siteplane 0.1.41 → 0.1.42

package/README.md

@@ -9,7 +9,7 @@ Copy the setup prompt in Siteplane, then run its exact one-time command in the
 website repository:
 
 ```bash
-npx -y siteplane@0.1.41 init --setup-token <one-time-setup-grant>
+npx -y siteplane@0.1.42 init --setup-token <one-time-setup-grant>
 npx siteplane setup context
 ```
 
@@ -18,6 +18,16 @@ stores it only in the ignored `.siteplane/credentials.json`. No browser approval
 is required. The same connection resumes the open setup and review corrections
 until the owner completes or revokes the setup.
 
+`setup context` returns the single `siteplane.setup-task.v2` task: exact packages, current run,
+authorized modules/scopes, separate unchanged user instructions, environment provenance and one next action.
+An initial instruction such as `Only prices` does not start a correction workflow. The agent integrates
+Siteplane's existing CMS editing layer, preserving the website; it does not build a separate CMS.
+
+Report observed work with `siteplane setup activity --phase inspecting` (also integrating, deploying,
+verifying or repairing). Reports are limited to one per 30 seconds; context polling is not activity.
+Optional Analytics preparation uses this same connection with explicit authorization. It grants no
+activation, import, reporting, booking or publishing rights. Standalone bootstrap cannot replace an open task.
+
 ## Approved fields
 
 Run the exact command from Siteplane's compact apply prompt. It authenticates

package/dist/bin/siteplane.js

@@ -1293,41 +1293,6 @@ var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
 var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
 var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
 var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
-var siteSetupTaskSchema = z14.object({
-  contractVersion: z14.literal("siteplane.setup-task.v1"),
-  workflow: z14.enum(["initial_setup", "structure_update"]),
-  goal: z14.string().min(1),
-  modules: z14.tuple([z14.literal("visual_editor")]),
-  packages: z14.object({
-    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  communication: z14.object({
-    beforeSourceChanges: z14.string().min(1),
-    updates: z14.array(z14.string().min(1)).min(1),
-    blocker: z14.string().min(1)
-  }).strict(),
-  discovery: z14.object({
-    inspectPublicRoutes: z14.boolean(),
-    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
-    rules: z14.array(z14.string().min(1)).min(1)
-  }).strict(),
-  steps: z14.array(z14.object({
-    id: z14.enum([
-      "inspect_repository",
-      "install_packages",
-      "instrument_fields",
-      "apply_contract",
-      "deploy_production",
-      "verify_deployment"
-    ]),
-    instruction: z14.string().min(1)
-  }).strict()).length(6),
-  completion: z14.object({
-    verifiedStatus: z14.literal("ready_for_review"),
-    instruction: z14.string().min(1)
-  }).strict()
-}).strict();
 var editorFieldSchema = z14.object({
   fieldId: fieldIdSchema,
   label: z14.string().trim().min(1),
@@ -1465,7 +1430,7 @@ var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
-var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+var siteSetupOwnerEditabilityNoteSchema = z14.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
   if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
     context.addIssue({
       code: "custom",
@@ -1479,6 +1444,161 @@ var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWN
     });
   }
 });
+var SITE_SETUP_MODULE_SCOPES = {
+  editing: ["setup:read", "setup:write"],
+  analytics: [
+    "analytics:setup",
+    "analytics:sync",
+    "analytics:test",
+    "analytics:readiness",
+    "analytics:agent_instructions",
+    "analytics:public_key_read"
+  ]
+};
+var siteSetupModulesSchema = z14.array(z14.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
+function siteSetupScopes(modules) {
+  return modules.flatMap((module) => [...SITE_SETUP_MODULE_SCOPES[module]]);
+}
+function hasExactSiteSetupScopes(scopes, modules) {
+  const matches = (expected) => scopes.length === expected.length && expected.every((scope) => scopes.includes(scope));
+  return modules ? matches(siteSetupScopes(modules)) : matches(siteSetupScopes(["editing"])) || matches(siteSetupScopes(["editing", "analytics"]));
+}
+var siteSetupActivityInputSchema = z14.object({
+  phase: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ]),
+  textId: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ])
+}).strict().refine((value) => value.phase === value.textId, "Activity text must describe its phase.");
+var nextActionFields = {
+  actor: z14.enum(["agent", "user", "siteplane"]),
+  boundary: z14.enum([
+    "source",
+    "environment",
+    "deployment",
+    "verification",
+    "authorization",
+    "review"
+  ]),
+  precondition: z14.string().min(1).max(1e3),
+  instruction: z14.string().min(1).max(2e3),
+  expectedEvidence: z14.string().min(1).max(1e3)
+};
+var siteSetupNextActionSchema = z14.discriminatedUnion("kind", [
+  z14.object({
+    ...nextActionFields,
+    kind: z14.literal("run_command"),
+    command: z14.string().min(1).max(500)
+  }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("agent_edit") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("needs_user_action") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("wait") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("done") }).strict()
+]);
+var siteSetupTaskRunSchema = z14.object({
+  runId: z14.string().uuid(),
+  mode: siteSetupRunModeSchema,
+  status: siteSetupRunStatusSchema,
+  fieldContractHash: z14.string().nullable(),
+  deploymentOrigin: z14.string().url().nullable(),
+  deploymentRevision: z14.string().nullable(),
+  publicRuntimeKeyId: z14.string().uuid().nullable(),
+  reviewVersion: z14.string().nullable()
+}).strict();
+var siteSetupTaskProgressSchema = z14.object({
+  progressStage: z14.enum([
+    "waiting_for_connection",
+    "agent_connected",
+    "project_context_loaded",
+    "fields_prepared",
+    "deployment_verification",
+    "ready_for_review",
+    "action_required",
+    "completed"
+  ]),
+  lastVerifiedAt: z14.string().datetime().nullable(),
+  lastActivityAt: z14.string().datetime(),
+  activitySource: z14.enum(["user", "server", "agent"]),
+  activityPhase: siteSetupActivityInputSchema.shape.phase.nullable(),
+  activityTextId: siteSetupActivityInputSchema.shape.textId.nullable()
+}).strict();
+var siteSetupTaskSchema = z14.object({
+  contractVersion: z14.literal("siteplane.setup-task.v2"),
+  workflow: z14.enum(["initial_setup", "structure_update"]),
+  goal: z14.string().min(1),
+  modules: siteSetupModulesSchema,
+  authorizationVersion: z14.number().int().positive(),
+  authorizedScopes: z14.array(z14.string()).min(2),
+  site: z14.object({
+    siteId: z14.string().uuid(),
+    portalPath: z14.string(),
+    adminOrigin: z14.string().url()
+  }).strict().nullable(),
+  run: siteSetupTaskRunSchema.nullable(),
+  progress: siteSetupTaskProgressSchema.nullable(),
+  assignment: z14.literal("owned"),
+  deadline: z14.string().datetime().nullable(),
+  userInstructions: z14.object({
+    text: siteSetupOwnerEditabilityNoteSchema,
+    source: z14.literal("user"),
+    trust: z14.literal("untrusted")
+  }).strict(),
+  corrections: setupCorrectionItemsSchema,
+  environmentBindings: z14.array(z14.object({
+    name: z14.string().regex(/^[A-Z][A-Z0-9_]+$/u),
+    source: z14.string().min(1),
+    sensitivity: z14.enum(["public", "secret"]),
+    usage: z14.enum(["build", "server", "build_and_server"]),
+    evidence: z14.string().min(1)
+  }).strict()),
+  nextAction: siteSetupNextActionSchema,
+  error: z14.object({
+    code: z14.string().regex(/^[a-z0-9_.]+$/u).max(160),
+    boundary: nextActionFields.boundary,
+    responsibleActor: nextActionFields.actor,
+    retryable: z14.boolean(),
+    retryAfter: z14.number().int().nonnegative().nullable(),
+    requestId: z14.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
+  }).strict().nullable(),
+  packages: z14.object({
+    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  communication: z14.object({
+    beforeSourceChanges: z14.string().min(1),
+    updates: z14.array(z14.string().min(1)).min(1),
+    blocker: z14.string().min(1)
+  }).strict(),
+  discovery: z14.object({
+    inspectPublicRoutes: z14.boolean(),
+    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z14.array(z14.string().min(1)).min(1)
+  }).strict(),
+  steps: z14.array(z14.object({
+    id: z14.enum([
+      "inspect_repository",
+      "install_packages",
+      "instrument_fields",
+      "apply_contract",
+      "deploy_production",
+      "verify_deployment"
+    ]),
+    instruction: z14.string().min(1)
+  }).strict()).length(6),
+  completion: z14.object({
+    verifiedStatus: z14.literal("ready_for_review"),
+    instruction: z14.string().min(1)
+  }).strict()
+}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.");
 var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
 var continueSiteSetupInputSchema = z14.object({
@@ -3970,31 +4090,7 @@ var safeErrorSchema = z27.object({
   message: z27.string().trim().min(1)
 }).passthrough();
 var errorResponseSchema2 = z27.object({ ok: z27.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z27.object({
-  task: siteSetupTaskSchema,
-  site: z27.object({ siteId: z27.string().uuid(), portalPath: z27.string() }),
-  run: z27.object({
-    runId: z27.string().uuid(),
-    mode: z27.enum(["initial", "update"]),
-    status: z27.enum([
-      "waiting_for_agent",
-      "working",
-      "action_required",
-      "ready_for_review"
-    ]),
-    fieldContractHash: z27.string().nullable(),
-    deploymentOrigin: z27.string().nullable(),
-    deploymentRevision: z27.string().nullable(),
-    errorCode: z27.string().nullable(),
-    errorMessage: z27.string().nullable()
-  }),
-  structureHandoff: z27.object({
-    pendingFields: z27.array(setupCorrectionItemSchema).max(50),
-    ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
-  }).strict().nullable(),
-  allowedTasks: z27.array(z27.string()),
-  requiredEnvironmentNames: z27.array(z27.string())
-}).strict();
+var contextDataSchema = z27.object({ task: siteSetupTaskSchema }).strict();
 var contextResponseSchema = z27.object({ ok: z27.literal(true), data: contextDataSchema }).strict();
 var applyDataSchema = z27.object({
   status: z27.enum(["applied", "ready_for_review"]),
@@ -4132,6 +4228,24 @@ async function readGitRevision(projectDir) {
   }
   return revision;
 }
+async function siteSetupActivityCommand(input) {
+  const activity = siteSetupActivityInputSchema.safeParse({
+    phase: input.phase,
+    textId: input.phase
+  });
+  if (!activity.success)
+    return {
+      status: "action_required",
+      code: "site_setup.invalid_activity",
+      message: "Choose inspecting, integrating, deploying, verifying or repairing."
+    };
+  const response = await postSiteSetup(input, "activity", activity.data);
+  const parsed = z27.object({
+    ok: z27.literal(true),
+    data: z27.object({ status: z27.enum(["recorded", "rate_limited"]) }).strict()
+  }).strict().safeParse(response.payload);
+  return response.ok && parsed.success ? parsed.data.data : actionRequired(response.payload, "Setup activity could not be recorded.");
+}
 
 // src/bin/run-siteplane.ts
 async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
@@ -4326,6 +4440,15 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result, null, 2));
     return { exitCode: result.status === "action_required" ? 1 : 0 };
   }
+  if (area === "activity") {
+    const result = await dependencies.commands.siteSetupActivityCommand({
+      projectDir,
+      phase: readRequiredOption(areaArgs, "--phase"),
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "action_required" ? 1 : 0 };
+  }
   if (area === "apply") {
     const editorDefinition = await dependencies.readJsonFile(
       readRequiredOption(areaArgs, "--definition")
@@ -4348,7 +4471,7 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result, null, 2));
     return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
   }
-  dependencies.stdout("Usage: siteplane setup <context|apply|verify>");
+  dependencies.stdout("Usage: siteplane setup <context|activity|apply|verify>");
   return { exitCode: 1 };
 }
 async function runBookingCommand(args, dependencies) {
@@ -4481,6 +4604,7 @@ function createDefaultDependencies() {
     commands: {
       siteSetupApplyCommand,
       siteSetupContextCommand,
+      siteSetupActivityCommand,
       siteSetupVerifyCommand,
       initCommand,
       bookingInitCommand,

package/dist/index.js

@@ -1021,41 +1021,6 @@ var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
 var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
 var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
 var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
-var siteSetupTaskSchema = z14.object({
-  contractVersion: z14.literal("siteplane.setup-task.v1"),
-  workflow: z14.enum(["initial_setup", "structure_update"]),
-  goal: z14.string().min(1),
-  modules: z14.tuple([z14.literal("visual_editor")]),
-  packages: z14.object({
-    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  communication: z14.object({
-    beforeSourceChanges: z14.string().min(1),
-    updates: z14.array(z14.string().min(1)).min(1),
-    blocker: z14.string().min(1)
-  }).strict(),
-  discovery: z14.object({
-    inspectPublicRoutes: z14.boolean(),
-    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
-    rules: z14.array(z14.string().min(1)).min(1)
-  }).strict(),
-  steps: z14.array(z14.object({
-    id: z14.enum([
-      "inspect_repository",
-      "install_packages",
-      "instrument_fields",
-      "apply_contract",
-      "deploy_production",
-      "verify_deployment"
-    ]),
-    instruction: z14.string().min(1)
-  }).strict()).length(6),
-  completion: z14.object({
-    verifiedStatus: z14.literal("ready_for_review"),
-    instruction: z14.string().min(1)
-  }).strict()
-}).strict();
 var editorFieldSchema = z14.object({
   fieldId: fieldIdSchema,
   label: z14.string().trim().min(1),
@@ -1193,7 +1158,7 @@ var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
-var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+var siteSetupOwnerEditabilityNoteSchema = z14.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
   if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
     context.addIssue({
       code: "custom",
@@ -1207,6 +1172,161 @@ var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWN
     });
   }
 });
+var SITE_SETUP_MODULE_SCOPES = {
+  editing: ["setup:read", "setup:write"],
+  analytics: [
+    "analytics:setup",
+    "analytics:sync",
+    "analytics:test",
+    "analytics:readiness",
+    "analytics:agent_instructions",
+    "analytics:public_key_read"
+  ]
+};
+var siteSetupModulesSchema = z14.array(z14.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
+function siteSetupScopes(modules) {
+  return modules.flatMap((module) => [...SITE_SETUP_MODULE_SCOPES[module]]);
+}
+function hasExactSiteSetupScopes(scopes, modules) {
+  const matches = (expected) => scopes.length === expected.length && expected.every((scope) => scopes.includes(scope));
+  return modules ? matches(siteSetupScopes(modules)) : matches(siteSetupScopes(["editing"])) || matches(siteSetupScopes(["editing", "analytics"]));
+}
+var siteSetupActivityInputSchema = z14.object({
+  phase: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ]),
+  textId: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ])
+}).strict().refine((value) => value.phase === value.textId, "Activity text must describe its phase.");
+var nextActionFields = {
+  actor: z14.enum(["agent", "user", "siteplane"]),
+  boundary: z14.enum([
+    "source",
+    "environment",
+    "deployment",
+    "verification",
+    "authorization",
+    "review"
+  ]),
+  precondition: z14.string().min(1).max(1e3),
+  instruction: z14.string().min(1).max(2e3),
+  expectedEvidence: z14.string().min(1).max(1e3)
+};
+var siteSetupNextActionSchema = z14.discriminatedUnion("kind", [
+  z14.object({
+    ...nextActionFields,
+    kind: z14.literal("run_command"),
+    command: z14.string().min(1).max(500)
+  }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("agent_edit") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("needs_user_action") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("wait") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("done") }).strict()
+]);
+var siteSetupTaskRunSchema = z14.object({
+  runId: z14.string().uuid(),
+  mode: siteSetupRunModeSchema,
+  status: siteSetupRunStatusSchema,
+  fieldContractHash: z14.string().nullable(),
+  deploymentOrigin: z14.string().url().nullable(),
+  deploymentRevision: z14.string().nullable(),
+  publicRuntimeKeyId: z14.string().uuid().nullable(),
+  reviewVersion: z14.string().nullable()
+}).strict();
+var siteSetupTaskProgressSchema = z14.object({
+  progressStage: z14.enum([
+    "waiting_for_connection",
+    "agent_connected",
+    "project_context_loaded",
+    "fields_prepared",
+    "deployment_verification",
+    "ready_for_review",
+    "action_required",
+    "completed"
+  ]),
+  lastVerifiedAt: z14.string().datetime().nullable(),
+  lastActivityAt: z14.string().datetime(),
+  activitySource: z14.enum(["user", "server", "agent"]),
+  activityPhase: siteSetupActivityInputSchema.shape.phase.nullable(),
+  activityTextId: siteSetupActivityInputSchema.shape.textId.nullable()
+}).strict();
+var siteSetupTaskSchema = z14.object({
+  contractVersion: z14.literal("siteplane.setup-task.v2"),
+  workflow: z14.enum(["initial_setup", "structure_update"]),
+  goal: z14.string().min(1),
+  modules: siteSetupModulesSchema,
+  authorizationVersion: z14.number().int().positive(),
+  authorizedScopes: z14.array(z14.string()).min(2),
+  site: z14.object({
+    siteId: z14.string().uuid(),
+    portalPath: z14.string(),
+    adminOrigin: z14.string().url()
+  }).strict().nullable(),
+  run: siteSetupTaskRunSchema.nullable(),
+  progress: siteSetupTaskProgressSchema.nullable(),
+  assignment: z14.literal("owned"),
+  deadline: z14.string().datetime().nullable(),
+  userInstructions: z14.object({
+    text: siteSetupOwnerEditabilityNoteSchema,
+    source: z14.literal("user"),
+    trust: z14.literal("untrusted")
+  }).strict(),
+  corrections: setupCorrectionItemsSchema,
+  environmentBindings: z14.array(z14.object({
+    name: z14.string().regex(/^[A-Z][A-Z0-9_]+$/u),
+    source: z14.string().min(1),
+    sensitivity: z14.enum(["public", "secret"]),
+    usage: z14.enum(["build", "server", "build_and_server"]),
+    evidence: z14.string().min(1)
+  }).strict()),
+  nextAction: siteSetupNextActionSchema,
+  error: z14.object({
+    code: z14.string().regex(/^[a-z0-9_.]+$/u).max(160),
+    boundary: nextActionFields.boundary,
+    responsibleActor: nextActionFields.actor,
+    retryable: z14.boolean(),
+    retryAfter: z14.number().int().nonnegative().nullable(),
+    requestId: z14.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
+  }).strict().nullable(),
+  packages: z14.object({
+    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  communication: z14.object({
+    beforeSourceChanges: z14.string().min(1),
+    updates: z14.array(z14.string().min(1)).min(1),
+    blocker: z14.string().min(1)
+  }).strict(),
+  discovery: z14.object({
+    inspectPublicRoutes: z14.boolean(),
+    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z14.array(z14.string().min(1)).min(1)
+  }).strict(),
+  steps: z14.array(z14.object({
+    id: z14.enum([
+      "inspect_repository",
+      "install_packages",
+      "instrument_fields",
+      "apply_contract",
+      "deploy_production",
+      "verify_deployment"
+    ]),
+    instruction: z14.string().min(1)
+  }).strict()).length(6),
+  completion: z14.object({
+    verifiedStatus: z14.literal("ready_for_review"),
+    instruction: z14.string().min(1)
+  }).strict()
+}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.");
 var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
 var continueSiteSetupInputSchema = z14.object({
@@ -2366,31 +2486,7 @@ var safeErrorSchema = z27.object({
   message: z27.string().trim().min(1)
 }).passthrough();
 var errorResponseSchema2 = z27.object({ ok: z27.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z27.object({
-  task: siteSetupTaskSchema,
-  site: z27.object({ siteId: z27.string().uuid(), portalPath: z27.string() }),
-  run: z27.object({
-    runId: z27.string().uuid(),
-    mode: z27.enum(["initial", "update"]),
-    status: z27.enum([
-      "waiting_for_agent",
-      "working",
-      "action_required",
-      "ready_for_review"
-    ]),
-    fieldContractHash: z27.string().nullable(),
-    deploymentOrigin: z27.string().nullable(),
-    deploymentRevision: z27.string().nullable(),
-    errorCode: z27.string().nullable(),
-    errorMessage: z27.string().nullable()
-  }),
-  structureHandoff: z27.object({
-    pendingFields: z27.array(setupCorrectionItemSchema).max(50),
-    ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
-  }).strict().nullable(),
-  allowedTasks: z27.array(z27.string()),
-  requiredEnvironmentNames: z27.array(z27.string())
-}).strict();
+var contextDataSchema = z27.object({ task: siteSetupTaskSchema }).strict();
 var contextResponseSchema = z27.object({ ok: z27.literal(true), data: contextDataSchema }).strict();
 var applyDataSchema = z27.object({
   status: z27.enum(["applied", "ready_for_review"]),

package/dist/next.js

@@ -1223,41 +1223,6 @@ var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
 var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
 var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
 var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
-var siteSetupTaskSchema = z14.object({
-  contractVersion: z14.literal("siteplane.setup-task.v1"),
-  workflow: z14.enum(["initial_setup", "structure_update"]),
-  goal: z14.string().min(1),
-  modules: z14.tuple([z14.literal("visual_editor")]),
-  packages: z14.object({
-    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  communication: z14.object({
-    beforeSourceChanges: z14.string().min(1),
-    updates: z14.array(z14.string().min(1)).min(1),
-    blocker: z14.string().min(1)
-  }).strict(),
-  discovery: z14.object({
-    inspectPublicRoutes: z14.boolean(),
-    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
-    rules: z14.array(z14.string().min(1)).min(1)
-  }).strict(),
-  steps: z14.array(z14.object({
-    id: z14.enum([
-      "inspect_repository",
-      "install_packages",
-      "instrument_fields",
-      "apply_contract",
-      "deploy_production",
-      "verify_deployment"
-    ]),
-    instruction: z14.string().min(1)
-  }).strict()).length(6),
-  completion: z14.object({
-    verifiedStatus: z14.literal("ready_for_review"),
-    instruction: z14.string().min(1)
-  }).strict()
-}).strict();
 var editorFieldSchema = z14.object({
   fieldId: fieldIdSchema,
   label: z14.string().trim().min(1),
@@ -1395,7 +1360,7 @@ var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
-var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+var siteSetupOwnerEditabilityNoteSchema = z14.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
   if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
     context.addIssue({
       code: "custom",
@@ -1409,6 +1374,161 @@ var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWN
     });
   }
 });
+var SITE_SETUP_MODULE_SCOPES = {
+  editing: ["setup:read", "setup:write"],
+  analytics: [
+    "analytics:setup",
+    "analytics:sync",
+    "analytics:test",
+    "analytics:readiness",
+    "analytics:agent_instructions",
+    "analytics:public_key_read"
+  ]
+};
+var siteSetupModulesSchema = z14.array(z14.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
+function siteSetupScopes(modules) {
+  return modules.flatMap((module) => [...SITE_SETUP_MODULE_SCOPES[module]]);
+}
+function hasExactSiteSetupScopes(scopes, modules) {
+  const matches = (expected) => scopes.length === expected.length && expected.every((scope) => scopes.includes(scope));
+  return modules ? matches(siteSetupScopes(modules)) : matches(siteSetupScopes(["editing"])) || matches(siteSetupScopes(["editing", "analytics"]));
+}
+var siteSetupActivityInputSchema = z14.object({
+  phase: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ]),
+  textId: z14.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ])
+}).strict().refine((value) => value.phase === value.textId, "Activity text must describe its phase.");
+var nextActionFields = {
+  actor: z14.enum(["agent", "user", "siteplane"]),
+  boundary: z14.enum([
+    "source",
+    "environment",
+    "deployment",
+    "verification",
+    "authorization",
+    "review"
+  ]),
+  precondition: z14.string().min(1).max(1e3),
+  instruction: z14.string().min(1).max(2e3),
+  expectedEvidence: z14.string().min(1).max(1e3)
+};
+var siteSetupNextActionSchema = z14.discriminatedUnion("kind", [
+  z14.object({
+    ...nextActionFields,
+    kind: z14.literal("run_command"),
+    command: z14.string().min(1).max(500)
+  }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("agent_edit") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("needs_user_action") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("wait") }).strict(),
+  z14.object({ ...nextActionFields, kind: z14.literal("done") }).strict()
+]);
+var siteSetupTaskRunSchema = z14.object({
+  runId: z14.string().uuid(),
+  mode: siteSetupRunModeSchema,
+  status: siteSetupRunStatusSchema,
+  fieldContractHash: z14.string().nullable(),
+  deploymentOrigin: z14.string().url().nullable(),
+  deploymentRevision: z14.string().nullable(),
+  publicRuntimeKeyId: z14.string().uuid().nullable(),
+  reviewVersion: z14.string().nullable()
+}).strict();
+var siteSetupTaskProgressSchema = z14.object({
+  progressStage: z14.enum([
+    "waiting_for_connection",
+    "agent_connected",
+    "project_context_loaded",
+    "fields_prepared",
+    "deployment_verification",
+    "ready_for_review",
+    "action_required",
+    "completed"
+  ]),
+  lastVerifiedAt: z14.string().datetime().nullable(),
+  lastActivityAt: z14.string().datetime(),
+  activitySource: z14.enum(["user", "server", "agent"]),
+  activityPhase: siteSetupActivityInputSchema.shape.phase.nullable(),
+  activityTextId: siteSetupActivityInputSchema.shape.textId.nullable()
+}).strict();
+var siteSetupTaskSchema = z14.object({
+  contractVersion: z14.literal("siteplane.setup-task.v2"),
+  workflow: z14.enum(["initial_setup", "structure_update"]),
+  goal: z14.string().min(1),
+  modules: siteSetupModulesSchema,
+  authorizationVersion: z14.number().int().positive(),
+  authorizedScopes: z14.array(z14.string()).min(2),
+  site: z14.object({
+    siteId: z14.string().uuid(),
+    portalPath: z14.string(),
+    adminOrigin: z14.string().url()
+  }).strict().nullable(),
+  run: siteSetupTaskRunSchema.nullable(),
+  progress: siteSetupTaskProgressSchema.nullable(),
+  assignment: z14.literal("owned"),
+  deadline: z14.string().datetime().nullable(),
+  userInstructions: z14.object({
+    text: siteSetupOwnerEditabilityNoteSchema,
+    source: z14.literal("user"),
+    trust: z14.literal("untrusted")
+  }).strict(),
+  corrections: setupCorrectionItemsSchema,
+  environmentBindings: z14.array(z14.object({
+    name: z14.string().regex(/^[A-Z][A-Z0-9_]+$/u),
+    source: z14.string().min(1),
+    sensitivity: z14.enum(["public", "secret"]),
+    usage: z14.enum(["build", "server", "build_and_server"]),
+    evidence: z14.string().min(1)
+  }).strict()),
+  nextAction: siteSetupNextActionSchema,
+  error: z14.object({
+    code: z14.string().regex(/^[a-z0-9_.]+$/u).max(160),
+    boundary: nextActionFields.boundary,
+    responsibleActor: nextActionFields.actor,
+    retryable: z14.boolean(),
+    retryAfter: z14.number().int().nonnegative().nullable(),
+    requestId: z14.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
+  }).strict().nullable(),
+  packages: z14.object({
+    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  communication: z14.object({
+    beforeSourceChanges: z14.string().min(1),
+    updates: z14.array(z14.string().min(1)).min(1),
+    blocker: z14.string().min(1)
+  }).strict(),
+  discovery: z14.object({
+    inspectPublicRoutes: z14.boolean(),
+    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z14.array(z14.string().min(1)).min(1)
+  }).strict(),
+  steps: z14.array(z14.object({
+    id: z14.enum([
+      "inspect_repository",
+      "install_packages",
+      "instrument_fields",
+      "apply_contract",
+      "deploy_production",
+      "verify_deployment"
+    ]),
+    instruction: z14.string().min(1)
+  }).strict()).length(6),
+  completion: z14.object({
+    verifiedStatus: z14.literal("ready_for_review"),
+    instruction: z14.string().min(1)
+  }).strict()
+}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.");
 var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
 var continueSiteSetupInputSchema = z14.object({
@@ -2736,31 +2856,7 @@ var safeErrorSchema = z27.object({
   message: z27.string().trim().min(1)
 }).passthrough();
 var errorResponseSchema2 = z27.object({ ok: z27.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z27.object({
-  task: siteSetupTaskSchema,
-  site: z27.object({ siteId: z27.string().uuid(), portalPath: z27.string() }),
-  run: z27.object({
-    runId: z27.string().uuid(),
-    mode: z27.enum(["initial", "update"]),
-    status: z27.enum([
-      "waiting_for_agent",
-      "working",
-      "action_required",
-      "ready_for_review"
-    ]),
-    fieldContractHash: z27.string().nullable(),
-    deploymentOrigin: z27.string().nullable(),
-    deploymentRevision: z27.string().nullable(),
-    errorCode: z27.string().nullable(),
-    errorMessage: z27.string().nullable()
-  }),
-  structureHandoff: z27.object({
-    pendingFields: z27.array(setupCorrectionItemSchema).max(50),
-    ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
-  }).strict().nullable(),
-  allowedTasks: z27.array(z27.string()),
-  requiredEnvironmentNames: z27.array(z27.string())
-}).strict();
+var contextDataSchema = z27.object({ task: siteSetupTaskSchema }).strict();
 var contextResponseSchema = z27.object({ ok: z27.literal(true), data: contextDataSchema }).strict();
 var applyDataSchema = z27.object({
   status: z27.enum(["applied", "ready_for_review"]),

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "siteplane",
   "private": false,
-  "version": "0.1.41",
+  "version": "0.1.42",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {