siteplane 0.1.36

package/dist/bin/siteplane.js

@@ -0,0 +1,4383 @@
+#!/usr/bin/env node
+
+// src/bin/run-siteplane.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { access as access2, readFile as readFile8 } from "fs/promises";
+import { join as join7, resolve } from "path";
+
+// ../cli/dist/analytics/manifest.js
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname } from "path";
+
+// ../shared/dist/actors.js
+import { z } from "zod";
+var ACTOR_TYPES = ["developer", "client", "agent", "system"];
+var actorTypeSchema = z.enum(ACTOR_TYPES);
+
+// ../shared/dist/analytics-defaults.js
+var ANALYTICS_BATCH_LIMITS = {
+  maxEventsPerRequest: 50,
+  maxJsonBodyBytes: 64 * 1024,
+  maxPropertiesJsonBytes: 8 * 1024
+};
+var ANALYTICS_RETENTION_DEFAULTS = {
+  enabledRawEventRetentionDays: 30,
+  higherTierRawEventRetentionDays: 90,
+  maxRawEventRetentionDaysWithoutAdr: 180,
+  diagnosticsRetentionDays: 30,
+  rateLimitBucketRetentionDays: 2,
+  lateEventWindowHours: 72
+};
+
+// ../shared/dist/analytics-booking.js
+import { z as z2 } from "zod";
+var bookingProviders = ["treatwell", "beautinda", "other"];
+var bookingAttributionModes = [
+  "outbound_click_and_utm",
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingSignalSources = [
+  "outbound_click",
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingAttributionConfidences = [
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingProviderSchema = z2.enum(bookingProviders);
+var bookingAttributionModeSchema = z2.enum(bookingAttributionModes);
+var bookingSignalSourceSchema = z2.enum(bookingSignalSources);
+var bookingAttributionConfidenceSchema = z2.enum(bookingAttributionConfidences);
+var bookingProviderHintSchema = z2.object({
+  bookingProvider: bookingProviderSchema,
+  bookingUrlHost: z2.string().min(1).max(253),
+  bookingAttributionMode: bookingAttributionModeSchema,
+  utmContent: z2.string().min(1).max(200).optional(),
+  successCondition: z2.literal("redirect_status=succeeded").optional()
+}).superRefine((hint, context) => {
+  if (hint.successCondition !== void 0 && hint.bookingAttributionMode !== "provider_redirect") {
+    context.addIssue({
+      code: "custom",
+      message: "successCondition is allowed only for provider_redirect booking hints.",
+      path: ["successCondition"]
+    });
+  }
+});
+
+// ../shared/dist/analytics-contract.js
+import { z as z3 } from "zod";
+var ANALYTICS_CONTRACT_VERSION = "analytics-contract.v1";
+var ANALYTICS_CONTRACT_HASH = "sha256:a91bddcc3c5e4196933b0335d03eaf41ff929cb736bdd694fe54d07ab52dada1";
+var ANALYTICS_IMPORT_SCHEMA_VERSION = "analytics-provider-import.v1";
+var analyticsImportTargetIdSchema = z3.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u);
+var analyticsProviderImportRowSchema = z3.object({
+  targetId: analyticsImportTargetIdSchema,
+  occurredAt: z3.string().datetime({ offset: true }),
+  attributionConfidence: z3.enum(["provider_reported", "manual_import"]),
+  providerEventId: z3.string().trim().min(1).max(160).optional(),
+  idempotencyKey: z3.string().trim().min(1).max(160).optional()
+}).strict().superRefine((row, context) => {
+  if (!row.providerEventId && !row.idempotencyKey) {
+    context.addIssue({
+      code: "custom",
+      message: "Each import row requires providerEventId or idempotencyKey.",
+      path: ["providerEventId"]
+    });
+  }
+});
+var analyticsProviderImportSchema = z3.object({
+  schemaVersion: z3.literal(ANALYTICS_IMPORT_SCHEMA_VERSION),
+  provider: z3.enum(["treatwell", "beautinda", "other"]),
+  sourceName: z3.string().trim().min(1).max(160).optional(),
+  rows: z3.array(analyticsProviderImportRowSchema).min(1).max(1e3)
+}).strict();
+
+// ../shared/dist/analytics-events.js
+import { z as z4 } from "zod";
+var ANALYTICS_SCHEMA_VERSION = "analytics.v1";
+var ANALYTICS_KEY_PATTERN = /^(pk|sk)_siteplane_([A-Za-z0-9_-]{16})_[A-Za-z0-9_-]{43}$/;
+var analyticsSessionIdSchema = z4.string().regex(/^cpa_s_[a-f0-9]{32}$/u);
+var analyticsVisitorIdSchema = z4.string().regex(/^cpa_v_[a-f0-9]{32}$/u);
+var analyticsPersistedIdentityHashSchema = z4.string().regex(/^[a-f0-9]{64}$/u);
+var analyticsEventNames = [
+  "page_view",
+  "section_view",
+  "cta_click",
+  "outbound_click",
+  "email_click",
+  "phone_click",
+  "file_download",
+  "form_start",
+  "form_submit",
+  "form_error",
+  "lead_created",
+  "checkout_started",
+  "conversion",
+  "checkout_completed",
+  "payment_succeeded",
+  "subscription_started",
+  "purchase_completed",
+  "trial_started"
+];
+var serverOnlyAnalyticsEvents = [
+  "checkout_completed",
+  "payment_succeeded",
+  "subscription_started",
+  "purchase_completed",
+  "trial_started"
+];
+var analyticsEventSources = [
+  "browser",
+  "server",
+  "test",
+  "editor_preview",
+  "system"
+];
+var analyticsIngestionChannels = [
+  "browser_collector",
+  "server_sdk",
+  "provider_endpoint",
+  "provider_import",
+  "test",
+  "editor_preview",
+  "system_job"
+];
+var analyticsTargetTypes = [
+  "cta",
+  "form",
+  "section",
+  "file",
+  "link",
+  "conversion",
+  "server_conversion"
+];
+var analyticsDataAttributeEvents = [
+  "cta_click",
+  "outbound_click",
+  "email_click",
+  "phone_click",
+  "file_download",
+  "section_view",
+  "checkout_started",
+  "form"
+];
+var analyticsDeviceTypes = [
+  "desktop",
+  "tablet",
+  "mobile",
+  "unknown"
+];
+var analyticsBotClassifications = [
+  "normal",
+  "known_bot",
+  "suspicious",
+  "invalid"
+];
+var analyticsValidityStatuses = [
+  "accepted",
+  "rejected",
+  "ignored"
+];
+var analyticsEventNameSchema = z4.enum(analyticsEventNames);
+var serverOnlyAnalyticsEventSchema = z4.enum(serverOnlyAnalyticsEvents);
+var analyticsEventSourceSchema = z4.enum(analyticsEventSources);
+var analyticsIngestionChannelSchema = z4.enum(analyticsIngestionChannels);
+var analyticsTargetTypeSchema = z4.enum(analyticsTargetTypes);
+var analyticsDataAttributeEventSchema = z4.enum(analyticsDataAttributeEvents);
+var analyticsDeviceTypeSchema = z4.enum(analyticsDeviceTypes);
+var analyticsBotClassificationSchema = z4.enum(analyticsBotClassifications);
+var analyticsValidityStatusSchema = z4.enum(analyticsValidityStatuses);
+var analyticsPropertiesSchema = z4.record(z4.string(), z4.unknown());
+var analyticsTimestampSchema = z4.string().datetime({ offset: true });
+var analyticsBrowserEventSchema = z4.object({
+  eventId: z4.string().min(1).max(160),
+  eventName: analyticsEventNameSchema,
+  eventSource: analyticsEventSourceSchema.optional().default("browser"),
+  targetId: z4.string().min(1).max(160).optional(),
+  targetType: analyticsTargetTypeSchema.optional(),
+  visitorId: analyticsVisitorIdSchema.optional(),
+  sessionId: analyticsSessionIdSchema,
+  idempotencyKey: z4.string().min(1).max(240).optional(),
+  occurredAt: analyticsTimestampSchema,
+  pageUrl: z4.string().url().max(2048).optional(),
+  pagePath: z4.string().min(1).max(1024).optional(),
+  routeTemplate: z4.string().min(1).max(1024).optional(),
+  referrer: z4.string().url().max(2048).optional(),
+  utmSource: z4.string().min(1).max(200).optional(),
+  utmMedium: z4.string().min(1).max(200).optional(),
+  utmCampaign: z4.string().min(1).max(200).optional(),
+  utmContent: z4.string().min(1).max(200).optional(),
+  utmTerm: z4.string().min(1).max(200).optional(),
+  deviceType: analyticsDeviceTypeSchema.optional(),
+  browserName: z4.string().min(1).max(120).optional(),
+  osName: z4.string().min(1).max(120).optional(),
+  country: z4.string().min(1).max(80).optional(),
+  region: z4.string().min(1).max(120).optional(),
+  properties: analyticsPropertiesSchema.optional().default({})
+}).superRefine((event, context) => {
+  if (isServerOnlyAnalyticsEvent(event.eventName)) {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot contain server-only events.",
+      path: ["eventName"]
+    });
+  }
+  if (event.eventSource === "server" || event.eventSource === "system") {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot use server/system sources.",
+      path: ["eventSource"]
+    });
+  }
+  if (event.targetType === "server_conversion") {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot use server conversion targets.",
+      path: ["targetType"]
+    });
+  }
+});
+var analyticsBrowserEventPayloadSchema = z4.object({
+  siteKey: z4.string().min(1),
+  schemaVersion: z4.literal(ANALYTICS_SCHEMA_VERSION),
+  mode: z4.enum(["live", "test"]).optional().default("live"),
+  events: z4.array(analyticsBrowserEventSchema).min(1).max(50)
+});
+var analyticsNormalizedEventBaseSchema = z4.object({
+  site_id: z4.string().uuid(),
+  event_id: z4.string().min(1).max(160),
+  schema_version: z4.literal(ANALYTICS_SCHEMA_VERSION),
+  event_name: analyticsEventNameSchema,
+  event_source: analyticsEventSourceSchema,
+  ingestion_channel: analyticsIngestionChannelSchema,
+  target_id: z4.string().min(1).max(160).nullable().optional(),
+  target_type: analyticsTargetTypeSchema.nullable().optional(),
+  dedupe_key: z4.string().regex(/^analytics_dedupe_v1_[a-f0-9]{64}$/u).nullable().optional(),
+  idempotency_key: z4.string().min(1).max(240).nullable().optional(),
+  bot_classification: analyticsBotClassificationSchema,
+  validity_status: analyticsValidityStatusSchema,
+  rejection_reason: z4.string().min(1).max(240).nullable().optional(),
+  occurred_at: analyticsTimestampSchema,
+  received_at: analyticsTimestampSchema,
+  page_url: z4.string().url().max(2048).nullable().optional(),
+  page_path: z4.string().min(1).max(1024).nullable().optional(),
+  route_template: z4.string().min(1).max(1024).nullable().optional(),
+  referrer: z4.string().url().max(2048).nullable().optional(),
+  utm_source: z4.string().min(1).max(200).nullable().optional(),
+  utm_medium: z4.string().min(1).max(200).nullable().optional(),
+  utm_campaign: z4.string().min(1).max(200).nullable().optional(),
+  utm_content: z4.string().min(1).max(200).nullable().optional(),
+  utm_term: z4.string().min(1).max(200).nullable().optional(),
+  country: z4.string().min(1).max(80).nullable().optional(),
+  region: z4.string().min(1).max(120).nullable().optional(),
+  device_type: analyticsDeviceTypeSchema,
+  browser_name: z4.string().min(1).max(120).nullable().optional(),
+  os_name: z4.string().min(1).max(120).nullable().optional(),
+  provider: z4.string().min(1).max(120).nullable().optional(),
+  provider_event_id: z4.string().min(1).max(240).nullable().optional(),
+  properties: analyticsPropertiesSchema
+});
+var analyticsRawNormalizedEventSchema = analyticsNormalizedEventBaseSchema.extend({
+  visitor_id: analyticsVisitorIdSchema.nullable().optional(),
+  session_id: analyticsSessionIdSchema.nullable().optional()
+});
+var analyticsNormalizedEventSchema = analyticsNormalizedEventBaseSchema.extend({
+  visitor_id: analyticsPersistedIdentityHashSchema.nullable().optional(),
+  session_id: analyticsPersistedIdentityHashSchema.nullable().optional()
+});
+function isServerOnlyAnalyticsEvent(eventName) {
+  return serverOnlyAnalyticsEvents.includes(eventName);
+}
+function getAnalyticsKeyLookup(rawKey) {
+  const match = ANALYTICS_KEY_PATTERN.exec(rawKey);
+  return match ? `${match[1]}_siteplane_${match[2]}` : null;
+}
+function expandAnalyticsDataAttributeEvent(event) {
+  if (event === "form") {
+    return ["form_start", "form_submit", "form_error"];
+  }
+  return [event];
+}
+
+// ../shared/dist/analytics-manifest.js
+import { z as z5 } from "zod";
+var analyticsTargetIdSchema = z5.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u, {
+  message: "Analytics target IDs must be stable identifiers without whitespace or visible copy."
+});
+var analyticsManifestRecordSchema = z5.record(z5.string(), z5.unknown());
+var analyticsFormPurposes = [
+  "contact",
+  "lead",
+  "newsletter",
+  "search",
+  "login",
+  "other"
+];
+var analyticsFormPurposeSchema = z5.enum(analyticsFormPurposes);
+var analyticsManifestRouteSchema = z5.object({
+  path: z5.string().min(1).max(1024),
+  pageType: z5.string().min(1).max(120).optional(),
+  label: z5.string().min(1).max(200).optional()
+}).passthrough();
+var analyticsManifestTargetSchema = z5.object({
+  id: analyticsTargetIdSchema,
+  type: analyticsTargetTypeSchema,
+  event: analyticsEventNameSchema.optional(),
+  events: z5.array(analyticsEventNameSchema).min(1).max(20).optional(),
+  route: z5.string().min(1).max(1024).optional(),
+  label: z5.string().min(1).max(200).optional(),
+  description: z5.string().min(1).max(1e3).optional(),
+  autoActive: z5.boolean().optional(),
+  sourceHints: analyticsManifestRecordSchema.optional()
+}).passthrough().superRefine((target, context) => {
+  if (target.event === void 0 && target.events === void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics targets require event or events.",
+      path: ["event"]
+    });
+  }
+  if (target.event !== void 0 && target.events !== void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics targets must use event or events, never both.",
+      path: ["events"]
+    });
+  }
+  if (target.type === "form" && !analyticsFormPurposeSchema.safeParse(target.sourceHints?.formPurpose).success) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics form targets require a typed sourceHints.formPurpose.",
+      path: ["sourceHints", "formPurpose"]
+    });
+  }
+});
+var analyticsManifestSchema = z5.object({
+  schemaVersion: z5.literal(ANALYTICS_SCHEMA_VERSION),
+  siteId: z5.string().min(1),
+  siteKeyRef: z5.string().regex(/^env:[A-Z][A-Z0-9_]*$/u, {
+    message: "siteKeyRef must be an environment-variable reference."
+  }),
+  siteKeyLookup: z5.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}$/),
+  routes: z5.array(analyticsManifestRouteSchema),
+  targets: z5.array(analyticsManifestTargetSchema),
+  metadata: analyticsManifestRecordSchema.optional(),
+  siteKey: z5.string().optional(),
+  secretKey: z5.string().optional(),
+  rawKey: z5.string().optional(),
+  token: z5.string().optional(),
+  accessToken: z5.string().optional()
+}).passthrough().superRefine((manifest, context) => {
+  const targetIds = /* @__PURE__ */ new Set();
+  for (const [index, target] of manifest.targets.entries()) {
+    if (targetIds.has(target.id)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate analytics target ID: ${target.id}`,
+        path: ["targets", index, "id"]
+      });
+    }
+    targetIds.add(target.id);
+  }
+  for (const issue of findUnsafeSecretReferences(manifest)) {
+    context.addIssue({
+      code: "custom",
+      message: "Raw secret material is not allowed in analytics manifests.",
+      path: issue
+    });
+  }
+});
+var redactedManifestKeys = /* @__PURE__ */ new Set([
+  "siteKey",
+  "secretKey",
+  "rawKey",
+  "token",
+  "accessToken"
+]);
+var sensitiveManifestKeyPattern = /(?:^|_)(?:access_token|api_key|authorization|bearer|cookie|password|private_key|raw_key|secret(?:_key)?|token)(?:$|_)/iu;
+var secretValuePattern = /(?:\bsk_(?:live|test)_|\bcpb_|\bpmt_(?:pc|setup|cli)_|\bservice_role\b|bearer\s+[a-z0-9._~-]+)/iu;
+function redactAnalyticsManifest(manifest) {
+  const redactedKeys = [];
+  const redacted = redactManifestValue(manifest, [], redactedKeys);
+  return {
+    manifest: analyticsManifestSchema.parse(redacted),
+    redactedKeys: redactedKeys.sort()
+  };
+}
+function redactManifestValue(value, path, redactedKeys) {
+  if (Array.isArray(value)) {
+    return value.map((item, index) => redactManifestValue(item, [...path, String(index)], redactedKeys));
+  }
+  if (!isPlainRecord(value)) {
+    return value;
+  }
+  const redacted = {};
+  for (const [key, childValue] of Object.entries(value)) {
+    const childPath = [...path, key];
+    if (redactedManifestKeys.has(key) || sensitiveManifestKeyPattern.test(normalizeManifestKey(key)) || typeof childValue === "string" && secretValuePattern.test(childValue)) {
+      redactedKeys.push(childPath.join("."));
+      continue;
+    }
+    const redactedChild = redactManifestValue(childValue, childPath, redactedKeys);
+    if (redactedChild !== void 0) {
+      redacted[key] = redactedChild;
+    }
+  }
+  if (path.length > 0 && Object.keys(redacted).length === 0) {
+    return void 0;
+  }
+  return redacted;
+}
+function normalizeManifestKey(key) {
+  return key.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").replace(/-/gu, "_").toLowerCase();
+}
+function findUnsafeSecretReferences(value, path = []) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => findUnsafeSecretReferences(item, [...path, index]));
+  }
+  if (!isPlainRecord(value)) {
+    return [];
+  }
+  return Object.entries(value).flatMap(([key, childValue]) => {
+    const childPath = [...path, key];
+    const referenceLikeKey = /(?:ref|lookup|prefix)$/iu.test(key);
+    const unsafeHere = referenceLikeKey && typeof childValue === "string" && secretValuePattern.test(childValue);
+    return [
+      ...unsafeHere ? [childPath] : [],
+      ...findUnsafeSecretReferences(childValue, childPath)
+    ];
+  });
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// ../shared/dist/analytics-metrics.js
+import { z as z6 } from "zod";
+var analyticsVisitorQualities = ["exact", "estimated"];
+var analyticsVisitorQualitySchema = z6.enum(analyticsVisitorQualities);
+var analyticsKpiKeys = [
+  "pageViews",
+  "sessions",
+  "visitors",
+  "estimatedVisitors",
+  "inquiries",
+  "leads",
+  "conversions",
+  "conversionRate",
+  "inquiryRate"
+];
+var analyticsKpiKeySchema = z6.enum(analyticsKpiKeys);
+
+// ../shared/dist/analytics-privacy.js
+var serverPropertySchemas = {
+  lead_created: {
+    conversionId: "identifier",
+    formId: "identifier",
+    formType: "enum",
+    customerRef: "identifier"
+  },
+  conversion: {
+    conversionId: "identifier",
+    conversionType: "enum",
+    attributionConfidence: "enum",
+    bookingSignalSource: "enum",
+    bookingProvider: "enum",
+    redirectStatus: "enum",
+    importId: "identifier"
+  },
+  checkout_completed: revenuePropertySchema(),
+  payment_succeeded: revenuePropertySchema(),
+  subscription_started: revenuePropertySchema(),
+  purchase_completed: revenuePropertySchema(),
+  trial_started: revenuePropertySchema()
+};
+function revenuePropertySchema() {
+  return {
+    conversionId: "identifier",
+    checkoutId: "identifier",
+    customerRef: "identifier",
+    amount: "amount",
+    currency: "enum",
+    planId: "identifier",
+    productId: "identifier"
+  };
+}
+
+// ../shared/dist/assets.js
+import { z as z7 } from "zod";
+var ASSET_STAGES = ["staging", "final", "deleted"];
+var ASSET_VISIBILITIES = ["private", "public", "deleted"];
+var ASSET_USAGE_ENTITY_TYPES = [
+  "branding",
+  "draft",
+  "change_set",
+  "published_value"
+];
+var assetStageSchema = z7.enum(ASSET_STAGES);
+var assetVisibilitySchema = z7.enum(ASSET_VISIBILITIES);
+var assetUsageEntityTypeSchema = z7.enum(ASSET_USAGE_ENTITY_TYPES);
+var brandingAccentColorSchema = z7.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/);
+
+// ../shared/dist/booking-contracts.js
+import { z as z8 } from "zod";
+var bookingStatuses = [
+  "pending_payment",
+  "confirmed",
+  "payment_expired",
+  "cancelled",
+  "no_show"
+];
+var bookingPaymentStatuses = [
+  "payment_not_required",
+  "checkout_open",
+  "processing",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "expired"
+];
+var bookingAccountReadinessStatuses = [
+  "not_started",
+  "setup_required",
+  "under_review",
+  "payments_ready",
+  "payouts_restricted",
+  "payments_restricted",
+  "deactivated"
+];
+var bookingRefundStatuses = [
+  "none",
+  "pending",
+  "partially_refunded",
+  "refunded",
+  "failed"
+];
+var bookingDisputeStatuses = [
+  "none",
+  "needs_response",
+  "under_review",
+  "won",
+  "lost"
+];
+var bookingPaymentModes = [
+  "onsite_only",
+  "online_required",
+  "customer_choice"
+];
+var bookingPaymentCollectionTypes = [
+  "full_amount",
+  "deposit_percent"
+];
+var bookingResourceKinds = [
+  "person",
+  "room",
+  "equipment",
+  "other"
+];
+var bookingStatusSchema = z8.enum(bookingStatuses);
+var bookingPaymentStatusSchema = z8.enum(bookingPaymentStatuses);
+var bookingAccountReadinessStatusSchema = z8.enum(bookingAccountReadinessStatuses);
+var bookingRefundStatusSchema = z8.enum(bookingRefundStatuses);
+var bookingDisputeStatusSchema = z8.enum(bookingDisputeStatuses);
+var bookingPaymentModeSchema = z8.enum(bookingPaymentModes);
+var bookingPaymentCollectionTypeSchema = z8.enum(bookingPaymentCollectionTypes);
+var bookingPaymentCollectionSchema = z8.discriminatedUnion("type", [
+  z8.object({ type: z8.literal("full_amount") }).strict(),
+  z8.object({
+    type: z8.literal("deposit_percent"),
+    depositPercent: z8.number().int().min(10).max(90)
+  }).strict()
+]);
+var bookingPaymentChoices = ["onsite", "online"];
+var bookingPaymentChoiceSchema = z8.enum(bookingPaymentChoices);
+var bookingPaymentSnapshotSchema = z8.object({
+  snapshotId: z8.string().uuid(),
+  snapshotVersion: z8.number().int().positive(),
+  currency: z8.literal("EUR"),
+  totalAmountCents: z8.number().int().min(0),
+  onlineAmountCents: z8.number().int().min(0),
+  onsiteRemainderCents: z8.number().int().min(0),
+  maxStripeRefundAmountCents: z8.number().int().min(0)
+}).strict().superRefine((snapshot, context) => {
+  if (snapshot.onlineAmountCents + snapshot.onsiteRemainderCents !== snapshot.totalAmountCents) {
+    context.addIssue({
+      code: "custom",
+      message: "Payment snapshot amounts must add up to the total amount."
+    });
+  }
+  if (snapshot.maxStripeRefundAmountCents > snapshot.onlineAmountCents) {
+    context.addIssue({
+      code: "custom",
+      message: "Stripe refund basis cannot exceed the online amount."
+    });
+  }
+});
+var bookingServiceVariantSchema = z8.object({
+  id: z8.string().uuid(),
+  name: z8.string().trim().min(1).max(120),
+  durationMinutes: z8.number().int().min(1).max(1440),
+  priceCents: z8.number().int().min(0).nullable()
+}).strict();
+var bookingServiceVariantsSchema = z8.array(bookingServiceVariantSchema).min(1).max(20);
+var isoDateSchema = z8.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var utcDateTimeSchema = z8.string().datetime();
+var bookingLocalTimeSchema = z8.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/);
+var bookingAvailabilityIntervalsSchema = z8.array(z8.object({
+  start: bookingLocalTimeSchema,
+  end: bookingLocalTimeSchema
+}).strict().refine((interval) => interval.end > interval.start)).superRefine((intervals, context) => {
+  const sorted = [...intervals].sort((left, right) => left.start.localeCompare(right.start));
+  for (let index = 1; index < sorted.length; index += 1) {
+    if (sorted[index].start < sorted[index - 1].end) {
+      context.addIssue({
+        code: "custom",
+        message: "Booking availability intervals must not overlap."
+      });
+      return;
+    }
+  }
+});
+var bookingPublicConfigSchema = z8.object({
+  site: z8.object({
+    name: z8.string().trim().min(1),
+    timezone: z8.string().trim().min(1),
+    locale: z8.string().trim().min(2),
+    bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+    privacyUrl: z8.string().url().nullable()
+  }),
+  branding: z8.object({
+    logoUrl: z8.string().url().nullable(),
+    accentColor: z8.string().trim().min(1).nullable()
+  }),
+  settings: z8.object({
+    slotIntervalMinutes: z8.number().int().positive(),
+    minLeadMinutes: z8.number().int().min(0),
+    maxAdvanceDays: z8.number().int().min(1),
+    requirePhone: z8.boolean(),
+    collectNote: z8.boolean(),
+    confirmationMessage: z8.string().nullable()
+  }),
+  /** Freitexte des Salons, im Kassen-Schritt vor der Bestaetigung sichtbar. */
+  policies: z8.object({
+    cancellation: z8.string().nullable(),
+    lateArrival: z8.string().nullable()
+  }),
+  payment: z8.object({
+    mode: bookingPaymentModeSchema,
+    collection: bookingPaymentCollectionSchema,
+    onlinePaymentsReady: z8.boolean()
+  }).strict(),
+  serviceCategories: z8.array(z8.object({
+    id: z8.string().uuid(),
+    name: z8.string().trim().min(1),
+    sortOrder: z8.number().int()
+  })),
+  serviceSubcategories: z8.array(z8.object({
+    id: z8.string().uuid(),
+    categoryId: z8.string().uuid(),
+    name: z8.string().trim().min(1),
+    sortOrder: z8.number().int()
+  })),
+  services: z8.array(z8.object({
+    id: z8.string().trim().min(1),
+    name: z8.string().trim().min(1),
+    durationMinutes: z8.number().int().positive(),
+    priceCents: z8.number().int().min(0).nullable(),
+    currency: z8.string().regex(/^[A-Z]{3}$/),
+    description: z8.string().nullable(),
+    categoryId: z8.string().uuid(),
+    subcategoryId: z8.string().uuid().nullable(),
+    variants: bookingServiceVariantsSchema,
+    allowsAnyResource: z8.boolean(),
+    sortOrder: z8.number().int()
+  })),
+  resources: z8.array(z8.object({
+    id: z8.string().trim().min(1),
+    name: z8.string().trim().min(1),
+    kind: z8.enum(bookingResourceKinds)
+  })),
+  serviceResources: z8.array(z8.object({
+    serviceId: z8.string().trim().min(1),
+    resourceId: z8.string().trim().min(1)
+  }))
+});
+var bookingItemSchema = z8.object({
+  serviceId: z8.string().trim().min(1),
+  variantId: z8.string().trim().min(1)
+}).strict();
+var bookingItemsSchema = z8.array(bookingItemSchema).min(1).max(10);
+function parseBookingItemsParam(value) {
+  const items = value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "").map((entry) => {
+    const [serviceId, variantId, ...rest] = entry.split(":");
+    return serviceId && variantId && rest.length === 0 ? { serviceId, variantId } : null;
+  });
+  return items.every((item) => item !== null) ? items : null;
+}
+var bookingSlotsQuerySchema = z8.object({
+  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z8.string().trim().min(1).optional(),
+  fromDate: isoDateSchema,
+  toDate: isoDateSchema
+});
+var bookingSlotsResponseSchema = z8.object({
+  timezone: z8.string().trim().min(1),
+  items: bookingItemsSchema,
+  // Reine Behandlungsdauer ohne Puffer: das UI zeigt damit die Terminspanne,
+  // ohne selbst rechnen zu muessen.
+  totalDurationMinutes: z8.number().int().min(1),
+  mode: z8.enum(["any", "resource"]),
+  slots: z8.array(z8.object({
+    startUtc: utcDateTimeSchema,
+    resourceId: z8.string().trim().min(1).optional()
+  }))
+});
+var bookingAvailabilityQuerySchema = z8.object({
+  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z8.string().trim().min(1).optional(),
+  fromDate: isoDateSchema,
+  toDate: isoDateSchema
+});
+var bookingAvailabilityResponseSchema = z8.object({
+  timezone: z8.string().trim().min(1),
+  totalDurationMinutes: z8.number().int().min(1),
+  days: z8.array(z8.object({
+    date: isoDateSchema,
+    hasSlots: z8.boolean()
+  })),
+  /** Erster Tag mit Slot ab `fromDate`, auch ausserhalb des Fensters. */
+  nextAvailableDate: isoDateSchema.nullable()
+});
+var bookingPublicErrorCodes = [
+  "slot_unavailable",
+  "validation_error",
+  "origin_not_allowed",
+  "invalid_key",
+  "rate_limited",
+  "payment_required",
+  "payment_unavailable",
+  "payment_amount_too_small",
+  "already_cancelled",
+  "too_late",
+  "not_found"
+];
+var bookingPublicErrorSchema = z8.object({
+  error: z8.enum(bookingPublicErrorCodes),
+  message: z8.string().optional(),
+  requestId: z8.string().optional()
+}).strict();
+var bookingCreateRequestSchema = z8.object({
+  items: bookingItemsSchema,
+  resourceId: z8.string().min(1).nullable(),
+  startUtc: utcDateTimeSchema,
+  customer: z8.object({
+    name: z8.string().min(1).max(120),
+    email: z8.string().email().max(254),
+    phone: z8.string().max(32).optional(),
+    note: z8.string().max(1e3).optional()
+  }).strict(),
+  hp: z8.string().optional(),
+  clientToken: z8.string().uuid(),
+  paymentChoice: bookingPaymentChoiceSchema,
+  // Werbe-Einwilligung. Bestaetigung, Erinnerung und Storno-Link sind davon
+  // unabhaengig und werden immer versendet.
+  consent: z8.object({
+    marketingEmail: z8.boolean(),
+    marketingSms: z8.boolean()
+  }).strict().optional()
+}).strict();
+var bookingPublicPaymentResponseSchema = z8.object({
+  clientSecret: z8.string().min(1),
+  stripeAccountId: z8.string().startsWith("acct_")
+}).strict();
+var bookingCreateResponseSchema = z8.union([
+  z8.object({
+    status: z8.literal("confirmed"),
+    booking: z8.object({
+      id: z8.string().min(1),
+      startUtc: utcDateTimeSchema,
+      endUtc: utcDateTimeSchema,
+      timezone: z8.string().trim().min(1),
+      serviceName: z8.string().trim().min(1),
+      resourceName: z8.string().trim().min(1)
+    }).strict(),
+    manageUrl: z8.string().url(),
+    confirmationMessage: z8.string().nullable()
+  }).strict(),
+  z8.object({
+    status: z8.literal("pending_payment"),
+    bookingId: z8.string().min(1),
+    holdExpiresAt: utcDateTimeSchema,
+    payment: bookingPublicPaymentResponseSchema,
+    statusToken: z8.string().min(20),
+    manageUrl: z8.string().url().optional()
+  }).strict(),
+  bookingPublicErrorSchema
+]);
+var bookingStatusResponseSchema = z8.object({
+  bookingStatus: bookingStatusSchema,
+  paymentStatus: bookingPaymentStatusSchema,
+  refundStatus: bookingRefundStatusSchema,
+  disputeStatus: bookingDisputeStatusSchema,
+  holdExpiresAt: utcDateTimeSchema.nullable()
+}).strict();
+var bookingCancelRequestSchema = z8.object({
+  token: z8.string().min(20)
+});
+var bookingCancelResponseSchema = z8.union([
+  z8.object({
+    status: z8.enum(["cancelled", "already_cancelled", "too_late", "not_found"])
+  }),
+  bookingPublicErrorSchema
+]);
+var bookingMoveErrorCodes = [
+  "slot_unavailable",
+  "booking_not_movable",
+  "not_found"
+];
+var bookingMoveRequestSchema = z8.object({
+  bookingId: z8.string().uuid(),
+  newStartUtc: utcDateTimeSchema,
+  newResourceId: z8.string().uuid().optional(),
+  notifyCustomer: z8.boolean().default(false),
+  reason: z8.string().max(500).optional()
+});
+var bookingMoveResponseSchema = z8.union([
+  z8.object({
+    status: z8.literal("moved"),
+    bookingId: z8.string().uuid(),
+    startUtc: utcDateTimeSchema,
+    endUtc: utcDateTimeSchema,
+    resourceId: z8.string().uuid()
+  }),
+  z8.object({
+    error: z8.enum(bookingMoveErrorCodes),
+    message: z8.string().optional(),
+    requestId: z8.string().optional()
+  })
+]);
+var bookingManifestSchema = z8.object({
+  schemaVersion: z8.number().int().positive(),
+  siteId: z8.string().trim().min(1),
+  siteKeyPrefix: z8.string().startsWith("bk_pub_"),
+  bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+  embedMode: z8.enum(["script", "web_component", "iframe"]).optional(),
+  productionOrigin: z8.string().url().optional()
+}).passthrough();
+var secretManifestKeys = /* @__PURE__ */ new Set([
+  "siteKey",
+  "rawKey",
+  "token",
+  "accessToken"
+]);
+function redactBookingManifest(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactBookingManifest(item));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !secretManifestKeys.has(key)).map(([key, item]) => [key, redactBookingManifest(item)]));
+  }
+  return value;
+}
+
+// ../shared/dist/booking-defaults.js
+var BOOKING_CREATE_PAYLOAD_LIMIT_BYTES = 16 * 1024;
+
+// ../shared/dist/bridge-protocol.js
+import { z as z15 } from "zod";
+
+// ../shared/dist/field-id.js
+import { z as z9 } from "zod";
+var FIELD_ID_PATTERN = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$/;
+var fieldIdSchema = z9.string().regex(FIELD_ID_PATTERN, "Invalid field id");
+function isFieldId(value) {
+  return typeof value === "string" && fieldIdSchema.safeParse(value).success;
+}
+
+// ../shared/dist/field-types.js
+import { z as z10 } from "zod";
+var FIELD_TYPES = ["text", "longText", "image", "link"];
+var fieldTypeSchema = z10.enum(FIELD_TYPES);
+
+// ../shared/dist/image-value.js
+import { z as z11 } from "zod";
+var SUPPORTED_IMAGE_CONTENT_TYPES = [
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif"
+];
+var maxImageUploadBytes = 10 * 1024 * 1024;
+var largeImageWarningBytes = 2 * 1024 * 1024;
+var imageContentTypeSchema = z11.enum(SUPPORTED_IMAGE_CONTENT_TYPES);
+var imageCropSchema = z11.object({
+  x: z11.number().min(0).max(100),
+  y: z11.number().min(0).max(100),
+  zoom: z11.number().min(1).max(4),
+  aspectRatio: z11.number().positive().max(10)
+});
+var imageValueSchema = z11.object({
+  src: z11.string().trim().min(1),
+  alt: z11.string().trim().min(1).max(300),
+  width: z11.number().int().positive().optional(),
+  height: z11.number().int().positive().optional(),
+  crop: imageCropSchema.optional(),
+  assetId: z11.string().uuid().optional(),
+  finalStorageProvider: z11.enum([
+    "repo_static_assets",
+    "repo_handoff",
+    "site_owned_storage",
+    "siteplane_managed_fallback"
+  ]).optional()
+});
+
+// ../shared/dist/site-setup.js
+import { z as z14 } from "zod";
+
+// ../shared/dist/site-field-contract.js
+import { z as z13 } from "zod";
+
+// ../shared/dist/fallback-hash.js
+import { z as z12 } from "zod";
+var SAFE_REPRESENTATION_REASONS = [
+  "asset_import_rewritten",
+  "relative_url_normalized",
+  "line_endings_normalized",
+  "image_value_serialized"
+];
+var safeRepresentationReasonSchema = z12.enum(SAFE_REPRESENTATION_REASONS);
+function canonicalizeFallbackValue(input) {
+  const fieldType = fieldTypeSchema.parse(input.fieldType);
+  if (input.safeRepresentationReason !== void 0) {
+    safeRepresentationReasonSchema.parse(input.safeRepresentationReason);
+  }
+  if (fieldType === "text" || fieldType === "longText") {
+    if (typeof input.fallbackValue !== "string") {
+      throw new Error("Text fallback values must be strings.");
+    }
+    return {
+      fieldType,
+      fallbackValue: normalizeLineEndings(input.fallbackValue)
+    };
+  }
+  if (fieldType === "link") {
+    const link = linkFallbackSchema.parse(input.fallbackValue);
+    return {
+      fieldType,
+      fallbackValue: sortObjectKeys({
+        ...link,
+        href: normalizeExplicitHref(link.href)
+      })
+    };
+  }
+  const image = imageValueSchema.parse(input.fallbackValue);
+  return {
+    fieldType,
+    fallbackValue: sortObjectKeys(image)
+  };
+}
+function createCanonicalFallbackHash(input) {
+  const canonical = canonicalizeFallbackValue(input);
+  const payload = stableJsonStringify(canonical);
+  return `sha256:${sha256Hex(payload)}`;
+}
+var linkFallbackSchema = z12.object({
+  href: z12.string().trim().min(1),
+  label: z12.string().trim().min(1).optional(),
+  target: z12.enum(["_self", "_blank"]).optional()
+}).passthrough();
+function normalizeLineEndings(value) {
+  return value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+function normalizeExplicitHref(value) {
+  const href = value.trim();
+  try {
+    const parsed = new URL(href);
+    const hasRootSlashOnly = parsed.pathname === "/" && parsed.search === "" && parsed.hash === "";
+    if (hasRootSlashOnly) {
+      return `${parsed.protocol}//${parsed.host}`;
+    }
+  } catch {
+    return href;
+  }
+  return href;
+}
+function stableJsonStringify(value) {
+  return JSON.stringify(sortObjectKeys(value));
+}
+function sortObjectKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortObjectKeys);
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, sortObjectKeys(entryValue)]));
+}
+function sha256Hex(input) {
+  const bytes = new TextEncoder().encode(input);
+  const paddedLength = Math.ceil((bytes.length + 1 + 8) / 64) * 64;
+  const padded = new Uint8Array(paddedLength);
+  padded.set(bytes);
+  padded[bytes.length] = 128;
+  const bitLength = bytes.length * 8;
+  const view = new DataView(padded.buffer);
+  view.setUint32(paddedLength - 8, Math.floor(bitLength / 4294967296));
+  view.setUint32(paddedLength - 4, bitLength >>> 0);
+  let h0 = 1779033703;
+  let h1 = 3144134277;
+  let h2 = 1013904242;
+  let h3 = 2773480762;
+  let h4 = 1359893119;
+  let h5 = 2600822924;
+  let h6 = 528734635;
+  let h7 = 1541459225;
+  const words = new Array(64).fill(0);
+  for (let chunk = 0; chunk < paddedLength; chunk += 64) {
+    for (let index = 0; index < 16; index += 1) {
+      words[index] = view.getUint32(chunk + index * 4);
+    }
+    for (let index = 16; index < 64; index += 1) {
+      words[index] = smallSigma1(words[index - 2] ?? 0) + (words[index - 7] ?? 0) + smallSigma0(words[index - 15] ?? 0) + (words[index - 16] ?? 0) >>> 0;
+    }
+    let a = h0;
+    let b = h1;
+    let c = h2;
+    let d = h3;
+    let e = h4;
+    let f = h5;
+    let g = h6;
+    let h = h7;
+    for (let index = 0; index < 64; index += 1) {
+      const temp1 = h + bigSigma1(e) + choose(e, f, g) + SHA256_CONSTANTS[index] + (words[index] ?? 0) >>> 0;
+      const temp2 = bigSigma0(a) + majority(a, b, c) >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + temp1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = temp1 + temp2 >>> 0;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+    h5 = h5 + f >>> 0;
+    h6 = h6 + g >>> 0;
+    h7 = h7 + h >>> 0;
+  }
+  return [h0, h1, h2, h3, h4, h5, h6, h7].map((value) => value.toString(16).padStart(8, "0")).join("");
+}
+function rightRotate(value, bits) {
+  return value >>> bits | value << 32 - bits;
+}
+function choose(x, y, zValue) {
+  return x & y ^ ~x & zValue;
+}
+function majority(x, y, zValue) {
+  return x & y ^ x & zValue ^ y & zValue;
+}
+function bigSigma0(value) {
+  return rightRotate(value, 2) ^ rightRotate(value, 13) ^ rightRotate(value, 22);
+}
+function bigSigma1(value) {
+  return rightRotate(value, 6) ^ rightRotate(value, 11) ^ rightRotate(value, 25);
+}
+function smallSigma0(value) {
+  return rightRotate(value, 7) ^ rightRotate(value, 18) ^ value >>> 3;
+}
+function smallSigma1(value) {
+  return rightRotate(value, 17) ^ rightRotate(value, 19) ^ value >>> 10;
+}
+var SHA256_CONSTANTS = [
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+];
+
+// ../shared/dist/site-field-contract.js
+var fieldContractVersion = "1.0.0";
+var scannerContractVersion = "1.0.0";
+var siteFieldStatusSchema = z13.enum(["hidden", "active"]);
+var semanticVersionSchema = z13.string().regex(/^\d+\.\d+\.\d+$/u);
+var siteFieldRouteKeySchema = z13.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
+var repositoryRelativePosixPathSchema = z13.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
+var sourceMappingSchema = z13.object({
+  kind: z13.literal("function"),
+  filePath: repositoryRelativePosixPathSchema,
+  exportName: z13.string().trim().min(1).optional(),
+  sourcePath: z13.string().trim().min(1).optional(),
+  editTarget: fieldIdSchema.optional()
+}).strict();
+var domMappingSchema = z13.object({
+  attribute: z13.literal("data-siteplane-field-id"),
+  previewStrategy: z13.enum(["dom", "event"])
+}).strict();
+var fieldBaseSchema = z13.object({
+  fieldId: fieldIdSchema,
+  routeKey: siteFieldRouteKeySchema,
+  source: sourceMappingSchema,
+  dom: domMappingSchema.optional()
+}).strict();
+var linkFallbackSchema2 = z13.object({
+  href: z13.string().trim().min(1),
+  label: z13.string().trim().min(1).optional(),
+  target: z13.enum(["_self", "_blank"]).optional()
+}).strict();
+var imageFallbackSchema = z13.object({
+  src: z13.string().trim().min(1),
+  alt: z13.string().trim().max(300),
+  width: z13.number().int().positive().optional(),
+  height: z13.number().int().positive().optional(),
+  crop: z13.object({
+    x: z13.number().min(0).max(100),
+    y: z13.number().min(0).max(100),
+    zoom: z13.number().min(1).max(4),
+    aspectRatio: z13.number().positive().max(10)
+  }).strict().optional()
+}).strict();
+var siteFieldContractFieldSchema = z13.discriminatedUnion("fieldType", [
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("text"),
+    fallback: z13.string()
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("longText"),
+    fallback: z13.string()
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("link"),
+    fallback: linkFallbackSchema2
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("image"),
+    fallback: imageFallbackSchema
+  })
+]);
+var siteFieldContractV1Schema = z13.object({
+  version: z13.literal(1),
+  fieldContractVersion: semanticVersionSchema,
+  scannerContractVersion: semanticVersionSchema,
+  fields: z13.array(siteFieldContractFieldSchema)
+}).strict().superRefine((contract, context) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, field] of contract.fields.entries()) {
+    if (seen.has(field.fieldId)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate field id: ${field.fieldId}`,
+        path: ["fields", index, "fieldId"]
+      });
+    }
+    seen.add(field.fieldId);
+  }
+});
+function normalizeSiteFieldContract(input) {
+  const contract = siteFieldContractV1Schema.parse(input);
+  return {
+    ...contract,
+    fields: [...contract.fields].sort((left, right) => left.fieldId.localeCompare(right.fieldId))
+  };
+}
+function createSiteFieldContractHash(input) {
+  const payload = stableJsonStringify(normalizeSiteFieldContract(input));
+  return `sha256:${sha256Hex(payload)}`;
+}
+
+// ../shared/dist/site-setup.js
+var SITE_SETUP_RUN_STATUSES = [
+  "waiting_for_agent",
+  "working",
+  "action_required",
+  "ready_for_review",
+  "completed"
+];
+var SITE_SETUP_RUN_MODES = ["initial", "update"];
+var SITE_SETUP_ERROR_CODES = [
+  "action_required",
+  "deployment_evidence_required",
+  "field_contract_scan_failed",
+  "invalid_editor_definition",
+  "invalid_field_contract",
+  "missing_build_revision",
+  "missing_field_contract",
+  "review_locked",
+  "stale_deployment_contract",
+  "stale_field_contract",
+  "stale_setup_review",
+  "update_required"
+];
+var CONTINUE_SITE_SETUP_MAX_ITEMS = 50;
+var CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES = 512;
+var CONTINUE_SITE_SETUP_VISIBLE_VALUE_MAX_BYTES = 256;
+var CONTINUE_SITE_SETUP_LOCATOR_HINT_MAX_BYTES = 512;
+var CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES = 32 * 1024;
+var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
+var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
+var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
+var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
+var editorFieldSchema = z14.object({
+  fieldId: fieldIdSchema,
+  label: z14.string().trim().min(1),
+  description: z14.string().trim().min(1).optional(),
+  required: z14.boolean().optional(),
+  maxLength: z14.number().int().positive().optional()
+}).strict();
+var editorSectionSchema = z14.object({
+  label: z14.string().trim().min(1),
+  fields: z14.array(editorFieldSchema).min(1)
+}).strict();
+var editorRouteSchema = z14.object({
+  routeKey: siteFieldRouteKeySchema,
+  label: z14.string().trim().min(1),
+  sections: z14.array(editorSectionSchema).min(1)
+}).strict().superRefine((route, context) => {
+  const sections = /* @__PURE__ */ new Set();
+  for (const [index, section] of route.sections.entries()) {
+    if (sections.has(section.label)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate section label: ${section.label}`,
+        path: ["sections", index, "label"]
+      });
+    }
+    sections.add(section.label);
+  }
+});
+var editorDefinitionV1Schema = z14.object({
+  version: z14.literal(1),
+  routes: z14.array(editorRouteSchema).min(1)
+}).strict().superRefine((definition, context) => {
+  const routes = /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const [routeIndex, route] of definition.routes.entries()) {
+    if (routes.has(route.routeKey)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate route key: ${route.routeKey}`,
+        path: ["routes", routeIndex, "routeKey"]
+      });
+    }
+    routes.add(route.routeKey);
+    for (const [sectionIndex, section] of route.sections.entries()) {
+      for (const [fieldIndex, field] of section.fields.entries()) {
+        if (fields.has(field.fieldId)) {
+          context.addIssue({
+            code: "custom",
+            message: `Duplicate editor field id: ${field.fieldId}`,
+            path: [
+              "routes",
+              routeIndex,
+              "sections",
+              sectionIndex,
+              "fields",
+              fieldIndex,
+              "fieldId"
+            ]
+          });
+        }
+        fields.add(field.fieldId);
+      }
+    }
+  }
+});
+var forbiddenControlOrBidi = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
+var unsafeLocator = /<\/?[a-z][^>]*>|\b(?:javascript|data:text\/html)\s*:|\bon[a-z]+\s*=/iu;
+var renderedPathSchema = z14.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
+  if (!value.startsWith("/") || value === "$global" || value.includes("?") || value.includes("#")) {
+    context.addIssue({
+      code: "custom",
+      message: "renderedPath must be a canonical real path."
+    });
+  }
+  addSafeByteIssues(value, CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES, "renderedPath", context);
+});
+function normalizedSafeTextSchema(maxBytes, label) {
+  return z14.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z14.string().min(1)).superRefine((value, context) => {
+    addSafeByteIssues(value, maxBytes, label, context);
+    if (label === "locatorHint" && unsafeLocator.test(value)) {
+      context.addIssue({
+        code: "custom",
+        message: "locatorHint contains unsafe markup or executable content."
+      });
+    }
+  });
+}
+var correctionItemBase = {
+  renderedPath: renderedPathSchema,
+  visibleValue: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_VISIBLE_VALUE_MAX_BYTES, "visibleValue"),
+  locatorHint: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_LOCATOR_HINT_MAX_BYTES, "locatorHint")
+};
+var setupCorrectionItemSchema = z14.discriminatedUnion("kind", [
+  z14.object({ kind: z14.literal("text"), ...correctionItemBase }).strict(),
+  z14.object({ kind: z14.literal("link"), ...correctionItemBase }).strict(),
+  z14.object({ kind: z14.literal("image"), ...correctionItemBase }).strict()
+]);
+var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
+var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
+var continueSiteSetupInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  correctionItems: z14.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS)
+}).strict().superRefine((input, context) => {
+  const bytes = utf8Bytes(stableJsonStringify(input.correctionItems));
+  if (bytes > CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES) {
+    context.addIssue({
+      code: "custom",
+      message: "Correction items exceed the 32 KiB canonical payload limit.",
+      path: ["correctionItems"]
+    });
+  }
+});
+var siteSetupContextInputSchema = z14.object({}).strict();
+var siteSetupApplyInputSchema = z14.object({
+  fieldContract: siteFieldContractV1Schema,
+  editorDefinition: editorDefinitionV1Schema
+}).strict().superRefine((input, context) => {
+  const contractRoutesByFieldId = new Map(input.fieldContract.fields.map((field) => [
+    field.fieldId,
+    field.routeKey
+  ]));
+  const definitionFieldIds = /* @__PURE__ */ new Set();
+  for (const [routeIndex, route] of input.editorDefinition.routes.entries()) {
+    for (const [sectionIndex, section] of route.sections.entries()) {
+      for (const [fieldIndex, field] of section.fields.entries()) {
+        const fieldPath = [
+          "editorDefinition",
+          "routes",
+          routeIndex,
+          "sections",
+          sectionIndex,
+          "fields",
+          fieldIndex,
+          "fieldId"
+        ];
+        const contractRouteKey = contractRoutesByFieldId.get(field.fieldId);
+        const contractField = input.fieldContract.fields.find((candidate) => candidate.fieldId === field.fieldId);
+        definitionFieldIds.add(field.fieldId);
+        if (!contractRouteKey) {
+          context.addIssue({
+            code: "custom",
+            message: `Unknown editor field id: ${field.fieldId}`,
+            path: fieldPath
+          });
+        } else if (contractRouteKey !== route.routeKey) {
+          context.addIssue({
+            code: "custom",
+            message: `Editor field ${field.fieldId} must use route ${contractRouteKey}.`,
+            path: fieldPath
+          });
+        } else if (field.maxLength !== void 0 && contractField?.fieldType !== "text" && contractField?.fieldType !== "longText") {
+          context.addIssue({
+            code: "custom",
+            message: `maxLength is not supported for ${contractField?.fieldType ?? "unknown"} fields.`,
+            path: [
+              "editorDefinition",
+              "routes",
+              routeIndex,
+              "sections",
+              sectionIndex,
+              "fields",
+              fieldIndex,
+              "maxLength"
+            ]
+          });
+        }
+      }
+    }
+  }
+  for (const field of input.fieldContract.fields) {
+    if (!definitionFieldIds.has(field.fieldId)) {
+      context.addIssue({
+        code: "custom",
+        message: `Missing editor field id: ${field.fieldId}`,
+        path: ["editorDefinition", "routes"]
+      });
+    }
+  }
+});
+var siteSetupVerifyInputSchema = z14.object({
+  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+  deploymentRevision: deploymentRevisionSchema,
+  wait: z14.boolean().optional()
+}).strict();
+var siteSetupEvidenceInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentOrigin: z14.string().url().refine((value) => value.startsWith("https://")),
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  publicRuntimeKeyId: z14.string().uuid(),
+  bridgeSessionId: normalizedSafeTextSchema(256, "bridgeSessionId"),
+  observations: z14.array(z14.object({
+    fieldId: fieldIdSchema,
+    routeKey: siteFieldRouteKeySchema,
+    renderedPath: renderedPathSchema,
+    targetResolved: z14.boolean(),
+    previewAck: z14.boolean()
+  }).strict().refine((value) => !value.previewAck || value.targetResolved, "Preview ACK requires a resolved target.")).min(1).max(200)
+}).strict();
+var completeSiteSetupInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  accessMode: z14.enum(["fallback", "custom_domain"]),
+  siteDomainId: z14.string().uuid().optional(),
+  defaultCanPublish: z14.boolean()
+}).strict().superRefine((input, context) => {
+  if (input.accessMode === "fallback" && input.siteDomainId) {
+    context.addIssue({
+      code: "custom",
+      message: "Fallback access cannot use a custom domain.",
+      path: ["siteDomainId"]
+    });
+  }
+  if (input.accessMode === "custom_domain" && !input.siteDomainId) {
+    context.addIssue({
+      code: "custom",
+      message: "Custom-domain access requires a site domain.",
+      path: ["siteDomainId"]
+    });
+  }
+});
+var refreshSiteSetupDeploymentInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+  deploymentRevision: deploymentRevisionSchema
+}).strict();
+function addSafeByteIssues(value, maxBytes, label, context) {
+  if (utf8Bytes(value) > maxBytes) {
+    context.addIssue({
+      code: "custom",
+      message: `${label} exceeds ${maxBytes} UTF-8 bytes.`
+    });
+  }
+  if (forbiddenControlOrBidi.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: `${label} contains a forbidden control or bidi character.`
+    });
+  }
+}
+function utf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+// ../shared/dist/bridge-protocol.js
+var BRIDGE_PROTOCOL_VERSION = 1;
+var bridgeRectSchema = z15.object({
+  x: z15.number(),
+  y: z15.number(),
+  width: z15.number().nonnegative(),
+  height: z15.number().nonnegative()
+});
+var previewTextValueSchema = z15.object({
+  fieldType: z15.enum(["text", "longText"]),
+  value: z15.string()
+});
+var previewLinkValueSchema = z15.object({
+  fieldType: z15.literal("link"),
+  value: z15.object({
+    href: z15.string().trim().min(1),
+    label: z15.string().trim().min(1).optional()
+  })
+});
+var previewImageValueSchema = z15.object({
+  fieldType: z15.literal("image"),
+  value: imageValueSchema
+});
+var bridgePreviewValueSchema = z15.discriminatedUnion("fieldType", [
+  previewTextValueSchema,
+  previewLinkValueSchema,
+  previewImageValueSchema
+]);
+var FIELD_BRIDGE_MESSAGE_TYPES = [
+  "siteplane:field-bridge:init",
+  "siteplane:field-bridge:ready",
+  "siteplane:field-bridge:fields",
+  "siteplane:field-bridge:select-field",
+  "siteplane:field-bridge:set-selected-field",
+  "siteplane:field-bridge:apply-preview-values",
+  "siteplane:field-bridge:test-preview-values",
+  "siteplane:field-bridge:preview-ack",
+  "siteplane:field-bridge:set-editability-review",
+  "siteplane:field-bridge:missing-content",
+  "siteplane:field-bridge:error"
+];
+var canonicalFieldContractHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var realRenderedPathSchema = z15.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
+var fieldBridgeIdentitySchema = z15.object({
+  publicRuntimeKeyId: z15.string().uuid(),
+  fieldContractHash: canonicalFieldContractHashSchema,
+  deploymentRevision: z15.string().trim().min(1).max(256)
+}).strict();
+var fieldBridgeBaseSchema = z15.object({
+  version: z15.literal(BRIDGE_PROTOCOL_VERSION),
+  type: z15.enum(FIELD_BRIDGE_MESSAGE_TYPES),
+  siteId: z15.string().uuid(),
+  sessionId: z15.string().trim().min(1),
+  publicRuntimeKeyId: z15.string().uuid(),
+  fieldContractHash: canonicalFieldContractHashSchema,
+  deploymentRevision: z15.string().trim().min(1).max(256),
+  requestId: z15.string().trim().min(1),
+  sentAt: z15.string().datetime()
+}).strict();
+var fieldBridgeFieldSchema = z15.object({
+  fieldId: fieldIdSchema,
+  fieldType: fieldTypeSchema,
+  routeKey: siteFieldRouteKeySchema,
+  renderedPath: realRenderedPathSchema,
+  sourcePath: z15.string().trim().min(1).optional(),
+  editTarget: fieldIdSchema,
+  rect: bridgeRectSchema,
+  targetResolved: z15.literal(true),
+  currentValue: bridgePreviewValueSchema.optional()
+}).strict();
+var fieldBridgeInitMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:init"),
+  payload: z15.object({
+    adminOrigin: z15.string().url(),
+    customerOrigin: z15.string().url(),
+    renderedPath: realRenderedPathSchema
+  }).strict()
+});
+var fieldBridgeReadyMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:ready"),
+  payload: z15.object({
+    renderedPath: realRenderedPathSchema,
+    fieldCount: z15.number().int().nonnegative(),
+    capabilities: z15.tuple([
+      z15.literal("field_selection"),
+      z15.literal("preview_values"),
+      z15.literal("field_evidence"),
+      z15.literal("editability_review")
+    ])
+  }).strict()
+});
+var fieldBridgeFieldsMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:fields"),
+  payload: z15.object({
+    renderedPath: realRenderedPathSchema,
+    fields: z15.array(fieldBridgeFieldSchema)
+  }).strict()
+});
+var fieldBridgeSelectFieldMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:select-field"),
+  payload: z15.object({ fieldId: fieldIdSchema }).strict()
+});
+var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:set-selected-field"),
+  payload: z15.object({
+    fieldId: fieldIdSchema.nullable(),
+    scrollIntoView: z15.boolean().optional()
+  }).strict()
+});
+var fieldBridgeApplyPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:apply-preview-values"),
+  payload: z15.object({ values: z15.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
+});
+var fieldBridgeTestPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:test-preview-values"),
+  payload: z15.object({ fieldIds: z15.array(fieldIdSchema).min(1).max(200) }).strict()
+});
+var fieldBridgePreviewAckMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:preview-ack"),
+  payload: z15.object({
+    ackRequestId: z15.string().trim().min(1),
+    kind: z15.enum(["apply", "test"]),
+    renderedPath: realRenderedPathSchema,
+    fieldIds: z15.array(fieldIdSchema).max(200)
+  }).strict()
+});
+var fieldBridgeSetEditabilityReviewMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:set-editability-review"),
+  payload: z15.object({ enabled: z15.boolean() }).strict()
+});
+var fieldBridgeMissingContentMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:missing-content"),
+  payload: z15.object({ item: setupCorrectionItemSchema }).strict()
+});
+var fieldBridgeErrorMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:error"),
+  payload: z15.object({
+    code: z15.string().trim().min(1),
+    message: z15.string().trim().min(1),
+    recoverable: z15.boolean().default(false)
+  }).strict()
+});
+var fieldBridgeMessageSchema = z15.discriminatedUnion("type", [
+  fieldBridgeInitMessageSchema,
+  fieldBridgeReadyMessageSchema,
+  fieldBridgeFieldsMessageSchema,
+  fieldBridgeSelectFieldMessageSchema,
+  fieldBridgeSetSelectedFieldMessageSchema,
+  fieldBridgeApplyPreviewValuesMessageSchema,
+  fieldBridgeTestPreviewValuesMessageSchema,
+  fieldBridgePreviewAckMessageSchema,
+  fieldBridgeSetEditabilityReviewMessageSchema,
+  fieldBridgeMissingContentMessageSchema,
+  fieldBridgeErrorMessageSchema
+]);
+
+// ../shared/dist/commands.js
+import { z as z17 } from "zod";
+
+// ../shared/dist/errors.js
+import { z as z16 } from "zod";
+var UI_ERROR_CATEGORIES = [
+  "client",
+  "developer",
+  "internal"
+];
+var uiErrorCategorySchema = z16.enum(UI_ERROR_CATEGORIES);
+var commandErrorPayloadSchema = z16.object({
+  code: z16.string().min(1),
+  message: z16.string().min(1),
+  category: uiErrorCategorySchema,
+  details: z16.record(z16.string(), z16.unknown()).optional()
+});
+
+// ../shared/dist/commands.js
+var commandSuccessSchema = z17.object({
+  ok: z17.literal(true),
+  data: z17.unknown()
+});
+var commandErrorSchema = z17.object({
+  ok: z17.literal(false),
+  error: commandErrorPayloadSchema
+});
+var commandResultSchema = z17.discriminatedUnion("ok", [
+  commandSuccessSchema,
+  commandErrorSchema
+]);
+
+// ../shared/dist/fallback-portal.js
+import { z as z18 } from "zod";
+var FALLBACK_PORTAL_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var fallbackPortalSlugSchema = z18.string().regex(FALLBACK_PORTAL_SLUG_PATTERN, "Invalid fallback portal slug");
+
+// ../shared/dist/entitlements.js
+import { z as z19 } from "zod";
+var entitlementSnapshotSchema = z19.object({
+  planKey: z19.string().trim().min(1),
+  sitesLimit: z19.number().int().positive(),
+  clientAccountsPerSiteLimit: z19.number().int().positive(),
+  customAdminDomainsEnabled: z19.boolean(),
+  agentMcpEnabled: z19.boolean(),
+  emailNotificationsEnabled: z19.boolean(),
+  analyticsEnabled: z19.boolean(),
+  analyticsSitesLimit: z19.number().int().min(0),
+  analyticsClientPerformanceEnabled: z19.boolean(),
+  analyticsMonthlyReportsEnabled: z19.boolean(),
+  analyticsAiSummaryEnabled: z19.boolean(),
+  analyticsRawEventRetentionDays: z19.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
+  analyticsMonthlyEventLimit: z19.number().int().min(0),
+  bookingEnabled: z19.boolean().default(false),
+  bookingSitesLimit: z19.number().int().min(0).default(0),
+  bookingClientManagementEnabled: z19.boolean().default(false),
+  bookingResourcesPerSiteLimit: z19.number().int().min(0).default(0),
+  bookingServicesPerSiteLimit: z19.number().int().min(0).default(0),
+  bookingMonthlyBookingsLimit: z19.number().int().min(0).default(0),
+  bookingRemindersEnabled: z19.boolean().default(false)
+});
+var EARLY_ACCESS_PLAN = {
+  planKey: "early_access_2026",
+  sitesLimit: 3,
+  clientAccountsPerSiteLimit: 5,
+  customAdminDomainsEnabled: true,
+  agentMcpEnabled: true,
+  emailNotificationsEnabled: true,
+  analyticsEnabled: false,
+  analyticsSitesLimit: 0,
+  analyticsClientPerformanceEnabled: false,
+  analyticsMonthlyReportsEnabled: false,
+  analyticsAiSummaryEnabled: false,
+  analyticsRawEventRetentionDays: ANALYTICS_RETENTION_DEFAULTS.enabledRawEventRetentionDays,
+  analyticsMonthlyEventLimit: 0,
+  bookingEnabled: true,
+  bookingSitesLimit: 3,
+  bookingClientManagementEnabled: true,
+  bookingResourcesPerSiteLimit: 10,
+  bookingServicesPerSiteLimit: 50,
+  bookingMonthlyBookingsLimit: 0,
+  bookingRemindersEnabled: true
+};
+
+// ../shared/dist/readiness.js
+import { z as z20 } from "zod";
+var READINESS_CHECK_KEYS = [
+  "agent_instructions_installed",
+  "runtime_package_connected",
+  "secure_server_access_configured",
+  "preview_bridge_working",
+  "admin_access_url_selected",
+  "default_publishing_mode_selected"
+];
+var READINESS_STATUSES = [
+  "pending",
+  "passing",
+  "failing",
+  "warning"
+];
+var readinessCheckKeySchema = z20.enum(READINESS_CHECK_KEYS);
+var readinessStatusSchema = z20.enum(READINESS_STATUSES);
+
+// ../shared/dist/site.js
+import { z as z21 } from "zod";
+var SITE_STATUSES = [
+  "setup",
+  "client_ready",
+  "disabled",
+  "archived"
+];
+var siteStatusSchema = z21.enum(SITE_STATUSES);
+var websiteUrlSchema = z21.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+
+// ../cli/dist/analytics/manifest.js
+async function readAnalyticsManifestFile(manifestPath) {
+  return validateAnalyticsManifestInput(JSON.parse(await readFile(manifestPath, "utf8")));
+}
+async function writeAnalyticsManifestFile(manifestPath, manifest) {
+  await mkdir(dirname(manifestPath), {
+    recursive: true
+  });
+  await writeFile(manifestPath, `${JSON.stringify(analyticsManifestSchema.parse(manifest), null, 2)}
+`, "utf8");
+}
+function validateAnalyticsManifestInput(input) {
+  return redactAnalyticsManifest(analyticsManifestSchema.parse(input));
+}
+
+// ../cli/dist/analytics/static-scan.js
+import ts from "typescript";
+
+// ../cli/dist/analytics/booking-providers.js
+function buildBookingProviderHintFromHref(href, mode, options = {}) {
+  const url = parseStaticHttpUrl(href);
+  if (!url) {
+    return void 0;
+  }
+  const bookingProvider = inferKnownBookingProviderFromHost(url.hostname) ?? inferExplicitOtherProvider(options.explicitProvider);
+  if (!bookingProvider) {
+    return void 0;
+  }
+  return {
+    bookingProvider,
+    bookingUrlHost: normalizeHost(url.hostname),
+    bookingAttributionMode: mode
+  };
+}
+function inferKnownBookingProviderFromHost(host) {
+  const normalizedHost = normalizeHost(host);
+  if (matchesProviderDomain(normalizedHost, "treatwell")) {
+    return "treatwell";
+  }
+  if (matchesProviderDomain(normalizedHost, "beautinda")) {
+    return "beautinda";
+  }
+  return void 0;
+}
+function inferExplicitOtherProvider(explicitProvider) {
+  return explicitProvider === "other" ? "other" : void 0;
+}
+var providerRegistrableDomains = {
+  treatwell: /* @__PURE__ */ new Set([
+    "treatwell.at",
+    "treatwell.be",
+    "treatwell.ch",
+    "treatwell.co.uk",
+    "treatwell.de",
+    "treatwell.es",
+    "treatwell.fr",
+    "treatwell.ie",
+    "treatwell.it",
+    "treatwell.nl",
+    "treatwell.pt"
+  ]),
+  beautinda: /* @__PURE__ */ new Set(["beautinda.de"])
+};
+function matchesProviderDomain(host, provider) {
+  return Array.from(providerRegistrableDomains[provider]).some((domain) => host === domain || host.endsWith(`.${domain}`));
+}
+function parseStaticHttpUrl(href) {
+  try {
+    const url = new URL(href);
+    return url.protocol === "http:" || url.protocol === "https:" ? url : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function normalizeHost(host) {
+  return host.toLowerCase().replace(/\.$/u, "");
+}
+
+// ../cli/dist/analytics/static-scan.js
+function scanAnalyticsSourceFiles(files, input) {
+  const targets = [];
+  const hardErrors = [];
+  const warnings = [];
+  const suggestions = [];
+  for (const file of files) {
+    scanSourceFile(file, targets, hardErrors, suggestions);
+  }
+  const manifest = analyticsManifestSchema.parse({
+    schemaVersion: ANALYTICS_SCHEMA_VERSION,
+    siteId: input.siteId,
+    siteKeyRef: input.siteKeyRef,
+    siteKeyLookup: input.siteKeyLookup,
+    routes: createRoutes(targets),
+    targets: uniqueTargets(targets).map(createManifestTarget),
+    ...input.metadata ? { metadata: input.metadata } : {}
+  });
+  return {
+    manifest,
+    hardErrors,
+    warnings,
+    suggestions
+  };
+}
+function scanSourceFile(file, targets, hardErrors, suggestions) {
+  const sourceFile = ts.createSourceFile(file.filePath, file.sourceText, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  function visit(node) {
+    if (ts.isJsxSelfClosingElement(node) || ts.isJsxOpeningElement(node)) {
+      const tagName = getJsxTagName(node.tagName);
+      const attributes = readJsxAttributes(node.attributes);
+      const eventValue = stringValue(attributes.get("data-siteplane-event"));
+      const href = stringValue(attributes.get("href"));
+      if (eventValue === void 0 && href !== void 0 && isClickableLinkTag(tagName) && buildBookingProviderHintFromHref(href, "outbound_click_and_utm") !== void 0) {
+        suggestions.push({
+          code: "analytics_scan.booking_provider_tracking_missing",
+          message: "Booking provider link is missing Siteplane analytics tracking on the clickable link.",
+          filePath: file.filePath
+        });
+      }
+      if (tagName === "form" && eventValue === void 0) {
+        suggestions.push({
+          code: "analytics_scan.form_tracking_missing",
+          message: "Form is missing Siteplane analytics tracking.",
+          filePath: file.filePath
+        });
+      }
+      if (eventValue !== void 0) {
+        extractAnalyticsTarget(file, tagName, attributes, eventValue, hardErrors, targets);
+      }
+    }
+    ts.forEachChild(node, visit);
+  }
+  visit(sourceFile);
+}
+function extractAnalyticsTarget(file, tagName, attributes, eventValue, hardErrors, targets) {
+  const events = parseDataAttributeEvents(eventValue);
+  const targetId = stringValue(attributes.get("data-siteplane-target-id")) ?? stringValue(attributes.get("data-siteplane-section-id"));
+  if (events.length === 0) {
+    hardErrors.push({
+      code: "analytics_scan.invalid_event",
+      message: `Invalid analytics data attribute event: ${eventValue}`,
+      filePath: file.filePath,
+      ...targetId ? { targetId } : {}
+    });
+    return;
+  }
+  if (targetId === void 0) {
+    hardErrors.push({
+      code: "analytics_scan.target_id_missing",
+      message: "Analytics data attribute is missing a static target id.",
+      filePath: file.filePath
+    });
+    return;
+  }
+  for (const event of events) {
+    if (isServerOnlyAnalyticsEvent(event)) {
+      hardErrors.push({
+        code: "analytics_scan.server_only_event_in_browser",
+        message: `Server-only analytics event cannot be used in browser data attributes: ${event}`,
+        filePath: file.filePath,
+        targetId
+      });
+    }
+  }
+  const route = inferRoute(file.filePath);
+  const type = inferTargetType(attributes, events);
+  const bookingSourceHints = createBookingProviderSourceHints({
+    attributes,
+    events,
+    tagName,
+    targetId,
+    type
+  });
+  if ("sourceHints" in bookingSourceHints && !hasRequiredBookingAttribution(stringValue(attributes.get("href")), targetId)) {
+    hardErrors.push({
+      code: "analytics_scan.booking_provider_attribution_missing",
+      message: "Booking provider links require siteplane source/medium plus campaign and target UTMs.",
+      filePath: file.filePath,
+      targetId
+    });
+  }
+  const formSourceHints = createFormSourceHints({
+    attributes,
+    tagName,
+    targetId,
+    type
+  });
+  targets.push({
+    id: targetId,
+    type,
+    events,
+    ...route ? { route } : {},
+    ...mergeSourceHints(bookingSourceHints, formSourceHints)
+  });
+}
+function createFormSourceHints(input) {
+  if (input.type !== "form" || input.tagName !== "form")
+    return {};
+  const explicit = analyticsFormPurposeSchema.safeParse(input.attributes.get("data-siteplane-form-purpose"));
+  if (explicit.success) {
+    return { sourceHints: { formPurpose: explicit.data } };
+  }
+  const tokens = [
+    input.targetId,
+    stringValue(input.attributes.get("id")),
+    stringValue(input.attributes.get("name")),
+    stringValue(input.attributes.get("action")),
+    stringValue(input.attributes.get("aria-label"))
+  ].filter((value) => Boolean(value)).join(" ").toLowerCase();
+  const formPurpose = /newsletter|subscribe|subscription/u.test(tokens) ? "newsletter" : /search/u.test(tokens) ? "search" : /login|log-in|sign-in|signin|auth/u.test(tokens) ? "login" : /lead/u.test(tokens) ? "lead" : /contact|inquiry|enquiry|quote|request/u.test(tokens) ? "contact" : "other";
+  return { sourceHints: { formPurpose } };
+}
+function mergeSourceHints(...hints) {
+  const sourceHints = Object.assign({}, ...hints.flatMap((hint) => "sourceHints" in hint ? [hint.sourceHints] : []));
+  return Object.keys(sourceHints).length > 0 ? { sourceHints } : {};
+}
+function hasRequiredBookingAttribution(href, targetId) {
+  if (!href)
+    return false;
+  try {
+    const url = new URL(href);
+    return url.searchParams.get("utm_source") === "siteplane" && url.searchParams.get("utm_medium") === "website" && Boolean(url.searchParams.get("utm_campaign")) && url.searchParams.get("utm_content") === targetId;
+  } catch {
+    return false;
+  }
+}
+function parseDataAttributeEvents(value) {
+  const dataAttributeEvent = analyticsDataAttributeEventSchema.safeParse(value);
+  if (dataAttributeEvent.success) {
+    return expandAnalyticsDataAttributeEvent(dataAttributeEvent.data);
+  }
+  const eventName = analyticsEventNameSchema.safeParse(value);
+  return eventName.success ? [eventName.data] : [];
+}
+function inferTargetType(attributes, events) {
+  const explicit = analyticsTargetTypeSchema.safeParse(attributes.get("data-siteplane-target-type"));
+  if (explicit.success) {
+    return explicit.data;
+  }
+  if (events.includes("section_view")) {
+    return "section";
+  }
+  if (events.includes("form_start") || events.includes("form_submit") || events.includes("form_error")) {
+    return "form";
+  }
+  if (events.includes("file_download")) {
+    return "file";
+  }
+  if (events.includes("outbound_click") || events.includes("email_click") || events.includes("phone_click")) {
+    return "link";
+  }
+  if (events.includes("conversion") || events.includes("lead_created")) {
+    return "conversion";
+  }
+  return "cta";
+}
+function createManifestTarget(target) {
+  const base = {
+    id: target.id,
+    type: target.type,
+    ...target.route ? { route: target.route } : {},
+    ...target.sourceHints ? { sourceHints: target.sourceHints } : {}
+  };
+  if (target.events.length === 1) {
+    return {
+      ...base,
+      event: target.events[0]
+    };
+  }
+  return {
+    ...base,
+    events: target.events
+  };
+}
+function createBookingProviderSourceHints(input) {
+  if (input.type !== "link" || !input.events.includes("outbound_click") || !isClickableLinkTag(input.tagName)) {
+    return {};
+  }
+  const href = stringValue(input.attributes.get("href"));
+  if (!href) {
+    return {};
+  }
+  const explicitProvider = bookingProviderSchema.safeParse(input.attributes.get("data-siteplane-booking-provider"));
+  const attributionMode = bookingAttributionModeSchema.safeParse(input.attributes.get("data-siteplane-booking-attribution-mode"));
+  const baseHint = buildBookingProviderHintFromHref(href, attributionMode.success ? attributionMode.data : "outbound_click_and_utm", explicitProvider.success ? { explicitProvider: explicitProvider.data } : void 0);
+  if (!baseHint) {
+    return {};
+  }
+  return {
+    sourceHints: {
+      ...baseHint,
+      href,
+      utmContent: input.targetId
+    }
+  };
+}
+function isClickableLinkTag(tagName) {
+  return tagName === "a" || tagName === "Link";
+}
+function uniqueTargets(targets) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const target of targets) {
+    if (seen.has(target.id)) {
+      continue;
+    }
+    seen.add(target.id);
+    unique.push(target);
+  }
+  return unique;
+}
+function createRoutes(targets) {
+  const paths = /* @__PURE__ */ new Set();
+  for (const target of targets) {
+    if (target.route) {
+      paths.add(target.route);
+    }
+  }
+  return [...paths].map((path) => ({ path }));
+}
+function readJsxAttributes(attributes) {
+  const values = /* @__PURE__ */ new Map();
+  for (const attribute of attributes.properties) {
+    if (!ts.isJsxAttribute(attribute)) {
+      continue;
+    }
+    const name = attribute.name.getText();
+    if (!attribute.initializer) {
+      values.set(name, true);
+      continue;
+    }
+    if (ts.isStringLiteral(attribute.initializer)) {
+      values.set(name, attribute.initializer.text);
+      continue;
+    }
+    if (ts.isJsxExpression(attribute.initializer)) {
+      values.set(name, staticExpressionValue(attribute.initializer.expression));
+    }
+  }
+  return values;
+}
+function staticExpressionValue(expression) {
+  if (!expression) {
+    return void 0;
+  }
+  if (ts.isStringLiteral(expression) || ts.isNoSubstitutionTemplateLiteral(expression)) {
+    return expression.text;
+  }
+  return void 0;
+}
+function getJsxTagName(tagName) {
+  return tagName.getText();
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function inferRoute(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  const appIndex = normalized.indexOf("app/");
+  if (appIndex === -1 || !normalized.endsWith("page.tsx")) {
+    return void 0;
+  }
+  const route = normalized.slice(appIndex + 4, -"page.tsx".length).split("/").filter((segment) => segment && !segment.startsWith("(")).join("/");
+  return route ? `/${route}` : "/";
+}
+
+// ../cli/dist/booking/manifest.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+async function readBookingManifestFile(manifestPath) {
+  return validateBookingManifestInput(JSON.parse(await readFile2(manifestPath, "utf8")));
+}
+async function writeBookingManifestFile(manifestPath, manifest) {
+  await mkdir2(dirname2(manifestPath), {
+    recursive: true
+  });
+  await writeFile2(manifestPath, `${JSON.stringify(bookingManifestSchema.parse(manifest), null, 2)}
+`, "utf8");
+}
+function validateBookingManifestInput(input) {
+  const redactedKeys = collectRedactedBookingKeys(input);
+  const redacted = redactBookingManifest(input);
+  return {
+    manifest: bookingManifestSchema.parse(redacted),
+    redactedKeys: [...redactedKeys].sort()
+  };
+}
+var secretManifestKeys2 = /* @__PURE__ */ new Set([
+  "siteKey",
+  "rawKey",
+  "token",
+  "accessToken"
+]);
+function collectRedactedBookingKeys(input, prefix = "") {
+  if (Array.isArray(input)) {
+    return input.flatMap((item, index) => collectRedactedBookingKeys(item, `${prefix}[${index}]`));
+  }
+  if (!input || typeof input !== "object") {
+    return [];
+  }
+  return Object.entries(input).flatMap(([key, value]) => {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (secretManifestKeys2.has(key)) {
+      return [path];
+    }
+    return collectRedactedBookingKeys(value, path);
+  });
+}
+
+// ../cli/dist/booking/static-scan.js
+function scanBookingSourceFiles(files, input) {
+  const embeds = files.flatMap(scanBookingEmbedFile);
+  const findings = embeds.map(createEmbedFoundIssue);
+  const hardErrors = embeds.length === 0 ? [
+    {
+      code: "booking_scan.embed_missing",
+      message: "No Siteplane Booking embed script, web component or iframe was found.",
+      filePath: "siteplane.booking.json"
+    }
+  ] : [];
+  const warnings = [
+    ...createPageSlugWarnings(embeds, input.bookingPageSlug),
+    ...createOriginWarnings(files, input.productionOrigin)
+  ];
+  const selectedEmbed = selectManifestEmbed(embeds);
+  const manifest = bookingManifestSchema.parse({
+    schemaVersion: 1,
+    siteId: input.siteId,
+    siteKeyPrefix: input.siteKeyPrefix,
+    bookingPageSlug: selectedEmbed?.pageSlug ?? input.bookingPageSlug,
+    ...selectedEmbed ? { embedMode: selectedEmbed.embedMode } : {},
+    ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
+  });
+  return {
+    manifest,
+    findings,
+    hardErrors,
+    warnings,
+    suggestions: []
+  };
+}
+function scanBookingEmbedFile(file) {
+  const embeds = [];
+  const source = file.sourceText;
+  if (/\/embed\/booking\.js/u.test(source)) {
+    embeds.push({
+      filePath: file.filePath,
+      embedMode: "script"
+    });
+  }
+  if (/<siteplane-booking\b/u.test(source)) {
+    const pageSlug = readAttributeValue(source, "booking-page-slug");
+    embeds.push({
+      filePath: file.filePath,
+      embedMode: "web_component",
+      ...pageSlug ? { pageSlug } : {}
+    });
+  }
+  for (const match of source.matchAll(/<iframe\b[^>]*>/giu)) {
+    const tag = match[0];
+    const src = readAttributeValue(tag, "src");
+    const pageSlug = src ? readBookingPageSlug(src) : void 0;
+    if (/data-siteplane-booking/u.test(tag) || pageSlug !== void 0) {
+      embeds.push({
+        filePath: file.filePath,
+        embedMode: "iframe",
+        ...pageSlug ? { pageSlug } : {}
+      });
+    }
+  }
+  return embeds;
+}
+function createEmbedFoundIssue(embed) {
+  return {
+    code: "booking_scan.embed_found",
+    message: "Siteplane Booking embed was found.",
+    filePath: embed.filePath,
+    embedMode: embed.embedMode,
+    ...embed.pageSlug ? { pageSlug: embed.pageSlug } : {}
+  };
+}
+function createPageSlugWarnings(embeds, expectedSlug) {
+  return embeds.filter((embed) => embed.pageSlug && embed.pageSlug !== expectedSlug).map((embed) => {
+    const pageSlug = embed.pageSlug;
+    return {
+      code: "booking_scan.page_slug_mismatch",
+      message: `Booking embed references page slug ${pageSlug}, but the manifest is configured for ${expectedSlug}.`,
+      filePath: embed.filePath,
+      embedMode: embed.embedMode,
+      ...pageSlug ? { pageSlug } : {}
+    };
+  });
+}
+function createOriginWarnings(files, productionOrigin) {
+  if (!productionOrigin) {
+    return [];
+  }
+  if (files.some((file) => file.sourceText.includes(productionOrigin))) {
+    return [];
+  }
+  return [
+    {
+      code: "booking_scan.origin_not_detected",
+      message: "The configured production origin was not found statically; verify it is registered as an allowed Booking origin in Siteplane.",
+      filePath: "siteplane.booking.json"
+    }
+  ];
+}
+function selectManifestEmbed(embeds) {
+  return embeds.find((embed) => embed.embedMode === "web_component") ?? embeds.find((embed) => embed.embedMode === "iframe") ?? embeds[0];
+}
+function readAttributeValue(source, attributeName) {
+  const escapedName = escapeRegExp(attributeName);
+  const match = new RegExp(`${escapedName}\\s*=\\s*["']([^"']+)["']`, "iu").exec(source);
+  return match?.[1];
+}
+function readBookingPageSlug(value) {
+  return /\/book\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:[/?#]|$)/u.exec(value)?.[1];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+// ../cli/dist/commands/analytics/check.js
+import { readFile as readFile3 } from "fs/promises";
+async function analyticsCheckCommand(input) {
+  const validatedManifest = await readAnalyticsManifestFile(input.manifestPath);
+  const sourceFiles = await readSourceFiles(input.sourceFilePaths);
+  const scanResult = scanAnalyticsSourceFiles(sourceFiles, {
+    siteId: validatedManifest.manifest.siteId,
+    siteKeyRef: validatedManifest.manifest.siteKeyRef,
+    siteKeyLookup: validatedManifest.manifest.siteKeyLookup,
+    ...validatedManifest.manifest.metadata ? { metadata: validatedManifest.manifest.metadata } : {}
+  });
+  const scannedManifest = preserveManualServerTargets(scanResult.manifest, validatedManifest.manifest);
+  const sdkInstalled = await hasAnalyticsSdk(input.packageJsonPath);
+  const hardErrors = [
+    ...createBoundaryErrors(validatedManifest),
+    ...sdkInstalled ? [] : [createSdkMissingIssue(input.manifestPath)],
+    ...createIntegrationErrors(validatedManifest.manifest, sourceFiles, input.manifestPath),
+    ...await readAgentArtifactErrors(input.artifactFilePaths ?? []),
+    ...scanResult.hardErrors
+  ];
+  const warnings = [
+    ...scanResult.warnings,
+    ...await readCspWarnings(input.cspFilePaths ?? [])
+  ];
+  return {
+    ok: hardErrors.length === 0,
+    manifest: validatedManifest.manifest,
+    scannedManifest,
+    sdkInstalled,
+    redactedKeys: validatedManifest.redactedKeys,
+    hardErrors,
+    warnings,
+    suggestions: scanResult.suggestions
+  };
+}
+function preserveManualServerTargets(scanned, configured) {
+  const scannedIds = new Set(scanned.targets.map((target) => target.id));
+  const manualServerTargets = configured.targets.filter((target) => target.type === "server_conversion" && !scannedIds.has(target.id));
+  return manualServerTargets.length === 0 ? scanned : { ...scanned, targets: [...scanned.targets, ...manualServerTargets] };
+}
+function createIntegrationErrors(manifest, sourceFiles, manifestPath) {
+  const sourceText = sourceFiles.map((file) => file.sourceText).join("\n");
+  const issues = [];
+  if (!sourceText.includes("@siteplane/analytics") || !sourceText.includes("initSiteplaneAnalytics")) {
+    issues.push({
+      code: "analytics_check.sdk_not_initialized",
+      message: "The Analytics SDK is not initialized in scanned customer source.",
+      filePath: manifestPath
+    });
+  }
+  if (!sourceText.includes("NEXT_PUBLIC_SITEPLANE_ANALYTICS_ENDPOINT") && !sourceText.includes("/api/analytics/collect")) {
+    issues.push({
+      code: "analytics_check.collector_endpoint_missing",
+      message: "Customer source does not configure the Siteplane collector endpoint.",
+      filePath: manifestPath
+    });
+  }
+  if (manifest.metadata?.siteplanePreviewSuppression !== true) {
+    issues.push({
+      code: "analytics_check.preview_suppression_unverified",
+      message: "Manifest does not attest Siteplane editor-preview suppression.",
+      filePath: manifestPath
+    });
+  }
+  return issues;
+}
+async function readAgentArtifactErrors(filePaths) {
+  const issues = [];
+  for (const filePath of filePaths) {
+    let sourceText;
+    try {
+      sourceText = await readFile3(filePath, "utf8");
+    } catch {
+      issues.push({
+        code: "analytics_check.agent_artifact_missing",
+        message: "Required Analytics agent instructions are missing.",
+        filePath
+      });
+      continue;
+    }
+    if (!sourceText.includes(`Analytics contract version: ${ANALYTICS_CONTRACT_VERSION}`) || !sourceText.includes(`Analytics contract hash: ${ANALYTICS_CONTRACT_HASH}`)) {
+      issues.push({
+        code: "analytics_check.agent_artifact_stale",
+        message: "Analytics agent instructions do not match the installed CLI/manifest contract.",
+        filePath
+      });
+    }
+  }
+  return issues;
+}
+async function readSourceFiles(filePaths) {
+  return Promise.all(filePaths.map(async (filePath) => ({
+    filePath,
+    sourceText: await readFile3(filePath, "utf8")
+  })));
+}
+function createBoundaryErrors(validation) {
+  return validation.redactedKeys.map((key) => ({
+    code: "analytics_check.raw_key_in_manifest",
+    message: `Analytics manifest contains a raw key-like field: ${key}`,
+    filePath: "siteplane.analytics.json"
+  }));
+}
+function createSdkMissingIssue(filePath) {
+  return {
+    code: "analytics_check.sdk_missing",
+    message: "Project package.json does not list @siteplane/analytics.",
+    filePath
+  };
+}
+async function hasAnalyticsSdk(packageJsonPath) {
+  if (!packageJsonPath) {
+    return false;
+  }
+  const packageJson = JSON.parse(await readFile3(packageJsonPath, "utf8"));
+  return Boolean(packageJson.dependencies?.["@siteplane/analytics"] ?? packageJson.devDependencies?.["@siteplane/analytics"] ?? packageJson.peerDependencies?.["@siteplane/analytics"]);
+}
+async function readCspWarnings(filePaths) {
+  const warnings = [];
+  for (const filePath of filePaths) {
+    const sourceText = await readFile3(filePath, "utf8");
+    if (/Content-Security-Policy|connect-src/u.test(sourceText) && !/siteplane|SITEPLANE/u.test(sourceText)) {
+      warnings.push({
+        code: "analytics_check.csp_connect_src_risk",
+        message: "Static CSP connect-src may need the Siteplane analytics collector origin.",
+        filePath
+      });
+    }
+  }
+  return warnings;
+}
+
+// ../cli/dist/commands/analytics/init.js
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join } from "path";
+async function analyticsInitCommand(input) {
+  const manifest = {
+    schemaVersion: ANALYTICS_SCHEMA_VERSION,
+    siteId: input.siteId,
+    siteKeyRef: input.siteKeyRef,
+    siteKeyLookup: input.siteKeyLookup,
+    routes: [],
+    targets: [],
+    metadata: { siteplanePreviewSuppression: true }
+  };
+  const manifestPath = join(input.projectDir, "siteplane.analytics.json");
+  const artifacts = createAnalyticsArtifacts(input.agentClient);
+  await writeAnalyticsManifestFile(manifestPath, manifest);
+  for (const artifact of artifacts) {
+    await writeProjectFile(input.projectDir, artifact.path, artifact.template);
+  }
+  return {
+    manifestPath,
+    manifest,
+    artifactPaths: artifacts.map((artifact) => artifact.path)
+  };
+}
+function createAnalyticsArtifacts(agentClient) {
+  const artifacts = [
+    {
+      path: ".siteplane/analytics.md",
+      template: analyticsRulesTemplate
+    }
+  ];
+  if (agentClient === "codex") {
+    artifacts.push({
+      path: ".agents/skills/siteplane-analytics/SKILL.md",
+      template: analyticsSkillTemplate("Codex")
+    });
+  }
+  if (agentClient === "claude") {
+    artifacts.push({
+      path: ".claude/skills/siteplane-analytics/SKILL.md",
+      template: analyticsSkillTemplate("Claude Code")
+    });
+  }
+  if (agentClient === "cursor") {
+    artifacts.push({
+      path: ".cursor/rules/siteplane-analytics.mdc",
+      template: analyticsCursorRulesTemplate
+    });
+  }
+  return artifacts;
+}
+async function writeProjectFile(projectDir, relativePath, contents) {
+  const path = join(projectDir, relativePath);
+  await mkdir3(dirname3(path), { recursive: true });
+  await writeFile3(path, contents, "utf8");
+}
+var analyticsRulesTemplate = `# Siteplane Analytics Rules
+
+Analytics contract version: ${ANALYTICS_CONTRACT_VERSION}
+Analytics contract hash: ${ANALYTICS_CONTRACT_HASH}
+
+- Do not change visible layout, copy, styling, animation or business logic while adding analytics.
+- Use stable data-siteplane-target-id values that do not depend on visible copy.
+- Use public site keys only through environment references.
+- Do not write secret analytics keys, setup tokens or project CLI tokens into source files.
+- Suppress editor-preview traffic from live analytics.
+- Run npx siteplane analytics check, npx siteplane analytics sync and npx siteplane analytics test after setup.
+`;
+function analyticsSkillTemplate(agentName) {
+  return `# Siteplane Analytics Skill
+
+Use this skill in ${agentName} before adding Siteplane Analytics tracking.
+
+${analyticsRulesTemplate}`;
+}
+var analyticsCursorRulesTemplate = `---
+description: Siteplane Analytics rules
+alwaysApply: true
+---
+
+${analyticsRulesTemplate}`;
+
+// ../cli/dist/commands/analytics/import.js
+import { createHash } from "crypto";
+
+// ../cli/dist/commands/analytics/sync.js
+async function analyticsSyncCommand(input) {
+  const redacted = validateAnalyticsManifestInput(input.manifest);
+  const fetcher = input.fetchImpl ?? fetch;
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/analytics/manifest/sync`, {
+    method: "POST",
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      source: "cli",
+      manifest: redacted.manifest
+    })
+  });
+}
+function createAnalyticsCliRequestHeaders(config) {
+  const headers = {
+    authorization: `Bearer ${config.accessToken}`,
+    "content-type": "application/json"
+  };
+  const bypassSecret = config.vercelAutomationBypassSecret?.trim();
+  if (bypassSecret) {
+    headers["x-vercel-protection-bypass"] = bypassSecret;
+  }
+  return headers;
+}
+
+// ../cli/dist/commands/analytics/import.js
+async function analyticsImportCommand(input) {
+  const payload = analyticsProviderImportSchema.parse(input.payload);
+  const payloadHash = hashAnalyticsProviderImport(payload);
+  if (input.apply && !input.yes) {
+    throw new Error("Analytics import apply requires --yes.");
+  }
+  if (input.apply && input.confirmHash !== payloadHash) {
+    throw new Error(`Analytics import apply requires --confirm-hash ${payloadHash} for this exact file.`);
+  }
+  const fetcher = input.fetchImpl ?? fetch;
+  return fetcher(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/import`, {
+    method: "POST",
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      mode: input.apply ? "apply" : "dry_run",
+      payloadHash,
+      ...input.apply ? { confirmHash: input.confirmHash } : {},
+      import: payload
+    })
+  });
+}
+function hashAnalyticsProviderImport(payload) {
+  return `sha256:${createHash("sha256").update(JSON.stringify(payload)).digest("hex")}`;
+}
+
+// ../cli/dist/commands/analytics/readiness.js
+async function analyticsReadinessCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  return fetcher(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/readiness`, {
+    method: "POST",
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({ siteId: input.config.siteId })
+  });
+}
+
+// ../cli/dist/commands/analytics/public-key.js
+import { z as z22 } from "zod";
+var responseSchema = z22.object({
+  ok: z22.literal(true),
+  data: z22.object({
+    rawPublicKey: z22.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+  })
+});
+var errorResponseSchema = z22.object({
+  error: z22.object({
+    code: z22.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+  })
+});
+async function analyticsPublicKeyCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  const response = await fetcher(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/public-key`, {
+    method: "POST",
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({ siteId: input.config.siteId })
+  });
+  const payload = await response.json();
+  const parsed = responseSchema.safeParse(payload);
+  if (!response.ok || !parsed.success) {
+    const error = errorResponseSchema.safeParse(payload);
+    throw new Error(`${error.success ? error.data.error.code : "analytics_public_key.invalid_response"}: Unable to read the active Analytics public key.`);
+  }
+  return parsed.data.data.rawPublicKey;
+}
+
+// ../cli/dist/commands/analytics/test.js
+import { randomUUID } from "crypto";
+async function analyticsTestCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  const occurredAt = input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const sessionId = `cpa_s_${randomUUID().replaceAll("-", "")}`;
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/analytics/test`, {
+    method: "POST",
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      mode: "test",
+      collectorPayload: {
+        siteKey: input.siteKey,
+        schemaVersion: ANALYTICS_SCHEMA_VERSION,
+        mode: "test",
+        events: [
+          {
+            eventId: input.eventId ?? `cli_test_${Date.now()}`,
+            eventName: "page_view",
+            eventSource: "test",
+            sessionId,
+            occurredAt,
+            ...input.targetId ? { targetId: input.targetId } : {},
+            ...input.pageUrl ? { pageUrl: input.pageUrl } : {},
+            ...input.pagePath ? { pagePath: input.pagePath } : {}
+          }
+        ]
+      }
+    })
+  });
+}
+
+// ../cli/dist/commands/booking/check.js
+import { readFile as readFile4 } from "fs/promises";
+async function bookingCheckCommand(input) {
+  const validatedManifest = await readBookingManifestFile(input.manifestPath);
+  const sourceFiles = await readSourceFiles2(input.sourceFilePaths);
+  const scanInput = {
+    siteId: validatedManifest.manifest.siteId,
+    siteKeyPrefix: validatedManifest.manifest.siteKeyPrefix,
+    bookingPageSlug: validatedManifest.manifest.bookingPageSlug,
+    ...validatedManifest.manifest.productionOrigin ? { productionOrigin: validatedManifest.manifest.productionOrigin } : {}
+  };
+  const scanResult = scanBookingSourceFiles(sourceFiles, {
+    ...scanInput
+  });
+  const hardErrors = [
+    ...createBoundaryErrors2(validatedManifest),
+    ...scanResult.hardErrors
+  ];
+  return {
+    ok: hardErrors.length === 0,
+    manifest: validatedManifest.manifest,
+    scannedManifest: scanResult.manifest,
+    redactedKeys: validatedManifest.redactedKeys,
+    hardErrors,
+    warnings: scanResult.warnings,
+    suggestions: scanResult.suggestions,
+    findings: scanResult.findings
+  };
+}
+async function readSourceFiles2(filePaths) {
+  return Promise.all(filePaths.map(async (filePath) => ({
+    filePath,
+    sourceText: await readFile4(filePath, "utf8")
+  })));
+}
+function createBoundaryErrors2(validation) {
+  return validation.redactedKeys.map((key) => ({
+    code: "booking_check.raw_key_in_manifest",
+    message: `Booking manifest contains a raw key-like field: ${key}`,
+    filePath: "siteplane.booking.json"
+  }));
+}
+
+// ../cli/dist/commands/booking/init.js
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname4, join as join2 } from "path";
+async function bookingInitCommand(input) {
+  const manifest = {
+    schemaVersion: 1,
+    siteId: input.siteId,
+    siteKeyPrefix: input.siteKeyPrefix,
+    bookingPageSlug: input.bookingPageSlug,
+    ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
+  };
+  const manifestPath = join2(input.projectDir, "siteplane.booking.json");
+  const artifacts = createBookingArtifacts(input.agentClient);
+  await writeBookingManifestFile(manifestPath, manifest);
+  for (const artifact of artifacts) {
+    await writeProjectFile2(input.projectDir, artifact.path, artifact.template);
+  }
+  return {
+    manifestPath,
+    manifest,
+    artifactPaths: artifacts.map((artifact) => artifact.path)
+  };
+}
+function createBookingArtifacts(agentClient) {
+  const artifacts = [
+    {
+      path: ".siteplane/booking.md",
+      template: bookingRulesTemplate
+    }
+  ];
+  if (agentClient === "codex") {
+    artifacts.push({
+      path: ".agents/skills/siteplane-booking/SKILL.md",
+      template: bookingSkillTemplate("Codex")
+    });
+  }
+  if (agentClient === "claude") {
+    artifacts.push({
+      path: ".claude/skills/siteplane-booking/SKILL.md",
+      template: bookingSkillTemplate("Claude Code")
+    });
+  }
+  if (agentClient === "cursor") {
+    artifacts.push({
+      path: ".cursor/rules/siteplane-booking.mdc",
+      template: bookingCursorRulesTemplate
+    });
+  }
+  return artifacts;
+}
+async function writeProjectFile2(projectDir, relativePath, contents) {
+  const path = join2(projectDir, relativePath);
+  await mkdir4(dirname4(path), { recursive: true });
+  await writeFile4(path, contents, "utf8");
+}
+var bookingRulesTemplate = `# Siteplane Booking Rules
+
+- Do not change layout, copy, styling, animation or business logic while adding Booking.
+- Add only the Siteplane Booking embed script and a booking iframe or web component.
+- Use the configured booking page slug from siteplane.booking.json.
+- Register the production website origin in Siteplane before testing cross-origin embeds.
+- Do not write setup tokens, project CLI tokens or private keys into source files.
+- Run npx siteplane booking check, npx siteplane booking sync and npx siteplane booking test after setup.
+- booking test stays in test_mode; live booking only starts after explicit dashboard activation.
+`;
+function bookingSkillTemplate(agentName) {
+  return `# Siteplane Booking Skill
+
+Use this skill in ${agentName} before adding Siteplane Booking embeds.
+
+${bookingRulesTemplate}`;
+}
+var bookingCursorRulesTemplate = `---
+description: Siteplane Booking rules
+alwaysApply: true
+---
+
+${bookingRulesTemplate}`;
+
+// ../cli/dist/commands/booking/sync.js
+async function bookingSyncCommand(input) {
+  const redacted = validateBookingManifestInput(input.manifest);
+  const fetcher = input.fetchImpl ?? fetch;
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/booking/sync`, {
+    method: "POST",
+    headers: createBookingCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      source: "cli",
+      manifest: redacted.manifest
+    })
+  });
+}
+function createBookingCliRequestHeaders(config) {
+  const headers = {
+    authorization: `Bearer ${config.accessToken}`,
+    "content-type": "application/json"
+  };
+  const bypassSecret = config.vercelAutomationBypassSecret?.trim();
+  if (bypassSecret) {
+    headers["x-vercel-protection-bypass"] = bypassSecret;
+  }
+  return headers;
+}
+
+// ../cli/dist/commands/booking/test.js
+async function bookingTestCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  const booking = bookingCreateRequestSchema.parse(input.booking);
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/booking/test`, {
+    method: "POST",
+    headers: createBookingCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      mode: "test",
+      ...input.manifest ? { manifest: input.manifest } : {},
+      booking
+    })
+  });
+}
+
+// ../cli/dist/config/project-config.js
+import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+import { join as join3 } from "path";
+import { z as z23 } from "zod";
+var siteplaneProjectConfigSchema = z23.object({
+  version: z23.literal(1),
+  apiBaseUrl: z23.string().url(),
+  siteId: z23.string().uuid(),
+  publicSiteKeyId: z23.string().uuid(),
+  publicSiteKey: z23.string().trim().min(1),
+  fieldContractHash: z23.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+}).strict();
+async function readProjectPackageJson(projectDir) {
+  return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
+}
+async function detectNextProject(projectDir) {
+  const packageJson = await readProjectPackageJson(projectDir).catch(() => null);
+  if (packageJson?.dependencies?.next || packageJson?.devDependencies?.next) {
+    return true;
+  }
+  for (const fileName of [
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts"
+  ]) {
+    try {
+      await access(join3(projectDir, fileName));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function writeProjectConfig(projectDir, config) {
+  const path = join3(projectDir, "siteplane.config.json");
+  const parsed = siteplaneProjectConfigSchema.parse(config);
+  await writeJsonAtomically(path, parsed, 420);
+  return path;
+}
+async function readProjectConfig(projectDir) {
+  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
+}
+async function writeJsonAtomically(path, value, mode) {
+  const temporaryPath = `${path}.${randomUUID2()}.tmp`;
+  const file = await open(temporaryPath, "wx", mode);
+  try {
+    await file.writeFile(`${JSON.stringify(value, null, 2)}
+`, "utf8");
+    await file.sync();
+  } catch (error) {
+    await file.close();
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+  await file.close();
+  try {
+    await rename(temporaryPath, path);
+    await chmod(path, mode);
+  } catch (error) {
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+}
+
+// ../cli/dist/config/credentials.js
+import { execFile } from "child_process";
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod2, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
+import { dirname as dirname5, join as join4, relative } from "path";
+import { promisify } from "util";
+import { z as z24 } from "zod";
+var siteplaneCredentialsSchema = z24.object({
+  accessToken: z24.string().trim().min(1),
+  siteRevalidationSecret: z24.string().trim().min(1)
+}).strict();
+async function writeLocalCredentials(projectDir, credentials, options = {}) {
+  const path = join4(projectDir, ".siteplane/credentials.json");
+  const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
+  const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
+  if (await isTrackedFile(path)) {
+    throw new Error("Refusing to write Siteplane credentials into a tracked file.");
+  }
+  if (!await isIgnoredFile(path)) {
+    throw new Error("Add .siteplane/credentials.json to .gitignore before running siteplane init.");
+  }
+  const parsed = siteplaneCredentialsSchema.parse(credentials);
+  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
+  await writeCredentialsAtomically(path, parsed);
+  return path;
+}
+async function readLocalCredentials(projectDir) {
+  return siteplaneCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
+}
+async function writeCredentialsAtomically(path, credentials) {
+  const temporaryPath = `${path}.${randomUUID3()}.tmp`;
+  const file = await open2(temporaryPath, "wx", 384);
+  try {
+    await file.writeFile(`${JSON.stringify(credentials, null, 2)}
+`, "utf8");
+    await file.sync();
+  } catch (error) {
+    await file.close();
+    await rm2(temporaryPath, { force: true });
+    throw error;
+  }
+  await file.close();
+  try {
+    await rename2(temporaryPath, path);
+    await chmod2(path, 384);
+  } catch (error) {
+    await rm2(temporaryPath, { force: true });
+    throw error;
+  }
+}
+var execFileAsync = promisify(execFile);
+async function gitPathMatches(projectDir, path, command) {
+  const args = command === "check-ignore" ? ["check-ignore", "--quiet", relative(projectDir, path)] : ["ls-files", "--error-unmatch", relative(projectDir, path)];
+  try {
+    await execFileAsync("git", args, { cwd: projectDir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ../cli/dist/commands/init.js
+import { join as join5 } from "path";
+import { z as z25 } from "zod";
+async function initCommand(input) {
+  if (!input.setupToken.trim()) {
+    throw new Error("A Siteplane setup token is required.");
+  }
+  if (!await detectNextProject(input.projectDir)) {
+    throw new Error("Siteplane init currently supports Next.js projects.");
+  }
+  const bootstrap = await bootstrapProjectConnection(input);
+  const paths = bootstrap.credentialPurpose === "site_setup" ? await persistSiteSetupBootstrap(input, bootstrap) : await persistFeatureBootstrap(input, bootstrap);
+  await acknowledgeBootstrapResponse(input);
+  return {
+    ...paths,
+    nextSteps: [
+      "npx siteplane setup context",
+      "Instrument the site and create EditorDefinitionV1.",
+      "npx siteplane setup apply --definition /tmp/siteplane-editor.json"
+    ]
+  };
+}
+var siteSetupBootstrapDataSchema = z25.object({
+  credentialPurpose: z25.literal("site_setup"),
+  apiBaseUrl: z25.string().url(),
+  siteId: z25.string().uuid(),
+  publicSiteKeyId: z25.string().uuid(),
+  publicSiteKey: z25.string().trim().min(1),
+  accessToken: z25.string().trim().min(1),
+  siteRevalidationSecret: z25.string().regex(/^[A-Za-z0-9_-]{43}$/u)
+}).strict();
+var featureBootstrapDataSchema = z25.object({
+  credentialPurpose: z25.enum(["analytics", "booking"]),
+  apiBaseUrl: z25.string().url(),
+  siteId: z25.string().uuid(),
+  accessToken: z25.string().trim().min(1)
+}).strict();
+var bootstrapResponseSchema = z25.object({
+  ok: z25.literal(true),
+  data: z25.discriminatedUnion("credentialPurpose", [
+    siteSetupBootstrapDataSchema,
+    featureBootstrapDataSchema
+  ])
+}).strict();
+async function bootstrapProjectConnection(input) {
+  const fetcher = input.fetcher ?? fetch;
+  const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
+    method: "POST",
+    headers: createBootstrapHeaders(input),
+    body: JSON.stringify({
+      action: "bootstrap",
+      agentClient: input.agentClient ?? "codex"
+    })
+  });
+  const payload = await response.json();
+  const parsed = bootstrapResponseSchema.safeParse(payload);
+  if (!response.ok || !parsed.success) {
+    throw new Error(readErrorMessage(payload) ?? "Siteplane init failed.");
+  }
+  return parsed.data.data;
+}
+async function acknowledgeBootstrapResponse(input) {
+  const fetcher = input.fetcher ?? fetch;
+  const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
+    method: "POST",
+    headers: createBootstrapHeaders(input),
+    body: JSON.stringify({ action: "acknowledge" })
+  });
+  if (!response.ok) {
+    throw new Error("Siteplane setup acknowledgement failed.");
+  }
+}
+async function persistSiteSetupBootstrap(input, bootstrap) {
+  const credentialsPath = await writeLocalCredentials(input.projectDir, {
+    accessToken: bootstrap.accessToken,
+    siteRevalidationSecret: bootstrap.siteRevalidationSecret
+  }, {
+    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
+    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
+  });
+  const configPath = await writeProjectConfig(input.projectDir, {
+    version: 1,
+    apiBaseUrl: bootstrap.apiBaseUrl,
+    siteId: bootstrap.siteId,
+    publicSiteKeyId: bootstrap.publicSiteKeyId,
+    publicSiteKey: bootstrap.publicSiteKey
+  });
+  const [credentials, config] = await Promise.all([
+    readLocalCredentials(input.projectDir),
+    readProjectConfig(input.projectDir)
+  ]);
+  if (credentials.accessToken !== bootstrap.accessToken || credentials.siteRevalidationSecret !== bootstrap.siteRevalidationSecret || config.apiBaseUrl !== bootstrap.apiBaseUrl || config.siteId !== bootstrap.siteId || config.publicSiteKeyId !== bootstrap.publicSiteKeyId || config.publicSiteKey !== bootstrap.publicSiteKey) {
+    throw new Error("Siteplane setup files could not be verified.");
+  }
+  return { configPath, credentialsPath };
+}
+async function persistFeatureBootstrap(input, bootstrap) {
+  const [config, existingCredentials] = await Promise.all([
+    readProjectConfig(input.projectDir),
+    readLocalCredentials(input.projectDir)
+  ]);
+  if (config.siteId !== bootstrap.siteId) {
+    throw new Error("The setup token belongs to a different Siteplane site.");
+  }
+  const credentialsPath = await writeLocalCredentials(input.projectDir, {
+    accessToken: bootstrap.accessToken,
+    siteRevalidationSecret: existingCredentials.siteRevalidationSecret
+  }, {
+    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
+    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
+  });
+  const persistedCredentials = await readLocalCredentials(input.projectDir);
+  if (persistedCredentials.accessToken !== bootstrap.accessToken || persistedCredentials.siteRevalidationSecret !== existingCredentials.siteRevalidationSecret) {
+    throw new Error("Siteplane credentials could not be verified.");
+  }
+  return {
+    configPath: join5(input.projectDir, "siteplane.config.json"),
+    credentialsPath
+  };
+}
+function createBootstrapHeaders(input) {
+  return new Headers({
+    authorization: `Bearer ${input.setupToken}`,
+    "content-type": "application/json",
+    ...input.vercelAutomationBypassSecret?.trim() ? {
+      "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim()
+    } : {}
+  });
+}
+function readErrorMessage(payload) {
+  if (payload && typeof payload === "object" && "error" in payload && payload.error && typeof payload.error === "object" && "message" in payload.error && typeof payload.error.message === "string") {
+    const code = "code" in payload.error && typeof payload.error.code === "string" ? payload.error.code : null;
+    return code ? `${code}: ${payload.error.message}` : payload.error.message;
+  }
+  return null;
+}
+
+// ../cli/dist/commands/scan.js
+import { readdir } from "fs/promises";
+import { extname, join as join6 } from "path";
+var defaultScanRoots = ["app", "src", "pages", "components", "lib"];
+var excludedDirectories = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".turbo",
+  ".vercel",
+  "build",
+  "coverage",
+  "dist",
+  "node_modules"
+]);
+var sourceExtensions = /* @__PURE__ */ new Set([".js", ".jsx", ".ts", ".tsx"]);
+async function resolveScanFilePaths(filePaths, options = {}) {
+  if (filePaths.length > 0) {
+    return filePaths;
+  }
+  const projectDir = options.projectDir ?? process.cwd();
+  const discovered = await Promise.all(defaultScanRoots.map((root) => collectSourceFiles(join6(projectDir, root))));
+  return [...new Set(discovered.flat())].sort();
+}
+async function collectSourceFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+  const files = [];
+  for (const entry of entries) {
+    const entryPath = join6(directory, entry.name);
+    if (entry.isDirectory()) {
+      if (!excludedDirectories.has(entry.name)) {
+        files.push(...await collectSourceFiles(entryPath));
+      }
+      continue;
+    }
+    if (entry.isFile() && sourceExtensions.has(extname(entry.name))) {
+      files.push(entryPath);
+    }
+  }
+  return files;
+}
+
+// ../cli/dist/commands/site-setup.js
+import { execFile as execFile2 } from "child_process";
+import { readFile as readFile7 } from "fs/promises";
+import { promisify as promisify2 } from "util";
+import { z as z26 } from "zod";
+
+// ../cli/dist/scan/next-source-scan.js
+import ts2 from "typescript";
+import { isAbsolute, relative as relative2 } from "path";
+var eventPreviewHandlerMissingMessage = "Event preview fields must consume preview values with useSiteplanePreviewText from @siteplane/runtime-next/client or a siteplane:preview-value-applied listener.";
+var valueCallUnusedMessage = "Siteplane value calls must feed rendered content. Assign or await the returned value and render that value instead of ignoring the call.";
+var legacyEditableComponentPrefix = "Editable";
+var editableComponentNames = new Set(["Image", "Text", "LongText", "Link"].map((name) => `${legacyEditableComponentPrefix}${name}`));
+var functionTypeByName = {
+  text: "text",
+  longText: "longText",
+  link: "link",
+  image: "image"
+};
+function scanNextSourceFilesToSiteFieldContract(files, options) {
+  const scan = scanSourceFacts(files);
+  const fields = [];
+  for (const field of uniqueFields(scan.fields)) {
+    const routeKey = field.technicalRouteKey ?? field.routeHint;
+    if (!routeKey) {
+      scan.hardErrors.push({
+        code: "field_scan.route_key_missing",
+        message: `Field ${field.fieldId} has no canonical route key.`,
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+      continue;
+    }
+    const source = {
+      kind: "function",
+      filePath: toRepositoryRelativePosixPath(field.sourceFilePath ?? "unknown", options.projectRoot)
+    };
+    assignIfDefined(source, "exportName", field.sourceExportName);
+    assignIfDefined(source, "sourcePath", field.sourcePath);
+    assignIfDefined(source, "editTarget", field.editTarget);
+    const parsed = siteFieldContractFieldSchema.safeParse({
+      fieldId: field.fieldId,
+      fieldType: field.fieldType,
+      fallback: field.fallback,
+      routeKey,
+      source,
+      ...field.hasDomBinding ? {
+        dom: {
+          attribute: "data-siteplane-field-id",
+          previewStrategy: field.previewStrategy ?? "dom"
+        }
+      } : {}
+    });
+    if (!parsed.success) {
+      scan.hardErrors.push({
+        code: "field_scan.invalid_site_field_contract",
+        message: parsed.error.issues[0]?.message ?? "Invalid field contract.",
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+      continue;
+    }
+    fields.push(parsed.data);
+  }
+  return {
+    contract: siteFieldContractV1Schema.parse({
+      version: 1,
+      fieldContractVersion,
+      scannerContractVersion,
+      fields
+    }),
+    hardErrors: scan.hardErrors,
+    warnings: scan.warnings,
+    suggestions: scan.suggestions
+  };
+}
+function scanSourceFacts(files) {
+  const fields = [];
+  const hardErrors = [];
+  const warnings = [];
+  const suggestions = [];
+  const eventPreviewAttrs = [];
+  const eventPreviewComponentPropConsumers = [];
+  const eventPreviewComponentPropUsages = [];
+  const eventPreviewConsumerFieldIds = /* @__PURE__ */ new Set();
+  let hasGenericEventPreviewConsumer = false;
+  for (const file of files) {
+    const facts = scanSourceFile2(file, fields, hardErrors);
+    eventPreviewAttrs.push(...facts.eventPreviewAttrs);
+    eventPreviewComponentPropConsumers.push(...facts.eventPreviewComponentPropConsumers);
+    eventPreviewComponentPropUsages.push(...facts.eventPreviewComponentPropUsages);
+    facts.eventPreviewConsumerFieldIds.forEach((fieldId) => {
+      eventPreviewConsumerFieldIds.add(fieldId);
+    });
+    hasGenericEventPreviewConsumer ||= facts.hasGenericEventPreviewConsumer;
+  }
+  for (const usage of eventPreviewComponentPropUsages) {
+    if (eventPreviewComponentPropConsumers.some((consumer) => consumer.componentName === usage.componentName && consumer.propName === usage.propName)) {
+      eventPreviewConsumerFieldIds.add(usage.fieldId);
+    }
+  }
+  markMissingEventPreviewHandlerErrors(eventPreviewAttrs, eventPreviewConsumerFieldIds, hasGenericEventPreviewConsumer, hardErrors);
+  validateScannedFields(fields, hardErrors, warnings, suggestions);
+  return {
+    fields,
+    hardErrors,
+    warnings,
+    suggestions
+  };
+}
+function uniqueFields(fields) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const field of fields) {
+    if (seen.has(field.fieldId)) {
+      continue;
+    }
+    seen.add(field.fieldId);
+    unique.push(field);
+  }
+  return unique;
+}
+function scanSourceFile2(file, fields, hardErrors) {
+  const fieldsInFile = [];
+  const attrFieldIds = /* @__PURE__ */ new Set();
+  const attrRouteRefs = /* @__PURE__ */ new Set();
+  const eventPreviewAttrs = [];
+  const eventPreviewAttrVariables = /* @__PURE__ */ new Map();
+  const eventPreviewComponentPropConsumers = [];
+  const eventPreviewComponentPropUsages = [];
+  const eventPreviewConsumerFieldIds = /* @__PURE__ */ new Set();
+  let hasGenericEventPreviewConsumer = false;
+  const sourceFile = ts2.createSourceFile(file.filePath, file.sourceText, ts2.ScriptTarget.Latest, true, ts2.ScriptKind.TSX);
+  function visit(node, currentComponentName) {
+    const nextComponentName = getFunctionComponentName(node) ?? currentComponentName;
+    if (ts2.isJsxSelfClosingElement(node) || ts2.isJsxOpeningElement(node)) {
+      const componentName = getJsxTagName2(node.tagName);
+      if (editableComponentNames.has(componentName)) {
+        hardErrors.push({
+          code: "field_scan.value_first_required",
+          message: "Siteplane MVP uses value-first APIs. Replace this field with siteplane.route(...) or a field value call.",
+          filePath: file.filePath
+        });
+      }
+      collectEventPreviewComponentPropUsages(node, eventPreviewAttrVariables, eventPreviewComponentPropUsages, file);
+    }
+    if (ts2.isCallExpression(node)) {
+      collectAttrsCall(node, attrFieldIds, attrRouteRefs, eventPreviewAttrs, eventPreviewAttrVariables, file);
+      collectUnusedValueCallError(node, hardErrors, file);
+      const extractedFields = extractFunctionFields(node, file);
+      for (const field of extractedFields) {
+        fieldsInFile.push(field);
+        fields.push(field);
+      }
+      const previewHookFieldId = getPreviewHookFieldId(node, eventPreviewAttrVariables);
+      if (previewHookFieldId) {
+        eventPreviewConsumerFieldIds.add(previewHookFieldId);
+      } else if (nextComponentName) {
+        const previewHookPropName = getPreviewHookPropName(node, eventPreviewAttrVariables);
+        if (previewHookPropName) {
+          eventPreviewComponentPropConsumers.push({
+            componentName: nextComponentName,
+            propName: previewHookPropName
+          });
+        }
+      }
+    }
+    if (isGenericEventPreviewConsumerReference(node)) {
+      hasGenericEventPreviewConsumer = true;
+    }
+    ts2.forEachChild(node, (child) => visit(child, nextComponentName));
+  }
+  visit(sourceFile);
+  markMissingAttrsWarnings(fieldsInFile, attrFieldIds, attrRouteRefs);
+  return {
+    eventPreviewAttrs,
+    eventPreviewComponentPropConsumers,
+    eventPreviewComponentPropUsages,
+    eventPreviewConsumerFieldIds: [...eventPreviewConsumerFieldIds],
+    hasGenericEventPreviewConsumer
+  };
+}
+function collectUnusedValueCallError(node, hardErrors, file) {
+  const valueFunctionName = getSiteplaneValueFunctionName(node);
+  if (!valueFunctionName || !isIgnoredValueCall(node)) {
+    return;
+  }
+  const fieldId = valueFunctionName === "route" ? void 0 : stringValue2(staticExpressionValue2(node.arguments[0]));
+  hardErrors.push({
+    code: "field_scan.value_call_unused",
+    message: valueCallUnusedMessage,
+    ...fieldId ? { fieldId } : {},
+    filePath: file.filePath
+  });
+}
+function getSiteplaneValueFunctionName(node) {
+  if (!ts2.isPropertyAccessExpression(node.expression)) {
+    return void 0;
+  }
+  if (node.expression.expression.getText() !== "siteplane") {
+    return void 0;
+  }
+  const functionName = node.expression.name.text;
+  if (functionName === "route" || functionTypeByName[functionName]) {
+    return functionName;
+  }
+  return void 0;
+}
+function isIgnoredValueCall(node) {
+  if (ts2.isVoidExpression(node.parent)) {
+    return true;
+  }
+  if (ts2.isExpressionStatement(node.parent)) {
+    return true;
+  }
+  return ts2.isAwaitExpression(node.parent) && ts2.isExpressionStatement(node.parent.parent);
+}
+function extractFunctionFields(node, file) {
+  if (!ts2.isPropertyAccessExpression(node.expression)) {
+    return [];
+  }
+  if (node.expression.expression.getText() !== "siteplane") {
+    return [];
+  }
+  const functionName = node.expression.name.text;
+  if (functionName === "route") {
+    return extractRouteFields(node, file);
+  }
+  const fieldType = functionTypeByName[functionName];
+  if (!fieldType) {
+    return [];
+  }
+  const fieldId = staticExpressionValue2(node.arguments[0]);
+  if (typeof fieldId !== "string") {
+    return [];
+  }
+  const input = {
+    fieldId,
+    fieldType,
+    fallback: staticExpressionValue2(node.arguments[1]),
+    source: "function",
+    sourceFilePath: file.filePath,
+    sourceExportName: functionName,
+    editTarget: fieldId
+  };
+  const routeHint = inferRouteHint(file.filePath);
+  const options = staticExpressionValue2(node.arguments[2]);
+  const fieldOptions = options && typeof options === "object" && !Array.isArray(options) ? options : {};
+  assignIfDefined(input, "routeHint", routeHint);
+  assignIfDefined(input, "technicalRouteKey", stringValue2(fieldOptions.routeKey) ?? routeHint);
+  assignIfDefined(input, "previewStrategy", previewStrategyValue(fieldOptions.previewStrategy));
+  assignIfDefined(input, "label", stringValue2(fieldOptions.label));
+  assignIfDefined(input, "description", stringValue2(fieldOptions.description));
+  assignIfDefined(input, "required", booleanValue(fieldOptions.required));
+  assignIfDefined(input, "maxLength", numberValue(fieldOptions.maxLength));
+  return [createField(input)];
+}
+function extractRouteFields(node, file) {
+  const routeId = staticExpressionValue2(node.arguments[0]);
+  const fallbacks = staticExpressionValue2(node.arguments[1]);
+  const options = staticExpressionValue2(node.arguments[2]);
+  if (typeof routeId !== "string" || !fallbacks || typeof fallbacks !== "object" || Array.isArray(fallbacks)) {
+    return [];
+  }
+  const routeVariableName = getAssignedVariableName(node);
+  const fieldsConfig = options && typeof options === "object" && !Array.isArray(options) ? options.fields : void 0;
+  const routeHint = inferRouteHint(file.filePath);
+  const fields = [];
+  for (const [key, fallback] of Object.entries(fallbacks)) {
+    const config = fieldsConfig && typeof fieldsConfig === "object" && !Array.isArray(fieldsConfig) ? fieldsConfig[key] : void 0;
+    if (!config || typeof config !== "object" || Array.isArray(config)) {
+      continue;
+    }
+    const fieldConfig = config;
+    const fieldId = stringValue2(fieldConfig.id);
+    const fieldType = fieldTypeValue(fieldConfig.type);
+    if (!fieldId || !fieldType) {
+      continue;
+    }
+    const input = {
+      fieldId,
+      fieldType,
+      fallback,
+      source: "function",
+      sourceFilePath: file.filePath,
+      sourceExportName: "route",
+      routeId,
+      sourcePath: `$.${key}`,
+      editTarget: fieldId,
+      routeFieldKey: key
+    };
+    assignIfDefined(input, "routeVariableName", routeVariableName);
+    assignIfDefined(input, "routeHint", routeHint);
+    assignIfDefined(input, "technicalRouteKey", stringValue2(fieldConfig.routeKey) ?? routeHint);
+    assignIfDefined(input, "previewStrategy", previewStrategyValue(fieldConfig.previewStrategy));
+    assignIfDefined(input, "label", stringValue2(fieldConfig.label));
+    assignIfDefined(input, "description", stringValue2(fieldConfig.description));
+    assignIfDefined(input, "required", booleanValue(fieldConfig.required));
+    assignIfDefined(input, "maxLength", numberValue(fieldConfig.maxLength));
+    fields.push(createField(input));
+  }
+  return fields;
+}
+function createField(input) {
+  const field = {
+    fieldId: input.fieldId,
+    fieldType: input.fieldType,
+    fallback: input.fallback,
+    source: input.source,
+    sourceFilePath: input.sourceFilePath,
+    warnings: [],
+    suggestions: []
+  };
+  assignIfDefined(field, "label", input.label);
+  assignIfDefined(field, "description", input.description);
+  assignIfDefined(field, "required", input.required);
+  assignIfDefined(field, "maxLength", input.maxLength);
+  assignIfDefined(field, "sourceExportName", input.sourceExportName);
+  assignIfDefined(field, "componentHint", input.componentHint);
+  assignIfDefined(field, "routeHint", input.routeHint);
+  assignIfDefined(field, "routeId", input.routeId);
+  assignIfDefined(field, "sourcePath", input.sourcePath);
+  assignIfDefined(field, "editTarget", input.editTarget);
+  assignMetadata(field, {
+    canonicalFallbackHash: createFallbackHash(input.fieldType, input.fallback)
+  });
+  assignIfDefined(field, "routeVariableName", input.routeVariableName);
+  assignIfDefined(field, "routeFieldKey", input.routeFieldKey);
+  assignIfDefined(field, "technicalRouteKey", input.technicalRouteKey);
+  assignIfDefined(field, "previewStrategy", input.previewStrategy);
+  if (field.fieldType === "text" && field.maxLength === void 0) {
+    field.warnings.push("field_scan.text_max_length_missing");
+  }
+  if (isPositionalFieldReference(field.fieldId) || isPositionalFieldReference(field.sourcePath)) {
+    field.warnings.push("field_scan.positional_repeating_id");
+  }
+  return field;
+}
+function assignMetadata(field, metadata) {
+  const entries = Object.entries(metadata).filter(([, value]) => value !== void 0);
+  if (entries.length === 0) {
+    return;
+  }
+  field.metadata = {
+    ...field.metadata ?? {},
+    ...Object.fromEntries(entries)
+  };
+}
+function createFallbackHash(fieldType, fallback) {
+  try {
+    return createCanonicalFallbackHash({ fieldType, fallbackValue: fallback });
+  } catch {
+    return void 0;
+  }
+}
+function collectAttrsCall(node, attrFieldIds, attrRouteRefs, eventPreviewAttrs, eventPreviewAttrVariables, file) {
+  if (!ts2.isPropertyAccessExpression(node.expression)) {
+    return;
+  }
+  if (node.expression.expression.getText() !== "siteplane" || node.expression.name.text !== "attrs") {
+    return;
+  }
+  const firstArg = node.arguments[0];
+  const secondArg = staticExpressionValue2(node.arguments[1]);
+  const directFieldId = staticExpressionValue2(firstArg);
+  if (typeof directFieldId === "string") {
+    attrFieldIds.add(directFieldId);
+    if (hasEventPreviewStrategy(secondArg)) {
+      eventPreviewAttrs.push({
+        fieldId: directFieldId,
+        filePath: file.filePath
+      });
+      const variableName = getAssignedVariableName(node);
+      if (variableName) {
+        eventPreviewAttrVariables.set(variableName, directFieldId);
+      }
+    }
+    return;
+  }
+  if (firstArg && ts2.isIdentifier(firstArg) && typeof secondArg === "string") {
+    attrRouteRefs.add(`${firstArg.text}:${secondArg}`);
+  }
+}
+function markMissingEventPreviewHandlerErrors(eventPreviewAttrs, eventPreviewConsumerFieldIds, hasGenericEventPreviewConsumer, hardErrors) {
+  if (hasGenericEventPreviewConsumer) {
+    return;
+  }
+  for (const attr of uniqueEventPreviewAttrs(eventPreviewAttrs)) {
+    if (eventPreviewConsumerFieldIds.has(attr.fieldId)) {
+      continue;
+    }
+    hardErrors.push({
+      code: "field_scan.event_preview_handler_missing",
+      message: eventPreviewHandlerMissingMessage,
+      fieldId: attr.fieldId,
+      filePath: attr.filePath
+    });
+  }
+}
+function uniqueEventPreviewAttrs(eventPreviewAttrs) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const attr of eventPreviewAttrs) {
+    const key = `${attr.filePath}:${attr.fieldId}`;
+    if (seen.has(key)) {
+      continue;
+    }
+    seen.add(key);
+    unique.push(attr);
+  }
+  return unique;
+}
+function hasEventPreviewStrategy(options) {
+  return !!options && typeof options === "object" && !Array.isArray(options) && options.previewStrategy === "event";
+}
+function isGenericEventPreviewConsumerReference(node) {
+  return (ts2.isStringLiteral(node) || ts2.isNoSubstitutionTemplateLiteral(node)) && node.text === "siteplane:preview-value-applied";
+}
+function getPreviewHookFieldId(node, eventPreviewAttrVariables) {
+  const firstArg = getUseSiteplanePreviewTextFirstArg(node);
+  if (!firstArg) {
+    return void 0;
+  }
+  const directFieldId = staticExpressionValue2(firstArg);
+  if (typeof directFieldId === "string") {
+    return directFieldId;
+  }
+  if (ts2.isIdentifier(firstArg)) {
+    return eventPreviewAttrVariables.get(firstArg.text);
+  }
+  return void 0;
+}
+function getPreviewHookPropName(node, eventPreviewAttrVariables) {
+  const firstArg = getUseSiteplanePreviewTextFirstArg(node);
+  if (!firstArg) {
+    return void 0;
+  }
+  if (ts2.isIdentifier(firstArg) && !eventPreviewAttrVariables.has(firstArg.text)) {
+    return firstArg.text;
+  }
+  if (ts2.isPropertyAccessExpression(firstArg) && ts2.isIdentifier(firstArg.expression)) {
+    return firstArg.name.text;
+  }
+  return void 0;
+}
+function getUseSiteplanePreviewTextFirstArg(node) {
+  if (ts2.isIdentifier(node.expression) && node.expression.text === "useSiteplanePreviewText") {
+    return node.arguments[0];
+  }
+  return void 0;
+}
+function markMissingAttrsWarnings(fields, attrFieldIds, attrRouteRefs) {
+  for (const field of fields) {
+    const hasDirectAttrs = attrFieldIds.has(field.fieldId);
+    const hasRouteAttrs = field.routeVariableName && field.routeFieldKey ? attrRouteRefs.has(`${field.routeVariableName}:${field.routeFieldKey}`) : false;
+    field.hasDomBinding = Boolean(hasDirectAttrs || hasRouteAttrs);
+    if (!field.hasDomBinding && (field.fieldType === "text" || field.fieldType === "longText")) {
+      field.warnings.push("field_scan.attrs_missing");
+    }
+  }
+}
+function validateScannedFields(fields, hardErrors, warnings, suggestions) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const field of fields) {
+    if (!isFieldId(field.fieldId)) {
+      hardErrors.push({
+        code: "field_scan.invalid_field_id",
+        message: `Invalid field id: ${field.fieldId}`,
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+    }
+    const existing = seen.get(field.fieldId);
+    if (existing) {
+      hardErrors.push({
+        code: "field_scan.duplicate_id",
+        message: `Duplicate field id: ${field.fieldId}`,
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+      if (existing.fieldType !== field.fieldType) {
+        hardErrors.push({
+          code: "field_scan.type_conflict",
+          message: `Field id ${field.fieldId} is used with multiple types.`,
+          fieldId: field.fieldId,
+          filePath: field.sourceFilePath ?? "unknown"
+        });
+      }
+    }
+    seen.set(field.fieldId, field);
+    for (const warning of field.warnings) {
+      warnings.push({
+        code: warning,
+        message: getScanIssueMessage(warning),
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+    }
+    for (const suggestion of field.suggestions) {
+      suggestions.push({
+        code: suggestion,
+        message: getScanIssueMessage(suggestion),
+        fieldId: field.fieldId,
+        filePath: field.sourceFilePath ?? "unknown"
+      });
+    }
+  }
+}
+function getScanIssueMessage(code) {
+  if (code === "field_scan.attrs_missing") {
+    return "Field renders a value but has no DOM discovery attrs. Add siteplane.attrs(...) to the nearest stable element so the visual editor can select it.";
+  }
+  if (code === "field_scan.positional_repeating_id") {
+    return "Repeating content needs stable Siteplane field IDs for the MVP. Replace positional array/index field ids with stable item ids such as services.haircut.price.";
+  }
+  if (code === "field_scan.animation_wrapper") {
+    return 'Put siteplane.attrs(...) on the stable wrapper and make the animation respect data-siteplane-editor="true" or useSiteplaneEditorMode().';
+  }
+  if (code === "field_scan.event_preview_handler_missing") {
+    return eventPreviewHandlerMissingMessage;
+  }
+  return code;
+}
+function staticExpressionValue2(expression) {
+  if (!expression) {
+    return void 0;
+  }
+  if (ts2.isStringLiteral(expression) || ts2.isNoSubstitutionTemplateLiteral(expression)) {
+    return expression.text;
+  }
+  if (ts2.isNumericLiteral(expression)) {
+    return Number(expression.text);
+  }
+  if (expression.kind === ts2.SyntaxKind.TrueKeyword) {
+    return true;
+  }
+  if (expression.kind === ts2.SyntaxKind.FalseKeyword) {
+    return false;
+  }
+  if (ts2.isObjectLiteralExpression(expression)) {
+    return readObjectLiteral(expression);
+  }
+  return void 0;
+}
+function readObjectLiteral(expression) {
+  const value = {};
+  for (const property of expression.properties) {
+    if (!ts2.isPropertyAssignment(property)) {
+      continue;
+    }
+    const name = getPropertyName(property.name);
+    if (!name) {
+      continue;
+    }
+    value[name] = staticExpressionValue2(property.initializer);
+  }
+  return value;
+}
+function getPropertyName(name) {
+  if (ts2.isIdentifier(name) || ts2.isStringLiteral(name)) {
+    return name.text;
+  }
+  return null;
+}
+function collectEventPreviewComponentPropUsages(node, eventPreviewAttrVariables, eventPreviewComponentPropUsages, file) {
+  const componentName = getJsxTagName2(node.tagName);
+  if (!isComponentName(componentName)) {
+    return;
+  }
+  for (const property of node.attributes.properties) {
+    if (!ts2.isJsxAttribute(property)) {
+      continue;
+    }
+    const propName = getJsxAttributeName(property.name);
+    const fieldId = getJsxFieldIdValue(property.initializer, eventPreviewAttrVariables);
+    if (!propName || !fieldId || !isFieldId(fieldId)) {
+      continue;
+    }
+    eventPreviewComponentPropUsages.push({
+      componentName,
+      fieldId,
+      filePath: file.filePath,
+      propName
+    });
+  }
+}
+function getJsxAttributeName(name) {
+  if (ts2.isIdentifier(name)) {
+    return name.text;
+  }
+  return void 0;
+}
+function getJsxFieldIdValue(initializer, eventPreviewAttrVariables) {
+  if (!initializer) {
+    return void 0;
+  }
+  if (ts2.isStringLiteral(initializer)) {
+    return initializer.text;
+  }
+  if (ts2.isJsxExpression(initializer) && initializer.expression && ts2.isIdentifier(initializer.expression)) {
+    return eventPreviewAttrVariables.get(initializer.expression.text);
+  }
+  return void 0;
+}
+function getFunctionComponentName(node) {
+  if (ts2.isFunctionDeclaration(node) && node.name && isComponentName(node.name.text)) {
+    return node.name.text;
+  }
+  if (ts2.isVariableDeclaration(node) && ts2.isIdentifier(node.name) && isComponentName(node.name.text) && node.initializer && (ts2.isArrowFunction(node.initializer) || ts2.isFunctionExpression(node.initializer))) {
+    return node.name.text;
+  }
+  return void 0;
+}
+function isComponentName(name) {
+  return /^[A-Z]/.test(name);
+}
+function getAssignedVariableName(node) {
+  let current = node;
+  while (ts2.isAwaitExpression(current.parent)) {
+    current = current.parent;
+  }
+  if (ts2.isVariableDeclaration(current.parent) && ts2.isIdentifier(current.parent.name)) {
+    return current.parent.name.text;
+  }
+  return void 0;
+}
+function getJsxTagName2(tagName) {
+  return tagName.getText();
+}
+function stringValue2(value) {
+  return typeof value === "string" ? value : void 0;
+}
+function fieldTypeValue(value) {
+  if (value === "text" || value === "longText" || value === "image" || value === "link") {
+    return value;
+  }
+  return void 0;
+}
+function previewStrategyValue(value) {
+  return value === "dom" || value === "event" ? value : void 0;
+}
+function numberValue(value) {
+  return typeof value === "number" ? value : void 0;
+}
+function booleanValue(value) {
+  return typeof value === "boolean" ? value : void 0;
+}
+function assignIfDefined(object, key, value) {
+  if (value !== void 0) {
+    object[key] = value;
+  }
+}
+function inferRouteHint(filePath) {
+  const normalized = filePath.replaceAll("\\", "/");
+  const appIndex = normalized.indexOf("app/");
+  if (appIndex === -1 || !normalized.endsWith("page.tsx")) {
+    return void 0;
+  }
+  const route = normalized.slice(appIndex + 4, -"page.tsx".length).split("/").filter((segment) => segment && !segment.startsWith("(")).join("/");
+  return route ? `/${route}` : "/";
+}
+function toRepositoryRelativePosixPath(filePath, projectRoot) {
+  const path = isAbsolute(filePath) ? relative2(projectRoot, filePath) : filePath;
+  return path.replaceAll("\\", "/");
+}
+function isPositionalFieldReference(value) {
+  return value ? /\[\d+\]|\.\d+(?:\.|$)/.test(value) : false;
+}
+
+// ../cli/dist/commands/site-setup.js
+var execFileAsync2 = promisify2(execFile2);
+var safeErrorSchema = z26.object({
+  code: z26.string().trim().min(1),
+  message: z26.string().trim().min(1)
+}).passthrough();
+var errorResponseSchema2 = z26.object({ ok: z26.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z26.object({
+  site: z26.object({ siteId: z26.string().uuid(), websiteUrl: z26.string().url() }),
+  run: z26.object({
+    runId: z26.string().uuid(),
+    mode: z26.enum(["initial", "update"]),
+    status: z26.enum([
+      "waiting_for_agent",
+      "working",
+      "action_required",
+      "ready_for_review"
+    ]),
+    fieldContractHash: z26.string().nullable(),
+    deploymentOrigin: z26.string().nullable(),
+    deploymentRevision: z26.string().nullable(),
+    errorCode: z26.string().nullable(),
+    errorMessage: z26.string().nullable()
+  }),
+  allowedTasks: z26.array(z26.string()),
+  requiredEnvironmentNames: z26.array(z26.string())
+}).strict();
+var contextResponseSchema = z26.object({ ok: z26.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z26.object({
+  status: z26.enum(["applied", "ready_for_review"]),
+  runId: z26.string().uuid().optional(),
+  contractVersionId: z26.string().uuid().optional(),
+  fieldContractHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z26.number().int().nonnegative().optional(),
+  routeCount: z26.number().int().nonnegative().optional()
+}).strict();
+var applyResponseSchema = z26.object({ ok: z26.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z26.object({
+  status: z26.literal("ready_for_review"),
+  runId: z26.string().uuid().optional(),
+  deploymentOrigin: z26.string().url().optional(),
+  deploymentRevision: z26.string().optional()
+}).strict();
+var verifyResponseSchema = z26.object({ ok: z26.literal(true), data: verifyDataSchema }).strict();
+async function siteSetupContextCommand(input) {
+  const response = await postSiteSetup(input, "context", {});
+  const parsed = contextResponseSchema.safeParse(response.payload);
+  if (response.ok && parsed.success) {
+    return { status: "ok", ...parsed.data.data };
+  }
+  return actionRequired(response.payload, "Siteplane setup context is unavailable.");
+}
+async function siteSetupApplyCommand(input) {
+  const editorDefinition = editorDefinitionV1Schema.parse(input.editorDefinition);
+  const resolveSourceFiles = input.resolveSourceFiles ?? resolveScanFilePaths;
+  const readSourceFile = input.readSourceFile ?? ((path) => readFile7(path, "utf8"));
+  const scanSourceFiles = input.scanSourceFiles ?? scanNextSourceFilesToSiteFieldContract;
+  const paths = await resolveSourceFiles([], { projectDir: input.projectDir });
+  const files = await Promise.all(paths.map(async (filePath) => ({
+    filePath,
+    sourceText: await readSourceFile(filePath)
+  })));
+  const scan = scanSourceFiles(files, { projectRoot: input.projectDir });
+  if (scan.hardErrors.length > 0) {
+    return {
+      status: "action_required",
+      code: "field_contract_scan_failed",
+      message: scan.hardErrors.map((issue) => issue.message).join("\n")
+    };
+  }
+  const payload = siteSetupApplyInputSchema.parse({
+    fieldContract: scan.contract,
+    editorDefinition
+  });
+  const response = await postSiteSetup(input, "apply", payload);
+  const parsed = applyResponseSchema.safeParse(response.payload);
+  if (!response.ok || !parsed.success) {
+    return actionRequired(response.payload, "Siteplane setup apply failed.");
+  }
+  const localFieldContractHash = createSiteFieldContractHash(scan.contract);
+  if (parsed.data.data.fieldContractHash !== localFieldContractHash) {
+    return {
+      status: "action_required",
+      code: "field_contract_hash_mismatch",
+      message: "The applied field contract hash does not match the final local source scan."
+    };
+  }
+  const config = await readProjectConfig(input.projectDir);
+  await writeProjectConfig(input.projectDir, {
+    ...config,
+    fieldContractHash: parsed.data.data.fieldContractHash
+  });
+  return parsed.data.data;
+}
+async function siteSetupVerifyCommand(input) {
+  const deploymentRevision = await (input.readRevision ?? readGitRevision)(input.projectDir);
+  const response = await postSiteSetup(input, "verify", {
+    deploymentUrl: input.deploymentUrl,
+    deploymentRevision,
+    ...input.wait ? { wait: true } : {}
+  });
+  const parsed = verifyResponseSchema.safeParse(response.payload);
+  if (response.ok && parsed.success) {
+    return parsed.data.data;
+  }
+  return actionRequired(response.payload, "Siteplane deployment verification failed.");
+}
+async function postSiteSetup(input, operation, body) {
+  const [config, credentials] = await Promise.all([
+    readProjectConfig(input.projectDir),
+    readLocalCredentials(input.projectDir)
+  ]);
+  const response = await (input.fetcher ?? fetch)(`${config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/setup/${operation}`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${credentials.accessToken}`,
+      "content-type": "application/json",
+      ...input.vercelAutomationBypassSecret?.trim() ? {
+        "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim()
+      } : {}
+    },
+    body: JSON.stringify(body)
+  });
+  const payload = await response.json().catch(() => null);
+  return { ok: response.ok, payload };
+}
+function actionRequired(payload, fallbackMessage) {
+  const parsed = errorResponseSchema2.safeParse(payload);
+  return parsed.success ? {
+    status: "action_required",
+    code: parsed.data.error.code,
+    message: parsed.data.error.message
+  } : {
+    status: "action_required",
+    code: "invalid_server_response",
+    message: fallbackMessage
+  };
+}
+async function readGitRevision(projectDir) {
+  const { stdout } = await execFileAsync2("git", ["rev-parse", "HEAD"], {
+    cwd: projectDir,
+    encoding: "utf8"
+  });
+  const revision = stdout.trim();
+  if (!revision) {
+    throw new Error("A committed Git revision is required before setup verify.");
+  }
+  return revision;
+}
+
+// src/bin/run-siteplane.ts
+async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
+  const [command, ...commandArgs] = args;
+  if (command === "init") {
+    const setupToken = readOption(commandArgs, "--setup-token");
+    const apiBaseUrl = readOption(commandArgs, "--api-base-url") ?? dependencies.env.SITEPLANE_API_BASE_URL ?? "https://app.siteplane.io";
+    if (!setupToken) {
+      throw new Error("Missing --setup-token.");
+    }
+    const result = await dependencies.commands.initCommand({
+      projectDir: dependencies.cwd(),
+      setupToken,
+      apiBaseUrl,
+      ...readOptionalVercelAutomationBypassSecret(dependencies.env)
+    });
+    dependencies.stdout(`Wrote ${result.configPath}`);
+    dependencies.stdout(`Wrote ${result.credentialsPath}`);
+    dependencies.stdout("Next steps:");
+    for (const nextStep of result.nextSteps) {
+      dependencies.stdout(`- ${nextStep}`);
+    }
+    return { exitCode: 0 };
+  }
+  if (command === "booking") {
+    return runBookingCommand(commandArgs, dependencies);
+  }
+  if (command === "analytics") {
+    return runAnalyticsCommand(commandArgs, dependencies);
+  }
+  if (command === "setup") {
+    return runSetupCommand(commandArgs, dependencies);
+  }
+  if (command === "--version" || command === "-v") {
+    dependencies.stdout(await dependencies.readPackageVersion());
+    return { exitCode: 0 };
+  }
+  if (command === "--help" || command === "-h") {
+    dependencies.stdout("Usage: siteplane <init|setup|analytics|booking>");
+    return { exitCode: 0 };
+  }
+  dependencies.stdout("Usage: siteplane <init|setup|analytics|booking>");
+  return { exitCode: 1 };
+}
+async function runAnalyticsCommand(args, dependencies) {
+  const [subcommand, ...subcommandArgs] = args;
+  const projectDir = dependencies.cwd();
+  if (!subcommand || subcommand === "--help" || subcommand === "-h") {
+    dependencies.stdout(
+      "Usage: siteplane analytics <init|check|sync|test|import>"
+    );
+    return { exitCode: subcommand ? 0 : 1 };
+  }
+  const [projectConfig, credentials] = await Promise.all([
+    dependencies.commands.readProjectConfig(projectDir),
+    dependencies.commands.readLocalCredentials(projectDir)
+  ]);
+  const config = {
+    apiBaseUrl: projectConfig.apiBaseUrl,
+    accessToken: credentials.accessToken,
+    siteId: projectConfig.siteId,
+    ...readOptionalVercelAutomationBypassSecret(dependencies.env)
+  };
+  const manifestPath = join7(projectDir, "siteplane.analytics.json");
+  if (subcommand === "init") {
+    const rawPublicKey = await dependencies.commands.analyticsPublicKeyCommand({
+      config
+    });
+    const siteKeyLookup = getAnalyticsKeyLookup(rawPublicKey);
+    if (!siteKeyLookup) {
+      throw new Error("Project config contains an invalid Analytics public site key.");
+    }
+    const agentClient = readAnalyticsAgentClient(subcommandArgs);
+    const result = await dependencies.commands.analyticsInitCommand({
+      projectDir,
+      siteId: projectConfig.siteId,
+      siteKeyRef: "env:NEXT_PUBLIC_SITEPLANE_ANALYTICS_SITE_KEY",
+      siteKeyLookup,
+      ...agentClient ? { agentClient } : {}
+    });
+    dependencies.stdout(`Wrote ${result.manifestPath}`);
+    for (const artifactPath of result.artifactPaths) {
+      dependencies.stdout(`Wrote ${artifactPath}`);
+    }
+    return { exitCode: 0 };
+  }
+  if (subcommand === "check" || subcommand === "sync") {
+    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths([], {
+      projectDir
+    });
+    const artifactFilePaths = [join7(projectDir, ".siteplane/analytics.md")];
+    const cspFilePaths = await existingPaths([
+      join7(projectDir, "next.config.js"),
+      join7(projectDir, "next.config.mjs"),
+      join7(projectDir, "next.config.ts"),
+      join7(projectDir, "middleware.ts"),
+      join7(projectDir, "src/middleware.ts")
+    ]);
+    const check = await dependencies.commands.analyticsCheckCommand({
+      manifestPath,
+      sourceFilePaths,
+      packageJsonPath: join7(projectDir, "package.json"),
+      cspFilePaths,
+      artifactFilePaths
+    });
+    if (subcommand === "check") {
+      const readinessResponse = await dependencies.commands.analyticsReadinessCommand({
+        config
+      });
+      const readiness = await readResponseJson(readinessResponse);
+      dependencies.stdout(JSON.stringify({ ...check, readiness }, null, 2));
+      return { exitCode: check.ok && readinessResponse.ok ? 0 : 1 };
+    }
+    if (!check.ok) {
+      dependencies.stdout(JSON.stringify(check, null, 2));
+      return { exitCode: 1 };
+    }
+    return printAnalyticsResponseWithReadiness(
+      await dependencies.commands.analyticsSyncCommand({
+        config,
+        manifest: check.scannedManifest
+      }),
+      config,
+      dependencies
+    );
+  }
+  if (subcommand === "test") {
+    const rawPublicKey = await dependencies.commands.analyticsPublicKeyCommand({
+      config
+    });
+    return printAnalyticsResponseWithReadiness(
+      await dependencies.commands.analyticsTestCommand({
+        config,
+        siteKey: rawPublicKey,
+        ...readOption(subcommandArgs, "--page-url") ? { pageUrl: readOption(subcommandArgs, "--page-url") } : {}
+      }),
+      config,
+      dependencies
+    );
+  }
+  if (subcommand === "import") {
+    const payload = await readPayloadFile(subcommandArgs, dependencies);
+    return printResponse(
+      await dependencies.commands.analyticsImportCommand({
+        config,
+        payload,
+        apply: subcommandArgs.includes("--apply"),
+        ...readOption(subcommandArgs, "--confirm-hash") ? { confirmHash: readOption(subcommandArgs, "--confirm-hash") } : {},
+        yes: subcommandArgs.includes("--yes")
+      }),
+      dependencies
+    );
+  }
+  dependencies.stdout(
+    "Usage: siteplane analytics <init|check|sync|test|import>"
+  );
+  return { exitCode: 1 };
+}
+async function runSetupCommand(args, dependencies) {
+  const [area, ...areaArgs] = args;
+  const projectDir = dependencies.cwd();
+  const connectionOptions = readOptionalVercelAutomationBypassSecret(
+    dependencies.env
+  );
+  if (area === "context") {
+    const result = await dependencies.commands.siteSetupContextCommand({
+      projectDir,
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "action_required" ? 1 : 0 };
+  }
+  if (area === "apply") {
+    const editorDefinition = await dependencies.readJsonFile(
+      readRequiredOption(areaArgs, "--definition")
+    );
+    const result = await dependencies.commands.siteSetupApplyCommand({
+      projectDir,
+      editorDefinition,
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "action_required" ? 1 : 0 };
+  }
+  if (area === "verify") {
+    const result = await dependencies.commands.siteSetupVerifyCommand({
+      projectDir,
+      deploymentUrl: readRequiredOption(areaArgs, "--deployment-url"),
+      wait: areaArgs.includes("--wait"),
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
+  }
+  dependencies.stdout(
+    "Usage: siteplane setup <context|apply|verify>"
+  );
+  return { exitCode: 1 };
+}
+async function runBookingCommand(args, dependencies) {
+  const [subcommand, ...subcommandArgs] = args;
+  const projectDir = dependencies.cwd();
+  const manifestPath = join7(projectDir, "siteplane.booking.json");
+  if (subcommand === "init") {
+    const siteId = readRequiredOption(subcommandArgs, "--site-id");
+    const siteKeyPrefix = readRequiredOption(
+      subcommandArgs,
+      "--site-key-prefix"
+    );
+    const bookingPageSlug = readRequiredOption(
+      subcommandArgs,
+      "--booking-page-slug"
+    );
+    const productionOrigin = readOption(subcommandArgs, "--production-origin");
+    const agentClient = readBookingAgentClient(subcommandArgs);
+    const result = await dependencies.commands.bookingInitCommand({
+      projectDir,
+      siteId,
+      siteKeyPrefix,
+      bookingPageSlug,
+      ...productionOrigin ? { productionOrigin } : {},
+      ...agentClient ? { agentClient } : {}
+    });
+    dependencies.stdout(`Wrote ${result.manifestPath}`);
+    for (const artifactPath of result.artifactPaths) {
+      dependencies.stdout(`Wrote ${artifactPath}`);
+    }
+    return { exitCode: 0 };
+  }
+  if (subcommand === "check") {
+    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths(subcommandArgs, {
+      projectDir
+    });
+    const result = await dependencies.commands.bookingCheckCommand({
+      manifestPath,
+      sourceFilePaths
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.ok ? 0 : 1 };
+  }
+  if (subcommand === "sync") {
+    const { config, manifest } = await readBookingProjectState(
+      projectDir,
+      manifestPath,
+      dependencies
+    );
+    const response = await dependencies.commands.bookingSyncCommand({
+      config,
+      manifest
+    });
+    dependencies.stdout(await response.text());
+    return { exitCode: response.ok ? 0 : 1 };
+  }
+  if (subcommand === "test") {
+    const { config, manifest } = await readBookingProjectState(
+      projectDir,
+      manifestPath,
+      dependencies
+    );
+    const customer = {
+      name: readRequiredOption(subcommandArgs, "--name"),
+      email: readRequiredOption(subcommandArgs, "--email"),
+      ...readOption(subcommandArgs, "--phone") ? { phone: readOption(subcommandArgs, "--phone") } : {},
+      ...readOption(subcommandArgs, "--note") ? { note: readOption(subcommandArgs, "--note") } : {}
+    };
+    const response = await dependencies.commands.bookingTestCommand({
+      config,
+      manifest,
+      booking: {
+        items: [
+          {
+            serviceId: readRequiredOption(subcommandArgs, "--service-id"),
+            variantId: readRequiredOption(subcommandArgs, "--variant-id")
+          }
+        ],
+        resourceId: readOption(subcommandArgs, "--resource-id") ?? null,
+        startUtc: readRequiredOption(subcommandArgs, "--start-utc"),
+        customer,
+        clientToken: readOption(subcommandArgs, "--client-token") ?? randomUUID4(),
+        paymentChoice: "onsite"
+      }
+    });
+    dependencies.stdout(await response.text());
+    return { exitCode: response.ok ? 0 : 1 };
+  }
+  dependencies.stdout(
+    "Usage: siteplane booking <init|check|sync|test>"
+  );
+  return { exitCode: 1 };
+}
+async function readBookingProjectState(projectDir, manifestPath, dependencies) {
+  const [projectConfig, credentials, bookingManifest] = await Promise.all([
+    dependencies.commands.readProjectConfig(projectDir),
+    dependencies.commands.readLocalCredentials(projectDir),
+    dependencies.commands.readBookingManifestFile(manifestPath)
+  ]);
+  return {
+    config: {
+      apiBaseUrl: projectConfig.apiBaseUrl,
+      accessToken: credentials.accessToken,
+      siteId: projectConfig.siteId,
+      ...readOptionalVercelAutomationBypassSecret(dependencies.env)
+    },
+    manifest: bookingManifest.manifest
+  };
+}
+function readOptionalVercelAutomationBypassSecret(env) {
+  const secret = env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();
+  return secret ? { vercelAutomationBypassSecret: secret } : {};
+}
+function createDefaultDependencies() {
+  return {
+    cwd: () => process.cwd(),
+    env: process.env,
+    stdout: (line) => console.log(line),
+    stderr: (line) => console.error(line),
+    readJsonFile: async (path) => JSON.parse(await readFile8(resolve(process.cwd(), path), "utf8")),
+    readPackageVersion: async () => {
+      const packageJson = JSON.parse(
+        await readFile8(new URL("../../package.json", import.meta.url), "utf8")
+      );
+      return packageJson.version;
+    },
+    commands: {
+      siteSetupApplyCommand,
+      siteSetupContextCommand,
+      siteSetupVerifyCommand,
+      initCommand,
+      bookingInitCommand,
+      bookingCheckCommand,
+      bookingSyncCommand,
+      bookingTestCommand,
+      analyticsCheckCommand,
+      analyticsImportCommand,
+      analyticsInitCommand,
+      analyticsPublicKeyCommand,
+      analyticsReadinessCommand,
+      analyticsSyncCommand,
+      analyticsTestCommand,
+      readProjectConfig,
+      readLocalCredentials,
+      readBookingManifestFile,
+      resolveScanFilePaths
+    }
+  };
+}
+function readRequiredOption(args, option) {
+  const value = readOption(args, option);
+  if (!value) {
+    throw new Error(`Missing ${option}.`);
+  }
+  return value;
+}
+function readOption(args, option) {
+  const index = args.indexOf(option);
+  return index >= 0 ? args[index + 1] : void 0;
+}
+async function readPayloadFile(args, dependencies) {
+  return dependencies.readJsonFile(readRequiredOption(args, "--file"));
+}
+async function printResponse(response, dependencies) {
+  dependencies.stdout(await response.text());
+  return { exitCode: response.ok ? 0 : 1 };
+}
+async function printAnalyticsResponseWithReadiness(response, config, dependencies) {
+  const readinessResponse = await dependencies.commands.analyticsReadinessCommand({
+    config
+  });
+  const [operation, readiness] = await Promise.all([
+    readResponseJson(response),
+    readResponseJson(readinessResponse)
+  ]);
+  dependencies.stdout(JSON.stringify({ operation, readiness }, null, 2));
+  return { exitCode: response.ok && readinessResponse.ok ? 0 : 1 };
+}
+async function readResponseJson(response) {
+  const text = await response.text();
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { ok: false, status: response.status, message: text };
+  }
+}
+async function existingPaths(paths) {
+  const existing = [];
+  for (const path of paths) {
+    try {
+      await access2(path);
+      existing.push(path);
+    } catch {
+    }
+  }
+  return existing;
+}
+function readAnalyticsAgentClient(args) {
+  const value = readOption(args, "--agent-client");
+  if (!value) return void 0;
+  if (value === "codex" || value === "claude" || value === "cursor") {
+    return value;
+  }
+  throw new Error("--agent-client must be codex, claude or cursor.");
+}
+function readBookingAgentClient(args) {
+  const value = readOption(args, "--agent-client");
+  if (!value) {
+    return void 0;
+  }
+  if (value === "codex" || value === "claude" || value === "cursor") {
+    return value;
+  }
+  throw new Error("--agent-client must be codex, claude or cursor.");
+}
+
+// src/bin/siteplane.ts
+async function main() {
+  const result = await runSiteplaneCli(process.argv.slice(2));
+  process.exitCode = result.exitCode;
+}
+await main().catch((error) => {
+  console.error(error instanceof Error ? error.message : String(error));
+  process.exitCode = 1;
+});