestedSite(opts) {
   for (const [key, value] of Object.entries(pkg.scripts)) pkg.scripts[key] = value.replaceAll("__SLUG__", opts.slug);
   writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}
 `);
-  for (const file2 of ["site.json", "README.md", "AGENTS.md"]) {
+  for (const file2 of ["site.json", "README.md", "AGENTS.md", "deployment/github-actions.yml.example"]) {
     const p = join2(dest, file2);
     if (!existsSync2(p)) continue;
     if (file2 === "site.json") {

package/bin/chunks/{chunk-WMJVLMU2.js → chunk-UR4NWYVW.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-2NW7KSPA.js";
 import {
   verifyPreservedSite
-} from "./chunk-R2WRQDVE.js";
+} from "./chunk-65LRZIBP.js";
 import {
   EXIT_CODES
 } from "./chunk-JCRGE6AL.js";
@@ -13,7 +13,7 @@ import {
 import {
   gradeAll,
   sourceRevision
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import {
   parseReleaseRecord
 } from "./chunk-M4LNHYYR.js";

package/bin/chunks/{chunk-3OKR5AZJ.js → chunk-VKU5TY5C.js}

@@ -6,7 +6,7 @@ import {
   selectStageKnowledge,
   signalsFromSite,
   siteWidgets
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import {
   coverageReport,
   loadKnowledgeV2

package/bin/chunks/{design-context-store-W3VTZ4HA.js → design-context-store-ETVS4N6W.js}

@@ -3,7 +3,7 @@ import {
   loadPersistedDesignContextPacket,
   persistDesignContextArtifacts,
   resolveDesignContextExpansion
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import "./chunk-KVMZSQ3D.js";
 import "./chunk-WOORR67N.js";
 import "./chunk-PRLL7B63.js";

package/bin/chunks/{packets-LBMDIFPO.js → packets-XFXKHSEY.js}

@@ -10,7 +10,7 @@ import {
   partitionByObligation,
   rankEvidenceRelevance,
   selectDiverseEvidence
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import "./chunk-KVMZSQ3D.js";
 import "./chunk-WOORR67N.js";
 import "./chunk-PRLL7B63.js";

package/bin/chunks/{preparation-AV4PDQY6.js → preparation-3OR7LVPQ.js}

@@ -30,7 +30,7 @@ import {
   withMutationLock,
   withMutationLockAsync,
   writeCommitJournal
-} from "./chunk-XY73ZLHB.js";
+} from "./chunk-GQPUILFR.js";
 import "./chunk-KVMZSQ3D.js";
 import "./chunk-WOORR67N.js";
 import "./chunk-PRLL7B63.js";

package/bin/cloudflare/backend.js

@@ -881,67 +881,6 @@ async function handleInboundEmail(message, env) {
   });
 }
 
-// src/html.ts
-function escapeHtml(value) {
-  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function escapeAttr(value) {
-  return escapeHtml(value);
-}
-
-// src/types.ts
-var defaultTheme = {
-  colorBg: "#F7F4EF",
-  colorText: "#1A1714",
-  colorMuted: "#5C574F",
-  colorAccent: "#B44A2C",
-  colorAccentText: "#FFFFFF",
-  colorSurface: "#FFFFFF",
-  colorSurface2: "#EFEAE3",
-  colorBorder: "#E4DDD2",
-  colorFocus: "#B44A2C",
-  fontBody: 'ui-sans-serif, system-ui, "Segoe UI", sans-serif',
-  fontDisplay: "ui-serif, Georgia, 'Times New Roman', serif",
-  radius: "8px",
-  radiusLg: "16px",
-  radiusPill: "999px",
-  maxWidth: "1120px"
-};
-
-// src/worker/tenant.ts
-async function tenantBySlug(env, slug) {
-  return env.DB.prepare("SELECT * FROM tenants WHERE slug = ?").bind(slug).first();
-}
-async function tenantById(env, id) {
-  return env.DB.prepare("SELECT * FROM tenants WHERE id = ?").bind(id).first();
-}
-async function tenantByHostname(env, hostname) {
-  const cached = await env.KV.get(`host:${hostname}`);
-  if (cached) return tenantById(env, cached);
-  const row = await env.DB.prepare(
-    `SELECT tenants.* FROM tenants JOIN hostnames ON hostnames.tenant_id = tenants.id WHERE hostnames.hostname = ?`
-  ).bind(hostname.toLowerCase()).first();
-  if (row) await env.KV.put(`host:${hostname}`, row.id, { expirationTtl: 3600 });
-  return row;
-}
-async function loadSiteSnapshot(env, tenantId) {
-  const siteRow = await env.DB.prepare("SELECT json FROM site_config WHERE tenant_id = ?").bind(tenantId).first();
-  const contentRow = await env.DB.prepare("SELECT json FROM content WHERE tenant_id = ?").bind(tenantId).first();
-  const themeRow = await env.DB.prepare("SELECT json FROM theme WHERE tenant_id = ?").bind(tenantId).first();
-  if (!siteRow || !contentRow || !themeRow) return null;
-  return {
-    site: JSON.parse(siteRow.json),
-    content: JSON.parse(contentRow.json),
-    theme: { ...defaultTheme, ...JSON.parse(themeRow.json) }
-  };
-}
-async function bumpVersion(env, tenantId) {
-  const row = await env.DB.prepare(
-    "UPDATE tenants SET content_version = content_version + 1 WHERE id = ? RETURNING content_version"
-  ).bind(tenantId).first();
-  return row?.content_version ?? 1;
-}
-
 // src/forms/config.ts
 var safeId = (s) => typeof s === "string" && /^[a-zA-Z0-9_-]{1,80}$/.test(s);
 var safeEmail = (s) => {
@@ -977,6 +916,14 @@ function validateFormConfig(value) {
   return c2;
 }
 
+// src/html.ts
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function escapeAttr(value) {
+  return escapeHtml(value);
+}
+
 // src/worker/forms.ts
 var MAX_BODY = 32768;
 function sandboxMailReadiness(env) {
@@ -1220,6 +1167,140 @@ async function handleFormsAdmin(env, request) {
   }
 }
 
+// src/worker/admin.ts
+var scopes = ["leads:read", "analytics:read", "leads:write"];
+var json2 = (data, status = 200) => Response.json(data, { status, headers: { "cache-control": "no-store", "x-content-type-options": "nosniff" } });
+async function handleAdmin(env, request) {
+  const url = new URL(request.url);
+  const match = url.pathname.match(/^\/api\/admin\/v1\/([a-zA-Z0-9_-]{1,100})\/(status|leads|analytics|leads\/status)$/);
+  if (!match) return json2({ error: "Not found" }, 404);
+  const [, tenant, resource] = match;
+  if (request.headers.has("origin")) return json2({ error: "Server credential required" }, 403);
+  const installationId = request.headers.get("x-vitris-installation") || "";
+  const token = request.headers.get("authorization")?.match(/^Bearer ([a-zA-Z0-9_-]{32,200})$/)?.[1];
+  let grant;
+  try {
+    const map = JSON.parse(env.ADMIN_CONNECTIONS || "{}");
+    if (map && typeof map === "object" && !Array.isArray(map) && Object.hasOwn(map, installationId)) grant = map[installationId];
+  } catch {
+  }
+  if (!grant || !token || !/^[a-f0-9]{64}$/.test(grant.tokenHash) || await digest(token) !== grant.tokenHash) return json2({ error: "Unauthorized" }, 401);
+  if (grant.tenantId !== tenant || grant.siteOrigin !== request.headers.get("x-vitris-site-origin") || !Array.isArray(grant.scopes) || grant.scopes.some((s) => !scopes.includes(s))) return json2({ error: "Forbidden" }, 403);
+  if (!await env.DB.prepare("SELECT id FROM tenants WHERE id=?").bind(tenant).first()) return json2({ error: "Forbidden" }, 403);
+  const identity = { schemaVersion: 1, installationId, tenantId: tenant, siteOrigin: grant.siteOrigin };
+  const required = resource === "analytics" ? "analytics:read" : resource === "leads/status" ? "leads:write" : resource === "leads" ? "leads:read" : void 0;
+  if (required && !grant.scopes.includes(required)) return json2({ error: "Forbidden" }, 403);
+  if (request.method !== (resource === "leads/status" ? "POST" : "GET")) return json2({ error: "Method not allowed" }, 405);
+  if (resource === "status") return json2({ ...identity, scopes: grant.scopes, capabilities: { leads: grant.scopes.includes("leads:read"), testSubmissions: grant.scopes.includes("leads:read"), analytics: grant.scopes.includes("analytics:read"), leadStatus: grant.scopes.includes("leads:write") } });
+  if (resource === "leads/status") {
+    if (url.searchParams.has("mode")) return json2({ error: "Test submissions are read-only" }, 400);
+    if (!request.headers.get("content-type")?.startsWith("application/json")) return json2({ error: "JSON required" }, 400);
+    const reader = request.body?.getReader();
+    let body = "";
+    let size = 0;
+    if (reader) for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      size += value.length;
+      if (size > 2048) {
+        await reader.cancel();
+        return json2({ error: "Body too large" }, 413);
+      }
+      body += new TextDecoder().decode(value);
+    }
+    let data;
+    try {
+      data = JSON.parse(body);
+    } catch {
+      return json2({ error: "Invalid JSON" }, 400);
+    }
+    if (!data || typeof data.id !== "string" || data.id.length > 200 || !["new", "contacted", "closed"].includes(data.status)) return json2({ error: "Invalid lead status" }, 400);
+    const result = await env.DB.prepare("UPDATE leads SET status=? WHERE id=? AND tenant_id=? RETURNING id").bind(data.status, data.id, tenant).first();
+    return result ? json2({ ok: true }) : json2({ error: "Lead not found" }, 404);
+  }
+  if (resource === "leads") {
+    const mode = url.searchParams.get("mode") || "live";
+    if (!["live", "test"].includes(mode)) return json2({ error: "Invalid mode" }, 400);
+    const sql = mode === "test" ? `SELECT s.id,s.name,s.email,s.phone,s.message,s.page_path,s.created_at,s.fields_json,'test' AS status,s.form_id,'test' AS mode,o.status AS notification_status,o.last_error AS notification_error,o.test_output
+         FROM form_submissions s LEFT JOIN form_outbox o ON o.id=s.id AND o.tenant_id=s.tenant_id WHERE s.tenant_id=? AND s.mode='test' ORDER BY s.created_at DESC,s.id DESC LIMIT 200` : `SELECT l.id,l.name,l.email,l.phone,l.message,l.page_path,l.status,l.created_at,s.fields_json,o.status AS notification_status,o.last_error AS notification_error
+         FROM leads l LEFT JOIN form_submissions s ON s.id=l.id AND s.tenant_id=l.tenant_id AND s.mode='live'
+         LEFT JOIN form_outbox o ON o.id=s.id AND o.tenant_id=l.tenant_id WHERE l.tenant_id=? ORDER BY l.created_at DESC,l.id DESC LIMIT 200`;
+    const stored = (await env.DB.prepare(sql).bind(tenant).all()).results;
+    const rows2 = [];
+    let size = 0;
+    for (const row of stored) {
+      size += new TextEncoder().encode(JSON.stringify(row)).length;
+      if (size > 35e5) break;
+      rows2.push(row);
+    }
+    return json2({ ...identity, source: "connected", mode: mode === "live" ? "production" : "test", writable: mode !== "test" && grant.scopes.includes("leads:write"), truncated: rows2.length < stored.length || stored.length === 200, rows: rows2 });
+  }
+  const days = Number(url.searchParams.get("days") || "30");
+  if (!Number.isInteger(days) || days < 1 || days > 90) return json2({ error: "days must be 1\u201390" }, 400);
+  const rows = (await env.DB.prepare(`WITH days AS (
+    SELECT day FROM analytics_events WHERE tenant_id=? AND (src IS NULL OR src='' OR src='live')
+    UNION SELECT substr(created_at,1,10) FROM leads WHERE tenant_id=?
+  ) SELECT day,
+    (SELECT COUNT(*) FROM analytics_events e WHERE e.tenant_id=? AND e.day=days.day AND e.kind='pageview' AND (e.src IS NULL OR e.src='' OR e.src='live')) AS views,
+    (SELECT COUNT(DISTINCT vid) FROM analytics_events e WHERE e.tenant_id=? AND e.day=days.day AND e.kind='pageview' AND (e.src IS NULL OR e.src='' OR e.src='live')) AS visitors,
+    (SELECT COUNT(*) FROM leads l WHERE l.tenant_id=? AND substr(l.created_at,1,10)=days.day) AS enquiries
+    FROM days WHERE day>=date('now',?) AND day<=date('now') ORDER BY day`).bind(tenant, tenant, tenant, tenant, tenant, `-${days - 1} days`).all()).results;
+  return json2({ ...identity, source: "connected", rows });
+}
+
+// src/types.ts
+var defaultTheme = {
+  colorBg: "#F7F4EF",
+  colorText: "#1A1714",
+  colorMuted: "#5C574F",
+  colorAccent: "#B44A2C",
+  colorAccentText: "#FFFFFF",
+  colorSurface: "#FFFFFF",
+  colorSurface2: "#EFEAE3",
+  colorBorder: "#E4DDD2",
+  colorFocus: "#B44A2C",
+  fontBody: 'ui-sans-serif, system-ui, "Segoe UI", sans-serif',
+  fontDisplay: "ui-serif, Georgia, 'Times New Roman', serif",
+  radius: "8px",
+  radiusLg: "16px",
+  radiusPill: "999px",
+  maxWidth: "1120px"
+};
+
+// src/worker/tenant.ts
+async function tenantBySlug(env, slug) {
+  return env.DB.prepare("SELECT * FROM tenants WHERE slug = ?").bind(slug).first();
+}
+async function tenantById(env, id) {
+  return env.DB.prepare("SELECT * FROM tenants WHERE id = ?").bind(id).first();
+}
+async function tenantByHostname(env, hostname) {
+  const cached = await env.KV.get(`host:${hostname}`);
+  if (cached) return tenantById(env, cached);
+  const row = await env.DB.prepare(
+    `SELECT tenants.* FROM tenants JOIN hostnames ON hostnames.tenant_id = tenants.id WHERE hostnames.hostname = ?`
+  ).bind(hostname.toLowerCase()).first();
+  if (row) await env.KV.put(`host:${hostname}`, row.id, { expirationTtl: 3600 });
+  return row;
+}
+async function loadSiteSnapshot(env, tenantId) {
+  const siteRow = await env.DB.prepare("SELECT json FROM site_config WHERE tenant_id = ?").bind(tenantId).first();
+  const contentRow = await env.DB.prepare("SELECT json FROM content WHERE tenant_id = ?").bind(tenantId).first();
+  const themeRow = await env.DB.prepare("SELECT json FROM theme WHERE tenant_id = ?").bind(tenantId).first();
+  if (!siteRow || !contentRow || !themeRow) return null;
+  return {
+    site: JSON.parse(siteRow.json),
+    content: JSON.parse(contentRow.json),
+    theme: { ...defaultTheme, ...JSON.parse(themeRow.json) }
+  };
+}
+async function bumpVersion(env, tenantId) {
+  const row = await env.DB.prepare(
+    "UPDATE tenants SET content_version = content_version + 1 WHERE id = ? RETURNING content_version"
+  ).bind(tenantId).first();
+  return row?.content_version ?? 1;
+}
+
 // src/worker/surfaces/api.ts
 var KINDS = /* @__PURE__ */ new Set(["pageview", "leave", "convert", "engage", "ping"]);
 var GOALS = /* @__PURE__ */ new Set(["form", "tel", "mailto", "maps"]);
@@ -23687,6 +23768,7 @@ async function route(env, request) {
   const path = url.pathname;
   if (isPreviewHost(env, request)) return handlePreview(env, request);
   if (path.startsWith("/preview/")) return previewHandoff(env, request);
+  if (path.startsWith("/api/admin/")) return handleAdmin(env, request);
   const approve = await handleApproveReject(env, request);
   if (approve) return approve;
   const updatesApi = await handleUpdatesApi(env, request);

package/bin/types/src/admin/connection.d.ts

@@ -0,0 +1,3 @@
+import type { AdminManifest } from '@tryvitris/website-admin-contracts';
+/** Identity and response requirements of the published alpha adapter. */
+export declare function readConnection(manifest: AdminManifest, token: string, resource: 'status' | 'leads' | 'analytics', test?: boolean, transport?: typeof fetch): Promise<any>;

package/bin/types/src/agent/refine-document-checks.d.ts

@@ -0,0 +1,5 @@
+export declare function hasRefinementPlaceholder(html: string): boolean;
+/** Load laid-out lazy images in the isolated verification page before judging them. */
+export declare function settleRefinementImages(page: {
+    evaluate: (expression: string) => Promise<unknown>;
+}, timeoutMs?: number): Promise<void>;

package/bin/types/src/cli/admin.d.ts

@@ -0,0 +1,21 @@
+import { type CommandResult } from './types.ts';
+export declare const ADMIN_VERSION = "0.1.0-alpha.1";
+export type AdminOptions = {
+    site?: string;
+    dir?: string;
+    domain?: string;
+    website?: string;
+    tenant?: string;
+    backendOrigin?: string;
+    plan?: boolean;
+    apply?: boolean;
+    leadWrite?: boolean;
+    dryRun?: boolean;
+    grants?: string;
+    out?: string;
+};
+/** Merge the operator's COMPLETE map, never replace unrelated installations. */
+export declare function mergeAdminGrant(existing: unknown, addition: unknown): {
+    [x: string]: unknown;
+};
+export declare function adminCommand(command: string, options: AdminOptions): Promise<CommandResult>;

package/bin/types/src/cli/site-create.d.ts

@@ -4,6 +4,8 @@ export type CreateSiteOptions = SiteInputOptions & {
     dir: string;
     slug: string;
     name?: string;
+    /** Opt-in instructions only; never provision during site creation. */
+    admin?: boolean;
     from?: string;
     mode?: "redesign" | "preserve";
     blank?: boolean;

package/bin/vitris-art.js

@@ -12,7 +12,7 @@ import {
   retireProducedAsset,
   validateAssetProduction,
   withMutationLock
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-create-site.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   createSite
-} from "./chunks/chunk-DYKLM4I3.js";
+} from "./chunks/chunk-M72KKZIB.js";
 import "./chunks/chunk-34H54KEY.js";
 import "./chunks/chunk-JCRGE6AL.js";
 import {
   promptSourceUrl
-} from "./chunks/chunk-PYCRUMCT.js";
+} from "./chunks/chunk-54QPYUM2.js";
 import "./chunks/chunk-XGTHGWPW.js";
 import {
   siteInputsFromArgv
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";
@@ -41,6 +41,7 @@ var arg = (flag) => {
 };
 var usage = `Usage: vitris-create-site --dir ../acme --slug acme [--name "Acme Shop"] [--from URL | --blank]
   --owner EMAIL         Owner login email
+  --admin               Prepare optional sibling admin instructions (no cloud writes)
   --template ID         Catalog ID, name, or hosted template URL; continue automatically
   --template-release R  Optional catalog revision
   --content TEXT        Additional business content or instructions
@@ -67,6 +68,7 @@ async function main() {
     blank,
     ...siteInputsFromArgv(process.argv),
     mode: arg("--mode"),
+    admin: process.argv.includes("--admin"),
     owner: arg("--owner"),
     backendOrigin: arg("--backend-origin") || arg("--kernel-origin"),
     harnessSpec: arg("--harness") || arg("--kernel")

package/bin/vitris-cursor-hook.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   handleCursorHook
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-eval.js

@@ -3,7 +3,7 @@ import {
   gradeAll,
   gradeNode,
   reviewSubject
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";
@@ -44,7 +44,7 @@ if (paths.length) {
 } else if (process.argv.includes("--expand-packet")) {
   const expId = arg("--expand-packet");
   const manifestHash = arg("--manifest-hash");
-  const { expandPacketItem } = await import("./chunks/packets-LBMDIFPO.js");
+  const { expandPacketItem } = await import("./chunks/packets-XFXKHSEY.js");
   console.log(expandPacketItem(root, node || "business-review", expId, manifestHash));
 } else if (process.argv.includes("--expand-design-context")) {
   const preparationId = arg("--preparation");
@@ -52,7 +52,7 @@ if (paths.length) {
   if (!preparationId || !expansionId || expansionId.startsWith("--")) {
     throw new Error("Use --expand-design-context <ID> --preparation <PREP_ID> [--site PATH]");
   }
-  const { expandDesignContextForPreparation } = await import("./chunks/design-context-store-W3VTZ4HA.js");
+  const { expandDesignContextForPreparation } = await import("./chunks/design-context-store-ETVS4N6W.js");
   const result = expandDesignContextForPreparation(root, preparationId, expansionId);
   if (!result.ok) {
     console.error(result.reason);

package/bin/vitris-go.js

@@ -7,8 +7,8 @@ import {
   runCreativeProfile,
   runSite,
   statusSite
-} from "./chunks/chunk-FEFLSJM5.js";
-import "./chunks/chunk-R2WRQDVE.js";
+} from "./chunks/chunk-RE4GOHSU.js";
+import "./chunks/chunk-65LRZIBP.js";
 import "./chunks/chunk-34H54KEY.js";
 import "./chunks/chunk-JCRGE6AL.js";
 import "./chunks/chunk-XL2DRAYI.js";
@@ -19,7 +19,7 @@ import {
   resolveSiteInputsLive,
   runWorkflow,
   siteInputsFromArgv
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-harvest.js

@@ -3,13 +3,13 @@ import {
   gatherOnboard,
   normalizeSourceUrl,
   persistOnboard
-} from "./chunks/chunk-PYCRUMCT.js";
+} from "./chunks/chunk-54QPYUM2.js";
 import {
   loadDevVars
 } from "./chunks/chunk-XGTHGWPW.js";
 import {
   gradeHarvest
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-knowledge.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   explainStage
-} from "./chunks/chunk-3OKR5AZJ.js";
-import "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-VKU5TY5C.js";
+import "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-launch-preflight.js

@@ -10,7 +10,7 @@ import {
 } from "./chunks/chunk-XL2DRAYI.js";
 import {
   templateAdaptationFailures
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-motion-view.js

@@ -3,7 +3,7 @@ import {
   TEMPLATE_MOTION_PATH,
   currentSelectionHash,
   templateMotionHash
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-refresh.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   upgradeSite
-} from "./chunks/chunk-A2XMAPVW.js";
+} from "./chunks/chunk-JBSGJR7X.js";
 import "./chunks/chunk-JCRGE6AL.js";
-import "./chunks/chunk-XY73ZLHB.js";
+import "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-stock.js

@@ -33,7 +33,7 @@ if (!command || command === "--help") {
   if (!site) throw new Error("--site required");
   const item = readStockCatalog(catalogPath).items.find((i) => i.id === id);
   if (!item) throw new Error("Unknown stock asset");
-  const { findActivePreparation } = await import("./chunks/preparation-AV4PDQY6.js");
+  const { findActivePreparation } = await import("./chunks/preparation-3OR7LVPQ.js");
   const current = existsSync(join(site, "agent/PREPARED.json"));
   if (current && !findActivePreparation(site, "media") && !findActivePreparation(site, "asset-production")) throw new Error("Import stock during media or asset-production; route later additions through the declared owner");
   const launch = existsSync(join(site, "launch.json")) ? json(join(site, "launch.json")) : {};

package/bin/vitris-themes.js

@@ -19,7 +19,7 @@ import {
   thumbnailService,
   validateAdaptationPreferences,
   writeThemePicker
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-upgrade.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 import {
   upgradeSite
-} from "./chunks/chunk-A2XMAPVW.js";
+} from "./chunks/chunk-JBSGJR7X.js";
 import "./chunks/chunk-JCRGE6AL.js";
-import "./chunks/chunk-XY73ZLHB.js";
+import "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";

package/bin/vitris-verify-browser.js

@@ -11,7 +11,7 @@ import {
   observeMotion,
   templateMotionHash,
   validateTemplateMotionPlan
-} from "./chunks/chunk-XY73ZLHB.js";
+} from "./chunks/chunk-GQPUILFR.js";
 import "./chunks/chunk-KVMZSQ3D.js";
 import "./chunks/chunk-WOORR67N.js";
 import "./chunks/chunk-PRLL7B63.js";