siteplane 0.1.36

package/dist/index.js

@@ -0,0 +1,2260 @@
+// ../cli/dist/analytics/manifest.js
+import { mkdir, readFile, writeFile } from "fs/promises";
+import { dirname } from "path";
+
+// ../shared/dist/actors.js
+import { z } from "zod";
+var ACTOR_TYPES = ["developer", "client", "agent", "system"];
+var actorTypeSchema = z.enum(ACTOR_TYPES);
+
+// ../shared/dist/analytics-defaults.js
+var ANALYTICS_BATCH_LIMITS = {
+  maxEventsPerRequest: 50,
+  maxJsonBodyBytes: 64 * 1024,
+  maxPropertiesJsonBytes: 8 * 1024
+};
+var ANALYTICS_RETENTION_DEFAULTS = {
+  enabledRawEventRetentionDays: 30,
+  higherTierRawEventRetentionDays: 90,
+  maxRawEventRetentionDaysWithoutAdr: 180,
+  diagnosticsRetentionDays: 30,
+  rateLimitBucketRetentionDays: 2,
+  lateEventWindowHours: 72
+};
+
+// ../shared/dist/analytics-booking.js
+import { z as z2 } from "zod";
+var bookingProviders = ["treatwell", "beautinda", "other"];
+var bookingAttributionModes = [
+  "outbound_click_and_utm",
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingSignalSources = [
+  "outbound_click",
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingAttributionConfidences = [
+  "provider_redirect",
+  "provider_reported",
+  "manual_import",
+  "verified_webhook"
+];
+var bookingProviderSchema = z2.enum(bookingProviders);
+var bookingAttributionModeSchema = z2.enum(bookingAttributionModes);
+var bookingSignalSourceSchema = z2.enum(bookingSignalSources);
+var bookingAttributionConfidenceSchema = z2.enum(bookingAttributionConfidences);
+var bookingProviderHintSchema = z2.object({
+  bookingProvider: bookingProviderSchema,
+  bookingUrlHost: z2.string().min(1).max(253),
+  bookingAttributionMode: bookingAttributionModeSchema,
+  utmContent: z2.string().min(1).max(200).optional(),
+  successCondition: z2.literal("redirect_status=succeeded").optional()
+}).superRefine((hint, context) => {
+  if (hint.successCondition !== void 0 && hint.bookingAttributionMode !== "provider_redirect") {
+    context.addIssue({
+      code: "custom",
+      message: "successCondition is allowed only for provider_redirect booking hints.",
+      path: ["successCondition"]
+    });
+  }
+});
+
+// ../shared/dist/analytics-contract.js
+import { z as z3 } from "zod";
+var ANALYTICS_CONTRACT_VERSION = "analytics-contract.v1";
+var ANALYTICS_CONTRACT_HASH = "sha256:a91bddcc3c5e4196933b0335d03eaf41ff929cb736bdd694fe54d07ab52dada1";
+var ANALYTICS_IMPORT_SCHEMA_VERSION = "analytics-provider-import.v1";
+var analyticsImportTargetIdSchema = z3.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u);
+var analyticsProviderImportRowSchema = z3.object({
+  targetId: analyticsImportTargetIdSchema,
+  occurredAt: z3.string().datetime({ offset: true }),
+  attributionConfidence: z3.enum(["provider_reported", "manual_import"]),
+  providerEventId: z3.string().trim().min(1).max(160).optional(),
+  idempotencyKey: z3.string().trim().min(1).max(160).optional()
+}).strict().superRefine((row, context) => {
+  if (!row.providerEventId && !row.idempotencyKey) {
+    context.addIssue({
+      code: "custom",
+      message: "Each import row requires providerEventId or idempotencyKey.",
+      path: ["providerEventId"]
+    });
+  }
+});
+var analyticsProviderImportSchema = z3.object({
+  schemaVersion: z3.literal(ANALYTICS_IMPORT_SCHEMA_VERSION),
+  provider: z3.enum(["treatwell", "beautinda", "other"]),
+  sourceName: z3.string().trim().min(1).max(160).optional(),
+  rows: z3.array(analyticsProviderImportRowSchema).min(1).max(1e3)
+}).strict();
+
+// ../shared/dist/analytics-events.js
+import { z as z4 } from "zod";
+var ANALYTICS_SCHEMA_VERSION = "analytics.v1";
+var analyticsSessionIdSchema = z4.string().regex(/^cpa_s_[a-f0-9]{32}$/u);
+var analyticsVisitorIdSchema = z4.string().regex(/^cpa_v_[a-f0-9]{32}$/u);
+var analyticsPersistedIdentityHashSchema = z4.string().regex(/^[a-f0-9]{64}$/u);
+var analyticsEventNames = [
+  "page_view",
+  "section_view",
+  "cta_click",
+  "outbound_click",
+  "email_click",
+  "phone_click",
+  "file_download",
+  "form_start",
+  "form_submit",
+  "form_error",
+  "lead_created",
+  "checkout_started",
+  "conversion",
+  "checkout_completed",
+  "payment_succeeded",
+  "subscription_started",
+  "purchase_completed",
+  "trial_started"
+];
+var serverOnlyAnalyticsEvents = [
+  "checkout_completed",
+  "payment_succeeded",
+  "subscription_started",
+  "purchase_completed",
+  "trial_started"
+];
+var analyticsEventSources = [
+  "browser",
+  "server",
+  "test",
+  "editor_preview",
+  "system"
+];
+var analyticsIngestionChannels = [
+  "browser_collector",
+  "server_sdk",
+  "provider_endpoint",
+  "provider_import",
+  "test",
+  "editor_preview",
+  "system_job"
+];
+var analyticsTargetTypes = [
+  "cta",
+  "form",
+  "section",
+  "file",
+  "link",
+  "conversion",
+  "server_conversion"
+];
+var analyticsDataAttributeEvents = [
+  "cta_click",
+  "outbound_click",
+  "email_click",
+  "phone_click",
+  "file_download",
+  "section_view",
+  "checkout_started",
+  "form"
+];
+var analyticsDeviceTypes = [
+  "desktop",
+  "tablet",
+  "mobile",
+  "unknown"
+];
+var analyticsBotClassifications = [
+  "normal",
+  "known_bot",
+  "suspicious",
+  "invalid"
+];
+var analyticsValidityStatuses = [
+  "accepted",
+  "rejected",
+  "ignored"
+];
+var analyticsEventNameSchema = z4.enum(analyticsEventNames);
+var serverOnlyAnalyticsEventSchema = z4.enum(serverOnlyAnalyticsEvents);
+var analyticsEventSourceSchema = z4.enum(analyticsEventSources);
+var analyticsIngestionChannelSchema = z4.enum(analyticsIngestionChannels);
+var analyticsTargetTypeSchema = z4.enum(analyticsTargetTypes);
+var analyticsDataAttributeEventSchema = z4.enum(analyticsDataAttributeEvents);
+var analyticsDeviceTypeSchema = z4.enum(analyticsDeviceTypes);
+var analyticsBotClassificationSchema = z4.enum(analyticsBotClassifications);
+var analyticsValidityStatusSchema = z4.enum(analyticsValidityStatuses);
+var analyticsPropertiesSchema = z4.record(z4.string(), z4.unknown());
+var analyticsTimestampSchema = z4.string().datetime({ offset: true });
+var analyticsBrowserEventSchema = z4.object({
+  eventId: z4.string().min(1).max(160),
+  eventName: analyticsEventNameSchema,
+  eventSource: analyticsEventSourceSchema.optional().default("browser"),
+  targetId: z4.string().min(1).max(160).optional(),
+  targetType: analyticsTargetTypeSchema.optional(),
+  visitorId: analyticsVisitorIdSchema.optional(),
+  sessionId: analyticsSessionIdSchema,
+  idempotencyKey: z4.string().min(1).max(240).optional(),
+  occurredAt: analyticsTimestampSchema,
+  pageUrl: z4.string().url().max(2048).optional(),
+  pagePath: z4.string().min(1).max(1024).optional(),
+  routeTemplate: z4.string().min(1).max(1024).optional(),
+  referrer: z4.string().url().max(2048).optional(),
+  utmSource: z4.string().min(1).max(200).optional(),
+  utmMedium: z4.string().min(1).max(200).optional(),
+  utmCampaign: z4.string().min(1).max(200).optional(),
+  utmContent: z4.string().min(1).max(200).optional(),
+  utmTerm: z4.string().min(1).max(200).optional(),
+  deviceType: analyticsDeviceTypeSchema.optional(),
+  browserName: z4.string().min(1).max(120).optional(),
+  osName: z4.string().min(1).max(120).optional(),
+  country: z4.string().min(1).max(80).optional(),
+  region: z4.string().min(1).max(120).optional(),
+  properties: analyticsPropertiesSchema.optional().default({})
+}).superRefine((event, context) => {
+  if (isServerOnlyAnalyticsEvent(event.eventName)) {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot contain server-only events.",
+      path: ["eventName"]
+    });
+  }
+  if (event.eventSource === "server" || event.eventSource === "system") {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot use server/system sources.",
+      path: ["eventSource"]
+    });
+  }
+  if (event.targetType === "server_conversion") {
+    context.addIssue({
+      code: "custom",
+      message: "Browser analytics payloads cannot use server conversion targets.",
+      path: ["targetType"]
+    });
+  }
+});
+var analyticsBrowserEventPayloadSchema = z4.object({
+  siteKey: z4.string().min(1),
+  schemaVersion: z4.literal(ANALYTICS_SCHEMA_VERSION),
+  mode: z4.enum(["live", "test"]).optional().default("live"),
+  events: z4.array(analyticsBrowserEventSchema).min(1).max(50)
+});
+var analyticsNormalizedEventBaseSchema = z4.object({
+  site_id: z4.string().uuid(),
+  event_id: z4.string().min(1).max(160),
+  schema_version: z4.literal(ANALYTICS_SCHEMA_VERSION),
+  event_name: analyticsEventNameSchema,
+  event_source: analyticsEventSourceSchema,
+  ingestion_channel: analyticsIngestionChannelSchema,
+  target_id: z4.string().min(1).max(160).nullable().optional(),
+  target_type: analyticsTargetTypeSchema.nullable().optional(),
+  dedupe_key: z4.string().regex(/^analytics_dedupe_v1_[a-f0-9]{64}$/u).nullable().optional(),
+  idempotency_key: z4.string().min(1).max(240).nullable().optional(),
+  bot_classification: analyticsBotClassificationSchema,
+  validity_status: analyticsValidityStatusSchema,
+  rejection_reason: z4.string().min(1).max(240).nullable().optional(),
+  occurred_at: analyticsTimestampSchema,
+  received_at: analyticsTimestampSchema,
+  page_url: z4.string().url().max(2048).nullable().optional(),
+  page_path: z4.string().min(1).max(1024).nullable().optional(),
+  route_template: z4.string().min(1).max(1024).nullable().optional(),
+  referrer: z4.string().url().max(2048).nullable().optional(),
+  utm_source: z4.string().min(1).max(200).nullable().optional(),
+  utm_medium: z4.string().min(1).max(200).nullable().optional(),
+  utm_campaign: z4.string().min(1).max(200).nullable().optional(),
+  utm_content: z4.string().min(1).max(200).nullable().optional(),
+  utm_term: z4.string().min(1).max(200).nullable().optional(),
+  country: z4.string().min(1).max(80).nullable().optional(),
+  region: z4.string().min(1).max(120).nullable().optional(),
+  device_type: analyticsDeviceTypeSchema,
+  browser_name: z4.string().min(1).max(120).nullable().optional(),
+  os_name: z4.string().min(1).max(120).nullable().optional(),
+  provider: z4.string().min(1).max(120).nullable().optional(),
+  provider_event_id: z4.string().min(1).max(240).nullable().optional(),
+  properties: analyticsPropertiesSchema
+});
+var analyticsRawNormalizedEventSchema = analyticsNormalizedEventBaseSchema.extend({
+  visitor_id: analyticsVisitorIdSchema.nullable().optional(),
+  session_id: analyticsSessionIdSchema.nullable().optional()
+});
+var analyticsNormalizedEventSchema = analyticsNormalizedEventBaseSchema.extend({
+  visitor_id: analyticsPersistedIdentityHashSchema.nullable().optional(),
+  session_id: analyticsPersistedIdentityHashSchema.nullable().optional()
+});
+function isServerOnlyAnalyticsEvent(eventName) {
+  return serverOnlyAnalyticsEvents.includes(eventName);
+}
+
+// ../shared/dist/analytics-manifest.js
+import { z as z5 } from "zod";
+var analyticsTargetIdSchema = z5.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u, {
+  message: "Analytics target IDs must be stable identifiers without whitespace or visible copy."
+});
+var analyticsManifestRecordSchema = z5.record(z5.string(), z5.unknown());
+var analyticsFormPurposes = [
+  "contact",
+  "lead",
+  "newsletter",
+  "search",
+  "login",
+  "other"
+];
+var analyticsFormPurposeSchema = z5.enum(analyticsFormPurposes);
+var analyticsManifestRouteSchema = z5.object({
+  path: z5.string().min(1).max(1024),
+  pageType: z5.string().min(1).max(120).optional(),
+  label: z5.string().min(1).max(200).optional()
+}).passthrough();
+var analyticsManifestTargetSchema = z5.object({
+  id: analyticsTargetIdSchema,
+  type: analyticsTargetTypeSchema,
+  event: analyticsEventNameSchema.optional(),
+  events: z5.array(analyticsEventNameSchema).min(1).max(20).optional(),
+  route: z5.string().min(1).max(1024).optional(),
+  label: z5.string().min(1).max(200).optional(),
+  description: z5.string().min(1).max(1e3).optional(),
+  autoActive: z5.boolean().optional(),
+  sourceHints: analyticsManifestRecordSchema.optional()
+}).passthrough().superRefine((target, context) => {
+  if (target.event === void 0 && target.events === void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics targets require event or events.",
+      path: ["event"]
+    });
+  }
+  if (target.event !== void 0 && target.events !== void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics targets must use event or events, never both.",
+      path: ["events"]
+    });
+  }
+  if (target.type === "form" && !analyticsFormPurposeSchema.safeParse(target.sourceHints?.formPurpose).success) {
+    context.addIssue({
+      code: "custom",
+      message: "Analytics form targets require a typed sourceHints.formPurpose.",
+      path: ["sourceHints", "formPurpose"]
+    });
+  }
+});
+var analyticsManifestSchema = z5.object({
+  schemaVersion: z5.literal(ANALYTICS_SCHEMA_VERSION),
+  siteId: z5.string().min(1),
+  siteKeyRef: z5.string().regex(/^env:[A-Z][A-Z0-9_]*$/u, {
+    message: "siteKeyRef must be an environment-variable reference."
+  }),
+  siteKeyLookup: z5.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}$/),
+  routes: z5.array(analyticsManifestRouteSchema),
+  targets: z5.array(analyticsManifestTargetSchema),
+  metadata: analyticsManifestRecordSchema.optional(),
+  siteKey: z5.string().optional(),
+  secretKey: z5.string().optional(),
+  rawKey: z5.string().optional(),
+  token: z5.string().optional(),
+  accessToken: z5.string().optional()
+}).passthrough().superRefine((manifest, context) => {
+  const targetIds = /* @__PURE__ */ new Set();
+  for (const [index, target] of manifest.targets.entries()) {
+    if (targetIds.has(target.id)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate analytics target ID: ${target.id}`,
+        path: ["targets", index, "id"]
+      });
+    }
+    targetIds.add(target.id);
+  }
+  for (const issue of findUnsafeSecretReferences(manifest)) {
+    context.addIssue({
+      code: "custom",
+      message: "Raw secret material is not allowed in analytics manifests.",
+      path: issue
+    });
+  }
+});
+var secretValuePattern = /(?:\bsk_(?:live|test)_|\bcpb_|\bpmt_(?:pc|setup|cli)_|\bservice_role\b|bearer\s+[a-z0-9._~-]+)/iu;
+function findUnsafeSecretReferences(value, path = []) {
+  if (Array.isArray(value)) {
+    return value.flatMap((item, index) => findUnsafeSecretReferences(item, [...path, index]));
+  }
+  if (!isPlainRecord(value)) {
+    return [];
+  }
+  return Object.entries(value).flatMap(([key, childValue]) => {
+    const childPath = [...path, key];
+    const referenceLikeKey = /(?:ref|lookup|prefix)$/iu.test(key);
+    const unsafeHere = referenceLikeKey && typeof childValue === "string" && secretValuePattern.test(childValue);
+    return [
+      ...unsafeHere ? [childPath] : [],
+      ...findUnsafeSecretReferences(childValue, childPath)
+    ];
+  });
+}
+function isPlainRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+
+// ../shared/dist/analytics-metrics.js
+import { z as z6 } from "zod";
+var analyticsVisitorQualities = ["exact", "estimated"];
+var analyticsVisitorQualitySchema = z6.enum(analyticsVisitorQualities);
+var analyticsKpiKeys = [
+  "pageViews",
+  "sessions",
+  "visitors",
+  "estimatedVisitors",
+  "inquiries",
+  "leads",
+  "conversions",
+  "conversionRate",
+  "inquiryRate"
+];
+var analyticsKpiKeySchema = z6.enum(analyticsKpiKeys);
+
+// ../shared/dist/analytics-privacy.js
+var serverPropertySchemas = {
+  lead_created: {
+    conversionId: "identifier",
+    formId: "identifier",
+    formType: "enum",
+    customerRef: "identifier"
+  },
+  conversion: {
+    conversionId: "identifier",
+    conversionType: "enum",
+    attributionConfidence: "enum",
+    bookingSignalSource: "enum",
+    bookingProvider: "enum",
+    redirectStatus: "enum",
+    importId: "identifier"
+  },
+  checkout_completed: revenuePropertySchema(),
+  payment_succeeded: revenuePropertySchema(),
+  subscription_started: revenuePropertySchema(),
+  purchase_completed: revenuePropertySchema(),
+  trial_started: revenuePropertySchema()
+};
+function revenuePropertySchema() {
+  return {
+    conversionId: "identifier",
+    checkoutId: "identifier",
+    customerRef: "identifier",
+    amount: "amount",
+    currency: "enum",
+    planId: "identifier",
+    productId: "identifier"
+  };
+}
+
+// ../shared/dist/assets.js
+import { z as z7 } from "zod";
+var ASSET_STAGES = ["staging", "final", "deleted"];
+var ASSET_VISIBILITIES = ["private", "public", "deleted"];
+var ASSET_USAGE_ENTITY_TYPES = [
+  "branding",
+  "draft",
+  "change_set",
+  "published_value"
+];
+var assetStageSchema = z7.enum(ASSET_STAGES);
+var assetVisibilitySchema = z7.enum(ASSET_VISIBILITIES);
+var assetUsageEntityTypeSchema = z7.enum(ASSET_USAGE_ENTITY_TYPES);
+var brandingAccentColorSchema = z7.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/);
+
+// ../shared/dist/booking-contracts.js
+import { z as z8 } from "zod";
+var bookingStatuses = [
+  "pending_payment",
+  "confirmed",
+  "payment_expired",
+  "cancelled",
+  "no_show"
+];
+var bookingPaymentStatuses = [
+  "payment_not_required",
+  "checkout_open",
+  "processing",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "expired"
+];
+var bookingAccountReadinessStatuses = [
+  "not_started",
+  "setup_required",
+  "under_review",
+  "payments_ready",
+  "payouts_restricted",
+  "payments_restricted",
+  "deactivated"
+];
+var bookingRefundStatuses = [
+  "none",
+  "pending",
+  "partially_refunded",
+  "refunded",
+  "failed"
+];
+var bookingDisputeStatuses = [
+  "none",
+  "needs_response",
+  "under_review",
+  "won",
+  "lost"
+];
+var bookingPaymentModes = [
+  "onsite_only",
+  "online_required",
+  "customer_choice"
+];
+var bookingPaymentCollectionTypes = [
+  "full_amount",
+  "deposit_percent"
+];
+var bookingResourceKinds = [
+  "person",
+  "room",
+  "equipment",
+  "other"
+];
+var bookingStatusSchema = z8.enum(bookingStatuses);
+var bookingPaymentStatusSchema = z8.enum(bookingPaymentStatuses);
+var bookingAccountReadinessStatusSchema = z8.enum(bookingAccountReadinessStatuses);
+var bookingRefundStatusSchema = z8.enum(bookingRefundStatuses);
+var bookingDisputeStatusSchema = z8.enum(bookingDisputeStatuses);
+var bookingPaymentModeSchema = z8.enum(bookingPaymentModes);
+var bookingPaymentCollectionTypeSchema = z8.enum(bookingPaymentCollectionTypes);
+var bookingPaymentCollectionSchema = z8.discriminatedUnion("type", [
+  z8.object({ type: z8.literal("full_amount") }).strict(),
+  z8.object({
+    type: z8.literal("deposit_percent"),
+    depositPercent: z8.number().int().min(10).max(90)
+  }).strict()
+]);
+var bookingPaymentChoices = ["onsite", "online"];
+var bookingPaymentChoiceSchema = z8.enum(bookingPaymentChoices);
+var bookingPaymentSnapshotSchema = z8.object({
+  snapshotId: z8.string().uuid(),
+  snapshotVersion: z8.number().int().positive(),
+  currency: z8.literal("EUR"),
+  totalAmountCents: z8.number().int().min(0),
+  onlineAmountCents: z8.number().int().min(0),
+  onsiteRemainderCents: z8.number().int().min(0),
+  maxStripeRefundAmountCents: z8.number().int().min(0)
+}).strict().superRefine((snapshot, context) => {
+  if (snapshot.onlineAmountCents + snapshot.onsiteRemainderCents !== snapshot.totalAmountCents) {
+    context.addIssue({
+      code: "custom",
+      message: "Payment snapshot amounts must add up to the total amount."
+    });
+  }
+  if (snapshot.maxStripeRefundAmountCents > snapshot.onlineAmountCents) {
+    context.addIssue({
+      code: "custom",
+      message: "Stripe refund basis cannot exceed the online amount."
+    });
+  }
+});
+var bookingServiceVariantSchema = z8.object({
+  id: z8.string().uuid(),
+  name: z8.string().trim().min(1).max(120),
+  durationMinutes: z8.number().int().min(1).max(1440),
+  priceCents: z8.number().int().min(0).nullable()
+}).strict();
+var bookingServiceVariantsSchema = z8.array(bookingServiceVariantSchema).min(1).max(20);
+var isoDateSchema = z8.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var utcDateTimeSchema = z8.string().datetime();
+var bookingLocalTimeSchema = z8.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/);
+var bookingAvailabilityIntervalsSchema = z8.array(z8.object({
+  start: bookingLocalTimeSchema,
+  end: bookingLocalTimeSchema
+}).strict().refine((interval) => interval.end > interval.start)).superRefine((intervals, context) => {
+  const sorted = [...intervals].sort((left, right) => left.start.localeCompare(right.start));
+  for (let index = 1; index < sorted.length; index += 1) {
+    if (sorted[index].start < sorted[index - 1].end) {
+      context.addIssue({
+        code: "custom",
+        message: "Booking availability intervals must not overlap."
+      });
+      return;
+    }
+  }
+});
+var bookingPublicConfigSchema = z8.object({
+  site: z8.object({
+    name: z8.string().trim().min(1),
+    timezone: z8.string().trim().min(1),
+    locale: z8.string().trim().min(2),
+    bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+    privacyUrl: z8.string().url().nullable()
+  }),
+  branding: z8.object({
+    logoUrl: z8.string().url().nullable(),
+    accentColor: z8.string().trim().min(1).nullable()
+  }),
+  settings: z8.object({
+    slotIntervalMinutes: z8.number().int().positive(),
+    minLeadMinutes: z8.number().int().min(0),
+    maxAdvanceDays: z8.number().int().min(1),
+    requirePhone: z8.boolean(),
+    collectNote: z8.boolean(),
+    confirmationMessage: z8.string().nullable()
+  }),
+  /** Freitexte des Salons, im Kassen-Schritt vor der Bestaetigung sichtbar. */
+  policies: z8.object({
+    cancellation: z8.string().nullable(),
+    lateArrival: z8.string().nullable()
+  }),
+  payment: z8.object({
+    mode: bookingPaymentModeSchema,
+    collection: bookingPaymentCollectionSchema,
+    onlinePaymentsReady: z8.boolean()
+  }).strict(),
+  serviceCategories: z8.array(z8.object({
+    id: z8.string().uuid(),
+    name: z8.string().trim().min(1),
+    sortOrder: z8.number().int()
+  })),
+  serviceSubcategories: z8.array(z8.object({
+    id: z8.string().uuid(),
+    categoryId: z8.string().uuid(),
+    name: z8.string().trim().min(1),
+    sortOrder: z8.number().int()
+  })),
+  services: z8.array(z8.object({
+    id: z8.string().trim().min(1),
+    name: z8.string().trim().min(1),
+    durationMinutes: z8.number().int().positive(),
+    priceCents: z8.number().int().min(0).nullable(),
+    currency: z8.string().regex(/^[A-Z]{3}$/),
+    description: z8.string().nullable(),
+    categoryId: z8.string().uuid(),
+    subcategoryId: z8.string().uuid().nullable(),
+    variants: bookingServiceVariantsSchema,
+    allowsAnyResource: z8.boolean(),
+    sortOrder: z8.number().int()
+  })),
+  resources: z8.array(z8.object({
+    id: z8.string().trim().min(1),
+    name: z8.string().trim().min(1),
+    kind: z8.enum(bookingResourceKinds)
+  })),
+  serviceResources: z8.array(z8.object({
+    serviceId: z8.string().trim().min(1),
+    resourceId: z8.string().trim().min(1)
+  }))
+});
+var bookingItemSchema = z8.object({
+  serviceId: z8.string().trim().min(1),
+  variantId: z8.string().trim().min(1)
+}).strict();
+var bookingItemsSchema = z8.array(bookingItemSchema).min(1).max(10);
+function parseBookingItemsParam(value) {
+  const items = value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "").map((entry) => {
+    const [serviceId, variantId, ...rest] = entry.split(":");
+    return serviceId && variantId && rest.length === 0 ? { serviceId, variantId } : null;
+  });
+  return items.every((item) => item !== null) ? items : null;
+}
+var bookingSlotsQuerySchema = z8.object({
+  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z8.string().trim().min(1).optional(),
+  fromDate: isoDateSchema,
+  toDate: isoDateSchema
+});
+var bookingSlotsResponseSchema = z8.object({
+  timezone: z8.string().trim().min(1),
+  items: bookingItemsSchema,
+  // Reine Behandlungsdauer ohne Puffer: das UI zeigt damit die Terminspanne,
+  // ohne selbst rechnen zu muessen.
+  totalDurationMinutes: z8.number().int().min(1),
+  mode: z8.enum(["any", "resource"]),
+  slots: z8.array(z8.object({
+    startUtc: utcDateTimeSchema,
+    resourceId: z8.string().trim().min(1).optional()
+  }))
+});
+var bookingAvailabilityQuerySchema = z8.object({
+  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z8.string().trim().min(1).optional(),
+  fromDate: isoDateSchema,
+  toDate: isoDateSchema
+});
+var bookingAvailabilityResponseSchema = z8.object({
+  timezone: z8.string().trim().min(1),
+  totalDurationMinutes: z8.number().int().min(1),
+  days: z8.array(z8.object({
+    date: isoDateSchema,
+    hasSlots: z8.boolean()
+  })),
+  /** Erster Tag mit Slot ab `fromDate`, auch ausserhalb des Fensters. */
+  nextAvailableDate: isoDateSchema.nullable()
+});
+var bookingPublicErrorCodes = [
+  "slot_unavailable",
+  "validation_error",
+  "origin_not_allowed",
+  "invalid_key",
+  "rate_limited",
+  "payment_required",
+  "payment_unavailable",
+  "payment_amount_too_small",
+  "already_cancelled",
+  "too_late",
+  "not_found"
+];
+var bookingPublicErrorSchema = z8.object({
+  error: z8.enum(bookingPublicErrorCodes),
+  message: z8.string().optional(),
+  requestId: z8.string().optional()
+}).strict();
+var bookingCreateRequestSchema = z8.object({
+  items: bookingItemsSchema,
+  resourceId: z8.string().min(1).nullable(),
+  startUtc: utcDateTimeSchema,
+  customer: z8.object({
+    name: z8.string().min(1).max(120),
+    email: z8.string().email().max(254),
+    phone: z8.string().max(32).optional(),
+    note: z8.string().max(1e3).optional()
+  }).strict(),
+  hp: z8.string().optional(),
+  clientToken: z8.string().uuid(),
+  paymentChoice: bookingPaymentChoiceSchema,
+  // Werbe-Einwilligung. Bestaetigung, Erinnerung und Storno-Link sind davon
+  // unabhaengig und werden immer versendet.
+  consent: z8.object({
+    marketingEmail: z8.boolean(),
+    marketingSms: z8.boolean()
+  }).strict().optional()
+}).strict();
+var bookingPublicPaymentResponseSchema = z8.object({
+  clientSecret: z8.string().min(1),
+  stripeAccountId: z8.string().startsWith("acct_")
+}).strict();
+var bookingCreateResponseSchema = z8.union([
+  z8.object({
+    status: z8.literal("confirmed"),
+    booking: z8.object({
+      id: z8.string().min(1),
+      startUtc: utcDateTimeSchema,
+      endUtc: utcDateTimeSchema,
+      timezone: z8.string().trim().min(1),
+      serviceName: z8.string().trim().min(1),
+      resourceName: z8.string().trim().min(1)
+    }).strict(),
+    manageUrl: z8.string().url(),
+    confirmationMessage: z8.string().nullable()
+  }).strict(),
+  z8.object({
+    status: z8.literal("pending_payment"),
+    bookingId: z8.string().min(1),
+    holdExpiresAt: utcDateTimeSchema,
+    payment: bookingPublicPaymentResponseSchema,
+    statusToken: z8.string().min(20),
+    manageUrl: z8.string().url().optional()
+  }).strict(),
+  bookingPublicErrorSchema
+]);
+var bookingStatusResponseSchema = z8.object({
+  bookingStatus: bookingStatusSchema,
+  paymentStatus: bookingPaymentStatusSchema,
+  refundStatus: bookingRefundStatusSchema,
+  disputeStatus: bookingDisputeStatusSchema,
+  holdExpiresAt: utcDateTimeSchema.nullable()
+}).strict();
+var bookingCancelRequestSchema = z8.object({
+  token: z8.string().min(20)
+});
+var bookingCancelResponseSchema = z8.union([
+  z8.object({
+    status: z8.enum(["cancelled", "already_cancelled", "too_late", "not_found"])
+  }),
+  bookingPublicErrorSchema
+]);
+var bookingMoveErrorCodes = [
+  "slot_unavailable",
+  "booking_not_movable",
+  "not_found"
+];
+var bookingMoveRequestSchema = z8.object({
+  bookingId: z8.string().uuid(),
+  newStartUtc: utcDateTimeSchema,
+  newResourceId: z8.string().uuid().optional(),
+  notifyCustomer: z8.boolean().default(false),
+  reason: z8.string().max(500).optional()
+});
+var bookingMoveResponseSchema = z8.union([
+  z8.object({
+    status: z8.literal("moved"),
+    bookingId: z8.string().uuid(),
+    startUtc: utcDateTimeSchema,
+    endUtc: utcDateTimeSchema,
+    resourceId: z8.string().uuid()
+  }),
+  z8.object({
+    error: z8.enum(bookingMoveErrorCodes),
+    message: z8.string().optional(),
+    requestId: z8.string().optional()
+  })
+]);
+var bookingManifestSchema = z8.object({
+  schemaVersion: z8.number().int().positive(),
+  siteId: z8.string().trim().min(1),
+  siteKeyPrefix: z8.string().startsWith("bk_pub_"),
+  bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+  embedMode: z8.enum(["script", "web_component", "iframe"]).optional(),
+  productionOrigin: z8.string().url().optional()
+}).passthrough();
+var secretManifestKeys = /* @__PURE__ */ new Set([
+  "siteKey",
+  "rawKey",
+  "token",
+  "accessToken"
+]);
+function redactBookingManifest(value) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactBookingManifest(item));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).filter(([key]) => !secretManifestKeys.has(key)).map(([key, item]) => [key, redactBookingManifest(item)]));
+  }
+  return value;
+}
+
+// ../shared/dist/booking-defaults.js
+var BOOKING_CREATE_PAYLOAD_LIMIT_BYTES = 16 * 1024;
+
+// ../shared/dist/bridge-protocol.js
+import { z as z15 } from "zod";
+
+// ../shared/dist/field-id.js
+import { z as z9 } from "zod";
+var FIELD_ID_PATTERN = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$/;
+var fieldIdSchema = z9.string().regex(FIELD_ID_PATTERN, "Invalid field id");
+
+// ../shared/dist/field-types.js
+import { z as z10 } from "zod";
+var FIELD_TYPES = ["text", "longText", "image", "link"];
+var fieldTypeSchema = z10.enum(FIELD_TYPES);
+
+// ../shared/dist/image-value.js
+import { z as z11 } from "zod";
+var SUPPORTED_IMAGE_CONTENT_TYPES = [
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "image/avif"
+];
+var maxImageUploadBytes = 10 * 1024 * 1024;
+var largeImageWarningBytes = 2 * 1024 * 1024;
+var imageContentTypeSchema = z11.enum(SUPPORTED_IMAGE_CONTENT_TYPES);
+var imageCropSchema = z11.object({
+  x: z11.number().min(0).max(100),
+  y: z11.number().min(0).max(100),
+  zoom: z11.number().min(1).max(4),
+  aspectRatio: z11.number().positive().max(10)
+});
+var imageValueSchema = z11.object({
+  src: z11.string().trim().min(1),
+  alt: z11.string().trim().min(1).max(300),
+  width: z11.number().int().positive().optional(),
+  height: z11.number().int().positive().optional(),
+  crop: imageCropSchema.optional(),
+  assetId: z11.string().uuid().optional(),
+  finalStorageProvider: z11.enum([
+    "repo_static_assets",
+    "repo_handoff",
+    "site_owned_storage",
+    "siteplane_managed_fallback"
+  ]).optional()
+});
+
+// ../shared/dist/site-setup.js
+import { z as z14 } from "zod";
+
+// ../shared/dist/site-field-contract.js
+import { z as z13 } from "zod";
+
+// ../shared/dist/fallback-hash.js
+import { z as z12 } from "zod";
+var SAFE_REPRESENTATION_REASONS = [
+  "asset_import_rewritten",
+  "relative_url_normalized",
+  "line_endings_normalized",
+  "image_value_serialized"
+];
+var safeRepresentationReasonSchema = z12.enum(SAFE_REPRESENTATION_REASONS);
+var linkFallbackSchema = z12.object({
+  href: z12.string().trim().min(1),
+  label: z12.string().trim().min(1).optional(),
+  target: z12.enum(["_self", "_blank"]).optional()
+}).passthrough();
+function stableJsonStringify(value) {
+  return JSON.stringify(sortObjectKeys(value));
+}
+function sortObjectKeys(value) {
+  if (Array.isArray(value)) {
+    return value.map(sortObjectKeys);
+  }
+  if (!value || typeof value !== "object") {
+    return value;
+  }
+  return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)).map(([key, entryValue]) => [key, sortObjectKeys(entryValue)]));
+}
+
+// ../shared/dist/site-field-contract.js
+var siteFieldStatusSchema = z13.enum(["hidden", "active"]);
+var semanticVersionSchema = z13.string().regex(/^\d+\.\d+\.\d+$/u);
+var siteFieldRouteKeySchema = z13.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
+var repositoryRelativePosixPathSchema = z13.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
+var sourceMappingSchema = z13.object({
+  kind: z13.literal("function"),
+  filePath: repositoryRelativePosixPathSchema,
+  exportName: z13.string().trim().min(1).optional(),
+  sourcePath: z13.string().trim().min(1).optional(),
+  editTarget: fieldIdSchema.optional()
+}).strict();
+var domMappingSchema = z13.object({
+  attribute: z13.literal("data-siteplane-field-id"),
+  previewStrategy: z13.enum(["dom", "event"])
+}).strict();
+var fieldBaseSchema = z13.object({
+  fieldId: fieldIdSchema,
+  routeKey: siteFieldRouteKeySchema,
+  source: sourceMappingSchema,
+  dom: domMappingSchema.optional()
+}).strict();
+var linkFallbackSchema2 = z13.object({
+  href: z13.string().trim().min(1),
+  label: z13.string().trim().min(1).optional(),
+  target: z13.enum(["_self", "_blank"]).optional()
+}).strict();
+var imageFallbackSchema = z13.object({
+  src: z13.string().trim().min(1),
+  alt: z13.string().trim().max(300),
+  width: z13.number().int().positive().optional(),
+  height: z13.number().int().positive().optional(),
+  crop: z13.object({
+    x: z13.number().min(0).max(100),
+    y: z13.number().min(0).max(100),
+    zoom: z13.number().min(1).max(4),
+    aspectRatio: z13.number().positive().max(10)
+  }).strict().optional()
+}).strict();
+var siteFieldContractFieldSchema = z13.discriminatedUnion("fieldType", [
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("text"),
+    fallback: z13.string()
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("longText"),
+    fallback: z13.string()
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("link"),
+    fallback: linkFallbackSchema2
+  }),
+  fieldBaseSchema.extend({
+    fieldType: z13.literal("image"),
+    fallback: imageFallbackSchema
+  })
+]);
+var siteFieldContractV1Schema = z13.object({
+  version: z13.literal(1),
+  fieldContractVersion: semanticVersionSchema,
+  scannerContractVersion: semanticVersionSchema,
+  fields: z13.array(siteFieldContractFieldSchema)
+}).strict().superRefine((contract, context) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, field] of contract.fields.entries()) {
+    if (seen.has(field.fieldId)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate field id: ${field.fieldId}`,
+        path: ["fields", index, "fieldId"]
+      });
+    }
+    seen.add(field.fieldId);
+  }
+});
+
+// ../shared/dist/site-setup.js
+var SITE_SETUP_RUN_STATUSES = [
+  "waiting_for_agent",
+  "working",
+  "action_required",
+  "ready_for_review",
+  "completed"
+];
+var SITE_SETUP_RUN_MODES = ["initial", "update"];
+var SITE_SETUP_ERROR_CODES = [
+  "action_required",
+  "deployment_evidence_required",
+  "field_contract_scan_failed",
+  "invalid_editor_definition",
+  "invalid_field_contract",
+  "missing_build_revision",
+  "missing_field_contract",
+  "review_locked",
+  "stale_deployment_contract",
+  "stale_field_contract",
+  "stale_setup_review",
+  "update_required"
+];
+var CONTINUE_SITE_SETUP_MAX_ITEMS = 50;
+var CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES = 512;
+var CONTINUE_SITE_SETUP_VISIBLE_VALUE_MAX_BYTES = 256;
+var CONTINUE_SITE_SETUP_LOCATOR_HINT_MAX_BYTES = 512;
+var CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES = 32 * 1024;
+var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
+var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
+var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
+var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
+var editorFieldSchema = z14.object({
+  fieldId: fieldIdSchema,
+  label: z14.string().trim().min(1),
+  description: z14.string().trim().min(1).optional(),
+  required: z14.boolean().optional(),
+  maxLength: z14.number().int().positive().optional()
+}).strict();
+var editorSectionSchema = z14.object({
+  label: z14.string().trim().min(1),
+  fields: z14.array(editorFieldSchema).min(1)
+}).strict();
+var editorRouteSchema = z14.object({
+  routeKey: siteFieldRouteKeySchema,
+  label: z14.string().trim().min(1),
+  sections: z14.array(editorSectionSchema).min(1)
+}).strict().superRefine((route, context) => {
+  const sections = /* @__PURE__ */ new Set();
+  for (const [index, section] of route.sections.entries()) {
+    if (sections.has(section.label)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate section label: ${section.label}`,
+        path: ["sections", index, "label"]
+      });
+    }
+    sections.add(section.label);
+  }
+});
+var editorDefinitionV1Schema = z14.object({
+  version: z14.literal(1),
+  routes: z14.array(editorRouteSchema).min(1)
+}).strict().superRefine((definition, context) => {
+  const routes = /* @__PURE__ */ new Set();
+  const fields = /* @__PURE__ */ new Set();
+  for (const [routeIndex, route] of definition.routes.entries()) {
+    if (routes.has(route.routeKey)) {
+      context.addIssue({
+        code: "custom",
+        message: `Duplicate route key: ${route.routeKey}`,
+        path: ["routes", routeIndex, "routeKey"]
+      });
+    }
+    routes.add(route.routeKey);
+    for (const [sectionIndex, section] of route.sections.entries()) {
+      for (const [fieldIndex, field] of section.fields.entries()) {
+        if (fields.has(field.fieldId)) {
+          context.addIssue({
+            code: "custom",
+            message: `Duplicate editor field id: ${field.fieldId}`,
+            path: [
+              "routes",
+              routeIndex,
+              "sections",
+              sectionIndex,
+              "fields",
+              fieldIndex,
+              "fieldId"
+            ]
+          });
+        }
+        fields.add(field.fieldId);
+      }
+    }
+  }
+});
+var forbiddenControlOrBidi = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
+var unsafeLocator = /<\/?[a-z][^>]*>|\b(?:javascript|data:text\/html)\s*:|\bon[a-z]+\s*=/iu;
+var renderedPathSchema = z14.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
+  if (!value.startsWith("/") || value === "$global" || value.includes("?") || value.includes("#")) {
+    context.addIssue({
+      code: "custom",
+      message: "renderedPath must be a canonical real path."
+    });
+  }
+  addSafeByteIssues(value, CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES, "renderedPath", context);
+});
+function normalizedSafeTextSchema(maxBytes, label) {
+  return z14.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z14.string().min(1)).superRefine((value, context) => {
+    addSafeByteIssues(value, maxBytes, label, context);
+    if (label === "locatorHint" && unsafeLocator.test(value)) {
+      context.addIssue({
+        code: "custom",
+        message: "locatorHint contains unsafe markup or executable content."
+      });
+    }
+  });
+}
+var correctionItemBase = {
+  renderedPath: renderedPathSchema,
+  visibleValue: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_VISIBLE_VALUE_MAX_BYTES, "visibleValue"),
+  locatorHint: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_LOCATOR_HINT_MAX_BYTES, "locatorHint")
+};
+var setupCorrectionItemSchema = z14.discriminatedUnion("kind", [
+  z14.object({ kind: z14.literal("text"), ...correctionItemBase }).strict(),
+  z14.object({ kind: z14.literal("link"), ...correctionItemBase }).strict(),
+  z14.object({ kind: z14.literal("image"), ...correctionItemBase }).strict()
+]);
+var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
+var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
+var continueSiteSetupInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  correctionItems: z14.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS)
+}).strict().superRefine((input, context) => {
+  const bytes = utf8Bytes(stableJsonStringify(input.correctionItems));
+  if (bytes > CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES) {
+    context.addIssue({
+      code: "custom",
+      message: "Correction items exceed the 32 KiB canonical payload limit.",
+      path: ["correctionItems"]
+    });
+  }
+});
+var siteSetupContextInputSchema = z14.object({}).strict();
+var siteSetupApplyInputSchema = z14.object({
+  fieldContract: siteFieldContractV1Schema,
+  editorDefinition: editorDefinitionV1Schema
+}).strict().superRefine((input, context) => {
+  const contractRoutesByFieldId = new Map(input.fieldContract.fields.map((field) => [
+    field.fieldId,
+    field.routeKey
+  ]));
+  const definitionFieldIds = /* @__PURE__ */ new Set();
+  for (const [routeIndex, route] of input.editorDefinition.routes.entries()) {
+    for (const [sectionIndex, section] of route.sections.entries()) {
+      for (const [fieldIndex, field] of section.fields.entries()) {
+        const fieldPath = [
+          "editorDefinition",
+          "routes",
+          routeIndex,
+          "sections",
+          sectionIndex,
+          "fields",
+          fieldIndex,
+          "fieldId"
+        ];
+        const contractRouteKey = contractRoutesByFieldId.get(field.fieldId);
+        const contractField = input.fieldContract.fields.find((candidate) => candidate.fieldId === field.fieldId);
+        definitionFieldIds.add(field.fieldId);
+        if (!contractRouteKey) {
+          context.addIssue({
+            code: "custom",
+            message: `Unknown editor field id: ${field.fieldId}`,
+            path: fieldPath
+          });
+        } else if (contractRouteKey !== route.routeKey) {
+          context.addIssue({
+            code: "custom",
+            message: `Editor field ${field.fieldId} must use route ${contractRouteKey}.`,
+            path: fieldPath
+          });
+        } else if (field.maxLength !== void 0 && contractField?.fieldType !== "text" && contractField?.fieldType !== "longText") {
+          context.addIssue({
+            code: "custom",
+            message: `maxLength is not supported for ${contractField?.fieldType ?? "unknown"} fields.`,
+            path: [
+              "editorDefinition",
+              "routes",
+              routeIndex,
+              "sections",
+              sectionIndex,
+              "fields",
+              fieldIndex,
+              "maxLength"
+            ]
+          });
+        }
+      }
+    }
+  }
+  for (const field of input.fieldContract.fields) {
+    if (!definitionFieldIds.has(field.fieldId)) {
+      context.addIssue({
+        code: "custom",
+        message: `Missing editor field id: ${field.fieldId}`,
+        path: ["editorDefinition", "routes"]
+      });
+    }
+  }
+});
+var siteSetupVerifyInputSchema = z14.object({
+  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+  deploymentRevision: deploymentRevisionSchema,
+  wait: z14.boolean().optional()
+}).strict();
+var siteSetupEvidenceInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentOrigin: z14.string().url().refine((value) => value.startsWith("https://")),
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  publicRuntimeKeyId: z14.string().uuid(),
+  bridgeSessionId: normalizedSafeTextSchema(256, "bridgeSessionId"),
+  observations: z14.array(z14.object({
+    fieldId: fieldIdSchema,
+    routeKey: siteFieldRouteKeySchema,
+    renderedPath: renderedPathSchema,
+    targetResolved: z14.boolean(),
+    previewAck: z14.boolean()
+  }).strict().refine((value) => !value.previewAck || value.targetResolved, "Preview ACK requires a resolved target.")).min(1).max(200)
+}).strict();
+var completeSiteSetupInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  accessMode: z14.enum(["fallback", "custom_domain"]),
+  siteDomainId: z14.string().uuid().optional(),
+  defaultCanPublish: z14.boolean()
+}).strict().superRefine((input, context) => {
+  if (input.accessMode === "fallback" && input.siteDomainId) {
+    context.addIssue({
+      code: "custom",
+      message: "Fallback access cannot use a custom domain.",
+      path: ["siteDomainId"]
+    });
+  }
+  if (input.accessMode === "custom_domain" && !input.siteDomainId) {
+    context.addIssue({
+      code: "custom",
+      message: "Custom-domain access requires a site domain.",
+      path: ["siteDomainId"]
+    });
+  }
+});
+var refreshSiteSetupDeploymentInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+  deploymentRevision: deploymentRevisionSchema
+}).strict();
+function addSafeByteIssues(value, maxBytes, label, context) {
+  if (utf8Bytes(value) > maxBytes) {
+    context.addIssue({
+      code: "custom",
+      message: `${label} exceeds ${maxBytes} UTF-8 bytes.`
+    });
+  }
+  if (forbiddenControlOrBidi.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: `${label} contains a forbidden control or bidi character.`
+    });
+  }
+}
+function utf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+
+// ../shared/dist/bridge-protocol.js
+var BRIDGE_PROTOCOL_VERSION = 1;
+var bridgeRectSchema = z15.object({
+  x: z15.number(),
+  y: z15.number(),
+  width: z15.number().nonnegative(),
+  height: z15.number().nonnegative()
+});
+var previewTextValueSchema = z15.object({
+  fieldType: z15.enum(["text", "longText"]),
+  value: z15.string()
+});
+var previewLinkValueSchema = z15.object({
+  fieldType: z15.literal("link"),
+  value: z15.object({
+    href: z15.string().trim().min(1),
+    label: z15.string().trim().min(1).optional()
+  })
+});
+var previewImageValueSchema = z15.object({
+  fieldType: z15.literal("image"),
+  value: imageValueSchema
+});
+var bridgePreviewValueSchema = z15.discriminatedUnion("fieldType", [
+  previewTextValueSchema,
+  previewLinkValueSchema,
+  previewImageValueSchema
+]);
+var FIELD_BRIDGE_MESSAGE_TYPES = [
+  "siteplane:field-bridge:init",
+  "siteplane:field-bridge:ready",
+  "siteplane:field-bridge:fields",
+  "siteplane:field-bridge:select-field",
+  "siteplane:field-bridge:set-selected-field",
+  "siteplane:field-bridge:apply-preview-values",
+  "siteplane:field-bridge:test-preview-values",
+  "siteplane:field-bridge:preview-ack",
+  "siteplane:field-bridge:set-editability-review",
+  "siteplane:field-bridge:missing-content",
+  "siteplane:field-bridge:error"
+];
+var canonicalFieldContractHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var realRenderedPathSchema = z15.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
+var fieldBridgeIdentitySchema = z15.object({
+  publicRuntimeKeyId: z15.string().uuid(),
+  fieldContractHash: canonicalFieldContractHashSchema,
+  deploymentRevision: z15.string().trim().min(1).max(256)
+}).strict();
+var fieldBridgeBaseSchema = z15.object({
+  version: z15.literal(BRIDGE_PROTOCOL_VERSION),
+  type: z15.enum(FIELD_BRIDGE_MESSAGE_TYPES),
+  siteId: z15.string().uuid(),
+  sessionId: z15.string().trim().min(1),
+  publicRuntimeKeyId: z15.string().uuid(),
+  fieldContractHash: canonicalFieldContractHashSchema,
+  deploymentRevision: z15.string().trim().min(1).max(256),
+  requestId: z15.string().trim().min(1),
+  sentAt: z15.string().datetime()
+}).strict();
+var fieldBridgeFieldSchema = z15.object({
+  fieldId: fieldIdSchema,
+  fieldType: fieldTypeSchema,
+  routeKey: siteFieldRouteKeySchema,
+  renderedPath: realRenderedPathSchema,
+  sourcePath: z15.string().trim().min(1).optional(),
+  editTarget: fieldIdSchema,
+  rect: bridgeRectSchema,
+  targetResolved: z15.literal(true),
+  currentValue: bridgePreviewValueSchema.optional()
+}).strict();
+var fieldBridgeInitMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:init"),
+  payload: z15.object({
+    adminOrigin: z15.string().url(),
+    customerOrigin: z15.string().url(),
+    renderedPath: realRenderedPathSchema
+  }).strict()
+});
+var fieldBridgeReadyMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:ready"),
+  payload: z15.object({
+    renderedPath: realRenderedPathSchema,
+    fieldCount: z15.number().int().nonnegative(),
+    capabilities: z15.tuple([
+      z15.literal("field_selection"),
+      z15.literal("preview_values"),
+      z15.literal("field_evidence"),
+      z15.literal("editability_review")
+    ])
+  }).strict()
+});
+var fieldBridgeFieldsMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:fields"),
+  payload: z15.object({
+    renderedPath: realRenderedPathSchema,
+    fields: z15.array(fieldBridgeFieldSchema)
+  }).strict()
+});
+var fieldBridgeSelectFieldMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:select-field"),
+  payload: z15.object({ fieldId: fieldIdSchema }).strict()
+});
+var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:set-selected-field"),
+  payload: z15.object({
+    fieldId: fieldIdSchema.nullable(),
+    scrollIntoView: z15.boolean().optional()
+  }).strict()
+});
+var fieldBridgeApplyPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:apply-preview-values"),
+  payload: z15.object({ values: z15.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
+});
+var fieldBridgeTestPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:test-preview-values"),
+  payload: z15.object({ fieldIds: z15.array(fieldIdSchema).min(1).max(200) }).strict()
+});
+var fieldBridgePreviewAckMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:preview-ack"),
+  payload: z15.object({
+    ackRequestId: z15.string().trim().min(1),
+    kind: z15.enum(["apply", "test"]),
+    renderedPath: realRenderedPathSchema,
+    fieldIds: z15.array(fieldIdSchema).max(200)
+  }).strict()
+});
+var fieldBridgeSetEditabilityReviewMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:set-editability-review"),
+  payload: z15.object({ enabled: z15.boolean() }).strict()
+});
+var fieldBridgeMissingContentMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:missing-content"),
+  payload: z15.object({ item: setupCorrectionItemSchema }).strict()
+});
+var fieldBridgeErrorMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:error"),
+  payload: z15.object({
+    code: z15.string().trim().min(1),
+    message: z15.string().trim().min(1),
+    recoverable: z15.boolean().default(false)
+  }).strict()
+});
+var fieldBridgeMessageSchema = z15.discriminatedUnion("type", [
+  fieldBridgeInitMessageSchema,
+  fieldBridgeReadyMessageSchema,
+  fieldBridgeFieldsMessageSchema,
+  fieldBridgeSelectFieldMessageSchema,
+  fieldBridgeSetSelectedFieldMessageSchema,
+  fieldBridgeApplyPreviewValuesMessageSchema,
+  fieldBridgeTestPreviewValuesMessageSchema,
+  fieldBridgePreviewAckMessageSchema,
+  fieldBridgeSetEditabilityReviewMessageSchema,
+  fieldBridgeMissingContentMessageSchema,
+  fieldBridgeErrorMessageSchema
+]);
+
+// ../shared/dist/commands.js
+import { z as z17 } from "zod";
+
+// ../shared/dist/errors.js
+import { z as z16 } from "zod";
+var UI_ERROR_CATEGORIES = [
+  "client",
+  "developer",
+  "internal"
+];
+var uiErrorCategorySchema = z16.enum(UI_ERROR_CATEGORIES);
+var commandErrorPayloadSchema = z16.object({
+  code: z16.string().min(1),
+  message: z16.string().min(1),
+  category: uiErrorCategorySchema,
+  details: z16.record(z16.string(), z16.unknown()).optional()
+});
+
+// ../shared/dist/commands.js
+var commandSuccessSchema = z17.object({
+  ok: z17.literal(true),
+  data: z17.unknown()
+});
+var commandErrorSchema = z17.object({
+  ok: z17.literal(false),
+  error: commandErrorPayloadSchema
+});
+var commandResultSchema = z17.discriminatedUnion("ok", [
+  commandSuccessSchema,
+  commandErrorSchema
+]);
+
+// ../shared/dist/fallback-portal.js
+import { z as z18 } from "zod";
+var FALLBACK_PORTAL_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+var fallbackPortalSlugSchema = z18.string().regex(FALLBACK_PORTAL_SLUG_PATTERN, "Invalid fallback portal slug");
+
+// ../shared/dist/entitlements.js
+import { z as z19 } from "zod";
+var entitlementSnapshotSchema = z19.object({
+  planKey: z19.string().trim().min(1),
+  sitesLimit: z19.number().int().positive(),
+  clientAccountsPerSiteLimit: z19.number().int().positive(),
+  customAdminDomainsEnabled: z19.boolean(),
+  agentMcpEnabled: z19.boolean(),
+  emailNotificationsEnabled: z19.boolean(),
+  analyticsEnabled: z19.boolean(),
+  analyticsSitesLimit: z19.number().int().min(0),
+  analyticsClientPerformanceEnabled: z19.boolean(),
+  analyticsMonthlyReportsEnabled: z19.boolean(),
+  analyticsAiSummaryEnabled: z19.boolean(),
+  analyticsRawEventRetentionDays: z19.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
+  analyticsMonthlyEventLimit: z19.number().int().min(0),
+  bookingEnabled: z19.boolean().default(false),
+  bookingSitesLimit: z19.number().int().min(0).default(0),
+  bookingClientManagementEnabled: z19.boolean().default(false),
+  bookingResourcesPerSiteLimit: z19.number().int().min(0).default(0),
+  bookingServicesPerSiteLimit: z19.number().int().min(0).default(0),
+  bookingMonthlyBookingsLimit: z19.number().int().min(0).default(0),
+  bookingRemindersEnabled: z19.boolean().default(false)
+});
+var EARLY_ACCESS_PLAN = {
+  planKey: "early_access_2026",
+  sitesLimit: 3,
+  clientAccountsPerSiteLimit: 5,
+  customAdminDomainsEnabled: true,
+  agentMcpEnabled: true,
+  emailNotificationsEnabled: true,
+  analyticsEnabled: false,
+  analyticsSitesLimit: 0,
+  analyticsClientPerformanceEnabled: false,
+  analyticsMonthlyReportsEnabled: false,
+  analyticsAiSummaryEnabled: false,
+  analyticsRawEventRetentionDays: ANALYTICS_RETENTION_DEFAULTS.enabledRawEventRetentionDays,
+  analyticsMonthlyEventLimit: 0,
+  bookingEnabled: true,
+  bookingSitesLimit: 3,
+  bookingClientManagementEnabled: true,
+  bookingResourcesPerSiteLimit: 10,
+  bookingServicesPerSiteLimit: 50,
+  bookingMonthlyBookingsLimit: 0,
+  bookingRemindersEnabled: true
+};
+
+// ../shared/dist/readiness.js
+import { z as z20 } from "zod";
+var READINESS_CHECK_KEYS = [
+  "agent_instructions_installed",
+  "runtime_package_connected",
+  "secure_server_access_configured",
+  "preview_bridge_working",
+  "admin_access_url_selected",
+  "default_publishing_mode_selected"
+];
+var READINESS_STATUSES = [
+  "pending",
+  "passing",
+  "failing",
+  "warning"
+];
+var readinessCheckKeySchema = z20.enum(READINESS_CHECK_KEYS);
+var readinessStatusSchema = z20.enum(READINESS_STATUSES);
+
+// ../shared/dist/site.js
+import { z as z21 } from "zod";
+var SITE_STATUSES = [
+  "setup",
+  "client_ready",
+  "disabled",
+  "archived"
+];
+var siteStatusSchema = z21.enum(SITE_STATUSES);
+var websiteUrlSchema = z21.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+
+// ../cli/dist/analytics/static-scan.js
+import ts from "typescript";
+
+// ../cli/dist/booking/manifest.js
+import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
+import { dirname as dirname2 } from "path";
+async function readBookingManifestFile(manifestPath) {
+  return validateBookingManifestInput(JSON.parse(await readFile2(manifestPath, "utf8")));
+}
+async function writeBookingManifestFile(manifestPath, manifest) {
+  await mkdir2(dirname2(manifestPath), {
+    recursive: true
+  });
+  await writeFile2(manifestPath, `${JSON.stringify(bookingManifestSchema.parse(manifest), null, 2)}
+`, "utf8");
+}
+function validateBookingManifestInput(input) {
+  const redactedKeys = collectRedactedBookingKeys(input);
+  const redacted = redactBookingManifest(input);
+  return {
+    manifest: bookingManifestSchema.parse(redacted),
+    redactedKeys: [...redactedKeys].sort()
+  };
+}
+var secretManifestKeys2 = /* @__PURE__ */ new Set([
+  "siteKey",
+  "rawKey",
+  "token",
+  "accessToken"
+]);
+function collectRedactedBookingKeys(input, prefix = "") {
+  if (Array.isArray(input)) {
+    return input.flatMap((item, index) => collectRedactedBookingKeys(item, `${prefix}[${index}]`));
+  }
+  if (!input || typeof input !== "object") {
+    return [];
+  }
+  return Object.entries(input).flatMap(([key, value]) => {
+    const path = prefix ? `${prefix}.${key}` : key;
+    if (secretManifestKeys2.has(key)) {
+      return [path];
+    }
+    return collectRedactedBookingKeys(value, path);
+  });
+}
+
+// ../cli/dist/booking/static-scan.js
+function scanBookingSourceFiles(files, input) {
+  const embeds = files.flatMap(scanBookingEmbedFile);
+  const findings = embeds.map(createEmbedFoundIssue);
+  const hardErrors = embeds.length === 0 ? [
+    {
+      code: "booking_scan.embed_missing",
+      message: "No Siteplane Booking embed script, web component or iframe was found.",
+      filePath: "siteplane.booking.json"
+    }
+  ] : [];
+  const warnings = [
+    ...createPageSlugWarnings(embeds, input.bookingPageSlug),
+    ...createOriginWarnings(files, input.productionOrigin)
+  ];
+  const selectedEmbed = selectManifestEmbed(embeds);
+  const manifest = bookingManifestSchema.parse({
+    schemaVersion: 1,
+    siteId: input.siteId,
+    siteKeyPrefix: input.siteKeyPrefix,
+    bookingPageSlug: selectedEmbed?.pageSlug ?? input.bookingPageSlug,
+    ...selectedEmbed ? { embedMode: selectedEmbed.embedMode } : {},
+    ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
+  });
+  return {
+    manifest,
+    findings,
+    hardErrors,
+    warnings,
+    suggestions: []
+  };
+}
+function scanBookingEmbedFile(file) {
+  const embeds = [];
+  const source = file.sourceText;
+  if (/\/embed\/booking\.js/u.test(source)) {
+    embeds.push({
+      filePath: file.filePath,
+      embedMode: "script"
+    });
+  }
+  if (/<siteplane-booking\b/u.test(source)) {
+    const pageSlug = readAttributeValue(source, "booking-page-slug");
+    embeds.push({
+      filePath: file.filePath,
+      embedMode: "web_component",
+      ...pageSlug ? { pageSlug } : {}
+    });
+  }
+  for (const match of source.matchAll(/<iframe\b[^>]*>/giu)) {
+    const tag = match[0];
+    const src = readAttributeValue(tag, "src");
+    const pageSlug = src ? readBookingPageSlug(src) : void 0;
+    if (/data-siteplane-booking/u.test(tag) || pageSlug !== void 0) {
+      embeds.push({
+        filePath: file.filePath,
+        embedMode: "iframe",
+        ...pageSlug ? { pageSlug } : {}
+      });
+    }
+  }
+  return embeds;
+}
+function createEmbedFoundIssue(embed) {
+  return {
+    code: "booking_scan.embed_found",
+    message: "Siteplane Booking embed was found.",
+    filePath: embed.filePath,
+    embedMode: embed.embedMode,
+    ...embed.pageSlug ? { pageSlug: embed.pageSlug } : {}
+  };
+}
+function createPageSlugWarnings(embeds, expectedSlug) {
+  return embeds.filter((embed) => embed.pageSlug && embed.pageSlug !== expectedSlug).map((embed) => {
+    const pageSlug = embed.pageSlug;
+    return {
+      code: "booking_scan.page_slug_mismatch",
+      message: `Booking embed references page slug ${pageSlug}, but the manifest is configured for ${expectedSlug}.`,
+      filePath: embed.filePath,
+      embedMode: embed.embedMode,
+      ...pageSlug ? { pageSlug } : {}
+    };
+  });
+}
+function createOriginWarnings(files, productionOrigin) {
+  if (!productionOrigin) {
+    return [];
+  }
+  if (files.some((file) => file.sourceText.includes(productionOrigin))) {
+    return [];
+  }
+  return [
+    {
+      code: "booking_scan.origin_not_detected",
+      message: "The configured production origin was not found statically; verify it is registered as an allowed Booking origin in Siteplane.",
+      filePath: "siteplane.booking.json"
+    }
+  ];
+}
+function selectManifestEmbed(embeds) {
+  return embeds.find((embed) => embed.embedMode === "web_component") ?? embeds.find((embed) => embed.embedMode === "iframe") ?? embeds[0];
+}
+function readAttributeValue(source, attributeName) {
+  const escapedName = escapeRegExp(attributeName);
+  const match = new RegExp(`${escapedName}\\s*=\\s*["']([^"']+)["']`, "iu").exec(source);
+  return match?.[1];
+}
+function readBookingPageSlug(value) {
+  return /\/book\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:[/?#]|$)/u.exec(value)?.[1];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+}
+
+// ../cli/dist/commands/analytics/check.js
+import { readFile as readFile3 } from "fs/promises";
+
+// ../cli/dist/commands/analytics/init.js
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { dirname as dirname3, join } from "path";
+var analyticsRulesTemplate = `# Siteplane Analytics Rules
+
+Analytics contract version: ${ANALYTICS_CONTRACT_VERSION}
+Analytics contract hash: ${ANALYTICS_CONTRACT_HASH}
+
+- Do not change visible layout, copy, styling, animation or business logic while adding analytics.
+- Use stable data-siteplane-target-id values that do not depend on visible copy.
+- Use public site keys only through environment references.
+- Do not write secret analytics keys, setup tokens or project CLI tokens into source files.
+- Suppress editor-preview traffic from live analytics.
+- Run npx siteplane analytics check, npx siteplane analytics sync and npx siteplane analytics test after setup.
+`;
+var analyticsCursorRulesTemplate = `---
+description: Siteplane Analytics rules
+alwaysApply: true
+---
+
+${analyticsRulesTemplate}`;
+
+// ../cli/dist/commands/analytics/import.js
+import { createHash } from "crypto";
+
+// ../cli/dist/commands/analytics/public-key.js
+import { z as z22 } from "zod";
+var responseSchema = z22.object({
+  ok: z22.literal(true),
+  data: z22.object({
+    rawPublicKey: z22.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+  })
+});
+var errorResponseSchema = z22.object({
+  error: z22.object({
+    code: z22.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+  })
+});
+
+// ../cli/dist/commands/analytics/test.js
+import { randomUUID } from "crypto";
+
+// ../cli/dist/commands/booking/check.js
+import { readFile as readFile4 } from "fs/promises";
+async function bookingCheckCommand(input) {
+  const validatedManifest = await readBookingManifestFile(input.manifestPath);
+  const sourceFiles = await readSourceFiles(input.sourceFilePaths);
+  const scanInput = {
+    siteId: validatedManifest.manifest.siteId,
+    siteKeyPrefix: validatedManifest.manifest.siteKeyPrefix,
+    bookingPageSlug: validatedManifest.manifest.bookingPageSlug,
+    ...validatedManifest.manifest.productionOrigin ? { productionOrigin: validatedManifest.manifest.productionOrigin } : {}
+  };
+  const scanResult = scanBookingSourceFiles(sourceFiles, {
+    ...scanInput
+  });
+  const hardErrors = [
+    ...createBoundaryErrors(validatedManifest),
+    ...scanResult.hardErrors
+  ];
+  return {
+    ok: hardErrors.length === 0,
+    manifest: validatedManifest.manifest,
+    scannedManifest: scanResult.manifest,
+    redactedKeys: validatedManifest.redactedKeys,
+    hardErrors,
+    warnings: scanResult.warnings,
+    suggestions: scanResult.suggestions,
+    findings: scanResult.findings
+  };
+}
+async function readSourceFiles(filePaths) {
+  return Promise.all(filePaths.map(async (filePath) => ({
+    filePath,
+    sourceText: await readFile4(filePath, "utf8")
+  })));
+}
+function createBoundaryErrors(validation) {
+  return validation.redactedKeys.map((key) => ({
+    code: "booking_check.raw_key_in_manifest",
+    message: `Booking manifest contains a raw key-like field: ${key}`,
+    filePath: "siteplane.booking.json"
+  }));
+}
+
+// ../cli/dist/commands/booking/init.js
+import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
+import { dirname as dirname4, join as join2 } from "path";
+async function bookingInitCommand(input) {
+  const manifest = {
+    schemaVersion: 1,
+    siteId: input.siteId,
+    siteKeyPrefix: input.siteKeyPrefix,
+    bookingPageSlug: input.bookingPageSlug,
+    ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
+  };
+  const manifestPath = join2(input.projectDir, "siteplane.booking.json");
+  const artifacts = createBookingArtifacts(input.agentClient);
+  await writeBookingManifestFile(manifestPath, manifest);
+  for (const artifact of artifacts) {
+    await writeProjectFile(input.projectDir, artifact.path, artifact.template);
+  }
+  return {
+    manifestPath,
+    manifest,
+    artifactPaths: artifacts.map((artifact) => artifact.path)
+  };
+}
+function createBookingArtifacts(agentClient) {
+  const artifacts = [
+    {
+      path: ".siteplane/booking.md",
+      template: bookingRulesTemplate
+    }
+  ];
+  if (agentClient === "codex") {
+    artifacts.push({
+      path: ".agents/skills/siteplane-booking/SKILL.md",
+      template: bookingSkillTemplate("Codex")
+    });
+  }
+  if (agentClient === "claude") {
+    artifacts.push({
+      path: ".claude/skills/siteplane-booking/SKILL.md",
+      template: bookingSkillTemplate("Claude Code")
+    });
+  }
+  if (agentClient === "cursor") {
+    artifacts.push({
+      path: ".cursor/rules/siteplane-booking.mdc",
+      template: bookingCursorRulesTemplate
+    });
+  }
+  return artifacts;
+}
+async function writeProjectFile(projectDir, relativePath, contents) {
+  const path = join2(projectDir, relativePath);
+  await mkdir4(dirname4(path), { recursive: true });
+  await writeFile4(path, contents, "utf8");
+}
+var bookingRulesTemplate = `# Siteplane Booking Rules
+
+- Do not change layout, copy, styling, animation or business logic while adding Booking.
+- Add only the Siteplane Booking embed script and a booking iframe or web component.
+- Use the configured booking page slug from siteplane.booking.json.
+- Register the production website origin in Siteplane before testing cross-origin embeds.
+- Do not write setup tokens, project CLI tokens or private keys into source files.
+- Run npx siteplane booking check, npx siteplane booking sync and npx siteplane booking test after setup.
+- booking test stays in test_mode; live booking only starts after explicit dashboard activation.
+`;
+function bookingSkillTemplate(agentName) {
+  return `# Siteplane Booking Skill
+
+Use this skill in ${agentName} before adding Siteplane Booking embeds.
+
+${bookingRulesTemplate}`;
+}
+var bookingCursorRulesTemplate = `---
+description: Siteplane Booking rules
+alwaysApply: true
+---
+
+${bookingRulesTemplate}`;
+
+// ../cli/dist/commands/booking/sync.js
+async function bookingSyncCommand(input) {
+  const redacted = validateBookingManifestInput(input.manifest);
+  const fetcher = input.fetchImpl ?? fetch;
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/booking/sync`, {
+    method: "POST",
+    headers: createBookingCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      source: "cli",
+      manifest: redacted.manifest
+    })
+  });
+}
+function createBookingCliRequestHeaders(config) {
+  const headers = {
+    authorization: `Bearer ${config.accessToken}`,
+    "content-type": "application/json"
+  };
+  const bypassSecret = config.vercelAutomationBypassSecret?.trim();
+  if (bypassSecret) {
+    headers["x-vercel-protection-bypass"] = bypassSecret;
+  }
+  return headers;
+}
+
+// ../cli/dist/commands/booking/test.js
+async function bookingTestCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  const booking = bookingCreateRequestSchema.parse(input.booking);
+  return fetcher(`${input.config.apiBaseUrl}/api/cli/booking/test`, {
+    method: "POST",
+    headers: createBookingCliRequestHeaders(input.config),
+    body: JSON.stringify({
+      siteId: input.config.siteId,
+      mode: "test",
+      ...input.manifest ? { manifest: input.manifest } : {},
+      booking
+    })
+  });
+}
+
+// ../cli/dist/commands/export.js
+async function exportCommand(input) {
+  requireContentExportScope(input.tokenScopes);
+  const values = await input.readPublishedValues();
+  if (input.format === "prompt") {
+    return {
+      kind: "prompt",
+      output: Object.entries(values).map(([fieldId, value]) => `${fieldId}: ${JSON.stringify(value)}`).join("\n")
+    };
+  }
+  return {
+    kind: "json",
+    values
+  };
+}
+function requireContentExportScope(scopes) {
+  if (!scopes?.includes("content:export")) {
+    throw new Error("A Project Connection with content:export is required.");
+  }
+}
+
+// ../cli/dist/config/project-config.js
+import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
+import { randomUUID as randomUUID2 } from "crypto";
+import { join as join3 } from "path";
+import { z as z23 } from "zod";
+var siteplaneProjectConfigSchema = z23.object({
+  version: z23.literal(1),
+  apiBaseUrl: z23.string().url(),
+  siteId: z23.string().uuid(),
+  publicSiteKeyId: z23.string().uuid(),
+  publicSiteKey: z23.string().trim().min(1),
+  fieldContractHash: z23.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+}).strict();
+async function readProjectPackageJson(projectDir) {
+  return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
+}
+async function detectNextProject(projectDir) {
+  const packageJson = await readProjectPackageJson(projectDir).catch(() => null);
+  if (packageJson?.dependencies?.next || packageJson?.devDependencies?.next) {
+    return true;
+  }
+  for (const fileName of [
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts"
+  ]) {
+    try {
+      await access(join3(projectDir, fileName));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+async function writeProjectConfig(projectDir, config) {
+  const path = join3(projectDir, "siteplane.config.json");
+  const parsed = siteplaneProjectConfigSchema.parse(config);
+  await writeJsonAtomically(path, parsed, 420);
+  return path;
+}
+async function readProjectConfig(projectDir) {
+  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
+}
+async function writeJsonAtomically(path, value, mode) {
+  const temporaryPath = `${path}.${randomUUID2()}.tmp`;
+  const file = await open(temporaryPath, "wx", mode);
+  try {
+    await file.writeFile(`${JSON.stringify(value, null, 2)}
+`, "utf8");
+    await file.sync();
+  } catch (error) {
+    await file.close();
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+  await file.close();
+  try {
+    await rename(temporaryPath, path);
+    await chmod(path, mode);
+  } catch (error) {
+    await rm(temporaryPath, { force: true });
+    throw error;
+  }
+}
+
+// ../cli/dist/config/credentials.js
+import { execFile } from "child_process";
+import { randomUUID as randomUUID3 } from "crypto";
+import { chmod as chmod2, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
+import { dirname as dirname5, join as join4, relative } from "path";
+import { promisify } from "util";
+import { z as z24 } from "zod";
+var siteplaneCredentialsSchema = z24.object({
+  accessToken: z24.string().trim().min(1),
+  siteRevalidationSecret: z24.string().trim().min(1)
+}).strict();
+async function writeLocalCredentials(projectDir, credentials, options = {}) {
+  const path = join4(projectDir, ".siteplane/credentials.json");
+  const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
+  const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
+  if (await isTrackedFile(path)) {
+    throw new Error("Refusing to write Siteplane credentials into a tracked file.");
+  }
+  if (!await isIgnoredFile(path)) {
+    throw new Error("Add .siteplane/credentials.json to .gitignore before running siteplane init.");
+  }
+  const parsed = siteplaneCredentialsSchema.parse(credentials);
+  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
+  await writeCredentialsAtomically(path, parsed);
+  return path;
+}
+async function readLocalCredentials(projectDir) {
+  return siteplaneCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
+}
+async function writeCredentialsAtomically(path, credentials) {
+  const temporaryPath = `${path}.${randomUUID3()}.tmp`;
+  const file = await open2(temporaryPath, "wx", 384);
+  try {
+    await file.writeFile(`${JSON.stringify(credentials, null, 2)}
+`, "utf8");
+    await file.sync();
+  } catch (error) {
+    await file.close();
+    await rm2(temporaryPath, { force: true });
+    throw error;
+  }
+  await file.close();
+  try {
+    await rename2(temporaryPath, path);
+    await chmod2(path, 384);
+  } catch (error) {
+    await rm2(temporaryPath, { force: true });
+    throw error;
+  }
+}
+var execFileAsync = promisify(execFile);
+async function gitPathMatches(projectDir, path, command) {
+  const args = command === "check-ignore" ? ["check-ignore", "--quiet", relative(projectDir, path)] : ["ls-files", "--error-unmatch", relative(projectDir, path)];
+  try {
+    await execFileAsync("git", args, { cwd: projectDir });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// ../cli/dist/commands/init.js
+import { join as join5 } from "path";
+import { z as z25 } from "zod";
+async function initCommand(input) {
+  if (!input.setupToken.trim()) {
+    throw new Error("A Siteplane setup token is required.");
+  }
+  if (!await detectNextProject(input.projectDir)) {
+    throw new Error("Siteplane init currently supports Next.js projects.");
+  }
+  const bootstrap = await bootstrapProjectConnection(input);
+  const paths = bootstrap.credentialPurpose === "site_setup" ? await persistSiteSetupBootstrap(input, bootstrap) : await persistFeatureBootstrap(input, bootstrap);
+  await acknowledgeBootstrapResponse(input);
+  return {
+    ...paths,
+    nextSteps: [
+      "npx siteplane setup context",
+      "Instrument the site and create EditorDefinitionV1.",
+      "npx siteplane setup apply --definition /tmp/siteplane-editor.json"
+    ]
+  };
+}
+var siteSetupBootstrapDataSchema = z25.object({
+  credentialPurpose: z25.literal("site_setup"),
+  apiBaseUrl: z25.string().url(),
+  siteId: z25.string().uuid(),
+  publicSiteKeyId: z25.string().uuid(),
+  publicSiteKey: z25.string().trim().min(1),
+  accessToken: z25.string().trim().min(1),
+  siteRevalidationSecret: z25.string().regex(/^[A-Za-z0-9_-]{43}$/u)
+}).strict();
+var featureBootstrapDataSchema = z25.object({
+  credentialPurpose: z25.enum(["analytics", "booking"]),
+  apiBaseUrl: z25.string().url(),
+  siteId: z25.string().uuid(),
+  accessToken: z25.string().trim().min(1)
+}).strict();
+var bootstrapResponseSchema = z25.object({
+  ok: z25.literal(true),
+  data: z25.discriminatedUnion("credentialPurpose", [
+    siteSetupBootstrapDataSchema,
+    featureBootstrapDataSchema
+  ])
+}).strict();
+async function bootstrapProjectConnection(input) {
+  const fetcher = input.fetcher ?? fetch;
+  const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
+    method: "POST",
+    headers: createBootstrapHeaders(input),
+    body: JSON.stringify({
+      action: "bootstrap",
+      agentClient: input.agentClient ?? "codex"
+    })
+  });
+  const payload = await response.json();
+  const parsed = bootstrapResponseSchema.safeParse(payload);
+  if (!response.ok || !parsed.success) {
+    throw new Error(readErrorMessage(payload) ?? "Siteplane init failed.");
+  }
+  return parsed.data.data;
+}
+async function acknowledgeBootstrapResponse(input) {
+  const fetcher = input.fetcher ?? fetch;
+  const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
+    method: "POST",
+    headers: createBootstrapHeaders(input),
+    body: JSON.stringify({ action: "acknowledge" })
+  });
+  if (!response.ok) {
+    throw new Error("Siteplane setup acknowledgement failed.");
+  }
+}
+async function persistSiteSetupBootstrap(input, bootstrap) {
+  const credentialsPath = await writeLocalCredentials(input.projectDir, {
+    accessToken: bootstrap.accessToken,
+    siteRevalidationSecret: bootstrap.siteRevalidationSecret
+  }, {
+    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
+    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
+  });
+  const configPath = await writeProjectConfig(input.projectDir, {
+    version: 1,
+    apiBaseUrl: bootstrap.apiBaseUrl,
+    siteId: bootstrap.siteId,
+    publicSiteKeyId: bootstrap.publicSiteKeyId,
+    publicSiteKey: bootstrap.publicSiteKey
+  });
+  const [credentials, config] = await Promise.all([
+    readLocalCredentials(input.projectDir),
+    readProjectConfig(input.projectDir)
+  ]);
+  if (credentials.accessToken !== bootstrap.accessToken || credentials.siteRevalidationSecret !== bootstrap.siteRevalidationSecret || config.apiBaseUrl !== bootstrap.apiBaseUrl || config.siteId !== bootstrap.siteId || config.publicSiteKeyId !== bootstrap.publicSiteKeyId || config.publicSiteKey !== bootstrap.publicSiteKey) {
+    throw new Error("Siteplane setup files could not be verified.");
+  }
+  return { configPath, credentialsPath };
+}
+async function persistFeatureBootstrap(input, bootstrap) {
+  const [config, existingCredentials] = await Promise.all([
+    readProjectConfig(input.projectDir),
+    readLocalCredentials(input.projectDir)
+  ]);
+  if (config.siteId !== bootstrap.siteId) {
+    throw new Error("The setup token belongs to a different Siteplane site.");
+  }
+  const credentialsPath = await writeLocalCredentials(input.projectDir, {
+    accessToken: bootstrap.accessToken,
+    siteRevalidationSecret: existingCredentials.siteRevalidationSecret
+  }, {
+    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
+    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
+  });
+  const persistedCredentials = await readLocalCredentials(input.projectDir);
+  if (persistedCredentials.accessToken !== bootstrap.accessToken || persistedCredentials.siteRevalidationSecret !== existingCredentials.siteRevalidationSecret) {
+    throw new Error("Siteplane credentials could not be verified.");
+  }
+  return {
+    configPath: join5(input.projectDir, "siteplane.config.json"),
+    credentialsPath
+  };
+}
+function createBootstrapHeaders(input) {
+  return new Headers({
+    authorization: `Bearer ${input.setupToken}`,
+    "content-type": "application/json",
+    ...input.vercelAutomationBypassSecret?.trim() ? {
+      "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim()
+    } : {}
+  });
+}
+function readErrorMessage(payload) {
+  if (payload && typeof payload === "object" && "error" in payload && payload.error && typeof payload.error === "object" && "message" in payload.error && typeof payload.error.message === "string") {
+    const code = "code" in payload.error && typeof payload.error.code === "string" ? payload.error.code : null;
+    return code ? `${code}: ${payload.error.message}` : payload.error.message;
+  }
+  return null;
+}
+
+// ../cli/dist/commands/scan.js
+import { readdir } from "fs/promises";
+import { extname, join as join6 } from "path";
+
+// ../cli/dist/commands/site-setup.js
+import { execFile as execFile2 } from "child_process";
+import { readFile as readFile7 } from "fs/promises";
+import { promisify as promisify2 } from "util";
+import { z as z26 } from "zod";
+
+// ../cli/dist/scan/next-source-scan.js
+import ts2 from "typescript";
+import { isAbsolute, relative as relative2 } from "path";
+var legacyEditableComponentPrefix = "Editable";
+var editableComponentNames = new Set(["Image", "Text", "LongText", "Link"].map((name) => `${legacyEditableComponentPrefix}${name}`));
+
+// ../cli/dist/commands/site-setup.js
+var execFileAsync2 = promisify2(execFile2);
+var safeErrorSchema = z26.object({
+  code: z26.string().trim().min(1),
+  message: z26.string().trim().min(1)
+}).passthrough();
+var errorResponseSchema2 = z26.object({ ok: z26.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z26.object({
+  site: z26.object({ siteId: z26.string().uuid(), websiteUrl: z26.string().url() }),
+  run: z26.object({
+    runId: z26.string().uuid(),
+    mode: z26.enum(["initial", "update"]),
+    status: z26.enum([
+      "waiting_for_agent",
+      "working",
+      "action_required",
+      "ready_for_review"
+    ]),
+    fieldContractHash: z26.string().nullable(),
+    deploymentOrigin: z26.string().nullable(),
+    deploymentRevision: z26.string().nullable(),
+    errorCode: z26.string().nullable(),
+    errorMessage: z26.string().nullable()
+  }),
+  allowedTasks: z26.array(z26.string()),
+  requiredEnvironmentNames: z26.array(z26.string())
+}).strict();
+var contextResponseSchema = z26.object({ ok: z26.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z26.object({
+  status: z26.enum(["applied", "ready_for_review"]),
+  runId: z26.string().uuid().optional(),
+  contractVersionId: z26.string().uuid().optional(),
+  fieldContractHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z26.number().int().nonnegative().optional(),
+  routeCount: z26.number().int().nonnegative().optional()
+}).strict();
+var applyResponseSchema = z26.object({ ok: z26.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z26.object({
+  status: z26.literal("ready_for_review"),
+  runId: z26.string().uuid().optional(),
+  deploymentOrigin: z26.string().url().optional(),
+  deploymentRevision: z26.string().optional()
+}).strict();
+var verifyResponseSchema = z26.object({ ok: z26.literal(true), data: verifyDataSchema }).strict();
+export {
+  bookingCheckCommand,
+  bookingInitCommand,
+  bookingSyncCommand,
+  bookingTestCommand,
+  exportCommand,
+  initCommand
+};