siteplane 0.1.40 → 0.1.41

package/dist/bin/siteplane.js

@@ -1286,11 +1286,48 @@ var CONTINUE_SITE_SETUP_LOCATOR_HINT_MAX_BYTES = 512;
 var CONTINUE_SITE_SETUP_REQUESTED_LABEL_MAX_BYTES = 120;
 var CONTINUE_SITE_SETUP_REQUESTED_SECTION_MAX_BYTES = 120;
 var CONTINUE_SITE_SETUP_REQUESTED_SUBSECTION_MAX_BYTES = 120;
+var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH = 2e3;
+var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES = 8e3;
 var CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES = 32 * 1024;
 var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
 var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
 var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
 var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
+var siteSetupTaskSchema = z14.object({
+  contractVersion: z14.literal("siteplane.setup-task.v1"),
+  workflow: z14.enum(["initial_setup", "structure_update"]),
+  goal: z14.string().min(1),
+  modules: z14.tuple([z14.literal("visual_editor")]),
+  packages: z14.object({
+    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  communication: z14.object({
+    beforeSourceChanges: z14.string().min(1),
+    updates: z14.array(z14.string().min(1)).min(1),
+    blocker: z14.string().min(1)
+  }).strict(),
+  discovery: z14.object({
+    inspectPublicRoutes: z14.boolean(),
+    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z14.array(z14.string().min(1)).min(1)
+  }).strict(),
+  steps: z14.array(z14.object({
+    id: z14.enum([
+      "inspect_repository",
+      "install_packages",
+      "instrument_fields",
+      "apply_contract",
+      "deploy_production",
+      "verify_deployment"
+    ]),
+    instruction: z14.string().min(1)
+  }).strict()).length(6),
+  completion: z14.object({
+    verifiedStatus: z14.literal("ready_for_review"),
+    instruction: z14.string().min(1)
+  }).strict()
+}).strict();
 var editorFieldSchema = z14.object({
   fieldId: fieldIdSchema,
   label: z14.string().trim().min(1),
@@ -1375,6 +1412,7 @@ var editorDefinitionV1Schema = z14.object({
   }
 });
 var forbiddenControlOrBidi = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
+var forbiddenOwnerNoteControlOrBidi = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 var unsafeLocator = /<\/?[a-z][^>]*>|\b(?:javascript|data:text\/html)\s*:|\bon[a-z]+\s*=/iu;
 var renderedPathSchema = z14.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
   if (!value.startsWith("/") || value === "$global" || value.includes("?") || value.includes("#")) {
@@ -1427,6 +1465,20 @@ var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
+var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+  if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
+    context.addIssue({
+      code: "custom",
+      message: `ownerEditabilityNote exceeds ${SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES} UTF-8 bytes.`
+    });
+  }
+  if (forbiddenOwnerNoteControlOrBidi.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: "ownerEditabilityNote contains a forbidden control or bidi character."
+    });
+  }
+});
 var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
 var continueSiteSetupInputSchema = z14.object({
@@ -1434,7 +1486,15 @@ var continueSiteSetupInputSchema = z14.object({
   runId: z14.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
-  correctionItems: setupCorrectionItemsSchema
+  correctionItems: setupCorrectionItemsSchema,
+  ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema.optional()
+}).strict();
+var saveSiteSetupOwnerNoteInputSchema = z14.object({
+  siteId: z14.string().uuid(),
+  runId: z14.string().uuid(),
+  expectedFieldContractHash: canonicalHashSchema,
+  expectedDeploymentRevision: deploymentRevisionSchema,
+  ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
 }).strict();
 var siteSetupContextInputSchema = z14.object({}).strict();
 var siteSetupApplyInputSchema = z14.object({
@@ -1599,6 +1659,7 @@ var FIELD_BRIDGE_MESSAGE_TYPES = [
   "siteplane:field-bridge:preview-ack",
   "siteplane:field-bridge:set-visual-control-state",
   "siteplane:field-bridge:missing-content",
+  "siteplane:field-bridge:preview-scrolled",
   "siteplane:field-bridge:error"
 ];
 var canonicalFieldContractHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/u);
@@ -1729,6 +1790,10 @@ var fieldBridgeMissingContentMessageSchema = fieldBridgeBaseSchema.extend({
     suggestedSection: bridgeSectionSchema.optional()
   }).strict()
 });
+var fieldBridgePreviewScrolledMessageSchema = fieldBridgeBaseSchema.extend({
+  type: z15.literal("siteplane:field-bridge:preview-scrolled"),
+  payload: z15.object({ renderedPath: realRenderedPathSchema }).strict()
+});
 var fieldBridgeErrorMessageSchema = fieldBridgeBaseSchema.extend({
   type: z15.literal("siteplane:field-bridge:error"),
   payload: z15.object({
@@ -1748,6 +1813,7 @@ var fieldBridgeMessageSchema = z15.discriminatedUnion("type", [
   fieldBridgePreviewAckMessageSchema,
   fieldBridgeSetVisualControlStateMessageSchema,
   fieldBridgeMissingContentMessageSchema,
+  fieldBridgePreviewScrolledMessageSchema,
   fieldBridgeErrorMessageSchema
 ]);
 
@@ -2920,49 +2986,54 @@ async function bookingTestCommand(input) {
   });
 }
 
-// ../cli/dist/commands/connect.js
-import { spawn } from "child_process";
-import { randomBytes } from "crypto";
-import { z as z27 } from "zod";
-
-// ../cli/dist/config/credentials.js
-import { execFile } from "child_process";
+// ../cli/dist/config/project-config.js
+import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
-import { chmod, mkdir as mkdir5, open, readFile as readFile5, rename, rm } from "fs/promises";
-import { dirname as dirname5, join as join3, relative } from "path";
-import { promisify } from "util";
+import { join as join3 } from "path";
 import { z as z24 } from "zod";
-var siteplaneCredentialsSchema = z24.object({
-  accessToken: z24.string().trim().min(1),
-  siteRevalidationSecret: z24.string().trim().min(1)
+var siteplaneProjectConfigSchema = z24.object({
+  version: z24.literal(1),
+  apiBaseUrl: z24.string().url(),
+  siteId: z24.string().uuid(),
+  publicSiteKeyId: z24.string().uuid(),
+  publicSiteKey: z24.string().trim().min(1),
+  fieldContractHash: z24.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
-async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
-  const path = join3(projectDir, ".siteplane/credentials.json");
-  const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
-  const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
-  if (await isTrackedFile(path)) {
-    throw new Error("Refusing to write Siteplane credentials into a tracked file.");
+async function readProjectPackageJson(projectDir) {
+  return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
+}
+async function detectNextProject(projectDir) {
+  const packageJson = await readProjectPackageJson(projectDir).catch(() => null);
+  if (packageJson?.dependencies?.next || packageJson?.devDependencies?.next) {
+    return true;
   }
-  if (!await isIgnoredFile(path)) {
-    throw new Error("Add .siteplane/credentials.json to .gitignore before running Siteplane connect.");
+  for (const fileName of [
+    "next.config.js",
+    "next.config.mjs",
+    "next.config.ts"
+  ]) {
+    try {
+      await access(join3(projectDir, fileName));
+      return true;
+    } catch {
+    }
   }
-  return path;
+  return false;
 }
-async function writeLocalCredentials(projectDir, credentials, options = {}) {
-  const path = await assertLocalCredentialsPathSafe(projectDir, options);
-  const parsed = siteplaneCredentialsSchema.parse(credentials);
-  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
-  await writeCredentialsAtomically(path, parsed);
+async function writeProjectConfig(projectDir, config) {
+  const path = join3(projectDir, "siteplane.config.json");
+  const parsed = siteplaneProjectConfigSchema.parse(config);
+  await writeJsonAtomically(path, parsed, 420);
   return path;
 }
-async function readLocalCredentials(projectDir) {
-  return siteplaneCredentialsSchema.parse(JSON.parse(await readFile5(join3(projectDir, ".siteplane/credentials.json"), "utf8")));
+async function readProjectConfig(projectDir) {
+  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
 }
-async function writeCredentialsAtomically(path, credentials) {
+async function writeJsonAtomically(path, value, mode) {
   const temporaryPath = `${path}.${randomUUID2()}.tmp`;
-  const file = await open(temporaryPath, "wx", 384);
+  const file = await open(temporaryPath, "wx", mode);
   try {
-    await file.writeFile(`${JSON.stringify(credentials, null, 2)}
+    await file.writeFile(`${JSON.stringify(value, null, 2)}
 `, "utf8");
     await file.sync();
   } catch (error) {
@@ -2973,71 +3044,51 @@ async function writeCredentialsAtomically(path, credentials) {
   await file.close();
   try {
     await rename(temporaryPath, path);
-    await chmod(path, 384);
+    await chmod(path, mode);
   } catch (error) {
     await rm(temporaryPath, { force: true });
     throw error;
   }
 }
-var execFileAsync = promisify(execFile);
-async function gitPathMatches(projectDir, path, command) {
-  const args = command === "check-ignore" ? ["check-ignore", "--quiet", relative(projectDir, path)] : ["ls-files", "--error-unmatch", relative(projectDir, path)];
-  try {
-    await execFileAsync("git", args, { cwd: projectDir });
-    return true;
-  } catch {
-    return false;
-  }
-}
 
-// ../cli/dist/config/project-config.js
-import { access, chmod as chmod2, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
+// ../cli/dist/config/credentials.js
+import { execFile } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
-import { join as join4 } from "path";
+import { chmod as chmod2, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
+import { dirname as dirname5, join as join4, relative } from "path";
+import { promisify } from "util";
 import { z as z25 } from "zod";
-var siteplaneProjectConfigSchema = z25.object({
-  version: z25.literal(1),
-  apiBaseUrl: z25.string().url(),
-  siteId: z25.string().uuid(),
-  publicSiteKeyId: z25.string().uuid(),
-  publicSiteKey: z25.string().trim().min(1),
-  fieldContractHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+var siteplaneCredentialsSchema = z25.object({
+  accessToken: z25.string().trim().min(1),
+  siteRevalidationSecret: z25.string().trim().min(1)
 }).strict();
-async function readProjectPackageJson(projectDir) {
-  return JSON.parse(await readFile6(join4(projectDir, "package.json"), "utf8"));
-}
-async function detectNextProject(projectDir) {
-  const packageJson = await readProjectPackageJson(projectDir).catch(() => null);
-  if (packageJson?.dependencies?.next || packageJson?.devDependencies?.next) {
-    return true;
+async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
+  const path = join4(projectDir, ".siteplane/credentials.json");
+  const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
+  const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
+  if (await isTrackedFile(path)) {
+    throw new Error("Refusing to write Siteplane credentials into a tracked file.");
   }
-  for (const fileName of [
-    "next.config.js",
-    "next.config.mjs",
-    "next.config.ts"
-  ]) {
-    try {
-      await access(join4(projectDir, fileName));
-      return true;
-    } catch {
-    }
+  if (!await isIgnoredFile(path)) {
+    throw new Error("Add .siteplane/credentials.json to .gitignore before running Siteplane init.");
   }
-  return false;
+  return path;
 }
-async function writeProjectConfig(projectDir, config) {
-  const path = join4(projectDir, "siteplane.config.json");
-  const parsed = siteplaneProjectConfigSchema.parse(config);
-  await writeJsonAtomically(path, parsed, 420);
+async function writeLocalCredentials(projectDir, credentials, options = {}) {
+  const path = await assertLocalCredentialsPathSafe(projectDir, options);
+  const parsed = siteplaneCredentialsSchema.parse(credentials);
+  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
+  await writeCredentialsAtomically(path, parsed);
   return path;
 }
-async function readProjectConfig(projectDir) {
-  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile6(join4(projectDir, "siteplane.config.json"), "utf8")));
+async function readLocalCredentials(projectDir) {
+  return siteplaneCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
 }
-async function writeJsonAtomically(path, value, mode) {
+async function writeCredentialsAtomically(path, credentials) {
   const temporaryPath = `${path}.${randomUUID3()}.tmp`;
-  const file = await open2(temporaryPath, "wx", mode);
+  const file = await open2(temporaryPath, "wx", 384);
   try {
-    await file.writeFile(`${JSON.stringify(value, null, 2)}
+    await file.writeFile(`${JSON.stringify(credentials, null, 2)}
 `, "utf8");
     await file.sync();
   } catch (error) {
@@ -3048,12 +3099,22 @@ async function writeJsonAtomically(path, value, mode) {
   await file.close();
   try {
     await rename2(temporaryPath, path);
-    await chmod2(path, mode);
+    await chmod2(path, 384);
   } catch (error) {
     await rm2(temporaryPath, { force: true });
     throw error;
   }
 }
+var execFileAsync = promisify(execFile);
+async function gitPathMatches(projectDir, path, command) {
+  const args = command === "check-ignore" ? ["check-ignore", "--quiet", relative(projectDir, path)] : ["ls-files", "--error-unmatch", relative(projectDir, path)];
+  try {
+    await execFileAsync("git", args, { cwd: projectDir });
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // ../cli/dist/commands/init.js
 import { join as join5 } from "path";
@@ -3071,9 +3132,9 @@ async function initCommand(input) {
   return {
     ...paths,
     nextSteps: [
-      "npx siteplane setup context",
-      "Instrument the site and create EditorDefinitionV1.",
-      "npx siteplane setup apply --definition /tmp/siteplane-editor.json"
+      "Run npx siteplane setup context and read the returned task.",
+      "Before source changes, briefly tell the user what Siteplane requested and what you will do.",
+      "Follow the returned steps through setup verify and stop only at ready_for_review or action_required."
     ]
   };
 }
@@ -3192,149 +3253,6 @@ function readErrorMessage(payload) {
   return null;
 }
 
-// ../cli/dist/commands/connect.js
-var claimResponseSchema = z27.object({
-  ok: z27.literal(true),
-  data: z27.object({
-    pairingId: z27.string().uuid(),
-    status: z27.literal("approval_required"),
-    approvalUrl: z27.string().url()
-  }).passthrough()
-}).strict();
-var waitingResponseSchema = z27.object({
-  ok: z27.literal(true),
-  data: z27.object({ status: z27.literal("approval_required") }).strict()
-}).strict();
-var bootstrapResponseSchema2 = z27.object({
-  ok: z27.literal(true),
-  data: siteSetupBootstrapDataSchema
-}).strict();
-async function connectCommand(input) {
-  if (!await detectNextProject(input.projectDir)) {
-    throw new Error("Siteplane connect currently supports Next.js projects.");
-  }
-  await assertLocalCredentialsPathSafe(input.projectDir, {
-    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
-    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
-  });
-  const fetcher = input.fetcher ?? fetch;
-  const pollSecret = randomBytes(32).toString("base64url");
-  const envelopeKey = randomBytes(32).toString("base64url");
-  const endpoint = `${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/connect`;
-  const headers = createHeaders(input);
-  const claimResponse = await fetcher(endpoint, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      action: "claim",
-      pairingCode: input.pairingCode.trim().toUpperCase(),
-      pollSecret,
-      envelopeKey,
-      agentLabel: input.agentLabel?.trim() || null
-    })
-  });
-  const claimPayload = await readJson(claimResponse);
-  const claim = claimResponseSchema.safeParse(claimPayload);
-  if (!claimResponse.ok || !claim.success) {
-    throw new Error(readErrorMessage2(claimPayload) ?? "Siteplane pairing failed.");
-  }
-  let browserOpened = false;
-  try {
-    await (input.openBrowser ?? openInDefaultBrowser)(claim.data.data.approvalUrl);
-    browserOpened = true;
-  } catch {
-  }
-  input.onApprovalRequired?.({
-    approvalUrl: claim.data.data.approvalUrl,
-    browserOpened
-  });
-  const wait = input.wait ?? ((milliseconds) => new Promise((resolve2) => setTimeout(resolve2, milliseconds)));
-  let bootstrap = null;
-  for (; ; ) {
-    const pollResponse = await fetcher(endpoint, {
-      method: "POST",
-      headers,
-      body: JSON.stringify({
-        action: "poll",
-        pairingId: claim.data.data.pairingId,
-        pollSecret,
-        envelopeKey
-      })
-    });
-    const pollPayload = await readJson(pollResponse);
-    const ready = bootstrapResponseSchema2.safeParse(pollPayload);
-    if (pollResponse.ok && ready.success) {
-      bootstrap = ready.data.data;
-      break;
-    }
-    if (pollResponse.status !== 202 || !waitingResponseSchema.safeParse(pollPayload).success) {
-      throw new Error(readErrorMessage2(pollPayload) ?? "Siteplane pairing was not approved.");
-    }
-    await wait(1500);
-  }
-  const paths = await persistSiteSetupBootstrap({
-    projectDir: input.projectDir,
-    setupToken: "pairing",
-    apiBaseUrl: input.apiBaseUrl,
-    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
-    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
-  }, bootstrap);
-  const acknowledgement = await fetcher(endpoint, {
-    method: "POST",
-    headers,
-    body: JSON.stringify({
-      action: "acknowledge",
-      pairingId: claim.data.data.pairingId,
-      pollSecret,
-      envelopeKey
-    })
-  });
-  if (!acknowledgement.ok) {
-    throw new Error("Siteplane setup acknowledgement failed.");
-  }
-  return {
-    ...paths,
-    nextSteps: [
-      "npx siteplane setup context",
-      "Instrument the site and create EditorDefinitionV1.",
-      "npx siteplane setup apply --definition /tmp/siteplane-editor.json"
-    ]
-  };
-}
-async function openInDefaultBrowser(url) {
-  const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32.exe" : "xdg-open";
-  const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url] : [url];
-  await new Promise((resolve2, reject) => {
-    const child = spawn(command, args, { detached: true, stdio: "ignore" });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve2();
-    });
-  });
-}
-function createHeaders(input) {
-  return new Headers({
-    "content-type": "application/json",
-    ...input.vercelAutomationBypassSecret?.trim() ? { "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim() } : {}
-  });
-}
-async function readJson(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
-  }
-}
-function readErrorMessage2(payload) {
-  if (!payload || typeof payload !== "object" || !("error" in payload))
-    return null;
-  const error = payload.error;
-  if (!error || typeof error !== "object" || !("message" in error))
-    return null;
-  return typeof error.message === "string" ? error.message : null;
-}
-
 // ../cli/dist/commands/scan.js
 import { readdir } from "fs/promises";
 import { extname, join as join6 } from "path";
@@ -3380,7 +3298,7 @@ async function collectSourceFiles(directory) {
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile7 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z28 } from "zod";
+import { z as z27 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
@@ -4047,52 +3965,54 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z28.object({
-  code: z28.string().trim().min(1),
-  message: z28.string().trim().min(1)
+var safeErrorSchema = z27.object({
+  code: z27.string().trim().min(1),
+  message: z27.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z28.object({ ok: z28.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z28.object({
-  site: z28.object({ siteId: z28.string().uuid(), portalPath: z28.string() }),
-  run: z28.object({
-    runId: z28.string().uuid(),
-    mode: z28.enum(["initial", "update"]),
-    status: z28.enum([
+var errorResponseSchema2 = z27.object({ ok: z27.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z27.object({
+  task: siteSetupTaskSchema,
+  site: z27.object({ siteId: z27.string().uuid(), portalPath: z27.string() }),
+  run: z27.object({
+    runId: z27.string().uuid(),
+    mode: z27.enum(["initial", "update"]),
+    status: z27.enum([
       "waiting_for_agent",
       "working",
       "action_required",
       "ready_for_review"
     ]),
-    fieldContractHash: z28.string().nullable(),
-    deploymentOrigin: z28.string().nullable(),
-    deploymentRevision: z28.string().nullable(),
-    errorCode: z28.string().nullable(),
-    errorMessage: z28.string().nullable()
+    fieldContractHash: z27.string().nullable(),
+    deploymentOrigin: z27.string().nullable(),
+    deploymentRevision: z27.string().nullable(),
+    errorCode: z27.string().nullable(),
+    errorMessage: z27.string().nullable()
   }),
-  structureHandoff: z28.object({
-    pendingFields: z28.array(setupCorrectionItemSchema).min(1).max(50)
+  structureHandoff: z27.object({
+    pendingFields: z27.array(setupCorrectionItemSchema).max(50),
+    ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
   }).strict().nullable(),
-  allowedTasks: z28.array(z28.string()),
-  requiredEnvironmentNames: z28.array(z28.string())
+  allowedTasks: z27.array(z27.string()),
+  requiredEnvironmentNames: z27.array(z27.string())
 }).strict();
-var contextResponseSchema = z28.object({ ok: z28.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z28.object({
-  status: z28.enum(["applied", "ready_for_review"]),
-  runId: z28.string().uuid().optional(),
-  contractVersionId: z28.string().uuid().optional(),
-  fieldContractHash: z28.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z28.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z28.number().int().nonnegative().optional(),
-  routeCount: z28.number().int().nonnegative().optional()
+var contextResponseSchema = z27.object({ ok: z27.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z27.object({
+  status: z27.enum(["applied", "ready_for_review"]),
+  runId: z27.string().uuid().optional(),
+  contractVersionId: z27.string().uuid().optional(),
+  fieldContractHash: z27.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z27.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z27.number().int().nonnegative().optional(),
+  routeCount: z27.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z28.object({ ok: z28.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z28.object({
-  status: z28.literal("ready_for_review"),
-  runId: z28.string().uuid().optional(),
-  deploymentOrigin: z28.string().url().optional(),
-  deploymentRevision: z28.string().optional()
+var applyResponseSchema = z27.object({ ok: z27.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z27.object({
+  status: z27.literal("ready_for_review"),
+  runId: z27.string().uuid().optional(),
+  deploymentOrigin: z27.string().url().optional(),
+  deploymentRevision: z27.string().optional()
 }).strict();
-var verifyResponseSchema = z28.object({ ok: z28.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z27.object({ ok: z27.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -4216,32 +4136,25 @@ async function readGitRevision(projectDir) {
 // src/bin/run-siteplane.ts
 async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
   const [command, ...commandArgs] = args;
-  if (command === "connect") {
-    const pairingCode = commandArgs[0];
-    if (pairingCode === "--help" || pairingCode === "-h") {
-      dependencies.stdout("Usage: siteplane connect <pairing-code>");
-      return { exitCode: 0 };
-    }
+  if (command === "init") {
+    const setupToken = readOption(commandArgs, "--setup-token");
     const apiBaseUrl = readOption(commandArgs, "--api-base-url") ?? dependencies.env.SITEPLANE_API_BASE_URL ?? "https://siteplane.io";
-    if (!pairingCode || pairingCode.startsWith("--")) {
-      throw new Error("Usage: siteplane connect <pairing-code>");
+    if (!setupToken) {
+      throw new Error("Usage: siteplane init --setup-token <one-time-grant>");
     }
-    const result = await dependencies.commands.connectCommand({
+    const result = await dependencies.commands.initCommand({
       projectDir: dependencies.cwd(),
-      pairingCode,
+      setupToken,
       apiBaseUrl,
-      onApprovalRequired: ({ approvalUrl, browserOpened }) => {
-        dependencies.stdout(
-          browserOpened ? "Opened Siteplane in your browser. Approve the connection there:" : "Could not open a browser automatically. Approve the connection here:"
-        );
-        dependencies.stdout(approvalUrl);
-      },
       ...readOptionalVercelAutomationBypassSecret(dependencies.env)
     });
     dependencies.stdout(`Wrote ${result.configPath}`);
     dependencies.stdout(`Wrote ${result.credentialsPath}`);
-    dependencies.stdout("Siteplane connected. Next steps:");
-    for (const nextStep of result.nextSteps) dependencies.stdout(`- ${nextStep}`);
+    dependencies.stdout(
+      "Siteplane setup connection stored securely. Next steps:"
+    );
+    for (const nextStep of result.nextSteps)
+      dependencies.stdout(`- ${nextStep}`);
     return { exitCode: 0 };
   }
   if (command === "booking") {
@@ -4258,10 +4171,10 @@ async function runSiteplaneCli(args, dependencies = createDefaultDependencies())
     return { exitCode: 0 };
   }
   if (command === "--help" || command === "-h") {
-    dependencies.stdout("Usage: siteplane <connect|setup|analytics|booking>");
+    dependencies.stdout("Usage: siteplane <init|setup|analytics|booking>");
     return { exitCode: 0 };
   }
-  dependencies.stdout("Usage: siteplane <connect|setup|analytics|booking>");
+  dependencies.stdout("Usage: siteplane <init|setup|analytics|booking>");
   return { exitCode: 1 };
 }
 async function runAnalyticsCommand(args, dependencies) {
@@ -4301,7 +4214,9 @@ async function runAnalyticsCommand(args, dependencies) {
     });
     const siteKeyLookup = getAnalyticsKeyLookup(rawPublicKey);
     if (!siteKeyLookup) {
-      throw new Error("Project config contains an invalid Analytics public site key.");
+      throw new Error(
+        "Project config contains an invalid Analytics public site key."
+      );
     }
     const agentClient = readAnalyticsAgentClient(subcommandArgs);
     const result = await dependencies.commands.analyticsInitCommand({
@@ -4318,9 +4233,12 @@ async function runAnalyticsCommand(args, dependencies) {
     return { exitCode: 0 };
   }
   if (subcommand === "check" || subcommand === "sync") {
-    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths([], {
-      projectDir
-    });
+    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths(
+      [],
+      {
+        projectDir
+      }
+    );
     const artifactFilePaths = [join7(projectDir, ".siteplane/analytics.md")];
     const cspFilePaths = await existingPaths([
       join7(projectDir, "next.config.js"),
@@ -4378,7 +4296,12 @@ async function runAnalyticsCommand(args, dependencies) {
         config,
         payload,
         apply: subcommandArgs.includes("--apply"),
-        ...readOption(subcommandArgs, "--confirm-hash") ? { confirmHash: readOption(subcommandArgs, "--confirm-hash") } : {},
+        ...readOption(subcommandArgs, "--confirm-hash") ? {
+          confirmHash: readOption(
+            subcommandArgs,
+            "--confirm-hash"
+          )
+        } : {},
         yes: subcommandArgs.includes("--yes")
       }),
       dependencies
@@ -4425,9 +4348,7 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result, null, 2));
     return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
   }
-  dependencies.stdout(
-    "Usage: siteplane setup <context|apply|verify>"
-  );
+  dependencies.stdout("Usage: siteplane setup <context|apply|verify>");
   return { exitCode: 1 };
 }
 async function runBookingCommand(args, dependencies) {
@@ -4461,9 +4382,12 @@ async function runBookingCommand(args, dependencies) {
     return { exitCode: 0 };
   }
   if (subcommand === "check") {
-    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths(subcommandArgs, {
-      projectDir
-    });
+    const sourceFilePaths = await dependencies.commands.resolveScanFilePaths(
+      subcommandArgs,
+      {
+        projectDir
+      }
+    );
     const result = await dependencies.commands.bookingCheckCommand({
       manifestPath,
       sourceFilePaths
@@ -4516,9 +4440,7 @@ async function runBookingCommand(args, dependencies) {
     dependencies.stdout(await response.text());
     return { exitCode: response.ok ? 0 : 1 };
   }
-  dependencies.stdout(
-    "Usage: siteplane booking <init|check|sync|test>"
-  );
+  dependencies.stdout("Usage: siteplane booking <init|check|sync|test>");
   return { exitCode: 1 };
 }
 async function readBookingProjectState(projectDir, manifestPath, dependencies) {
@@ -4547,7 +4469,9 @@ function createDefaultDependencies() {
     env: process.env,
     stdout: (line) => console.log(line),
     stderr: (line) => console.error(line),
-    readJsonFile: async (path) => JSON.parse(await readFile8(resolve(process.cwd(), path), "utf8")),
+    readJsonFile: async (path) => JSON.parse(
+      await readFile8(resolve(process.cwd(), path), "utf8")
+    ),
     readPackageVersion: async () => {
       const packageJson = JSON.parse(
         await readFile8(new URL("../../package.json", import.meta.url), "utf8")
@@ -4558,7 +4482,6 @@ function createDefaultDependencies() {
       siteSetupApplyCommand,
       siteSetupContextCommand,
       siteSetupVerifyCommand,
-      connectCommand,
       initCommand,
       bookingInitCommand,
       bookingCheckCommand,