siteplane 0.1.41 → 0.1.43

package/dist/bin/siteplane.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/bin/run-siteplane.ts
-import { randomUUID as randomUUID4 } from "crypto";
-import { access as access2, readFile as readFile8 } from "fs/promises";
-import { join as join7, resolve } from "path";
+import { randomUUID as randomUUID7 } from "crypto";
+import { access as access6, readFile as readFile13 } from "fs/promises";
+import { join as join12, resolve as resolve4 } from "path";
 
 // ../cli/dist/analytics/manifest.js
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -892,7 +892,7 @@ function redactBookingManifest(value) {
 var BOOKING_CREATE_PAYLOAD_LIMIT_BYTES = 16 * 1024;
 
 // ../shared/dist/bridge-protocol.js
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // ../shared/dist/field-id.js
 import { z as z9 } from "zod";
@@ -939,21 +939,70 @@ var imageValueSchema = z11.object({
   ]).optional()
 });
 
+// ../shared/dist/setup-deployment.js
+import { z as z12 } from "zod";
+var version = z12.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
+var hash = z12.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var setupDeploymentRecordSchema = z12.object({
+  version: z12.literal(1),
+  operationId: z12.string().uuid(),
+  provider: z12.literal("vercel"),
+  projectId: z12.string().regex(/^prj_[A-Za-z0-9]+$/u),
+  teamId: z12.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u),
+  origin: z12.string().url().refine((value) => {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.origin === value && !url.username && !url.password;
+  }),
+  deploymentId: z12.string().regex(/^dpl_[A-Za-z0-9]+$/u).nullable(),
+  revision: z12.string().regex(/^[0-9a-f]{40}$/u),
+  fieldContractHash: hash,
+  packages: z12.object({ siteplane: version, runtimeNext: version }).strict(),
+  configurationFingerprint: hash,
+  adminSecretGeneration: z12.string().uuid(),
+  revalidationGeneration: z12.number().int().positive(),
+  startedAt: z12.string().datetime(),
+  environmentWrittenAt: z12.string().datetime().nullable(),
+  deployRequestedAt: z12.string().datetime().nullable(),
+  deadline: z12.string().datetime(),
+  phase: z12.enum([
+    "planned",
+    "environment_written",
+    "deploy_requested",
+    "deployed",
+    "verified",
+    "failed"
+  ]),
+  build: z12.object({
+    node: version,
+    packageManager: z12.enum(["npm", "pnpm"]),
+    packageManagerVersion: version,
+    lockfileHash: hash
+  }).strict().nullable()
+}).strict();
+var setupDeploymentInputSchema = z12.discriminatedUnion("action", [
+  z12.object({ action: z12.literal("read") }).strict(),
+  z12.object({
+    action: z12.literal("record"),
+    expectedOperationId: z12.string().uuid().nullable(),
+    record: setupDeploymentRecordSchema
+  }).strict()
+]);
+
 // ../shared/dist/site-setup.js
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // ../shared/dist/site-field-contract.js
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 
 // ../shared/dist/fallback-hash.js
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var SAFE_REPRESENTATION_REASONS = [
   "asset_import_rewritten",
   "relative_url_normalized",
   "line_endings_normalized",
   "image_value_serialized"
 ];
-var safeRepresentationReasonSchema = z12.enum(SAFE_REPRESENTATION_REASONS);
+var safeRepresentationReasonSchema = z13.enum(SAFE_REPRESENTATION_REASONS);
 function canonicalizeFallbackValue(input) {
   const fieldType = fieldTypeSchema.parse(input.fieldType);
   if (input.safeRepresentationReason !== void 0) {
@@ -989,10 +1038,10 @@ function createCanonicalFallbackHash(input) {
   const payload = stableJsonStringify(canonical);
   return `sha256:${sha256Hex(payload)}`;
 }
-var linkFallbackSchema = z12.object({
-  href: z12.string().trim().min(1),
-  label: z12.string().trim().min(1).optional(),
-  target: z12.enum(["_self", "_blank"]).optional()
+var linkFallbackSchema = z13.object({
+  href: z13.string().trim().min(1),
+  label: z13.string().trim().min(1).optional(),
+  target: z13.enum(["_self", "_blank"]).optional()
 }).passthrough();
 function normalizeLineEndings(value) {
   return value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
@@ -1170,67 +1219,67 @@ var SHA256_CONSTANTS = [
 // ../shared/dist/site-field-contract.js
 var fieldContractVersion = "1.0.0";
 var scannerContractVersion = "1.0.0";
-var siteFieldStatusSchema = z13.enum(["hidden", "active"]);
-var semanticVersionSchema = z13.string().regex(/^\d+\.\d+\.\d+$/u);
-var siteFieldRouteKeySchema = z13.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
-var repositoryRelativePosixPathSchema = z13.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
-var sourceMappingSchema = z13.object({
-  kind: z13.literal("function"),
+var siteFieldStatusSchema = z14.enum(["hidden", "active"]);
+var semanticVersionSchema = z14.string().regex(/^\d+\.\d+\.\d+$/u);
+var siteFieldRouteKeySchema = z14.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
+var repositoryRelativePosixPathSchema = z14.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
+var sourceMappingSchema = z14.object({
+  kind: z14.literal("function"),
   filePath: repositoryRelativePosixPathSchema,
-  exportName: z13.string().trim().min(1).optional(),
-  sourcePath: z13.string().trim().min(1).optional(),
+  exportName: z14.string().trim().min(1).optional(),
+  sourcePath: z14.string().trim().min(1).optional(),
   editTarget: fieldIdSchema.optional()
 }).strict();
-var domMappingSchema = z13.object({
-  attribute: z13.literal("data-siteplane-field-id"),
-  previewStrategy: z13.enum(["dom", "event"])
+var domMappingSchema = z14.object({
+  attribute: z14.literal("data-siteplane-field-id"),
+  previewStrategy: z14.enum(["dom", "event"])
 }).strict();
-var fieldBaseSchema = z13.object({
+var fieldBaseSchema = z14.object({
   fieldId: fieldIdSchema,
   routeKey: siteFieldRouteKeySchema,
   source: sourceMappingSchema,
   dom: domMappingSchema.optional()
 }).strict();
-var linkFallbackSchema2 = z13.object({
-  href: z13.string().trim().min(1),
-  label: z13.string().trim().min(1).optional(),
-  target: z13.enum(["_self", "_blank"]).optional()
+var linkFallbackSchema2 = z14.object({
+  href: z14.string().trim().min(1),
+  label: z14.string().trim().min(1).optional(),
+  target: z14.enum(["_self", "_blank"]).optional()
 }).strict();
-var imageFallbackSchema = z13.object({
-  src: z13.string().trim().min(1),
-  alt: z13.string().trim().max(300),
-  width: z13.number().int().positive().optional(),
-  height: z13.number().int().positive().optional(),
-  crop: z13.object({
-    x: z13.number().min(0).max(100),
-    y: z13.number().min(0).max(100),
-    zoom: z13.number().min(1).max(4),
-    aspectRatio: z13.number().positive().max(10)
+var imageFallbackSchema = z14.object({
+  src: z14.string().trim().min(1),
+  alt: z14.string().trim().max(300),
+  width: z14.number().int().positive().optional(),
+  height: z14.number().int().positive().optional(),
+  crop: z14.object({
+    x: z14.number().min(0).max(100),
+    y: z14.number().min(0).max(100),
+    zoom: z14.number().min(1).max(4),
+    aspectRatio: z14.number().positive().max(10)
   }).strict().optional()
 }).strict();
-var siteFieldContractFieldSchema = z13.discriminatedUnion("fieldType", [
+var siteFieldContractFieldSchema = z14.discriminatedUnion("fieldType", [
   fieldBaseSchema.extend({
-    fieldType: z13.literal("text"),
-    fallback: z13.string()
+    fieldType: z14.literal("text"),
+    fallback: z14.string()
   }),
   fieldBaseSchema.extend({
-    fieldType: z13.literal("longText"),
-    fallback: z13.string()
+    fieldType: z14.literal("longText"),
+    fallback: z14.string()
   }),
   fieldBaseSchema.extend({
-    fieldType: z13.literal("link"),
+    fieldType: z14.literal("link"),
     fallback: linkFallbackSchema2
   }),
   fieldBaseSchema.extend({
-    fieldType: z13.literal("image"),
+    fieldType: z14.literal("image"),
     fallback: imageFallbackSchema
   })
 ]);
-var siteFieldContractV1Schema = z13.object({
-  version: z13.literal(1),
+var siteFieldContractV1Schema = z14.object({
+  version: z14.literal(1),
   fieldContractVersion: semanticVersionSchema,
   scannerContractVersion: semanticVersionSchema,
-  fields: z13.array(siteFieldContractFieldSchema)
+  fields: z14.array(siteFieldContractFieldSchema)
 }).strict().superRefine((contract, context) => {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, field] of contract.fields.entries()) {
@@ -1290,55 +1339,20 @@ var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH = 2e3;
 var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES = 8e3;
 var CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES = 32 * 1024;
 var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
-var siteSetupRunStatusSchema = z14.enum(SITE_SETUP_RUN_STATUSES);
-var siteSetupRunModeSchema = z14.enum(SITE_SETUP_RUN_MODES);
-var siteSetupErrorCodeSchema = z14.enum(SITE_SETUP_ERROR_CODES);
-var siteSetupTaskSchema = z14.object({
-  contractVersion: z14.literal("siteplane.setup-task.v1"),
-  workflow: z14.enum(["initial_setup", "structure_update"]),
-  goal: z14.string().min(1),
-  modules: z14.tuple([z14.literal("visual_editor")]),
-  packages: z14.object({
-    siteplane: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z14.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  communication: z14.object({
-    beforeSourceChanges: z14.string().min(1),
-    updates: z14.array(z14.string().min(1)).min(1),
-    blocker: z14.string().min(1)
-  }).strict(),
-  discovery: z14.object({
-    inspectPublicRoutes: z14.boolean(),
-    contentKinds: z14.array(z14.enum(["text", "longText", "link", "image"])).min(1),
-    rules: z14.array(z14.string().min(1)).min(1)
-  }).strict(),
-  steps: z14.array(z14.object({
-    id: z14.enum([
-      "inspect_repository",
-      "install_packages",
-      "instrument_fields",
-      "apply_contract",
-      "deploy_production",
-      "verify_deployment"
-    ]),
-    instruction: z14.string().min(1)
-  }).strict()).length(6),
-  completion: z14.object({
-    verifiedStatus: z14.literal("ready_for_review"),
-    instruction: z14.string().min(1)
-  }).strict()
-}).strict();
-var editorFieldSchema = z14.object({
+var siteSetupRunStatusSchema = z15.enum(SITE_SETUP_RUN_STATUSES);
+var siteSetupRunModeSchema = z15.enum(SITE_SETUP_RUN_MODES);
+var siteSetupErrorCodeSchema = z15.enum(SITE_SETUP_ERROR_CODES);
+var editorFieldSchema = z15.object({
   fieldId: fieldIdSchema,
-  label: z14.string().trim().min(1),
-  subsection: z14.string().trim().min(1).optional(),
-  description: z14.string().trim().min(1).optional(),
-  required: z14.boolean().optional(),
-  maxLength: z14.number().int().positive().optional()
+  label: z15.string().trim().min(1),
+  subsection: z15.string().trim().min(1).optional(),
+  description: z15.string().trim().min(1).optional(),
+  required: z15.boolean().optional(),
+  maxLength: z15.number().int().positive().optional()
 }).strict();
-var editorSectionSchema = z14.object({
-  label: z14.string().trim().min(1),
-  fields: z14.array(editorFieldSchema).min(1)
+var editorSectionSchema = z15.object({
+  label: z15.string().trim().min(1),
+  fields: z15.array(editorFieldSchema).min(1)
 }).strict().superRefine((section, context) => {
   const closedSubsections = /* @__PURE__ */ new Set();
   let currentSubsection;
@@ -1357,10 +1371,10 @@ var editorSectionSchema = z14.object({
     }
   }
 });
-var editorRouteSchema = z14.object({
+var editorRouteSchema = z15.object({
   routeKey: siteFieldRouteKeySchema,
-  label: z14.string().trim().min(1),
-  sections: z14.array(editorSectionSchema).min(1)
+  label: z15.string().trim().min(1),
+  sections: z15.array(editorSectionSchema).min(1)
 }).strict().superRefine((route, context) => {
   const sections = /* @__PURE__ */ new Set();
   for (const [index, section] of route.sections.entries()) {
@@ -1374,9 +1388,9 @@ var editorRouteSchema = z14.object({
     sections.add(section.label);
   }
 });
-var editorDefinitionV1Schema = z14.object({
-  version: z14.literal(1),
-  routes: z14.array(editorRouteSchema).min(1)
+var editorDefinitionV1Schema = z15.object({
+  version: z15.literal(1),
+  routes: z15.array(editorRouteSchema).min(1)
 }).strict().superRefine((definition, context) => {
   const routes = /* @__PURE__ */ new Set();
   const fields = /* @__PURE__ */ new Set();
@@ -1414,7 +1428,7 @@ var editorDefinitionV1Schema = z14.object({
 var forbiddenControlOrBidi = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 var forbiddenOwnerNoteControlOrBidi = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 var unsafeLocator = /<\/?[a-z][^>]*>|\b(?:javascript|data:text\/html)\s*:|\bon[a-z]+\s*=/iu;
-var renderedPathSchema = z14.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
+var renderedPathSchema = z15.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
   if (!value.startsWith("/") || value === "$global" || value.includes("?") || value.includes("#")) {
     context.addIssue({
       code: "custom",
@@ -1424,7 +1438,7 @@ var renderedPathSchema = z14.string().trim().transform((value) => value !== "/"
   addSafeByteIssues(value, CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES, "renderedPath", context);
 });
 function normalizedSafeTextSchema(maxBytes, label) {
-  return z14.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z14.string().min(1)).superRefine((value, context) => {
+  return z15.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z15.string().min(1)).superRefine((value, context) => {
     addSafeByteIssues(value, maxBytes, label, context);
     if (label === "locatorHint" && unsafeLocator.test(value)) {
       context.addIssue({
@@ -1441,12 +1455,12 @@ var correctionItemBase = {
   requestedLabel: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_LABEL_MAX_BYTES, "requestedLabel").optional(),
   requestedSection: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_SECTION_MAX_BYTES, "requestedSection").optional(),
   requestedSubsection: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_SUBSECTION_MAX_BYTES, "requestedSubsection").optional(),
-  requestedSortOrder: z14.number().int().nonnegative().optional()
+  requestedSortOrder: z15.number().int().nonnegative().optional()
 };
-var setupCorrectionItemSchema = z14.discriminatedUnion("kind", [
-  z14.object({ kind: z14.literal("text"), ...correctionItemBase }).strict(),
-  z14.object({ kind: z14.literal("link"), ...correctionItemBase }).strict(),
-  z14.object({ kind: z14.literal("image"), ...correctionItemBase }).strict()
+var setupCorrectionItemSchema = z15.discriminatedUnion("kind", [
+  z15.object({ kind: z15.literal("text"), ...correctionItemBase }).strict(),
+  z15.object({ kind: z15.literal("link"), ...correctionItemBase }).strict(),
+  z15.object({ kind: z15.literal("image"), ...correctionItemBase }).strict()
 ]).superRefine((item, context) => {
   if (item.requestedSubsection && !item.requestedSection) {
     context.addIssue({
@@ -1456,7 +1470,7 @@ var setupCorrectionItemSchema = z14.discriminatedUnion("kind", [
     });
   }
 });
-var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS).superRefine((items, context) => {
+var setupCorrectionItemsSchema = z15.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS).superRefine((items, context) => {
   const bytes = utf8Bytes(stableJsonStringify(items));
   if (bytes > CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES) {
     context.addIssue({
@@ -1465,7 +1479,7 @@ var setupCorrectionItemsSchema = z14.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
-var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+var siteSetupOwnerEditabilityNoteSchema = z15.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
   if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
     context.addIssue({
       code: "custom",
@@ -1479,27 +1493,190 @@ var siteSetupOwnerEditabilityNoteSchema = z14.string().trim().max(SITE_SETUP_OWN
     });
   }
 });
-var canonicalHashSchema = z14.string().regex(/^sha256:[0-9a-f]{64}$/iu);
+var SITE_SETUP_MODULE_SCOPES = {
+  editing: ["setup:read", "setup:write"],
+  analytics: [
+    "analytics:setup",
+    "analytics:sync",
+    "analytics:test",
+    "analytics:readiness",
+    "analytics:agent_instructions",
+    "analytics:public_key_read"
+  ]
+};
+var siteSetupModulesSchema = z15.array(z15.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
+function siteSetupScopes(modules) {
+  return modules.flatMap((module) => [...SITE_SETUP_MODULE_SCOPES[module]]);
+}
+function hasExactSiteSetupScopes(scopes, modules) {
+  const matches = (expected) => scopes.length === expected.length && expected.every((scope) => scopes.includes(scope));
+  return modules ? matches(siteSetupScopes(modules)) : matches(siteSetupScopes(["editing"])) || matches(siteSetupScopes(["editing", "analytics"]));
+}
+var siteSetupActivityInputSchema = z15.object({
+  phase: z15.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ]),
+  textId: z15.enum([
+    "inspecting",
+    "integrating",
+    "deploying",
+    "verifying",
+    "repairing"
+  ])
+}).strict().refine((value) => value.phase === value.textId, "Activity text must describe its phase.");
+var nextActionFields = {
+  actor: z15.enum(["agent", "user", "siteplane"]),
+  boundary: z15.enum([
+    "source",
+    "environment",
+    "deployment",
+    "verification",
+    "authorization",
+    "review"
+  ]),
+  precondition: z15.string().min(1).max(1e3),
+  instruction: z15.string().min(1).max(2e3),
+  expectedEvidence: z15.string().min(1).max(1e3)
+};
+var siteSetupNextActionSchema = z15.discriminatedUnion("kind", [
+  z15.object({
+    ...nextActionFields,
+    kind: z15.literal("run_command"),
+    command: z15.string().min(1).max(500)
+  }).strict(),
+  z15.object({ ...nextActionFields, kind: z15.literal("agent_edit") }).strict(),
+  z15.object({ ...nextActionFields, kind: z15.literal("needs_user_action") }).strict(),
+  z15.object({ ...nextActionFields, kind: z15.literal("wait") }).strict(),
+  z15.object({ ...nextActionFields, kind: z15.literal("done") }).strict()
+]);
+var siteSetupTaskRunSchema = z15.object({
+  runId: z15.string().uuid(),
+  mode: siteSetupRunModeSchema,
+  status: siteSetupRunStatusSchema,
+  fieldContractHash: z15.string().nullable(),
+  deploymentOrigin: z15.string().url().nullable(),
+  deploymentRevision: z15.string().nullable(),
+  publicRuntimeKeyId: z15.string().uuid().nullable(),
+  reviewVersion: z15.string().nullable()
+}).strict();
+var siteSetupTaskProgressSchema = z15.object({
+  progressStage: z15.enum([
+    "waiting_for_connection",
+    "agent_connected",
+    "project_context_loaded",
+    "fields_prepared",
+    "deployment_verification",
+    "ready_for_review",
+    "action_required",
+    "completed"
+  ]),
+  lastVerifiedAt: z15.string().datetime().nullable(),
+  lastActivityAt: z15.string().datetime(),
+  activitySource: z15.enum(["user", "server", "agent"]),
+  activityPhase: siteSetupActivityInputSchema.shape.phase.nullable(),
+  activityTextId: siteSetupActivityInputSchema.shape.textId.nullable()
+}).strict();
+var siteSetupTaskSchema = z15.object({
+  contractVersion: z15.literal("siteplane.setup-task.v2"),
+  workflow: z15.enum(["initial_setup", "structure_update"]),
+  goal: z15.string().min(1),
+  modules: siteSetupModulesSchema,
+  authorizationVersion: z15.number().int().positive(),
+  authorizedScopes: z15.array(z15.string()).min(2),
+  site: z15.object({
+    siteId: z15.string().uuid(),
+    portalPath: z15.string(),
+    adminOrigin: z15.string().url()
+  }).strict().nullable(),
+  run: siteSetupTaskRunSchema.nullable(),
+  progress: siteSetupTaskProgressSchema.nullable(),
+  deployment: setupDeploymentRecordSchema.nullable(),
+  revalidationGeneration: z15.number().int().positive(),
+  assignment: z15.literal("owned"),
+  deadline: z15.string().datetime().nullable(),
+  userInstructions: z15.object({
+    text: siteSetupOwnerEditabilityNoteSchema,
+    source: z15.literal("user"),
+    trust: z15.literal("untrusted")
+  }).strict(),
+  corrections: setupCorrectionItemsSchema,
+  contentSelectionSummary: z15.object({
+    text: siteSetupOwnerEditabilityNoteSchema,
+    source: z15.literal("agent"),
+    trust: z15.literal("untrusted")
+  }).strict().nullable(),
+  environmentBindings: z15.array(z15.object({
+    name: z15.string().regex(/^[A-Z][A-Z0-9_]+$/u),
+    source: z15.string().min(1),
+    sensitivity: z15.enum(["public", "secret"]),
+    usage: z15.enum(["build", "server", "build_and_server"]),
+    evidence: z15.string().min(1)
+  }).strict()),
+  nextAction: siteSetupNextActionSchema,
+  error: z15.object({
+    code: z15.string().regex(/^[a-z0-9_.]+$/u).max(160),
+    boundary: nextActionFields.boundary,
+    responsibleActor: nextActionFields.actor,
+    retryable: z15.boolean(),
+    retryAfter: z15.number().int().nonnegative().nullable(),
+    requestId: z15.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
+  }).strict().nullable(),
+  packages: z15.object({
+    siteplane: z15.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z15.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  communication: z15.object({
+    beforeSourceChanges: z15.string().min(1),
+    updates: z15.array(z15.string().min(1)).min(1),
+    blocker: z15.string().min(1)
+  }).strict(),
+  discovery: z15.object({
+    inspectPublicRoutes: z15.boolean(),
+    contentKinds: z15.array(z15.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z15.array(z15.string().min(1)).min(1)
+  }).strict(),
+  steps: z15.array(z15.object({
+    id: z15.enum([
+      "inspect_repository",
+      "install_packages",
+      "instrument_fields",
+      "apply_contract",
+      "deploy_production",
+      "verify_deployment"
+    ]),
+    instruction: z15.string().min(1)
+  }).strict()).length(6),
+  completion: z15.object({
+    verifiedStatus: z15.literal("ready_for_review"),
+    instruction: z15.string().min(1)
+  }).strict()
+}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.");
+var canonicalHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
-var continueSiteSetupInputSchema = z14.object({
-  siteId: z14.string().uuid(),
-  runId: z14.string().uuid(),
+var continueSiteSetupInputSchema = z15.object({
+  siteId: z15.string().uuid(),
+  runId: z15.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   correctionItems: setupCorrectionItemsSchema,
   ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema.optional()
 }).strict();
-var saveSiteSetupOwnerNoteInputSchema = z14.object({
-  siteId: z14.string().uuid(),
-  runId: z14.string().uuid(),
+var saveSiteSetupOwnerNoteInputSchema = z15.object({
+  siteId: z15.string().uuid(),
+  runId: z15.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
 }).strict();
-var siteSetupContextInputSchema = z14.object({}).strict();
-var siteSetupApplyInputSchema = z14.object({
+var siteSetupContextInputSchema = z15.object({}).strict();
+var siteSetupApplyInputSchema = z15.object({
   fieldContract: siteFieldContractV1Schema,
-  editorDefinition: editorDefinitionV1Schema
+  editorDefinition: editorDefinitionV1Schema,
+  contentSelectionSummary: siteSetupOwnerEditabilityNoteSchema.refine((text) => text.trim().length > 0, "Describe the selected content, important exclusions and any open gaps.")
 }).strict().superRefine((input, context) => {
   const contractRoutesByFieldId = new Map(input.fieldContract.fields.map((field) => [
     field.fieldId,
@@ -1563,37 +1740,37 @@ var siteSetupApplyInputSchema = z14.object({
     }
   }
 });
-var siteSetupVerifyInputSchema = z14.object({
-  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+var siteSetupVerifyInputSchema = z15.object({
+  deploymentUrl: z15.string().url().refine((value) => value.startsWith("https://")),
   deploymentRevision: deploymentRevisionSchema,
-  wait: z14.boolean().optional()
+  wait: z15.boolean().optional()
 }).strict();
-var siteSetupEvidenceInputSchema = z14.object({
-  siteId: z14.string().uuid(),
-  runId: z14.string().uuid(),
+var siteSetupEvidenceInputSchema = z15.object({
+  siteId: z15.string().uuid(),
+  runId: z15.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
-  expectedDeploymentOrigin: z14.string().url().refine((value) => value.startsWith("https://")),
+  expectedDeploymentOrigin: z15.string().url().refine((value) => value.startsWith("https://")),
   expectedDeploymentRevision: deploymentRevisionSchema,
-  publicRuntimeKeyId: z14.string().uuid(),
+  publicRuntimeKeyId: z15.string().uuid(),
   bridgeSessionId: normalizedSafeTextSchema(256, "bridgeSessionId"),
-  observations: z14.array(z14.object({
+  observations: z15.array(z15.object({
     fieldId: fieldIdSchema,
     routeKey: siteFieldRouteKeySchema,
     renderedPath: renderedPathSchema,
-    targetResolved: z14.boolean(),
-    previewAck: z14.boolean()
+    targetResolved: z15.boolean(),
+    previewAck: z15.boolean()
   }).strict().refine((value) => !value.previewAck || value.targetResolved, "Preview ACK requires a resolved target.")).min(1).max(200)
 }).strict();
-var completeSiteSetupInputSchema = z14.object({
-  siteId: z14.string().uuid(),
-  runId: z14.string().uuid(),
+var completeSiteSetupInputSchema = z15.object({
+  siteId: z15.string().uuid(),
+  runId: z15.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   expectedReadyFingerprint: canonicalHashSchema
 }).strict();
-var refreshSiteSetupDeploymentInputSchema = z14.object({
-  siteId: z14.string().uuid(),
-  deploymentUrl: z14.string().url().refine((value) => value.startsWith("https://")),
+var refreshSiteSetupDeploymentInputSchema = z15.object({
+  siteId: z15.string().uuid(),
+  deploymentUrl: z15.string().url().refine((value) => value.startsWith("https://")),
   deploymentRevision: deploymentRevisionSchema
 }).strict();
 function addSafeByteIssues(value, maxBytes, label, context) {
@@ -1616,34 +1793,34 @@ function utf8Bytes(value) {
 
 // ../shared/dist/bridge-protocol.js
 var BRIDGE_PROTOCOL_VERSION = 2;
-var bridgeRectSchema = z15.object({
-  x: z15.number(),
-  y: z15.number(),
-  width: z15.number().nonnegative(),
-  height: z15.number().nonnegative()
+var bridgeRectSchema = z16.object({
+  x: z16.number(),
+  y: z16.number(),
+  width: z16.number().nonnegative(),
+  height: z16.number().nonnegative()
 });
-var previewTextValueSchema = z15.object({
-  fieldType: z15.enum(["text", "longText"]),
-  value: z15.string()
+var previewTextValueSchema = z16.object({
+  fieldType: z16.enum(["text", "longText"]),
+  value: z16.string()
 });
-var previewLinkValueSchema = z15.object({
-  fieldType: z15.literal("link"),
-  value: z15.object({
-    href: z15.string().trim().min(1),
-    label: z15.string().trim().min(1).optional()
+var previewLinkValueSchema = z16.object({
+  fieldType: z16.literal("link"),
+  value: z16.object({
+    href: z16.string().trim().min(1),
+    label: z16.string().trim().min(1).optional()
   })
 });
-var previewImageValueSchema = z15.object({
-  fieldType: z15.literal("image"),
+var previewImageValueSchema = z16.object({
+  fieldType: z16.literal("image"),
   value: imageValueSchema
 });
-var bridgePreviewValueSchema = z15.discriminatedUnion("fieldType", [
+var bridgePreviewValueSchema = z16.discriminatedUnion("fieldType", [
   previewTextValueSchema,
   previewLinkValueSchema,
   previewImageValueSchema
 ]);
-var fieldSelectionModeSchema = z15.enum(["replace", "range", "toggle"]);
-var fieldBridgeMissingContentActionSchema = z15.enum([
+var fieldSelectionModeSchema = z16.enum(["replace", "range", "toggle"]);
+var fieldBridgeMissingContentActionSchema = z16.enum([
   "add",
   "select",
   "remove"
@@ -1662,77 +1839,77 @@ var FIELD_BRIDGE_MESSAGE_TYPES = [
   "siteplane:field-bridge:preview-scrolled",
   "siteplane:field-bridge:error"
 ];
-var canonicalFieldContractHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/u);
-var bridgeSectionSchema = z15.string().trim().min(1).max(256);
-var realRenderedPathSchema = z15.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
-var fieldBridgeIdentitySchema = z15.object({
-  publicRuntimeKeyId: z15.string().uuid(),
+var canonicalFieldContractHashSchema = z16.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var bridgeSectionSchema = z16.string().trim().min(1).max(256);
+var realRenderedPathSchema = z16.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
+var fieldBridgeIdentitySchema = z16.object({
+  publicRuntimeKeyId: z16.string().uuid(),
   fieldContractHash: canonicalFieldContractHashSchema,
-  deploymentRevision: z15.string().trim().min(1).max(256)
+  deploymentRevision: z16.string().trim().min(1).max(256)
 }).strict();
-var fieldBridgeBaseSchema = z15.object({
-  version: z15.literal(BRIDGE_PROTOCOL_VERSION),
-  type: z15.enum(FIELD_BRIDGE_MESSAGE_TYPES),
-  siteId: z15.string().uuid(),
-  sessionId: z15.string().trim().min(1),
-  publicRuntimeKeyId: z15.string().uuid(),
+var fieldBridgeBaseSchema = z16.object({
+  version: z16.literal(BRIDGE_PROTOCOL_VERSION),
+  type: z16.enum(FIELD_BRIDGE_MESSAGE_TYPES),
+  siteId: z16.string().uuid(),
+  sessionId: z16.string().trim().min(1),
+  publicRuntimeKeyId: z16.string().uuid(),
   fieldContractHash: canonicalFieldContractHashSchema,
-  deploymentRevision: z15.string().trim().min(1).max(256),
-  requestId: z15.string().trim().min(1),
-  sentAt: z15.string().datetime()
+  deploymentRevision: z16.string().trim().min(1).max(256),
+  requestId: z16.string().trim().min(1),
+  sentAt: z16.string().datetime()
 }).strict();
-var fieldBridgeFieldSchema = z15.object({
+var fieldBridgeFieldSchema = z16.object({
   fieldId: fieldIdSchema,
   fieldType: fieldTypeSchema,
   routeKey: siteFieldRouteKeySchema,
   renderedPath: realRenderedPathSchema,
-  sourcePath: z15.string().trim().min(1).optional(),
+  sourcePath: z16.string().trim().min(1).optional(),
   editTarget: fieldIdSchema,
   rect: bridgeRectSchema,
-  targetResolved: z15.literal(true),
+  targetResolved: z16.literal(true),
   currentValue: bridgePreviewValueSchema.optional()
 }).strict();
 var fieldBridgeInitMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:init"),
-  payload: z15.object({
-    adminOrigin: z15.string().url(),
-    customerOrigin: z15.string().url(),
+  type: z16.literal("siteplane:field-bridge:init"),
+  payload: z16.object({
+    adminOrigin: z16.string().url(),
+    customerOrigin: z16.string().url(),
     renderedPath: realRenderedPathSchema
   }).strict()
 });
 var fieldBridgeReadyMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:ready"),
-  payload: z15.object({
+  type: z16.literal("siteplane:field-bridge:ready"),
+  payload: z16.object({
     renderedPath: realRenderedPathSchema,
-    fieldCount: z15.number().int().nonnegative(),
-    capabilities: z15.tuple([
-      z15.literal("field_selection"),
-      z15.literal("preview_values"),
-      z15.literal("field_evidence"),
-      z15.literal("visual_field_control")
+    fieldCount: z16.number().int().nonnegative(),
+    capabilities: z16.tuple([
+      z16.literal("field_selection"),
+      z16.literal("preview_values"),
+      z16.literal("field_evidence"),
+      z16.literal("visual_field_control")
     ])
   }).strict()
 });
 var fieldBridgeFieldsMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:fields"),
-  payload: z15.object({
+  type: z16.literal("siteplane:field-bridge:fields"),
+  payload: z16.object({
     renderedPath: realRenderedPathSchema,
-    fields: z15.array(fieldBridgeFieldSchema)
+    fields: z16.array(fieldBridgeFieldSchema)
   }).strict()
 });
 var fieldBridgeSelectFieldMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:select-field"),
-  payload: z15.object({
+  type: z16.literal("siteplane:field-bridge:select-field"),
+  payload: z16.object({
     fieldId: fieldIdSchema,
     selectionMode: fieldSelectionModeSchema
   }).strict()
 });
 var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:set-selected-field"),
-  payload: z15.object({
-    fieldIds: z15.array(fieldIdSchema).max(200),
+  type: z16.literal("siteplane:field-bridge:set-selected-field"),
+  payload: z16.object({
+    fieldIds: z16.array(fieldIdSchema).max(200),
     primaryFieldId: fieldIdSchema.nullable(),
-    scrollIntoView: z15.boolean().optional()
+    scrollIntoView: z16.boolean().optional()
   }).strict().superRefine((value, context) => {
     if (value.fieldIds.length > 0 && value.primaryFieldId === null) {
       context.addIssue({
@@ -1751,58 +1928,58 @@ var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
   })
 });
 var fieldBridgeApplyPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:apply-preview-values"),
-  payload: z15.object({ values: z15.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
+  type: z16.literal("siteplane:field-bridge:apply-preview-values"),
+  payload: z16.object({ values: z16.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
 });
 var fieldBridgeTestPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:test-preview-values"),
-  payload: z15.object({ fieldIds: z15.array(fieldIdSchema).min(1).max(200) }).strict()
+  type: z16.literal("siteplane:field-bridge:test-preview-values"),
+  payload: z16.object({ fieldIds: z16.array(fieldIdSchema).min(1).max(200) }).strict()
 });
 var fieldBridgePreviewAckMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:preview-ack"),
-  payload: z15.object({
-    ackRequestId: z15.string().trim().min(1),
-    kind: z15.enum(["apply", "test"]),
+  type: z16.literal("siteplane:field-bridge:preview-ack"),
+  payload: z16.object({
+    ackRequestId: z16.string().trim().min(1),
+    kind: z16.enum(["apply", "test"]),
     renderedPath: realRenderedPathSchema,
-    fieldIds: z15.array(fieldIdSchema).max(200)
+    fieldIds: z16.array(fieldIdSchema).max(200)
   }).strict()
 });
 var fieldBridgeSetVisualControlStateMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:set-visual-control-state"),
-  payload: z15.object({
-    enabled: z15.boolean(),
-    fieldProximityEnabled: z15.boolean(),
-    pendingKeys: z15.array(z15.string().trim().min(1).max(2048)).max(50),
-    activeFieldIds: z15.array(fieldIdSchema),
-    fieldSections: z15.record(fieldIdSchema, bridgeSectionSchema),
-    selectedPending: z15.array(z15.object({
-      key: z15.string().trim().min(1).max(2048),
-      locatorHint: z15.string().trim().min(1).max(2048)
+  type: z16.literal("siteplane:field-bridge:set-visual-control-state"),
+  payload: z16.object({
+    enabled: z16.boolean(),
+    fieldProximityEnabled: z16.boolean(),
+    pendingKeys: z16.array(z16.string().trim().min(1).max(2048)).max(50),
+    activeFieldIds: z16.array(fieldIdSchema),
+    fieldSections: z16.record(fieldIdSchema, bridgeSectionSchema),
+    selectedPending: z16.array(z16.object({
+      key: z16.string().trim().min(1).max(2048),
+      locatorHint: z16.string().trim().min(1).max(2048)
     }).strict()).max(50),
-    scrollPendingIntoView: z15.boolean().optional()
+    scrollPendingIntoView: z16.boolean().optional()
   }).strict()
 });
 var fieldBridgeMissingContentMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:missing-content"),
-  payload: z15.object({
+  type: z16.literal("siteplane:field-bridge:missing-content"),
+  payload: z16.object({
     action: fieldBridgeMissingContentActionSchema,
     item: setupCorrectionItemSchema,
     suggestedSection: bridgeSectionSchema.optional()
   }).strict()
 });
 var fieldBridgePreviewScrolledMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:preview-scrolled"),
-  payload: z15.object({ renderedPath: realRenderedPathSchema }).strict()
+  type: z16.literal("siteplane:field-bridge:preview-scrolled"),
+  payload: z16.object({ renderedPath: realRenderedPathSchema }).strict()
 });
 var fieldBridgeErrorMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z15.literal("siteplane:field-bridge:error"),
-  payload: z15.object({
-    code: z15.string().trim().min(1),
-    message: z15.string().trim().min(1),
-    recoverable: z15.boolean().default(false)
+  type: z16.literal("siteplane:field-bridge:error"),
+  payload: z16.object({
+    code: z16.string().trim().min(1),
+    message: z16.string().trim().min(1),
+    recoverable: z16.boolean().default(false)
   }).strict()
 });
-var fieldBridgeMessageSchema = z15.discriminatedUnion("type", [
+var fieldBridgeMessageSchema = z16.discriminatedUnion("type", [
   fieldBridgeInitMessageSchema,
   fieldBridgeReadyMessageSchema,
   fieldBridgeFieldsMessageSchema,
@@ -1818,51 +1995,51 @@ var fieldBridgeMessageSchema = z15.discriminatedUnion("type", [
 ]);
 
 // ../shared/dist/commands.js
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 
 // ../shared/dist/errors.js
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var UI_ERROR_CATEGORIES = [
   "site_member",
   "workspace_member",
   "internal"
 ];
-var uiErrorCategorySchema = z16.enum(UI_ERROR_CATEGORIES);
-var commandErrorPayloadSchema = z16.object({
-  code: z16.string().min(1),
-  message: z16.string().min(1),
+var uiErrorCategorySchema = z17.enum(UI_ERROR_CATEGORIES);
+var commandErrorPayloadSchema = z17.object({
+  code: z17.string().min(1),
+  message: z17.string().min(1),
   category: uiErrorCategorySchema,
-  details: z16.record(z16.string(), z16.unknown()).optional()
+  details: z17.record(z17.string(), z17.unknown()).optional()
 });
 
 // ../shared/dist/commands.js
-var commandSuccessSchema = z17.object({
-  ok: z17.literal(true),
-  data: z17.unknown()
+var commandSuccessSchema = z18.object({
+  ok: z18.literal(true),
+  data: z18.unknown()
 });
-var commandErrorSchema = z17.object({
-  ok: z17.literal(false),
+var commandErrorSchema = z18.object({
+  ok: z18.literal(false),
   error: commandErrorPayloadSchema
 });
-var commandResultSchema = z17.discriminatedUnion("ok", [
+var commandResultSchema = z18.discriminatedUnion("ok", [
   commandSuccessSchema,
   commandErrorSchema
 ]);
 
 // ../shared/dist/editor-settings.js
-import { z as z18 } from "zod";
-var editorColorSchemeSchema = z18.enum([
+import { z as z19 } from "zod";
+var editorColorSchemeSchema = z19.enum([
   "paper",
   "slate",
   "siteplane",
   "bloom"
 ]);
 var editorColorSchemes = editorColorSchemeSchema.options;
-var editorColorModeSchema = z18.enum(["light", "dark"]);
+var editorColorModeSchema = z19.enum(["light", "dark"]);
 var editorColorModes = editorColorModeSchema.options;
 
 // ../shared/dist/site-slug.js
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var SITE_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "account",
@@ -1879,31 +2056,31 @@ var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "support",
   "workspace"
 ]);
-var siteSlugSchema = z19.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
+var siteSlugSchema = z20.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
 
 // ../shared/dist/entitlements.js
-import { z as z20 } from "zod";
-var entitlementSnapshotSchema = z20.object({
-  planKey: z20.string().trim().min(1),
-  sitesLimit: z20.number().int().positive(),
-  siteMembersPerSiteLimit: z20.number().int().positive(),
-  customAdminDomainsEnabled: z20.boolean(),
-  agentMcpEnabled: z20.boolean(),
-  emailNotificationsEnabled: z20.boolean(),
-  analyticsEnabled: z20.boolean(),
-  analyticsSitesLimit: z20.number().int().min(0),
-  analyticsPortalPerformanceEnabled: z20.boolean(),
-  analyticsMonthlyReportsEnabled: z20.boolean(),
-  analyticsAiSummaryEnabled: z20.boolean(),
-  analyticsRawEventRetentionDays: z20.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
-  analyticsMonthlyEventLimit: z20.number().int().min(0),
-  bookingEnabled: z20.boolean().default(false),
-  bookingSitesLimit: z20.number().int().min(0).default(0),
-  bookingPortalManagementEnabled: z20.boolean().default(false),
-  bookingResourcesPerSiteLimit: z20.number().int().min(0).default(0),
-  bookingServicesPerSiteLimit: z20.number().int().min(0).default(0),
-  bookingMonthlyBookingsLimit: z20.number().int().min(0).default(0),
-  bookingRemindersEnabled: z20.boolean().default(false)
+import { z as z21 } from "zod";
+var entitlementSnapshotSchema = z21.object({
+  planKey: z21.string().trim().min(1),
+  sitesLimit: z21.number().int().positive(),
+  siteMembersPerSiteLimit: z21.number().int().positive(),
+  customAdminDomainsEnabled: z21.boolean(),
+  agentMcpEnabled: z21.boolean(),
+  emailNotificationsEnabled: z21.boolean(),
+  analyticsEnabled: z21.boolean(),
+  analyticsSitesLimit: z21.number().int().min(0),
+  analyticsPortalPerformanceEnabled: z21.boolean(),
+  analyticsMonthlyReportsEnabled: z21.boolean(),
+  analyticsAiSummaryEnabled: z21.boolean(),
+  analyticsRawEventRetentionDays: z21.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
+  analyticsMonthlyEventLimit: z21.number().int().min(0),
+  bookingEnabled: z21.boolean().default(false),
+  bookingSitesLimit: z21.number().int().min(0).default(0),
+  bookingPortalManagementEnabled: z21.boolean().default(false),
+  bookingResourcesPerSiteLimit: z21.number().int().min(0).default(0),
+  bookingServicesPerSiteLimit: z21.number().int().min(0).default(0),
+  bookingMonthlyBookingsLimit: z21.number().int().min(0).default(0),
+  bookingRemindersEnabled: z21.boolean().default(false)
 });
 var EARLY_ACCESS_PLAN = {
   planKey: "early_access_2026",
@@ -1929,7 +2106,7 @@ var EARLY_ACCESS_PLAN = {
 };
 
 // ../shared/dist/readiness.js
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var READINESS_CHECK_KEYS = [
   "agent_instructions_installed",
   "runtime_package_connected",
@@ -1944,19 +2121,19 @@ var READINESS_STATUSES = [
   "failing",
   "warning"
 ];
-var readinessCheckKeySchema = z21.enum(READINESS_CHECK_KEYS);
-var readinessStatusSchema = z21.enum(READINESS_STATUSES);
+var readinessCheckKeySchema = z22.enum(READINESS_CHECK_KEYS);
+var readinessStatusSchema = z22.enum(READINESS_STATUSES);
 
 // ../shared/dist/site.js
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var SITE_STATUSES = [
   "setup",
   "active",
   "disabled",
   "archived"
 ];
-var siteStatusSchema = z22.enum(SITE_STATUSES);
-var websiteUrlSchema = z22.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+var siteStatusSchema = z23.enum(SITE_STATUSES);
+var websiteUrlSchema = z23.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
 
 // ../cli/dist/analytics/manifest.js
 async function readAnalyticsManifestFile(manifestPath) {
@@ -2283,17 +2460,17 @@ function readJsxAttributes(attributes) {
     if (!ts.isJsxAttribute(attribute)) {
       continue;
     }
-    const name = attribute.name.getText();
+    const name2 = attribute.name.getText();
     if (!attribute.initializer) {
-      values.set(name, true);
+      values.set(name2, true);
       continue;
     }
     if (ts.isStringLiteral(attribute.initializer)) {
-      values.set(name, attribute.initializer.text);
+      values.set(name2, attribute.initializer.text);
       continue;
     }
     if (ts.isJsxExpression(attribute.initializer)) {
-      values.set(name, staticExpressionValue(attribute.initializer.expression));
+      values.set(name2, staticExpressionValue(attribute.initializer.expression));
     }
   }
   return values;
@@ -2761,16 +2938,16 @@ async function analyticsReadinessCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/public-key.js
-import { z as z23 } from "zod";
-var responseSchema = z23.object({
-  ok: z23.literal(true),
-  data: z23.object({
-    rawPublicKey: z23.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+import { z as z24 } from "zod";
+var responseSchema = z24.object({
+  ok: z24.literal(true),
+  data: z24.object({
+    rawPublicKey: z24.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
   })
 });
-var errorResponseSchema = z23.object({
-  error: z23.object({
-    code: z23.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+var errorResponseSchema = z24.object({
+  error: z24.object({
+    code: z24.string().regex(/^[a-z][a-z0-9_.-]+$/u)
   })
 });
 async function analyticsPublicKeyCommand(input) {
@@ -2990,14 +3167,22 @@ async function bookingTestCommand(input) {
 import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
 import { join as join3 } from "path";
-import { z as z24 } from "zod";
-var siteplaneProjectConfigSchema = z24.object({
-  version: z24.literal(1),
-  apiBaseUrl: z24.string().url(),
-  siteId: z24.string().uuid(),
-  publicSiteKeyId: z24.string().uuid(),
-  publicSiteKey: z24.string().trim().min(1),
-  fieldContractHash: z24.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+import { z as z25 } from "zod";
+var siteplaneProjectConfigSchema = z25.object({
+  version: z25.literal(2),
+  apiBaseUrl: z25.string().url(),
+  siteId: z25.string().uuid(),
+  publicSiteKeyId: z25.string().uuid(),
+  publicSiteKey: z25.string().trim().min(1),
+  runId: z25.string().uuid(),
+  appDirectory: z25.string().min(1),
+  taskContractVersion: z25.literal("siteplane.setup-task.v2"),
+  adminProtocolVersion: z25.literal(2),
+  packages: z25.object({
+    siteplane: z25.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z25.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict(),
+  fieldContractHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectPackageJson(projectDir) {
   return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
@@ -3054,16 +3239,21 @@ async function writeJsonAtomically(path, value, mode) {
 // ../cli/dist/config/credentials.js
 import { execFile } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
-import { chmod as chmod2, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
+import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
 import { dirname as dirname5, join as join4, relative } from "path";
 import { promisify } from "util";
-import { z as z25 } from "zod";
-var siteplaneCredentialsSchema = z25.object({
-  accessToken: z25.string().trim().min(1),
-  siteRevalidationSecret: z25.string().trim().min(1)
+import { z as z26 } from "zod";
+var siteplaneCredentialsSchema = z26.object({
+  accessToken: z26.string().trim().min(1),
+  siteRevalidationSecret: z26.string().trim().min(1),
+  adminSession: z26.object({
+    secret: z26.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    generation: z26.string().uuid()
+  }).strict().optional()
 }).strict();
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
   const path = join4(projectDir, ".siteplane/credentials.json");
+  await assertCredentialFilesystemSafe(projectDir);
   const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
   const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
   if (await isTrackedFile(path)) {
@@ -3074,6 +3264,27 @@ async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
   }
   return path;
 }
+async function assertCredentialFilesystemSafe(projectDir) {
+  for (const [path, directory, mode] of [
+    [projectDir, true, null],
+    [join4(projectDir, ".siteplane"), true, 448],
+    [join4(projectDir, ".siteplane/credentials.json"), false, 384]
+  ]) {
+    const stat = await lstat(path).catch((error) => {
+      if (error.code === "ENOENT")
+        return null;
+      throw error;
+    });
+    if (!stat)
+      continue;
+    if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile())) {
+      throw new Error("Siteplane credential paths must not contain symlinks or unexpected file types.");
+    }
+    if (mode !== null && (stat.mode & 511) !== mode) {
+      throw new Error(`Siteplane credential ${directory ? "directory" : "file"} permissions must be ${mode.toString(8)} before setup.`);
+    }
+  }
+}
 async function writeLocalCredentials(projectDir, credentials, options = {}) {
   const path = await assertLocalCredentialsPathSafe(projectDir, options);
   const parsed = siteplaneCredentialsSchema.parse(credentials);
@@ -3082,6 +3293,7 @@ async function writeLocalCredentials(projectDir, credentials, options = {}) {
   return path;
 }
 async function readLocalCredentials(projectDir) {
+  await assertCredentialFilesystemSafe(projectDir);
   return siteplaneCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
 }
 async function writeCredentialsAtomically(path, credentials) {
@@ -3117,8 +3329,467 @@ async function gitPathMatches(projectDir, path, command) {
 }
 
 // ../cli/dist/commands/init.js
+import { access as access3 } from "fs/promises";
+import { join as join7, relative as relative3 } from "path";
+import { z as z29 } from "zod";
+
+// ../cli/dist/commands/setup-preflight.js
+import { createHash as createHash2 } from "crypto";
+import semver from "semver";
+import { minimatch } from "minimatch";
+import { parse as parseYaml } from "yaml";
+
+// ../cli/dist/config/installed-package.js
+import { createRequire } from "module";
+import { readFile as readFile7 } from "fs/promises";
 import { join as join5 } from "path";
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
+var packageSchema = z27.object({
+  name: z27.string().optional(),
+  version: z27.string(),
+  peerDependencies: z27.record(z27.string(), z27.string()).optional()
+});
+async function readInstalledPackage(projectDir, name2) {
+  const require2 = createRequire(join5(projectDir, "package.json"));
+  for (const directory of require2.resolve.paths(name2) ?? []) {
+    try {
+      return packageSchema.parse(JSON.parse(await readFile7(join5(directory, name2, "package.json"), "utf8")));
+    } catch (error) {
+      if (error.code !== "ENOENT")
+        throw error;
+    }
+  }
+  throw new Error(`Install ${name2} with the canonical package manager before setup.`);
+}
+async function assertExactSetupPackages(projectDir, packages) {
+  const manifest = z27.object({
+    dependencies: z27.record(z27.string(), z27.string()).optional(),
+    devDependencies: z27.record(z27.string(), z27.string()).optional()
+  }).parse(JSON.parse(await readFile7(join5(projectDir, "package.json"), "utf8")));
+  for (const [name2, version2] of [
+    ["siteplane", packages.siteplane],
+    ["@siteplane/runtime-next", packages.runtimeNext]
+  ]) {
+    const declared = manifest.dependencies?.[name2] ?? manifest.devDependencies?.[name2];
+    const installed = await readInstalledPackage(projectDir, name2);
+    if (declared !== version2 || installed.version !== version2)
+      throw new Error("The installed Siteplane packages must match the current task's exact pins.");
+  }
+}
+
+// ../cli/dist/commands/setup-preflight.js
+import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
+import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
+import { z as z28 } from "zod";
+
+// ../cli/dist/commands/setup-process.js
+import { spawn } from "child_process";
+var SetupFailure = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+};
+async function setupProcess(binary, args, options) {
+  return new Promise((resolve5, reject) => {
+    const child = spawn(binary, args, {
+      cwd: options.cwd,
+      env: process.env,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const chunks = [];
+    const errors = [];
+    let errorBytes = 0;
+    let bytes = 0;
+    let exceeded = false;
+    const timer = setTimeout(() => {
+      exceeded = true;
+      child.kill("SIGKILL");
+    }, options.timeoutMs ?? 12e4);
+    const capture = (chunk) => {
+      bytes += chunk.length;
+      if (bytes > 4 * 1024 * 1024) {
+        exceeded = true;
+        child.kill("SIGKILL");
+      } else
+        chunks.push(chunk);
+    };
+    child.stdout.on("data", capture);
+    child.stderr.on("data", (chunk) => {
+      errorBytes += chunk.length;
+      if (errorBytes <= 4 * 1024 * 1024)
+        errors.push(chunk);
+      else {
+        exceeded = true;
+        child.kill("SIGKILL");
+      }
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      reject(new SetupFailure("local_tool_unavailable", `${binary} could not be started. Check the local installation and access.`));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (exceeded)
+        reject(new SetupFailure("provider_timeout", "The operation exceeded its time or response limit; inspect the existing operation before retrying."));
+      else if (code !== 0) {
+        const diagnostic = Buffer.concat([...chunks, ...errors]).toString("utf8");
+        if (/\b(?:401|403|unauthorized|forbidden|not authenticated|not authorized|login required|E401|E403)\b/iu.test(diagnostic))
+          reject(new SetupFailure("provider_access_denied", `${binary} denied access. Restore the existing local login and project/package permissions before retrying.`));
+        else if (/\b(?:ECONNRESET|ETIMEDOUT|ENOTFOUND|EAI_AGAIN|ECONNREFUSED|429|502|503|504)\b/iu.test(diagnostic))
+          reject(new SetupFailure("provider_transport_failed", `${binary} could not reach its provider. Inspect the existing operation before retrying.`));
+        else
+          reject(new SetupFailure("local_command_failed", `${binary} failed. Check its local login, permissions and project configuration.`));
+      } else
+        resolve5(Buffer.concat(options.includeStderr ? [...chunks, ...errors] : chunks).toString("utf8"));
+    });
+    child.stdin.on("error", () => {
+    });
+    child.stdin.end(options.input);
+  });
+}
+async function setupVercelApi(cwd, endpoint, body, method, options) {
+  const args = ["api", endpoint, "--raw"];
+  if (body !== void 0)
+    args.push("--method", method ?? "POST", "--input", "-");
+  else if (method)
+    args.push("--method", method);
+  let output = "";
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const remaining = (options?.deadline ?? Date.now() + 3e4) - Date.now();
+    if (remaining <= 0)
+      throw new SetupFailure("provider_deadline_exceeded", "The provider deadline expired; inspect the recorded operation before continuing.");
+    try {
+      output = await setupProcess("vercel", args, {
+        cwd,
+        timeoutMs: Math.min(3e4, remaining),
+        ...body === void 0 ? {} : { input: JSON.stringify(body) }
+      });
+      break;
+    } catch (error) {
+      if (!(error instanceof SetupFailure) || error.code !== "provider_transport_failed" || attempt === 2)
+        throw error;
+      await new Promise((resolve5) => setTimeout(resolve5, Math.min(1e3 * 2 ** attempt, Math.max(0, (options?.deadline ?? Date.now() + 2e3) - Date.now()))));
+    }
+  }
+  try {
+    return JSON.parse(output);
+  } catch {
+    throw new SetupFailure("invalid_provider_response", "Vercel did not return valid JSON for the bound project.");
+  }
+}
+
+// ../cli/dist/commands/setup-preflight.js
+var manifestSchema = z28.object({
+  packageManager: z28.string().optional(),
+  engines: z28.object({ node: z28.string().optional() }).optional(),
+  dependencies: z28.record(z28.string(), z28.string()).optional(),
+  devDependencies: z28.record(z28.string(), z28.string()).optional(),
+  scripts: z28.record(z28.string(), z28.string()).optional(),
+  workspaces: z28.unknown().optional()
+});
+var vercelProjectSchema = z28.object({
+  id: z28.string(),
+  accountId: z28.string(),
+  name: z28.string(),
+  nodeVersion: z28.string().nullable().optional(),
+  rootDirectory: z28.string().nullable().optional(),
+  framework: z28.string().nullable().optional(),
+  installCommand: z28.string().nullable().optional(),
+  buildCommand: z28.string().nullable().optional(),
+  link: z28.object({
+    type: z28.string(),
+    repo: z28.string().optional(),
+    repoId: z28.union([z28.string(), z28.number()]).optional(),
+    org: z28.string().optional(),
+    productionBranch: z28.string().optional()
+  }).nullable().optional()
+});
+var exists = async (path) => access2(path).then(() => true, () => false);
+var fail = (code, message) => {
+  throw new SetupFailure(code, message);
+};
+var stable = (version2, major) => new RegExp(`^${major}\\.\\d+\\.\\d+$`, "u").test(version2);
+async function inspectSetupLocalProject(projectDir) {
+  const projectDirectory = await realpath(resolve(projectDir));
+  const manifest = manifestSchema.parse(JSON.parse(await readFile8(join6(projectDirectory, "package.json"), "utf8")));
+  const apps = (await Promise.all(["app", "src/app"].map(async (path) => await exists(join6(projectDirectory, path)) ? path : null))).filter((path) => path !== null);
+  if (apps.length !== 1)
+    fail("ambiguous_app_directory", "Select one Next.js App Router application with exactly one app/ or src/app/ directory.");
+  const repositoryRoot = (await setupProcess("git", ["rev-parse", "--show-toplevel"], {
+    cwd: projectDirectory
+  })).trim();
+  const tracked = await setupProcess("git", ["ls-files", "--stage", "-z"], {
+    cwd: repositoryRoot
+  });
+  for (const entry of tracked.split("\0").filter(Boolean)) {
+    if (entry.startsWith("160000 "))
+      fail("git_submodule_conflict", "The repository contains Git submodules. Resolve the explicit deployment source boundary before setup; the CLI will not copy external repositories.");
+    if (!entry.startsWith("120000 "))
+      continue;
+    const path = join6(repositoryRoot, entry.slice(entry.indexOf("	") + 1));
+    const target = resolve(dirname6(path), await readlink(path));
+    const bound = relative2(repositoryRoot, target);
+    if (bound.startsWith("..") || bound.startsWith(sep))
+      fail("external_symlink_conflict", "A tracked symbolic link points outside this repository. Resolve that source boundary before setup; local external files cannot enter a deployment.");
+  }
+  let lockfileRoot = projectDirectory;
+  const lockNames = [
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+    "bun.lockb"
+  ];
+  let locks = [];
+  for (; ; ) {
+    locks = (await Promise.all(lockNames.map(async (name3) => await exists(join6(lockfileRoot, name3)) ? name3 : null))).filter((name3) => name3 !== null);
+    if (locks.length || lockfileRoot === repositoryRoot || dirname6(lockfileRoot) === lockfileRoot)
+      break;
+    lockfileRoot = dirname6(lockfileRoot);
+  }
+  if (locks.length > 1)
+    fail("conflicting_lockfiles", "Resolve conflicting package-manager lockfiles before setup; Siteplane does not replace them.");
+  if (!locks.length)
+    fail("lockfile_missing", "Install the existing application with its chosen package manager to create one canonical lockfile.");
+  const lockName = locks[0];
+  if (!["package-lock.json", "pnpm-lock.yaml"].includes(lockName))
+    fail("unsupported_package_manager", "This setup supports npm 10 or pnpm 9/10 with their canonical lockfile.");
+  const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
+  if (lockfileRoot !== projectDirectory) {
+    const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
+    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z28.object({ packages: z28.array(z28.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z28.union([
+      z28.array(z28.string()),
+      z28.object({ packages: z28.array(z28.string()) }).transform((value) => value.packages)
+    ]).parse(rootManifest.workspaces);
+    const selected = relative2(lockfileRoot, projectDirectory).split(sep).join("/");
+    if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
+      fail("unbound_workspace_app", "The selected application is excluded from the canonical lockfile's workspace packages. Select its actual application root.");
+  }
+  for (let ancestor = dirname6(lockfileRoot); ancestor.startsWith(repositoryRoot + sep) || ancestor === repositoryRoot; ancestor = dirname6(ancestor)) {
+    const ancestorLocks = await Promise.all(lockNames.map((name3) => exists(join6(ancestor, name3))));
+    if (ancestorLocks.some(Boolean))
+      fail("ambiguous_lockfile_root", "Both the selected package and its repository ancestors contain lockfiles. Select one canonical workspace resolution before setup.");
+    if (ancestor === repositoryRoot)
+      break;
+  }
+  const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
+  const npmLock = lockName === "package-lock.json" ? z28.object({
+    lockfileVersion: z28.number(),
+    packages: z28.record(z28.string(), z28.object({
+      version: z28.string().optional(),
+      peerDependencies: z28.record(z28.string(), z28.string()).optional()
+    })).optional()
+  }).parse(JSON.parse(lockText)) : null;
+  async function version2(name3) {
+    try {
+      return (await readInstalledPackage(projectDirectory, name3)).version;
+    } catch {
+      const resolved = npmLock?.packages?.[`node_modules/${name3}`]?.version;
+      if (resolved)
+        return resolved;
+      return fail("dependencies_not_installed", `Install the existing ${name3} dependency using the canonical lockfile before setup.`);
+    }
+  }
+  const [nextVersion, reactVersion, reactDomVersion] = await Promise.all([
+    version2("next"),
+    version2("react"),
+    version2("react-dom")
+  ]);
+  if (!stable(nextVersion, 16))
+    fail("unsupported_next_version", "Setup supports stable Next.js 16 App Router projects. Framework migration requires a separate owner decision.");
+  if (!stable(reactVersion, 19) || reactDomVersion !== reactVersion)
+    fail("react_version_conflict", "Use the same stable React 19/react-dom version compatible with the installed Next.js peers.");
+  if (!stable(process.versions.node, 22))
+    fail("unsupported_node_version", "Run setup under Node.js 22; this does not change your framework or package-manager versions.");
+  const nextMetadata = await readInstalledPackage(projectDirectory, "next").catch(() => npmLock?.packages?.["node_modules/next"] ?? null);
+  const peers = nextMetadata?.peerDependencies;
+  if (!peers?.react || !peers["react-dom"])
+    fail("next_peer_metadata_missing", "Install the locked Next.js dependency before setup so its actual React peer requirements can be checked.");
+  if (!semver.satisfies(reactVersion, peers.react) || !semver.satisfies(reactDomVersion, peers["react-dom"]))
+    fail("react_peer_conflict", "The installed React pair does not satisfy the installed Next.js peer requirements. Choose a compatible pair explicitly.");
+  if (manifest.engines?.node && !semver.satisfies(process.versions.node, manifest.engines.node))
+    fail("node_engine_conflict", "The selected application's Node engine declaration excludes the active supported Node.js 22 runtime.");
+  const name2 = lockName === "package-lock.json" ? "npm" : "pnpm";
+  const declared = rootManifest.packageManager ?? manifest.packageManager ?? null;
+  if (rootManifest.packageManager && manifest.packageManager && rootManifest.packageManager !== manifest.packageManager)
+    fail("package_manager_conflict", "Application and workspace packageManager declarations disagree.");
+  if (declared && !new RegExp(`^${name2}@\\d+\\.\\d+\\.\\d+$`, "u").test(declared))
+    fail("package_manager_conflict", "Declare an exact supported npm/pnpm packageManager version matching the canonical lockfile.");
+  const localVersion = (await setupProcess(declared ? "npx" : name2, declared ? ["--yes", declared, "--version"] : ["--version"], { cwd: lockfileRoot })).trim();
+  if (!(name2 === "npm" ? stable(localVersion, 10) : stable(localVersion, 9) || stable(localVersion, 10)))
+    fail("unsupported_package_manager_version", "Use npm 10 or pnpm 9/10; other versions are outside the initial setup support range.");
+  if (declared && declared !== `${name2}@${localVersion}`)
+    fail("package_manager_conflict", "The actual local package-manager version differs from the project's exact packageManager declaration. Select the declared tool without rewriting the lockfile.");
+  const format = npmLock ? String(npmLock.lockfileVersion) : /^lockfileVersion:\s*['"]?([\d.]+)/mu.exec(lockText)?.[1];
+  if (name2 === "npm" && format !== "3" || name2 === "pnpm" && format !== "9.0" && format !== "9")
+    fail("lockfile_format_conflict", "The canonical lockfile format does not match npm 10 or pnpm 9/10.");
+  const sourceConflicts = [];
+  for (const file of ["next.config.js", "next.config.mjs", "next.config.ts"]) {
+    if (!await exists(join6(projectDirectory, file)))
+      continue;
+    const source = await readFile8(join6(projectDirectory, file), "utf8");
+    if (/output\s*:\s*['"]export['"]/u.test(source))
+      sourceConflicts.push("static_export");
+    if (/\bbasePath\s*:/u.test(source))
+      sourceConflicts.push("base_path");
+  }
+  if (sourceConflicts.length)
+    fail("unsupported_server_configuration", "Resolve static export/basePath configuration explicitly; Siteplane requires its server-side admin and revalidation handlers.");
+  for (const name3 of [
+    "middleware.ts",
+    "middleware.js",
+    "proxy.ts",
+    "proxy.js",
+    "src/middleware.ts",
+    "src/middleware.js",
+    "src/proxy.ts",
+    "src/proxy.js"
+  ]) {
+    if (await exists(join6(projectDirectory, name3)))
+      sourceConflicts.push(`inspect_routing:${name3}`);
+  }
+  async function inspectSource(directory) {
+    for (const entry of await readdir(directory, { withFileTypes: true })) {
+      if (entry.isSymbolicLink() || ["node_modules", ".git", ".next", ".siteplane", ".vercel"].includes(entry.name))
+        continue;
+      const path = join6(directory, entry.name);
+      if (entry.isDirectory()) {
+        await inspectSource(path);
+        continue;
+      }
+      if (!/\.[cm]?[jt]sx?$/u.test(entry.name))
+        continue;
+      const source = await readFile8(path, "utf8");
+      if (/from\s*["']next\/image["']/u.test(source))
+        sourceConflicts.push(`inspect_image_policy:${relative2(projectDirectory, path)}`);
+      if (/\b(?:Cookiebot|OneTrust|cookieyes|consentManager|cookieConsent)\b/iu.test(source))
+        sourceConflicts.push(`inspect_existing_consent:${relative2(projectDirectory, path)}`);
+      if (/from\s*["']next\/image["']/u.test(source) && semver.lt(nextVersion, "16.3.3"))
+        fail("next_security_advisory", `Next.js ${nextVersion} uses image optimization affected by the August 2026 AVIF advisory. Review https://nextjs.org/blog/august-2026-security-release and explicitly update the affected dependency before setup; no framework upgrade was performed.`);
+      if (/["']use server["']/u.test(source) && semver.lt(nextVersion, "16.2.11"))
+        fail("next_security_advisory", `Next.js ${nextVersion} contains Server Actions affected by the July 2026 advisory. Review https://nextjs.org/blog/july-2026-security-release and explicitly update the affected dependency before setup.`);
+    }
+  }
+  await inspectSource(join6(projectDirectory, apps[0]));
+  const gitRead = async (args) => setupProcess("git", args, { cwd: projectDirectory }).then((value) => value.trim(), () => null);
+  return {
+    projectDirectory,
+    repositoryRoot,
+    lockfileRoot,
+    appDirectory: apps[0],
+    nextVersion,
+    reactVersion,
+    nodeVersion: process.versions.node,
+    packageManager: { name: name2, version: localVersion, declared },
+    lockfile: {
+      path: relative2(repositoryRoot, join6(lockfileRoot, lockName)),
+      format,
+      sha256: createHash2("sha256").update(lockText).digest("hex")
+    },
+    git: {
+      branch: await gitRead(["branch", "--show-current"]),
+      revision: await gitRead(["rev-parse", "HEAD"]),
+      remote: safeGitRemote(await gitRead(["remote", "get-url", "origin"])),
+      changes: (await gitRead(["status", "--porcelain=v1", "--untracked-files=all"]))?.split("\n").filter(Boolean) ?? []
+    },
+    sourceConflicts
+  };
+}
+async function setupPreflightCommand(input) {
+  let local;
+  try {
+    local = await inspectSetupLocalProject(input.projectDir);
+    await assertLocalCredentialsPathSafe(input.projectDir);
+    let linkDirectory = local.projectDirectory;
+    while (!await exists(join6(linkDirectory, ".vercel/project.json")) && linkDirectory !== local.repositoryRoot && dirname6(linkDirectory) !== linkDirectory)
+      linkDirectory = dirname6(linkDirectory);
+    if (!await exists(join6(linkDirectory, ".vercel/project.json")))
+      fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
+    const linked = z28.object({
+      projectId: z28.string().regex(/^prj_[A-Za-z0-9]+$/u),
+      orgId: z28.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
+    }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
+    const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
+    if (project.id !== linked.projectId || project.accountId !== linked.orgId)
+      fail("vercel_identity_conflict", "The provider project does not match the locally linked project and team.");
+    const expectedRoot = relative2(local.repositoryRoot, local.projectDirectory).split(sep).join("/");
+    if ((project.rootDirectory ?? "") !== expectedRoot)
+      fail("vercel_root_conflict", "Vercel Root Directory and the selected local app must identify the same application.");
+    if (project.nodeVersion !== "22.x" || project.framework !== "nextjs")
+      fail("vercel_framework_conflict", "The bound Vercel project must use Next.js with Node.js 22 before setup.");
+    if (project.link && project.link.productionBranch !== local.git.branch)
+      fail("vercel_production_branch_conflict", "The local branch differs from the bound Vercel Production branch.");
+    if (project.link?.repo && project.link.org && !local.git.remote?.replace(/\.git$/u, "").endsWith(`${project.link.org}/${project.link.repo}`))
+      fail("vercel_git_conflict", "The local origin repository differs from the Vercel Git connection.");
+    const env = z28.object({
+      envs: z28.array(z28.object({
+        key: z28.string(),
+        value: z28.string().optional(),
+        target: z28.array(z28.string()).optional()
+      }))
+    }).parse(await setupVercelApi(linkDirectory, `/v10/projects/${linked.projectId}/env?teamId=${linked.orgId}`));
+    const corepack = env.envs.some((item) => item.key === "ENABLE_EXPERIMENTAL_COREPACK" && item.value === "1" && item.target?.includes("production"));
+    const install = project.installCommand ?? null;
+    const selected = corepack ? "corepack" : install ? "install_override" : "automatic";
+    if (local.packageManager.declared && selected === "automatic")
+      fail("vercel_package_manager_pin_unconfirmed", "This project declares an exact packageManager but Vercel automatic selection does not bind that version. Enable its supported Corepack selection or set an exact install AND build override in the existing project, then rerun preflight. No package, lockfile or provider setting was changed.");
+    if (install && /\b(?:yarn|bun)\b/u.test(install))
+      fail("vercel_package_manager_conflict", "The Vercel install override selects an unsupported package manager.");
+    const overridePin = install ? /\b(npm|pnpm)@(\d+\.\d+\.\d+)\b/u.exec(install) : null;
+    if (overridePin && overridePin[1] !== local.packageManager.name)
+      fail("vercel_package_manager_conflict", "The provider override selects a different package manager than the canonical lockfile.");
+    const overrideFamily = install ? /(?:^|[;&|]\s*)(npm|pnpm)\s+(?:ci|install)\b/u.exec(install)?.[1] : null;
+    if (overrideFamily && overrideFamily !== local.packageManager.name)
+      fail("vercel_package_manager_conflict", "The provider install command conflicts with the canonical lockfile.");
+    if (overridePin && local.packageManager.declared && `${overridePin[1]}@${overridePin[2]}` !== local.packageManager.declared)
+      fail("vercel_package_manager_conflict", "The Vercel install override conflicts with the exact packageManager declaration.");
+    return {
+      status: "ready",
+      local,
+      provider: {
+        projectId: project.id,
+        teamId: project.accountId,
+        name: project.name,
+        rootDirectory: expectedRoot,
+        nodeVersion: project.nodeVersion,
+        git: project.link,
+        installCommand: install,
+        buildCommand: project.buildCommand ?? null,
+        packageManagerSelection: selected,
+        declaredPackageManager: local.packageManager.declared,
+        observedPackageManager: null
+      }
+    };
+  } catch (error) {
+    return {
+      status: "action_required",
+      code: error instanceof SetupFailure ? error.code : "invalid_local_project",
+      message: error instanceof SetupFailure ? error.message : "The selected project or provider response could not be validated. Check the application manifest and local project access.",
+      ...local ? { local } : {}
+    };
+  }
+}
+function safeGitRemote(value) {
+  if (!value)
+    return null;
+  if (!value.includes("://"))
+    return value;
+  try {
+    const url = new URL(value);
+    url.username = "";
+    url.password = "";
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/$/u, "");
+  } catch {
+    return null;
+  }
+}
+
+// ../cli/dist/commands/init.js
 async function initCommand(input) {
   if (!input.setupToken.trim()) {
     throw new Error("A Siteplane setup token is required.");
@@ -3126,47 +3797,64 @@ async function initCommand(input) {
   if (!await detectNextProject(input.projectDir)) {
     throw new Error("Siteplane init currently supports Next.js projects.");
   }
+  await assertLocalCredentialsPathSafe(input.projectDir, {
+    ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
+    ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
+  });
+  const preflight = await (input.preflight ?? setupPreflightCommand)({
+    projectDir: input.projectDir
+  });
+  if (preflight.status !== "ready")
+    throw new Error(`${preflight.code}: ${preflight.message}`);
   const bootstrap = await bootstrapProjectConnection(input);
-  const paths = bootstrap.credentialPurpose === "site_setup" ? await persistSiteSetupBootstrap(input, bootstrap) : await persistFeatureBootstrap(input, bootstrap);
+  const paths = bootstrap.credentialPurpose === "site_setup" ? await persistSiteSetupBootstrap(input, bootstrap, relative3(preflight.local.lockfileRoot, preflight.local.projectDirectory) || ".") : await persistFeatureBootstrap(input, bootstrap);
   await acknowledgeBootstrapResponse(input);
   return {
     ...paths,
     nextSteps: [
       "Run npx siteplane setup context and read the returned task.",
       "Before source changes, briefly tell the user what Siteplane requested and what you will do.",
-      "Follow the returned steps through setup verify and stop only at ready_for_review or action_required."
+      "Follow the returned steps through setup prepare and setup deploy --wait, which performs setup verify; stop only at ready_for_review or action_required."
     ]
   };
 }
-var siteSetupBootstrapDataSchema = z26.object({
-  credentialPurpose: z26.literal("site_setup"),
-  apiBaseUrl: z26.string().url(),
-  siteId: z26.string().uuid(),
-  publicSiteKeyId: z26.string().uuid(),
-  publicSiteKey: z26.string().trim().min(1),
-  accessToken: z26.string().trim().min(1),
-  siteRevalidationSecret: z26.string().regex(/^[A-Za-z0-9_-]{43}$/u)
+var siteSetupBootstrapDataSchema = z29.object({
+  credentialPurpose: z29.literal("site_setup"),
+  apiBaseUrl: z29.string().url(),
+  siteId: z29.string().uuid(),
+  publicSiteKeyId: z29.string().uuid(),
+  publicSiteKey: z29.string().trim().min(1),
+  accessToken: z29.string().trim().min(1),
+  siteRevalidationSecret: z29.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  runId: z29.string().uuid(),
+  packages: z29.object({
+    siteplane: z29.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
+    runtimeNext: z29.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
+  }).strict()
 }).strict();
-var featureBootstrapDataSchema = z26.object({
-  credentialPurpose: z26.enum(["analytics", "booking"]),
-  apiBaseUrl: z26.string().url(),
-  siteId: z26.string().uuid(),
-  accessToken: z26.string().trim().min(1)
+var featureBootstrapDataSchema = z29.object({
+  credentialPurpose: z29.enum(["analytics", "booking"]),
+  apiBaseUrl: z29.string().url(),
+  siteId: z29.string().uuid(),
+  accessToken: z29.string().trim().min(1)
 }).strict();
-var bootstrapResponseSchema = z26.object({
-  ok: z26.literal(true),
-  data: z26.discriminatedUnion("credentialPurpose", [
+var bootstrapResponseSchema = z29.object({
+  ok: z29.literal(true),
+  data: z29.discriminatedUnion("credentialPurpose", [
     siteSetupBootstrapDataSchema,
     featureBootstrapDataSchema
   ])
 }).strict();
 async function bootstrapProjectConnection(input) {
   const fetcher = input.fetcher ?? fetch;
+  const existing = await access3(join7(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
   const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
     method: "POST",
+    signal: AbortSignal.timeout(2e4),
     headers: createBootstrapHeaders(input),
     body: JSON.stringify({
       action: "bootstrap",
+      ...existing ? { expectedSiteId: existing.siteId, expectedRunId: existing.runId } : {},
       agentClient: input.agentClient ?? "codex"
     })
   });
@@ -3181,6 +3869,7 @@ async function acknowledgeBootstrapResponse(input) {
   const fetcher = input.fetcher ?? fetch;
   const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
     method: "POST",
+    signal: AbortSignal.timeout(2e4),
     headers: createBootstrapHeaders(input),
     body: JSON.stringify({ action: "acknowledge" })
   });
@@ -3188,8 +3877,13 @@ async function acknowledgeBootstrapResponse(input) {
     throw new Error("Siteplane setup acknowledgement failed.");
   }
 }
-async function persistSiteSetupBootstrap(input, bootstrap) {
+async function persistSiteSetupBootstrap(input, bootstrap, appDirectory) {
+  const previous = await access3(join7(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
+  if (previous && (previous.siteId !== bootstrap.siteId || previous.runId !== bootstrap.runId || previous.publicSiteKeyId !== bootstrap.publicSiteKeyId || previous.publicSiteKey !== bootstrap.publicSiteKey))
+    throw new Error("The grant does not match this local Siteplane run. Preserve this directory and choose the correct owner connection.");
+  const previousCredentials = previous ? await access3(join7(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalCredentials(input.projectDir), () => null) : null;
   const credentialsPath = await writeLocalCredentials(input.projectDir, {
+    ...previousCredentials?.adminSession ? { adminSession: previousCredentials.adminSession } : {},
     accessToken: bootstrap.accessToken,
     siteRevalidationSecret: bootstrap.siteRevalidationSecret
   }, {
@@ -3197,7 +3891,13 @@ async function persistSiteSetupBootstrap(input, bootstrap) {
     ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
   });
   const configPath = await writeProjectConfig(input.projectDir, {
-    version: 1,
+    ...previous ?? {},
+    version: 2,
+    appDirectory,
+    runId: bootstrap.runId,
+    packages: bootstrap.packages,
+    taskContractVersion: "siteplane.setup-task.v2",
+    adminProtocolVersion: 2,
     apiBaseUrl: bootstrap.apiBaseUrl,
     siteId: bootstrap.siteId,
     publicSiteKeyId: bootstrap.publicSiteKeyId,
@@ -3207,7 +3907,7 @@ async function persistSiteSetupBootstrap(input, bootstrap) {
     readLocalCredentials(input.projectDir),
     readProjectConfig(input.projectDir)
   ]);
-  if (credentials.accessToken !== bootstrap.accessToken || credentials.siteRevalidationSecret !== bootstrap.siteRevalidationSecret || config.apiBaseUrl !== bootstrap.apiBaseUrl || config.siteId !== bootstrap.siteId || config.publicSiteKeyId !== bootstrap.publicSiteKeyId || config.publicSiteKey !== bootstrap.publicSiteKey) {
+  if (credentials.accessToken !== bootstrap.accessToken || credentials.siteRevalidationSecret !== bootstrap.siteRevalidationSecret || config.runId !== bootstrap.runId || config.packages.siteplane !== bootstrap.packages.siteplane || config.packages.runtimeNext !== bootstrap.packages.runtimeNext || config.apiBaseUrl !== bootstrap.apiBaseUrl || config.siteId !== bootstrap.siteId || config.publicSiteKeyId !== bootstrap.publicSiteKeyId || config.publicSiteKey !== bootstrap.publicSiteKey) {
     throw new Error("Siteplane setup files could not be verified.");
   }
   return { configPath, credentialsPath };
@@ -3221,8 +3921,8 @@ async function persistFeatureBootstrap(input, bootstrap) {
     throw new Error("The setup token belongs to a different Siteplane site.");
   }
   const credentialsPath = await writeLocalCredentials(input.projectDir, {
-    accessToken: bootstrap.accessToken,
-    siteRevalidationSecret: existingCredentials.siteRevalidationSecret
+    ...existingCredentials,
+    accessToken: bootstrap.accessToken
   }, {
     ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
     ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
@@ -3232,7 +3932,7 @@ async function persistFeatureBootstrap(input, bootstrap) {
     throw new Error("Siteplane credentials could not be verified.");
   }
   return {
-    configPath: join5(input.projectDir, "siteplane.config.json"),
+    configPath: join7(input.projectDir, "siteplane.config.json"),
     credentialsPath
   };
 }
@@ -3254,8 +3954,8 @@ function readErrorMessage(payload) {
 }
 
 // ../cli/dist/commands/scan.js
-import { readdir } from "fs/promises";
-import { extname, join as join6 } from "path";
+import { readdir as readdir2 } from "fs/promises";
+import { extname, join as join8 } from "path";
 var defaultScanRoots = ["app", "src", "pages", "components", "lib"];
 var excludedDirectories = /* @__PURE__ */ new Set([
   ".git",
@@ -3273,14 +3973,14 @@ async function resolveScanFilePaths(filePaths, options = {}) {
     return filePaths;
   }
   const projectDir = options.projectDir ?? process.cwd();
-  const discovered = await Promise.all(defaultScanRoots.map((root) => collectSourceFiles(join6(projectDir, root))));
+  const discovered = await Promise.all(defaultScanRoots.map((root) => collectSourceFiles(join8(projectDir, root))));
   return [...new Set(discovered.flat())].sort();
 }
 async function collectSourceFiles(directory) {
-  const entries = await readdir(directory, { withFileTypes: true }).catch(() => []);
+  const entries = await readdir2(directory, { withFileTypes: true }).catch(() => []);
   const files = [];
   for (const entry of entries) {
-    const entryPath = join6(directory, entry.name);
+    const entryPath = join8(directory, entry.name);
     if (entry.isDirectory()) {
       if (!excludedDirectories.has(entry.name)) {
         files.push(...await collectSourceFiles(entryPath));
@@ -3296,17 +3996,17 @@ async function collectSourceFiles(directory) {
 
 // ../cli/dist/commands/site-setup.js
 import { execFile as execFile2 } from "child_process";
-import { readFile as readFile7 } from "fs/promises";
+import { readFile as readFile9 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z27 } from "zod";
+import { z as z30 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
-import { isAbsolute, relative as relative2 } from "path";
+import { isAbsolute, relative as relative4 } from "path";
 var eventPreviewHandlerMissingMessage = "Event preview fields must consume preview values with useSiteplanePreviewText from @siteplane/runtime-next/client or a siteplane:preview-value-applied listener.";
 var valueCallUnusedMessage = "Siteplane value calls must feed rendered content. Assign or await the returned value and render that value instead of ignoring the call.";
 var legacyEditableComponentPrefix = "Editable";
-var editableComponentNames = new Set(["Image", "Text", "LongText", "Link"].map((name) => `${legacyEditableComponentPrefix}${name}`));
+var editableComponentNames = new Set(["Image", "Text", "LongText", "Link"].map((name2) => `${legacyEditableComponentPrefix}${name2}`));
 var functionTypeByName = {
   text: "text",
   longText: "longText",
@@ -3844,17 +4544,17 @@ function readObjectLiteral(expression) {
     if (!ts2.isPropertyAssignment(property)) {
       continue;
     }
-    const name = getPropertyName(property.name);
-    if (!name) {
+    const name2 = getPropertyName(property.name);
+    if (!name2) {
       continue;
     }
-    value[name] = staticExpressionValue2(property.initializer);
+    value[name2] = staticExpressionValue2(property.initializer);
   }
   return value;
 }
-function getPropertyName(name) {
-  if (ts2.isIdentifier(name) || ts2.isStringLiteral(name)) {
-    return name.text;
+function getPropertyName(name2) {
+  if (ts2.isIdentifier(name2) || ts2.isStringLiteral(name2)) {
+    return name2.text;
   }
   return null;
 }
@@ -3880,9 +4580,9 @@ function collectEventPreviewComponentPropUsages(node, eventPreviewAttrVariables,
     });
   }
 }
-function getJsxAttributeName(name) {
-  if (ts2.isIdentifier(name)) {
-    return name.text;
+function getJsxAttributeName(name2) {
+  if (ts2.isIdentifier(name2)) {
+    return name2.text;
   }
   return void 0;
 }
@@ -3907,8 +4607,8 @@ function getFunctionComponentName(node) {
   }
   return void 0;
 }
-function isComponentName(name) {
-  return /^[A-Z]/.test(name);
+function isComponentName(name2) {
+  return /^[A-Z]/.test(name2);
 }
 function getAssignedVariableName(node) {
   let current = node;
@@ -3956,7 +4656,7 @@ function inferRouteHint(filePath) {
   return route ? `/${route}` : "/";
 }
 function toRepositoryRelativePosixPath(filePath, projectRoot) {
-  const path = isAbsolute(filePath) ? relative2(projectRoot, filePath) : filePath;
+  const path = isAbsolute(filePath) ? relative4(projectRoot, filePath) : filePath;
   return path.replaceAll("\\", "/");
 }
 function isPositionalFieldReference(value) {
@@ -3965,54 +4665,30 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z27.object({
-  code: z27.string().trim().min(1),
-  message: z27.string().trim().min(1)
+var safeErrorSchema = z30.object({
+  code: z30.string().trim().min(1),
+  message: z30.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z27.object({ ok: z27.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z27.object({
-  task: siteSetupTaskSchema,
-  site: z27.object({ siteId: z27.string().uuid(), portalPath: z27.string() }),
-  run: z27.object({
-    runId: z27.string().uuid(),
-    mode: z27.enum(["initial", "update"]),
-    status: z27.enum([
-      "waiting_for_agent",
-      "working",
-      "action_required",
-      "ready_for_review"
-    ]),
-    fieldContractHash: z27.string().nullable(),
-    deploymentOrigin: z27.string().nullable(),
-    deploymentRevision: z27.string().nullable(),
-    errorCode: z27.string().nullable(),
-    errorMessage: z27.string().nullable()
-  }),
-  structureHandoff: z27.object({
-    pendingFields: z27.array(setupCorrectionItemSchema).max(50),
-    ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
-  }).strict().nullable(),
-  allowedTasks: z27.array(z27.string()),
-  requiredEnvironmentNames: z27.array(z27.string())
-}).strict();
-var contextResponseSchema = z27.object({ ok: z27.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z27.object({
-  status: z27.enum(["applied", "ready_for_review"]),
-  runId: z27.string().uuid().optional(),
-  contractVersionId: z27.string().uuid().optional(),
-  fieldContractHash: z27.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z27.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z27.number().int().nonnegative().optional(),
-  routeCount: z27.number().int().nonnegative().optional()
+var errorResponseSchema2 = z30.object({ ok: z30.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z30.object({ task: siteSetupTaskSchema }).strict();
+var contextResponseSchema = z30.object({ ok: z30.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z30.object({
+  status: z30.enum(["applied", "ready_for_review"]),
+  runId: z30.string().uuid().optional(),
+  contractVersionId: z30.string().uuid().optional(),
+  fieldContractHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z30.number().int().nonnegative().optional(),
+  routeCount: z30.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z27.object({ ok: z27.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z27.object({
-  status: z27.literal("ready_for_review"),
-  runId: z27.string().uuid().optional(),
-  deploymentOrigin: z27.string().url().optional(),
-  deploymentRevision: z27.string().optional()
+var applyResponseSchema = z30.object({ ok: z30.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z30.object({
+  status: z30.literal("ready_for_review"),
+  runId: z30.string().uuid().optional(),
+  deploymentOrigin: z30.string().url().optional(),
+  deploymentRevision: z30.string().optional()
 }).strict();
-var verifyResponseSchema = z27.object({ ok: z27.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z30.object({ ok: z30.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -4022,9 +4698,19 @@ async function siteSetupContextCommand(input) {
   return actionRequired(response.payload, "Siteplane setup context is unavailable.");
 }
 async function siteSetupApplyCommand(input) {
+  const config = await readProjectConfig(input.projectDir);
+  try {
+    await assertExactSetupPackages(input.projectDir, config.packages);
+  } catch {
+    return {
+      status: "action_required",
+      code: "siteplane_package_pin_conflict",
+      message: "Run setup prepare to install the exact Siteplane packages from the current task before applying fields."
+    };
+  }
   const editorDefinition = editorDefinitionV1Schema.parse(input.editorDefinition);
   const resolveSourceFiles = input.resolveSourceFiles ?? resolveScanFilePaths;
-  const readSourceFile = input.readSourceFile ?? ((path) => readFile7(path, "utf8"));
+  const readSourceFile = input.readSourceFile ?? ((path) => readFile9(path, "utf8"));
   const scanSourceFiles = input.scanSourceFiles ?? scanNextSourceFilesToSiteFieldContract;
   const paths = await resolveSourceFiles([], { projectDir: input.projectDir });
   const files = await Promise.all(paths.map(async (filePath) => ({
@@ -4041,7 +4727,8 @@ async function siteSetupApplyCommand(input) {
   }
   const payload = siteSetupApplyInputSchema.parse({
     fieldContract: scan.contract,
-    editorDefinition
+    editorDefinition,
+    contentSelectionSummary: input.contentSelectionSummary
   });
   const response = await postSiteSetup(input, "apply", payload);
   const parsed = applyResponseSchema.safeParse(response.payload);
@@ -4056,7 +4743,6 @@ async function siteSetupApplyCommand(input) {
       message: "The applied field contract hash does not match the final local source scan."
     };
   }
-  const config = await readProjectConfig(input.projectDir);
   await writeProjectConfig(input.projectDir, {
     ...config,
     fieldContractHash: parsed.data.data.fieldContractHash
@@ -4065,7 +4751,7 @@ async function siteSetupApplyCommand(input) {
 }
 async function siteSetupVerifyCommand(input) {
   const resolveSourceFiles = input.resolveSourceFiles ?? resolveScanFilePaths;
-  const readSourceFile = input.readSourceFile ?? ((path) => readFile7(path, "utf8"));
+  const readSourceFile = input.readSourceFile ?? ((path) => readFile9(path, "utf8"));
   const paths = await resolveSourceFiles([], { projectDir: input.projectDir });
   const sources = await Promise.all(paths.map(readSourceFile));
   if (!sources.some(hasMountedFieldRuntimeBridge)) {
@@ -4095,19 +4781,33 @@ async function postSiteSetup(input, operation, body) {
     readProjectConfig(input.projectDir),
     readLocalCredentials(input.projectDir)
   ]);
-  const response = await (input.fetcher ?? fetch)(`${config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/setup/${operation}`, {
-    method: "POST",
-    headers: {
-      authorization: `Bearer ${credentials.accessToken}`,
-      "content-type": "application/json",
-      ...input.vercelAutomationBypassSecret?.trim() ? {
-        "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim()
-      } : {}
-    },
-    body: JSON.stringify(body)
-  });
-  const payload = await response.json().catch(() => null);
-  return { ok: response.ok, payload };
+  try {
+    const response = await (input.fetcher ?? fetch)(`${config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/setup/${operation}`, {
+      method: "POST",
+      signal: AbortSignal.timeout(Math.max(1, Math.min(2e4, (input.deadline ?? Date.now() + 2e4) - Date.now()))),
+      headers: {
+        authorization: `Bearer ${credentials.accessToken}`,
+        "content-type": "application/json",
+        ...input.vercelAutomationBypassSecret?.trim() ? {
+          "x-vercel-protection-bypass": input.vercelAutomationBypassSecret.trim()
+        } : {}
+      },
+      body: JSON.stringify(body)
+    });
+    const payload = await response.json().catch(() => null);
+    return { ok: response.ok, payload };
+  } catch {
+    return {
+      ok: false,
+      payload: {
+        ok: false,
+        error: {
+          code: "site_setup.transport_failed",
+          message: "The setup request was not acknowledged. Reload the existing task before retrying; no credential values are included."
+        }
+      }
+    };
+  }
 }
 function actionRequired(payload, fallbackMessage) {
   const parsed = errorResponseSchema2.safeParse(payload);
@@ -4132,9 +4832,880 @@ async function readGitRevision(projectDir) {
   }
   return revision;
 }
+async function siteSetupActivityCommand(input) {
+  const activity = siteSetupActivityInputSchema.safeParse({
+    phase: input.phase,
+    textId: input.phase
+  });
+  if (!activity.success)
+    return {
+      status: "action_required",
+      code: "site_setup.invalid_activity",
+      message: "Choose inspecting, integrating, deploying, verifying or repairing."
+    };
+  const response = await postSiteSetup(input, "activity", activity.data);
+  const parsed = z30.object({
+    ok: z30.literal(true),
+    data: z30.object({ status: z30.enum(["recorded", "rate_limited"]) }).strict()
+  }).strict().safeParse(response.payload);
+  return response.ok && parsed.success ? parsed.data.data : actionRequired(response.payload, "Setup activity could not be recorded.");
+}
+
+// ../cli/dist/commands/setup-prepare.js
+import { access as access4, lstat as lstat2, mkdir as mkdir6, open as open3, readFile as readFile10, rename as rename3, rm as rm3 } from "fs/promises";
+import { randomUUID as randomUUID4 } from "crypto";
+import { dirname as dirname7, join as join9, relative as relative5, sep as sep2 } from "path";
+import ts3 from "typescript";
+var exists2 = async (path) => access4(path).then(() => true, () => false);
+var importPath = (from, target) => {
+  const path = relative5(dirname7(from), target).split(sep2).join("/");
+  return path.startsWith(".") ? path : `./${path}`;
+};
+async function setupPrepareCommand(input) {
+  try {
+    const preflight = await setupPreflightCommand(input);
+    if (preflight.status !== "ready")
+      return preflight;
+    const config = await readProjectConfig(input.projectDir);
+    const context = await siteSetupContextCommand(input);
+    if (context.status !== "ok")
+      return context;
+    const task = context.task;
+    if (task.site?.siteId !== config.siteId || task.run?.runId !== config.runId || task.packages.siteplane !== config.packages.siteplane || task.packages.runtimeNext !== config.packages.runtimeNext) {
+      throw new SetupFailure("setup_contract_conflict", "The local configuration does not match this server task and its exact package versions.");
+    }
+    if (task.run.status === "completed" || task.run.status === "ready_for_review")
+      return {
+        status: "unchanged",
+        message: "The verified setup is available for owner review; no preparation writes are needed."
+      };
+    const directory = preflight.local.projectDirectory;
+    const app = join9(directory, preflight.local.appDirectory);
+    const layouts = (await Promise.all(["layout.tsx", "layout.jsx", "layout.js"].map(async (name2) => await exists2(join9(app, name2)) ? join9(app, name2) : null))).filter((path) => path !== null);
+    if (layouts.length !== 1)
+      throw new SetupFailure("layout_integration_conflict", "Select one root layout and mount the Siteplane preview bridge there; preserve existing providers and rendering.");
+    const layoutPath = layouts[0];
+    const typed = layoutPath.endsWith(".tsx");
+    const routeExtension = typed ? "ts" : "js";
+    const bridgePath = join9(app, "_siteplane", `bridge.${typed ? "tsx" : "jsx"}`);
+    const portal = task.site.portalPath;
+    if (!/^\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(portal))
+      throw new SetupFailure("portal_route_conflict", "The selected portal path is not a supported single route segment.");
+    const adminRoot = join9(app, portal.slice(1));
+    for (const name2 of [
+      "page.tsx",
+      "page.jsx",
+      "page.js",
+      "route.ts",
+      "route.js"
+    ]) {
+      if (await exists2(join9(adminRoot, name2)))
+        throw new SetupFailure("portal_route_conflict", "The selected admin path already belongs to the website. Choose an unused editor path in Siteplane.");
+    }
+    const configPath = join9(directory, "siteplane.config.json");
+    const adminPath = join9(adminRoot, "[[...siteplane]]", `route.${routeExtension}`);
+    const revalidationPath = join9(app, "api/siteplane/revalidate", `route.${routeExtension}`);
+    const commonOptions = `siteId: config.siteId,
+    publicRuntimeKeyId: config.publicSiteKeyId,
+    fieldContractHash: process.env.SITEPLANE_BUILD_FIELD_CONTRACT_HASH${typed ? "!" : ""},
+    deploymentRevision: process.env.SITEPLANE_BUILD_REVISION${typed ? "!" : ""},`;
+    const admin = `import { createSiteplaneAdminRouteHandler } from "@siteplane/runtime-next/server";
+import config from ${JSON.stringify(importPath(adminPath, configPath))};
+export const runtime = "nodejs";
+function handle(request${typed ? ": Request" : ""}) {
+  return createSiteplaneAdminRouteHandler({
+    ${commonOptions}
+    setupRunId: config.runId, portalPath: ${JSON.stringify(portal)},
+    deploymentOrigin: process.env.SITEPLANE_SITE_ORIGIN${typed ? "!" : ""},
+    publicSiteKey: config.publicSiteKey, apiBaseUrl: config.apiBaseUrl,
+    revalidationSecret: process.env.SITEPLANE_REVALIDATION_SECRET${typed ? "!" : ""},
+    sessionSecret: process.env.SITEPLANE_ADMIN_SESSION_SECRET${typed ? "!" : ""},
+  })(request);
+}
+export { handle as GET, handle as POST };
+`;
+    const revalidation = `import { revalidatePath, revalidateTag } from "next/cache";
+import { createSiteplaneRevalidationHandler } from "@siteplane/runtime-next/server";
+import config from ${JSON.stringify(importPath(revalidationPath, configPath))};
+export const runtime = "nodejs";
+export async function POST(request${typed ? ": Request" : ""}) {
+  return createSiteplaneRevalidationHandler({
+    ${commonOptions}
+    audienceOrigin: process.env.SITEPLANE_SITE_ORIGIN${typed ? "!" : ""},
+    secret: process.env.SITEPLANE_REVALIDATION_SECRET,
+    revalidate: async (_payload, context) => {
+      revalidateTag(context.cacheTag, { expire: 0 });
+      revalidatePath("/", "layout");
+    },
+  })(request);
+}
+`;
+    const bridge = `"use client";
+import { useEffect, useState } from "react";
+import { FieldRuntimeBridge } from "@siteplane/runtime-next/client";
+import config from ${JSON.stringify(importPath(bridgePath, configPath))};
+export default function SiteplaneBridge() {
+  const [sessionId, setSessionId] = useState${typed ? "<string | null>" : ""}(null);
+  useEffect(() => {
+    const query = new URL(window.location.href).searchParams;
+    const session = query.get("siteplaneSessionId");
+    if (query.get("siteplanePreview") === "1" && query.get("siteplaneAdminOrigin") === new URL(config.apiBaseUrl).origin && session && /^[A-Za-z0-9_-]{1,128}$/.test(session)) setSessionId(session);
+  }, []);
+  return sessionId ? <FieldRuntimeBridge siteId={config.siteId} adminOrigin={new URL(config.apiBaseUrl).origin} sessionId={sessionId} /> : null;
+}
+`;
+    const files = /* @__PURE__ */ new Map([
+      [adminPath, admin],
+      [revalidationPath, revalidation],
+      [bridgePath, bridge]
+    ]);
+    const layoutSource = await readFile10(layoutPath, "utf8");
+    if (!/import\s+SiteplaneBridge\s+from\s+["']\.\/_siteplane\/bridge["']/u.test(layoutSource)) {
+      const ast = ts3.createSourceFile(layoutPath, layoutSource, ts3.ScriptTarget.Latest, true, ts3.ScriptKind.TSX);
+      const closingBodies = [];
+      const visit = (node) => {
+        if (ts3.isJsxClosingElement(node) && node.tagName.getText(ast) === "body")
+          closingBodies.push(node.getStart(ast));
+        ts3.forEachChild(node, visit);
+      };
+      visit(ast);
+      if (closingBodies.length !== 1)
+        throw new SetupFailure("layout_integration_conflict", "Mount SiteplaneBridge inside the existing root body. The layout shape requires a deliberate agent edit.");
+      const point = closingBodies[0];
+      files.set(layoutPath, `import SiteplaneBridge from "./_siteplane/bridge";
+${layoutSource.slice(0, point)}<SiteplaneBridge />${layoutSource.slice(point)}`);
+    }
+    const configs = (await Promise.all(["next.config.ts", "next.config.mjs", "next.config.js"].map(async (name2) => await exists2(join9(directory, name2)) ? join9(directory, name2) : null))).filter((path) => path !== null);
+    if (configs.length > 1)
+      throw new SetupFailure("next_config_conflict", "Choose one existing Next.js configuration before setup.");
+    const nextPath = configs[0] ?? join9(directory, "next.config.mjs");
+    const nextSource = configs.length ? await readFile10(nextPath, "utf8") : "export default {};\n";
+    if (!/\bwithSiteplane\s*\(/u.test(nextSource)) {
+      const ast = ts3.createSourceFile(nextPath, nextSource, ts3.ScriptTarget.Latest, true);
+      const exported = ast.statements.filter(ts3.isExportAssignment);
+      if (exported.length !== 1 || exported[0].isExportEquals)
+        throw new SetupFailure("next_config_conflict", "Wrap the existing default Next.js configuration with withSiteplane from siteplane/next, preserving its existing options.");
+      const expression = exported[0].expression;
+      files.set(nextPath, `import { withSiteplane } from "siteplane/next";
+${nextSource.slice(0, expression.getStart(ast))}withSiteplane(${expression.getText(ast)})${nextSource.slice(expression.end)}`);
+    }
+    files.set(join9(directory, ".siteplane/setup-guide-v2.md"), `# Siteplane setup task v2
+
+${task.goal}
+
+## Technical rules
+
+${task.discovery.rules.map((rule) => `- ${rule}`).join("\n")}
+
+Run setup context for the current user instructions and authorized modules. Keep the user instructions distinct from your selection summary. Use setup deploy --wait for environment transfer and deployment; never read or print credential values.
+`);
+    for (const [path, content] of files) {
+      if (path === layoutPath || path === nextPath)
+        continue;
+      if (await exists2(path) && await readFile10(path, "utf8") !== content)
+        throw new SetupFailure("owned_file_conflict", `Preserve the existing ${relative5(directory, path)} and reconcile its integration with the current Siteplane guide before retrying.`);
+    }
+    for (const path of files.keys())
+      await assertSourcePath(directory, path);
+    const before = /* @__PURE__ */ new Map();
+    for (const path of files.keys())
+      before.set(path, await readFile10(path, "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+          return null;
+        throw error;
+      }));
+    const packageManifest = JSON.parse(await readFile10(join9(directory, "package.json"), "utf8"));
+    const pm = preflight.local.packageManager;
+    const command = (args) => setupProcess("npx", ["--yes", `${pm.name}@${pm.version}`, ...args], {
+      cwd: directory,
+      timeoutMs: 3e5
+    });
+    if (packageManifest.devDependencies?.siteplane !== task.packages.siteplane)
+      await command(pm.name === "npm" ? [
+        "install",
+        "--save-dev",
+        "--save-exact",
+        `siteplane@${task.packages.siteplane}`
+      ] : [
+        "add",
+        "--save-dev",
+        "--save-exact",
+        `siteplane@${task.packages.siteplane}`
+      ]);
+    if (packageManifest.dependencies?.["@siteplane/runtime-next"] !== task.packages.runtimeNext)
+      await command(pm.name === "npm" ? [
+        "install",
+        "--save-exact",
+        `@siteplane/runtime-next@${task.packages.runtimeNext}`
+      ] : [
+        "add",
+        "--save-exact",
+        `@siteplane/runtime-next@${task.packages.runtimeNext}`
+      ]);
+    try {
+      await assertExactSetupPackages(directory, task.packages);
+    } catch {
+      throw new SetupFailure("siteplane_package_pin_conflict", "The actual installed Siteplane packages do not match the task's exact versions. Resolve package access and the canonical lockfile before preparation.");
+    }
+    const written = [];
+    for (const [path, content] of files) {
+      await assertSourcePath(directory, path);
+      const current = await readFile10(path, "utf8").catch((error) => {
+        if (error.code === "ENOENT")
+          return null;
+        throw error;
+      });
+      if (current !== before.get(path))
+        throw new SetupFailure("source_changed_during_prepare", "The source changed while dependencies were installing. Preserve the concurrent edit and reconcile it before retrying preparation.");
+      if (current === content)
+        continue;
+      await mkdir6(dirname7(path), {
+        recursive: true,
+        mode: path.includes(`${sep2}.siteplane${sep2}`) ? 448 : 493
+      });
+      const temporary = `${path}.${randomUUID4()}.tmp`;
+      const handle = await open3(temporary, "wx", path.includes(`${sep2}.siteplane${sep2}`) ? 384 : 420);
+      try {
+        await handle.writeFile(content, "utf8");
+        await handle.sync();
+        await handle.close();
+        await assertSourcePath(directory, path);
+        const latest = await readFile10(path, "utf8").catch((error) => {
+          if (error.code === "ENOENT")
+            return null;
+          throw error;
+        });
+        if (latest !== current)
+          throw new SetupFailure("source_changed_during_prepare", "The source changed before the prepared write. The existing edit was preserved.");
+        await rename3(temporary, path);
+      } finally {
+        await handle.close().catch(() => void 0);
+        await rm3(temporary, { force: true });
+      }
+      written.push(relative5(directory, path));
+    }
+    return {
+      status: "prepared",
+      preexistingChanges: preflight.local.git.changes,
+      files: written,
+      packages: task.packages,
+      nextAction: "Describe your content selection, instrument those values, then run setup apply with the editor definition and --selection-summary-file. Commit only the intended source before setup deploy --wait."
+    };
+  } catch (error) {
+    return {
+      status: "action_required",
+      code: error instanceof SetupFailure ? error.code : "setup_preparation_failed",
+      message: error instanceof SetupFailure ? error.message : "Setup preparation could not complete. Check the selected project, package access and current task; no credential values are included in this diagnostic."
+    };
+  }
+}
+async function assertSourcePath(root, target) {
+  let current = root;
+  for (const part of relative5(root, target).split(sep2)) {
+    if (part === "..")
+      throw new SetupFailure("unsafe_source_path", "The prepared file is outside the selected application.");
+    current = join9(current, part);
+    const stat = await lstat2(current).catch((error) => {
+      if (error.code === "ENOENT")
+        return null;
+      throw error;
+    });
+    if (stat?.isSymbolicLink())
+      throw new SetupFailure("unsafe_source_path", "Preparation cannot write through a symbolic link.");
+  }
+}
+
+// ../cli/dist/commands/setup-lock.js
+import { randomUUID as randomUUID5 } from "crypto";
+import { lstat as lstat3, mkdir as mkdir7, open as open4, readFile as readFile11, rm as rm4, rmdir } from "fs/promises";
+import { resolve as resolve2 } from "path";
+import { z as z31 } from "zod";
+var ownerSchema = z31.object({ pid: z31.number().int().positive(), nonce: z31.string().uuid() }).strict();
+async function withSetupLock(projectDir, work) {
+  const gitPath = (await setupProcess("git", ["rev-parse", "--git-path", "siteplane-setup.lock"], { cwd: projectDir })).trim();
+  const path = resolve2(projectDir, gitPath);
+  const owner = { pid: process.pid, nonce: randomUUID5() };
+  for (let attempt = 0; ; attempt++) {
+    try {
+      const handle = await open4(path, "wx", 384);
+      try {
+        await handle.writeFile(JSON.stringify(owner));
+        await handle.sync();
+      } finally {
+        await handle.close();
+      }
+      break;
+    } catch (error) {
+      if (error.code !== "EEXIST")
+        throw error;
+      if (attempt || (await lstat3(path)).isSymbolicLink())
+        throw locked();
+      const recovery = `${path}.recovery`;
+      try {
+        await mkdir7(recovery, { mode: 448 });
+      } catch {
+        throw locked();
+      }
+      try {
+        const source = await readFile11(path, "utf8");
+        const existing = ownerSchema.safeParse(JSON.parse(source));
+        if (!existing.success)
+          throw locked();
+        try {
+          process.kill(existing.data.pid, 0);
+          throw locked();
+        } catch (failure) {
+          if (failure.code !== "ESRCH")
+            throw locked();
+        }
+        if (await readFile11(path, "utf8") !== source)
+          throw locked();
+        await rm4(path);
+      } finally {
+        await rmdir(recovery);
+      }
+    }
+  }
+  try {
+    return await work();
+  } finally {
+    const current = await readFile11(path, "utf8").catch(() => "");
+    if (current === JSON.stringify(owner))
+      await rm4(path);
+  }
+}
+function locked() {
+  return new SetupFailure("setup_process_active", "Another setup process owns this repository. Wait for it to finish; a live lock is never replaced.");
+}
+
+// ../cli/dist/config/build-provenance.js
+import { createHash as createHash3 } from "crypto";
+import { execFile as execFile3 } from "child_process";
+import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
+import { dirname as dirname8, isAbsolute as isAbsolute2, join as join10, relative as relative6, resolve as resolve3, sep as sep3 } from "path";
+import { isDeepStrictEqual, promisify as promisify3 } from "util";
+import { z as z32 } from "zod";
+var execute = promisify3(execFile3);
+var name = ".siteplane/build-source.json";
+var oid = z32.string().regex(/^[0-9a-f]{40}$/u);
+var entrySchema = z32.object({
+  path: z32.string().min(1).max(4096),
+  mode: z32.enum(["100644", "100755", "120000"]),
+  oid
+}).strict();
+var schema = z32.object({
+  version: z32.literal(2),
+  revision: oid,
+  commit: z32.string().min(1).max(1048576),
+  entries: z32.array(entrySchema).min(1).max(1e5),
+  providerConfigurations: z32.array(z32.object({
+    path: z32.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
+    source: z32.string().max(1048576)
+  }).strict()).max(1e3)
+}).strict();
+async function writeBuildProvenance(checkout, revision) {
+  const commit = (await execute("git", ["cat-file", "commit", revision], {
+    cwd: checkout,
+    maxBuffer: 1048576
+  })).stdout;
+  const tree = (await execute("git", ["ls-tree", "-rz", "--full-tree", revision], {
+    cwd: checkout,
+    maxBuffer: 16777216
+  })).stdout;
+  const entries = tree.split("\0").filter(Boolean).map((line) => {
+    const match = /^(100644|100755|120000) blob ([0-9a-f]{40})\t([\s\S]+)$/u.exec(line);
+    if (!match)
+      throw new Error("Git submodules or unsupported tracked objects need an explicit deployment configuration.");
+    return { path: match[3], mode: match[1], oid: match[2] };
+  });
+  for (const entry of entries) {
+    if (entry.mode !== "120000")
+      continue;
+    const { readlink: readlink2 } = await import("fs/promises");
+    const path = join10(checkout, entry.path);
+    const target2 = resolve3(dirname8(path), await readlink2(path));
+    const bound = relative6(checkout, target2);
+    if (bound.startsWith("..") || isAbsolute2(bound))
+      throw new Error("A tracked symbolic link escapes the committed upload; resolve that source boundary before deployment.");
+  }
+  const providerConfigurations = await Promise.all(entries.filter((entry) => /(?:^|\/)vercel\.json$/u.test(entry.path)).map(async (entry) => ({
+    path: entry.path,
+    source: await readFile12(join10(checkout, entry.path), "utf8")
+  })));
+  const record = schema.parse({
+    version: 2,
+    revision,
+    commit,
+    entries,
+    providerConfigurations
+  });
+  const target = join10(checkout, name);
+  await mkdir8(dirname8(target), { recursive: true, mode: 448 });
+  await writeFile5(target, JSON.stringify(record), { flag: "wx", mode: 384 });
+}
+
+// ../cli/dist/commands/setup-deploy.js
+import { createHash as createHash4, randomBytes, randomUUID as randomUUID6 } from "crypto";
+import { access as access5, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join11 } from "path";
+import { z as z33 } from "zod";
+var envSchema = z33.object({
+  id: z33.string(),
+  key: z33.string(),
+  target: z33.array(z33.string()),
+  type: z33.string(),
+  comment: z33.string().optional(),
+  updatedAt: z33.number().optional()
+});
+var deploymentSchema = z33.object({
+  id: z33.string(),
+  projectId: z33.string(),
+  ownerId: z33.string().optional(),
+  target: z33.string().nullable(),
+  readyState: z33.string(),
+  createdAt: z33.number(),
+  url: z33.string(),
+  meta: z33.record(z33.string(), z33.unknown()).optional(),
+  gitSource: z33.object({ sha: z33.string().optional() }).nullable().optional()
+});
+var buildProofSchema = z33.object({
+  node: z33.string(),
+  packageManager: z33.enum(["npm", "pnpm"]),
+  packageManagerVersion: z33.string(),
+  lockfileHash: z33.string(),
+  revision: z33.string(),
+  fieldContractHash: z33.string(),
+  siteplane: z33.string(),
+  runtimeNext: z33.string(),
+  next: z33.string(),
+  react: z33.string()
+}).strict();
+var digest = (value) => `sha256:${createHash4("sha256").update(stableJsonStringify(value)).digest("hex")}`;
+function fail2(code, message) {
+  throw new SetupFailure(code, message);
+}
+var defaults = {
+  preflight: setupPreflightCommand,
+  context: siteSetupContextCommand,
+  api: setupVercelApi,
+  process: setupProcess,
+  verify: siteSetupVerifyCommand,
+  post: postSiteSetup,
+  writeBuildProvenance,
+  now: Date.now,
+  pause: (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds))
+};
+async function setupDeployCommand(input, deps = defaults) {
+  let record = null;
+  try {
+    if (!await access5(join11(input.projectDir, "siteplane.config.json")).then(() => true, () => false) || !await access5(join11(input.projectDir, ".siteplane/credentials.json")).then(() => true, () => false))
+      fail2("local_connection_missing", "Open this site's setup and choose Replace local connection, then initialize this folder with its new one-time grant.");
+    await assertLocalCredentialsPathSafe(input.projectDir);
+    const config = await readProjectConfig(input.projectDir);
+    let credentials = await readLocalCredentials(input.projectDir);
+    const context = await deps.context(input);
+    if (context.status !== "ok")
+      return context;
+    const task = context.task;
+    if (task.run?.runId !== config.runId || task.site?.siteId !== config.siteId || task.packages.siteplane !== config.packages.siteplane || task.packages.runtimeNext !== config.packages.runtimeNext || task.run.fieldContractHash !== config.fieldContractHash)
+      fail2("setup_contract_conflict", "Local configuration and the current applied setup task must match before deployment.");
+    if (!config.fieldContractHash)
+      fail2("setup_apply_required", "Instrument the agreed content and run setup apply before deployment.");
+    record = task.deployment;
+    const preflight = await deps.preflight(input);
+    if (preflight.status !== "ready")
+      return {
+        ...preflight,
+        ...record ? { deploymentId: record.deploymentId, deadline: record.deadline } : {}
+      };
+    const { local, provider } = preflight;
+    if (local.git.changes.length || !local.git.revision || !local.git.branch)
+      fail2("uncommitted_source", "Commit only the intended setup source on a named branch before deployment. Siteplane does not stage, reset or publish unrelated local work.");
+    const revision = local.git.revision;
+    if (!/^[0-9a-f]{40}$/u.test(revision))
+      fail2("invalid_git_revision", "A full committed Git revision is required.");
+    try {
+      await assertExactSetupPackages(local.projectDirectory, config.packages);
+    } catch {
+      fail2("siteplane_package_pin_conflict", "Install the exact Siteplane package versions from the current task and commit their canonical lockfile.");
+    }
+    let operationDeadline = record && !["verified", "failed"].includes(record.phase) ? Date.parse(record.deadline) : deps.now() + 9e5;
+    const remaining = () => {
+      const milliseconds = operationDeadline - deps.now();
+      if (milliseconds <= 0)
+        fail2("provider_deadline_exceeded", "The 15-minute provider deadline expired. Inspect the recorded operation; setup will not start a second deployment on resume.");
+      return milliseconds;
+    };
+    const processCommand = async (binary, args, options) => {
+      const output = await deps.process(binary, args, {
+        ...options,
+        timeoutMs: Math.min(options.timeoutMs ?? 12e4, remaining())
+      });
+      remaining();
+      return output;
+    };
+    const scope = `teamId=${provider.teamId}`;
+    const api = async (endpoint, body, method) => {
+      remaining();
+      const result = await deps.api(local.projectDirectory, endpoint, body, method, { deadline: operationDeadline });
+      remaining();
+      return result;
+    };
+    const domains = z33.object({
+      domains: z33.array(z33.object({
+        name: z33.string(),
+        verified: z33.boolean(),
+        redirect: z33.string().nullable().optional(),
+        gitBranch: z33.string().nullable().optional()
+      }))
+    }).parse(await api(`/v9/projects/${provider.projectId}/domains?${scope}`)).domains.filter((domain) => domain.verified && !domain.redirect && !domain.gitBranch);
+    const origin = record?.origin ?? (domains.length === 1 ? `https://${domains[0].name}` : null);
+    if (!origin || !domains.some((domain) => `https://${domain.name}` === origin))
+      fail2("production_origin_ambiguous", "The linked project needs one verified canonical Production domain, or the existing setup domain must still belong to it.");
+    if (record && (record.projectId !== provider.projectId || record.teamId !== provider.teamId))
+      fail2("deployment_target_conflict", "This setup already belongs to a different provider project/team. Restore its original local link.");
+    const listEnv = async () => z33.object({ envs: z33.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
+    let env = await listEnv();
+    const owned = (key) => {
+      const matches2 = env.filter((item) => item.key === key && item.target.includes("production"));
+      if (matches2.length > 1 || matches2.some((item) => item.target.length !== 1))
+        fail2("environment_scope_conflict", `Separate ${key} into an unambiguous Production-only binding before setup; other scopes are preserved.`);
+      return matches2[0];
+    };
+    const admin = owned("SITEPLANE_ADMIN_SESSION_SECRET");
+    if (record && !admin && !credentials.adminSession)
+      fail2("admin_secret_recovery_required", "The previously configured admin-session secret is missing. Restore it through an explicit owner-directed configuration recovery; connection replacement never rotates it.");
+    if (!credentials.adminSession && !record && admin)
+      fail2("admin_secret_binding_unknown", "An existing admin-session secret has no matching setup generation. Resolve its ownership before configuration; Siteplane will not overwrite it.");
+    if (!credentials.adminSession && !record && !admin) {
+      credentials = {
+        ...credentials,
+        adminSession: {
+          secret: randomBytes(32).toString("base64url"),
+          generation: randomUUID6()
+        }
+      };
+      await writeLocalCredentials(input.projectDir, credentials);
+      const persisted = await readLocalCredentials(input.projectDir);
+      if (persisted.adminSession?.secret !== credentials.adminSession.secret)
+        fail2("credential_write_failed", "The generated admin credential could not be read back securely.");
+    }
+    const generation = record?.adminSecretGeneration ?? credentials.adminSession.generation;
+    if (credentials.adminSession && credentials.adminSession.generation !== generation)
+      fail2("admin_secret_generation_conflict", "The local admin credential belongs to another configuration generation. Preserve the provider secret and resolve the local binding.");
+    if (admin && admin.comment !== `Siteplane admin generation ${generation}`)
+      fail2("admin_secret_generation_conflict", "The provider admin secret does not match the recorded setup generation. No secret was replaced.");
+    const publicBindings = {
+      SITEPLANE_SITE_ORIGIN: origin,
+      SITEPLANE_SETUP_RUN_ID: config.runId,
+      SITEPLANE_PORTAL_PATH: task.site.portalPath,
+      SITEPLANE_BUILD_FIELD_CONTRACT_HASH: config.fieldContractHash,
+      SITEPLANE_BUILD_REVISION: revision
+    };
+    const fingerprint = digest({
+      publicBindings,
+      siteId: config.siteId,
+      publicKeyId: config.publicSiteKeyId,
+      apiBaseUrl: config.apiBaseUrl,
+      packages: config.packages,
+      bindings: [
+        ...Object.keys(publicBindings),
+        "SITEPLANE_REVALIDATION_SECRET",
+        "SITEPLANE_ADMIN_SESSION_SECRET"
+      ].sort(),
+      adminSecretGeneration: generation,
+      revalidationGeneration: task.revalidationGeneration,
+      projectId: provider.projectId,
+      teamId: provider.teamId,
+      rootDirectory: provider.rootDirectory,
+      nodeVersion: provider.nodeVersion,
+      installCommand: provider.installCommand,
+      buildCommand: provider.buildCommand,
+      packageManagerSelection: provider.packageManagerSelection,
+      declaredPackageManager: provider.declaredPackageManager,
+      lockfileHash: local.lockfile.sha256
+    });
+    const save = async (next) => {
+      const result = await deps.post({ ...input, deadline: operationDeadline }, "deployment", {
+        action: "record",
+        expectedOperationId: record?.operationId ?? null,
+        record: next
+      });
+      const parsed = z33.object({
+        ok: z33.literal(true),
+        data: z33.object({ record: setupDeploymentRecordSchema }).strict()
+      }).strict().safeParse(result.payload);
+      if (!result.ok || !parsed.success || stableJsonStringify(parsed.data.data.record) !== stableJsonStringify(next))
+        fail2("deployment_record_unconfirmed", "The setup deployment record was not acknowledged. Reload context before continuing; no deployment is blindly repeated.");
+      record = parsed.data.data.record;
+      if (next.phase === "planned")
+        operationDeadline = Date.parse(next.deadline);
+    };
+    const fresh = () => ({
+      version: 1,
+      operationId: randomUUID6(),
+      provider: "vercel",
+      projectId: provider.projectId,
+      teamId: provider.teamId,
+      origin,
+      deploymentId: null,
+      revision,
+      fieldContractHash: config.fieldContractHash,
+      packages: config.packages,
+      configurationFingerprint: fingerprint,
+      adminSecretGeneration: generation,
+      revalidationGeneration: task.revalidationGeneration,
+      startedAt: new Date(deps.now()).toISOString(),
+      environmentWrittenAt: null,
+      deployRequestedAt: null,
+      deadline: new Date(deps.now() + 9e5).toISOString(),
+      phase: "planned",
+      build: null
+    });
+    if (!record || record.configurationFingerprint !== fingerprint) {
+      if (record && !["verified", "deployed", "failed"].includes(record.phase))
+        fail2("previous_deployment_unresolved", "Resolve the previous provider operation before changing the source or configuration.");
+      await save(fresh());
+    }
+    const progress = () => input.onProgress?.({
+      phase: record.phase,
+      deadline: record.deadline,
+      deploymentId: record.deploymentId
+    });
+    progress();
+    const values = {
+      ...publicBindings,
+      SITEPLANE_REVALIDATION_SECRET: credentials.siteRevalidationSecret,
+      ...credentials.adminSession ? { SITEPLANE_ADMIN_SESSION_SECRET: credentials.adminSession.secret } : {}
+    };
+    const pending = [];
+    for (const [key, value] of Object.entries(values)) {
+      const item = owned(key);
+      if (key === "SITEPLANE_ADMIN_SESSION_SECRET" && item && record.phase === "verified")
+        continue;
+      const current = item ? z33.object({ key: z33.literal(key), value: z33.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`)).value : null;
+      if (current !== value)
+        pending.push({
+          key,
+          value,
+          type: key.endsWith("SECRET") ? "encrypted" : "plain",
+          target: ["production"],
+          comment: key === "SITEPLANE_ADMIN_SESSION_SECRET" ? `Siteplane admin generation ${generation}` : "Managed by Siteplane setup"
+        });
+    }
+    if (pending.length && record.phase !== "planned") {
+      if (!["verified", "deployed", "failed"].includes(record.phase))
+        fail2("environment_changed_during_deploy", "The environment changed during an unresolved deployment. Inspect that operation before retrying.");
+      await save(fresh());
+    }
+    if (record.phase === "planned") {
+      if (deps.now() >= Date.parse(record.deadline))
+        fail2("provider_deadline_exceeded", "The setup provider deadline expired before configuration. Inspect its existing record before a new attempt.");
+      if (pending.length)
+        await api(`/v10/projects/${provider.projectId}/env?${scope}&upsert=true`, pending);
+      env = await listEnv();
+      for (const [key, value] of Object.entries(values)) {
+        const item = owned(key);
+        if (!item)
+          fail2("environment_write_unconfirmed", "A Siteplane Production binding was not persisted; retry the same configuration.");
+        const observed = z33.object({ key: z33.literal(key), value: z33.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`));
+        if (observed.value !== value)
+          fail2("environment_write_unconfirmed", "The provider readback does not match the authorized Siteplane value; no deployment was started.");
+      }
+      await save({
+        ...record,
+        phase: "environment_written",
+        environmentWrittenAt: new Date(deps.now()).toISOString()
+      });
+    }
+    const detail = async (id) => deploymentSchema.parse(await api(`/v13/deployments/${encodeURIComponent(id)}?${scope}&withGitRepoInfo=true`));
+    const matches = (deployment2) => deployment2.projectId === provider.projectId && deployment2.target === "production" && (!deployment2.ownerId || deployment2.ownerId === provider.teamId) && deployment2.createdAt >= Date.parse(record.environmentWrittenAt) && (deployment2.meta?.siteplaneOperationId === record.operationId || provider.git && (deployment2.gitSource?.sha ?? deployment2.meta?.githubCommitSha ?? deployment2.meta?.gitlabCommitSha ?? deployment2.meta?.bitbucketCommitSha ?? deployment2.meta?.gitCommitSha) === revision);
+    const discover = async () => {
+      const result = z33.object({ deployments: z33.array(z33.object({ uid: z33.string() })) }).parse(await api(`/v6/deployments?${scope}&projectId=${provider.projectId}&target=production&since=${Date.parse(record.environmentWrittenAt)}&limit=100`));
+      const candidates = [];
+      for (const item of result.deployments) {
+        const found = await detail(item.uid);
+        if (matches(found))
+          candidates.push(found);
+      }
+      if (candidates.length > 1)
+        fail2("deployment_ambiguous", "Multiple matching provider deployments exist. Select the existing intended operation before continuing; no additional build was started.");
+      return candidates[0] ?? null;
+    };
+    let deployment = record.deploymentId ? await detail(record.deploymentId) : await discover();
+    if (deployment && !matches(deployment))
+      fail2("deployment_binding_conflict", "The stored deployment does not match this project, commit and environment generation.");
+    if (!deployment && record.phase === "environment_written") {
+      const status = await processCommand("git", ["status", "--porcelain=v1", "--untracked-files=all"], { cwd: local.repositoryRoot });
+      const head = (await processCommand("git", ["rev-parse", "HEAD"], {
+        cwd: local.repositoryRoot
+      })).trim();
+      if (status.trim() || head !== revision)
+        fail2("source_changed_before_deploy", "The source changed after preflight. Commit only the intended source and rerun setup deploy.");
+      await save({
+        ...record,
+        phase: "deploy_requested",
+        deployRequestedAt: new Date(deps.now()).toISOString()
+      });
+      try {
+        if (provider.git) {
+          const remote = (await processCommand("git", ["ls-remote", "origin", `refs/heads/${local.git.branch}`], { cwd: local.repositoryRoot })).trim().split(/\s/u)[0];
+          if (remote !== revision)
+            await processCommand("git", ["push", "origin", `HEAD:refs/heads/${local.git.branch}`], { cwd: local.repositoryRoot });
+          else {
+            const gitSource = {
+              type: provider.git.type,
+              ref: revision,
+              ...provider.git.repoId ? { repoId: provider.git.repoId } : {}
+            };
+            const body = JSON.stringify({
+              name: provider.name,
+              project: provider.projectId,
+              target: "production",
+              gitSource,
+              meta: { siteplaneOperationId: record.operationId }
+            });
+            await processCommand("vercel", [
+              "api",
+              `/v13/deployments?${scope}`,
+              "--method",
+              "POST",
+              "--input",
+              "-",
+              "--raw"
+            ], { cwd: local.projectDirectory, input: body, timeoutMs: 3e4 });
+          }
+        } else {
+          const upload = await mkdtemp(join11(tmpdir(), "siteplane-setup-upload-"));
+          try {
+            await processCommand("git", [
+              "clone",
+              "--no-hardlinks",
+              "--no-checkout",
+              "--",
+              local.repositoryRoot,
+              upload
+            ], { cwd: local.repositoryRoot });
+            await processCommand("git", ["checkout", "--detach", revision], {
+              cwd: upload
+            });
+            await deps.writeBuildProvenance(upload, revision);
+            await mkdir9(join11(upload, ".vercel"), {
+              recursive: true,
+              mode: 448
+            });
+            await writeFile6(join11(upload, ".vercel/project.json"), JSON.stringify({
+              projectId: provider.projectId,
+              orgId: provider.teamId
+            }), { mode: 384 });
+            await processCommand("vercel", [
+              "deploy",
+              "--yes",
+              "--prod",
+              "--no-wait",
+              "--scope",
+              provider.teamId,
+              "--meta",
+              `siteplaneOperationId=${record.operationId}`
+            ], { cwd: upload, timeoutMs: 12e4 });
+          } finally {
+            await rm5(upload, { recursive: true, force: true });
+          }
+        }
+      } catch (error) {
+        if (error instanceof SetupFailure && error.code === "provider_access_denied") {
+          await save({
+            ...record,
+            phase: "environment_written",
+            deployRequestedAt: null
+          });
+          throw error;
+        }
+        if (!(error instanceof SetupFailure) || !["provider_timeout", "provider_transport_failed"].includes(error.code))
+          throw error;
+      }
+    }
+    let poll = 0;
+    while (!deployment || !["READY", "ERROR", "CANCELED"].includes(deployment.readyState)) {
+      progress();
+      const remaining2 = Date.parse(record.deadline) - deps.now();
+      if (remaining2 <= 0)
+        fail2("provider_deadline_exceeded", "The 15-minute provider deadline expired. Inspect the recorded operation; setup will not start a second deployment on resume.");
+      await deps.pause(Math.min(remaining2, Math.min(15e3, 2e3 * 2 ** Math.min(poll++, 3)) + Math.floor(Math.random() * 500)));
+      deployment = deployment ? await detail(deployment.id) : await discover();
+      if (deployment && !matches(deployment))
+        fail2("deployment_binding_conflict", "The provider operation no longer matches this setup deployment.");
+    }
+    if (deployment.readyState !== "READY") {
+      await save({ ...record, phase: "failed", deploymentId: deployment.id });
+      fail2("provider_build_failed", "The existing provider build failed or was canceled. Fix its diagnosed package/build configuration before requesting another deployment.");
+    }
+    if (record.phase !== "verified")
+      await save({
+        ...record,
+        phase: "deployed",
+        deploymentId: deployment.id
+      });
+    const logs = await processCommand("vercel", ["inspect", deployment.url, "--logs", "--scope", provider.teamId], { cwd: local.projectDirectory, includeStderr: true });
+    const markers = [
+      ...logs.matchAll(/SITEPLANE_BUILD_PROOF=(\{[^\n]+\})/gu)
+    ].map((match) => buildProofSchema.parse(JSON.parse(match[1])));
+    const proof = markers.find((item) => item.revision === revision && item.fieldContractHash === config.fieldContractHash);
+    if (!proof || !/^22\.\d+\.\d+$/u.test(proof.node) || proof.siteplane !== config.packages.siteplane || proof.runtimeNext !== config.packages.runtimeNext || proof.lockfileHash !== `sha256:${local.lockfile.sha256}` || proof.next !== local.nextVersion || proof.react !== local.reactVersion || !(proof.packageManager === "npm" ? /^10\./u : /^(9|10)\./u).test(proof.packageManagerVersion) || local.packageManager.declared && `${proof.packageManager}@${proof.packageManagerVersion}` !== local.packageManager.declared)
+      fail2("provider_build_identity_missing", "The actual provider build did not prove the expected Node, package manager, lockfile, package pins and applied source. Inspect its install/build configuration.");
+    const canonical = await detail(new URL(origin).hostname);
+    if (canonical.id !== deployment.id)
+      fail2("production_alias_not_ready", "The canonical Production domain does not yet point to the verified deployment. Inspect the existing promotion; do not create another build.");
+    const verified = await deps.verify({ ...input, deploymentUrl: origin });
+    if (verified.status !== "ready_for_review")
+      return {
+        ...verified,
+        deadline: record.deadline,
+        deploymentId: deployment.id
+      };
+    await save({
+      ...record,
+      phase: "verified",
+      deploymentId: deployment.id,
+      build: {
+        node: proof.node,
+        packageManager: proof.packageManager,
+        packageManagerVersion: proof.packageManagerVersion,
+        lockfileHash: proof.lockfileHash
+      }
+    });
+    return {
+      status: "ready_for_review",
+      deploymentId: deployment.id,
+      origin,
+      configurationFingerprint: fingerprint,
+      deadline: record.deadline,
+      build: record.build
+    };
+  } catch (error) {
+    return {
+      status: "action_required",
+      code: error instanceof SetupFailure ? error.code : "setup_deployment_failed",
+      message: error instanceof SetupFailure ? error.message : "The setup deployment could not be validated. Inspect the local connection and bound provider operation; credential values are never included.",
+      ...record ? { deploymentId: record.deploymentId, deadline: record.deadline } : {}
+    };
+  }
+}
 
 // src/bin/run-siteplane.ts
 async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
+  const writes = args[0] === "init" || args[0] === "setup" && ["apply", "prepare", "deploy"].includes(args[1] ?? "");
+  const missingDeploy = args[0] === "setup" && args[1] === "deploy" && !await access6(join12(dependencies.cwd(), "siteplane.config.json")).then(
+    () => true,
+    () => false
+  );
+  return writes && !missingDeploy ? dependencies.withSetupLock(
+    dependencies.cwd(),
+    () => runSiteplaneCliUnlocked(args, dependencies)
+  ) : runSiteplaneCliUnlocked(args, dependencies);
+}
+async function runSiteplaneCliUnlocked(args, dependencies = createDefaultDependencies()) {
   const [command, ...commandArgs] = args;
   if (command === "init") {
     const setupToken = readOption(commandArgs, "--setup-token");
@@ -4207,7 +5778,7 @@ async function runAnalyticsCommand(args, dependencies) {
     siteId: projectConfig.siteId,
     ...readOptionalVercelAutomationBypassSecret(dependencies.env)
   };
-  const manifestPath = join7(projectDir, "siteplane.analytics.json");
+  const manifestPath = join12(projectDir, "siteplane.analytics.json");
   if (subcommand === "init") {
     const rawPublicKey = await dependencies.commands.analyticsPublicKeyCommand({
       config
@@ -4239,18 +5810,18 @@ async function runAnalyticsCommand(args, dependencies) {
         projectDir
       }
     );
-    const artifactFilePaths = [join7(projectDir, ".siteplane/analytics.md")];
+    const artifactFilePaths = [join12(projectDir, ".siteplane/analytics.md")];
     const cspFilePaths = await existingPaths([
-      join7(projectDir, "next.config.js"),
-      join7(projectDir, "next.config.mjs"),
-      join7(projectDir, "next.config.ts"),
-      join7(projectDir, "middleware.ts"),
-      join7(projectDir, "src/middleware.ts")
+      join12(projectDir, "next.config.js"),
+      join12(projectDir, "next.config.mjs"),
+      join12(projectDir, "next.config.ts"),
+      join12(projectDir, "middleware.ts"),
+      join12(projectDir, "src/middleware.ts")
     ]);
     const check = await dependencies.commands.analyticsCheckCommand({
       manifestPath,
       sourceFilePaths,
-      packageJsonPath: join7(projectDir, "package.json"),
+      packageJsonPath: join12(projectDir, "package.json"),
       cspFilePaths,
       artifactFilePaths
     });
@@ -4318,6 +5889,28 @@ async function runSetupCommand(args, dependencies) {
   const connectionOptions = readOptionalVercelAutomationBypassSecret(
     dependencies.env
   );
+  if (area === "deploy") {
+    const result = await dependencies.commands.setupDeployCommand({
+      projectDir,
+      onProgress: (progress) => dependencies.stderr(JSON.stringify({ status: "waiting", ...progress }))
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
+  }
+  if (area === "preflight") {
+    const result = await dependencies.commands.setupPreflightCommand({
+      projectDir
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "ready" ? 0 : 1 };
+  }
+  if (area === "prepare") {
+    const result = await dependencies.commands.setupPrepareCommand({
+      projectDir
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "action_required" ? 1 : 0 };
+  }
   if (area === "context") {
     const result = await dependencies.commands.siteSetupContextCommand({
       projectDir,
@@ -4326,6 +5919,15 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result, null, 2));
     return { exitCode: result.status === "action_required" ? 1 : 0 };
   }
+  if (area === "activity") {
+    const result = await dependencies.commands.siteSetupActivityCommand({
+      projectDir,
+      phase: readRequiredOption(areaArgs, "--phase"),
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result, null, 2));
+    return { exitCode: result.status === "action_required" ? 1 : 0 };
+  }
   if (area === "apply") {
     const editorDefinition = await dependencies.readJsonFile(
       readRequiredOption(areaArgs, "--definition")
@@ -4333,6 +5935,12 @@ async function runSetupCommand(args, dependencies) {
     const result = await dependencies.commands.siteSetupApplyCommand({
       projectDir,
       editorDefinition,
+      contentSelectionSummary: await dependencies.readTextFile(
+        resolve4(
+          projectDir,
+          readRequiredOption(areaArgs, "--selection-summary-file")
+        )
+      ),
       ...connectionOptions
     });
     dependencies.stdout(JSON.stringify(result, null, 2));
@@ -4348,13 +5956,15 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result, null, 2));
     return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
   }
-  dependencies.stdout("Usage: siteplane setup <context|apply|verify>");
+  dependencies.stdout(
+    "Usage: siteplane setup <preflight|prepare|context|activity|apply|deploy|verify>"
+  );
   return { exitCode: 1 };
 }
 async function runBookingCommand(args, dependencies) {
   const [subcommand, ...subcommandArgs] = args;
   const projectDir = dependencies.cwd();
-  const manifestPath = join7(projectDir, "siteplane.booking.json");
+  const manifestPath = join12(projectDir, "siteplane.booking.json");
   if (subcommand === "init") {
     const siteId = readRequiredOption(subcommandArgs, "--site-id");
     const siteKeyPrefix = readRequiredOption(
@@ -4433,7 +6043,7 @@ async function runBookingCommand(args, dependencies) {
         resourceId: readOption(subcommandArgs, "--resource-id") ?? null,
         startUtc: readRequiredOption(subcommandArgs, "--start-utc"),
         customer,
-        clientToken: readOption(subcommandArgs, "--client-token") ?? randomUUID4(),
+        clientToken: readOption(subcommandArgs, "--client-token") ?? randomUUID7(),
         paymentChoice: "onsite"
       }
     });
@@ -4469,19 +6079,25 @@ function createDefaultDependencies() {
     env: process.env,
     stdout: (line) => console.log(line),
     stderr: (line) => console.error(line),
+    readTextFile: (path) => readFile13(path, "utf8"),
+    withSetupLock,
     readJsonFile: async (path) => JSON.parse(
-      await readFile8(resolve(process.cwd(), path), "utf8")
+      await readFile13(resolve4(process.cwd(), path), "utf8")
     ),
     readPackageVersion: async () => {
       const packageJson = JSON.parse(
-        await readFile8(new URL("../../package.json", import.meta.url), "utf8")
+        await readFile13(new URL("../../package.json", import.meta.url), "utf8")
       );
       return packageJson.version;
     },
     commands: {
       siteSetupApplyCommand,
       siteSetupContextCommand,
+      siteSetupActivityCommand,
       siteSetupVerifyCommand,
+      setupPreflightCommand,
+      setupPrepareCommand,
+      setupDeployCommand,
       initCommand,
       bookingInitCommand,
       bookingCheckCommand,
@@ -4542,7 +6158,7 @@ async function existingPaths(paths) {
   const existing = [];
   for (const path of paths) {
     try {
-      await access2(path);
+      await access6(path);
       existing.push(path);
     } catch {
     }