siteplane 0.1.44 → 0.1.46

package/dist/next.js

@@ -100,12 +100,41 @@ var analyticsProviderImportSchema = z3.object({
   rows: z3.array(analyticsProviderImportRowSchema).min(1).max(1e3)
 }).strict();
 
-// ../shared/dist/analytics-events.js
+// ../shared/dist/analytics-config.js
 import { z as z4 } from "zod";
+var ANALYTICS_CONFIG_LEASE_MS = 6e4;
+var analyticsMeasurementConfigSchema = z4.object({
+  version: z4.literal(1),
+  installationGeneration: z4.number().int().positive(),
+  configRevision: z4.number().int().positive(),
+  effectiveSiteMode: z4.enum(["disabled", "session_only", "full_analytics"]),
+  measurementEnabled: z4.boolean(),
+  issuedAt: z4.string().datetime({ offset: true }),
+  expiresAt: z4.string().datetime({ offset: true })
+}).strict().superRefine((config, context) => {
+  const lifetime = Date.parse(config.expiresAt) - Date.parse(config.issuedAt);
+  if (lifetime <= 0 || lifetime > ANALYTICS_CONFIG_LEASE_MS) {
+    context.addIssue({
+      code: "custom",
+      path: ["expiresAt"],
+      message: "Measurement permission must expire within 60 seconds."
+    });
+  }
+  if (config.measurementEnabled !== (config.effectiveSiteMode !== "disabled")) {
+    context.addIssue({
+      code: "custom",
+      path: ["measurementEnabled"],
+      message: "Measurement permission must match the effective site mode."
+    });
+  }
+});
+
+// ../shared/dist/analytics-events.js
+import { z as z5 } from "zod";
 var ANALYTICS_SCHEMA_VERSION = "analytics.v1";
-var analyticsSessionIdSchema = z4.string().regex(/^cpa_s_[a-f0-9]{32}$/u);
-var analyticsVisitorIdSchema = z4.string().regex(/^cpa_v_[a-f0-9]{32}$/u);
-var analyticsPersistedIdentityHashSchema = z4.string().regex(/^[a-f0-9]{64}$/u);
+var analyticsSessionIdSchema = z5.string().regex(/^cpa_s_[a-f0-9]{32}$/u);
+var analyticsVisitorIdSchema = z5.string().regex(/^cpa_v_[a-f0-9]{32}$/u);
+var analyticsPersistedIdentityHashSchema = z5.string().regex(/^[a-f0-9]{64}$/u);
 var analyticsEventNames = [
   "page_view",
   "section_view",
@@ -185,41 +214,43 @@ var analyticsValidityStatuses = [
   "rejected",
   "ignored"
 ];
-var analyticsEventNameSchema = z4.enum(analyticsEventNames);
-var serverOnlyAnalyticsEventSchema = z4.enum(serverOnlyAnalyticsEvents);
-var analyticsEventSourceSchema = z4.enum(analyticsEventSources);
-var analyticsIngestionChannelSchema = z4.enum(analyticsIngestionChannels);
-var analyticsTargetTypeSchema = z4.enum(analyticsTargetTypes);
-var analyticsDataAttributeEventSchema = z4.enum(analyticsDataAttributeEvents);
-var analyticsDeviceTypeSchema = z4.enum(analyticsDeviceTypes);
-var analyticsBotClassificationSchema = z4.enum(analyticsBotClassifications);
-var analyticsValidityStatusSchema = z4.enum(analyticsValidityStatuses);
-var analyticsPropertiesSchema = z4.record(z4.string(), z4.unknown());
-var analyticsTimestampSchema = z4.string().datetime({ offset: true });
-var analyticsBrowserEventSchema = z4.object({
-  eventId: z4.string().min(1).max(160),
+var analyticsEventNameSchema = z5.enum(analyticsEventNames);
+var serverOnlyAnalyticsEventSchema = z5.enum(serverOnlyAnalyticsEvents);
+var analyticsEventSourceSchema = z5.enum(analyticsEventSources);
+var analyticsIngestionChannelSchema = z5.enum(analyticsIngestionChannels);
+var analyticsTargetTypeSchema = z5.enum(analyticsTargetTypes);
+var analyticsDataAttributeEventSchema = z5.enum(analyticsDataAttributeEvents);
+var analyticsDeviceTypeSchema = z5.enum(analyticsDeviceTypes);
+var analyticsBotClassificationSchema = z5.enum(analyticsBotClassifications);
+var analyticsValidityStatusSchema = z5.enum(analyticsValidityStatuses);
+var analyticsPropertiesSchema = z5.record(z5.string(), z5.unknown());
+var analyticsTimestampSchema = z5.string().datetime({ offset: true });
+var analyticsBrowserEventSchema = z5.object({
+  eventId: z5.string().min(1).max(160),
+  installationGeneration: z5.number().int().positive().optional(),
+  measurementMode: z5.enum(["session_only", "full_analytics"]).optional(),
   eventName: analyticsEventNameSchema,
   eventSource: analyticsEventSourceSchema.optional().default("browser"),
-  targetId: z4.string().min(1).max(160).optional(),
+  targetId: z5.string().min(1).max(160).optional(),
   targetType: analyticsTargetTypeSchema.optional(),
   visitorId: analyticsVisitorIdSchema.optional(),
   sessionId: analyticsSessionIdSchema,
-  idempotencyKey: z4.string().min(1).max(240).optional(),
+  idempotencyKey: z5.string().min(1).max(240).optional(),
   occurredAt: analyticsTimestampSchema,
-  pageUrl: z4.string().url().max(2048).optional(),
-  pagePath: z4.string().min(1).max(1024).optional(),
-  routeTemplate: z4.string().min(1).max(1024).optional(),
-  referrer: z4.string().url().max(2048).optional(),
-  utmSource: z4.string().min(1).max(200).optional(),
-  utmMedium: z4.string().min(1).max(200).optional(),
-  utmCampaign: z4.string().min(1).max(200).optional(),
-  utmContent: z4.string().min(1).max(200).optional(),
-  utmTerm: z4.string().min(1).max(200).optional(),
+  pageUrl: z5.string().url().max(2048).optional(),
+  pagePath: z5.string().min(1).max(1024).optional(),
+  routeTemplate: z5.string().min(1).max(1024).optional(),
+  referrer: z5.string().url().max(2048).optional(),
+  utmSource: z5.string().min(1).max(200).optional(),
+  utmMedium: z5.string().min(1).max(200).optional(),
+  utmCampaign: z5.string().min(1).max(200).optional(),
+  utmContent: z5.string().min(1).max(200).optional(),
+  utmTerm: z5.string().min(1).max(200).optional(),
   deviceType: analyticsDeviceTypeSchema.optional(),
-  browserName: z4.string().min(1).max(120).optional(),
-  osName: z4.string().min(1).max(120).optional(),
-  country: z4.string().min(1).max(80).optional(),
-  region: z4.string().min(1).max(120).optional(),
+  browserName: z5.string().min(1).max(120).optional(),
+  osName: z5.string().min(1).max(120).optional(),
+  country: z5.string().min(1).max(80).optional(),
+  region: z5.string().min(1).max(120).optional(),
   properties: analyticsPropertiesSchema.optional().default({})
 }).superRefine((event, context) => {
   if (isServerOnlyAnalyticsEvent(event.eventName)) {
@@ -244,44 +275,44 @@ var analyticsBrowserEventSchema = z4.object({
     });
   }
 });
-var analyticsBrowserEventPayloadSchema = z4.object({
-  siteKey: z4.string().min(1),
-  schemaVersion: z4.literal(ANALYTICS_SCHEMA_VERSION),
-  mode: z4.enum(["live", "test"]).optional().default("live"),
-  events: z4.array(analyticsBrowserEventSchema).min(1).max(50)
+var analyticsBrowserEventPayloadSchema = z5.object({
+  siteKey: z5.string().min(1),
+  schemaVersion: z5.literal(ANALYTICS_SCHEMA_VERSION),
+  mode: z5.enum(["live", "test"]).optional().default("live"),
+  events: z5.array(analyticsBrowserEventSchema).min(1).max(50)
 });
-var analyticsNormalizedEventBaseSchema = z4.object({
-  site_id: z4.string().uuid(),
-  event_id: z4.string().min(1).max(160),
-  schema_version: z4.literal(ANALYTICS_SCHEMA_VERSION),
+var analyticsNormalizedEventBaseSchema = z5.object({
+  site_id: z5.string().uuid(),
+  event_id: z5.string().min(1).max(160),
+  schema_version: z5.literal(ANALYTICS_SCHEMA_VERSION),
   event_name: analyticsEventNameSchema,
   event_source: analyticsEventSourceSchema,
   ingestion_channel: analyticsIngestionChannelSchema,
-  target_id: z4.string().min(1).max(160).nullable().optional(),
+  target_id: z5.string().min(1).max(160).nullable().optional(),
   target_type: analyticsTargetTypeSchema.nullable().optional(),
-  dedupe_key: z4.string().regex(/^analytics_dedupe_v1_[a-f0-9]{64}$/u).nullable().optional(),
-  idempotency_key: z4.string().min(1).max(240).nullable().optional(),
+  dedupe_key: z5.string().regex(/^analytics_dedupe_v1_[a-f0-9]{64}$/u).nullable().optional(),
+  idempotency_key: z5.string().min(1).max(240).nullable().optional(),
   bot_classification: analyticsBotClassificationSchema,
   validity_status: analyticsValidityStatusSchema,
-  rejection_reason: z4.string().min(1).max(240).nullable().optional(),
+  rejection_reason: z5.string().min(1).max(240).nullable().optional(),
   occurred_at: analyticsTimestampSchema,
   received_at: analyticsTimestampSchema,
-  page_url: z4.string().url().max(2048).nullable().optional(),
-  page_path: z4.string().min(1).max(1024).nullable().optional(),
-  route_template: z4.string().min(1).max(1024).nullable().optional(),
-  referrer: z4.string().url().max(2048).nullable().optional(),
-  utm_source: z4.string().min(1).max(200).nullable().optional(),
-  utm_medium: z4.string().min(1).max(200).nullable().optional(),
-  utm_campaign: z4.string().min(1).max(200).nullable().optional(),
-  utm_content: z4.string().min(1).max(200).nullable().optional(),
-  utm_term: z4.string().min(1).max(200).nullable().optional(),
-  country: z4.string().min(1).max(80).nullable().optional(),
-  region: z4.string().min(1).max(120).nullable().optional(),
+  page_url: z5.string().url().max(2048).nullable().optional(),
+  page_path: z5.string().min(1).max(1024).nullable().optional(),
+  route_template: z5.string().min(1).max(1024).nullable().optional(),
+  referrer: z5.string().url().max(2048).nullable().optional(),
+  utm_source: z5.string().min(1).max(200).nullable().optional(),
+  utm_medium: z5.string().min(1).max(200).nullable().optional(),
+  utm_campaign: z5.string().min(1).max(200).nullable().optional(),
+  utm_content: z5.string().min(1).max(200).nullable().optional(),
+  utm_term: z5.string().min(1).max(200).nullable().optional(),
+  country: z5.string().min(1).max(80).nullable().optional(),
+  region: z5.string().min(1).max(120).nullable().optional(),
   device_type: analyticsDeviceTypeSchema,
-  browser_name: z4.string().min(1).max(120).nullable().optional(),
-  os_name: z4.string().min(1).max(120).nullable().optional(),
-  provider: z4.string().min(1).max(120).nullable().optional(),
-  provider_event_id: z4.string().min(1).max(240).nullable().optional(),
+  browser_name: z5.string().min(1).max(120).nullable().optional(),
+  os_name: z5.string().min(1).max(120).nullable().optional(),
+  provider: z5.string().min(1).max(120).nullable().optional(),
+  provider_event_id: z5.string().min(1).max(240).nullable().optional(),
   properties: analyticsPropertiesSchema
 });
 var analyticsRawNormalizedEventSchema = analyticsNormalizedEventBaseSchema.extend({
@@ -297,11 +328,11 @@ function isServerOnlyAnalyticsEvent(eventName) {
 }
 
 // ../shared/dist/analytics-manifest.js
-import { z as z5 } from "zod";
-var analyticsTargetIdSchema = z5.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u, {
+import { z as z6 } from "zod";
+var analyticsTargetIdSchema = z6.string().min(1).max(120).regex(/^[a-zA-Z][a-zA-Z0-9]*(?:[._-][a-zA-Z0-9]+)*$/u, {
   message: "Analytics target IDs must be stable identifiers without whitespace or visible copy."
 });
-var analyticsManifestRecordSchema = z5.record(z5.string(), z5.unknown());
+var analyticsManifestRecordSchema = z6.record(z6.string(), z6.unknown());
 var analyticsFormPurposes = [
   "contact",
   "lead",
@@ -310,21 +341,21 @@ var analyticsFormPurposes = [
   "login",
   "other"
 ];
-var analyticsFormPurposeSchema = z5.enum(analyticsFormPurposes);
-var analyticsManifestRouteSchema = z5.object({
-  path: z5.string().min(1).max(1024),
-  pageType: z5.string().min(1).max(120).optional(),
-  label: z5.string().min(1).max(200).optional()
+var analyticsFormPurposeSchema = z6.enum(analyticsFormPurposes);
+var analyticsManifestRouteSchema = z6.object({
+  path: z6.string().min(1).max(1024),
+  pageType: z6.string().min(1).max(120).optional(),
+  label: z6.string().min(1).max(200).optional()
 }).passthrough();
-var analyticsManifestTargetSchema = z5.object({
+var analyticsManifestTargetSchema = z6.object({
   id: analyticsTargetIdSchema,
   type: analyticsTargetTypeSchema,
   event: analyticsEventNameSchema.optional(),
-  events: z5.array(analyticsEventNameSchema).min(1).max(20).optional(),
-  route: z5.string().min(1).max(1024).optional(),
-  label: z5.string().min(1).max(200).optional(),
-  description: z5.string().min(1).max(1e3).optional(),
-  autoActive: z5.boolean().optional(),
+  events: z6.array(analyticsEventNameSchema).min(1).max(20).optional(),
+  route: z6.string().min(1).max(1024).optional(),
+  label: z6.string().min(1).max(200).optional(),
+  description: z6.string().min(1).max(1e3).optional(),
+  autoActive: z6.boolean().optional(),
   sourceHints: analyticsManifestRecordSchema.optional()
 }).passthrough().superRefine((target, context) => {
   if (target.event === void 0 && target.events === void 0) {
@@ -349,21 +380,21 @@ var analyticsManifestTargetSchema = z5.object({
     });
   }
 });
-var analyticsManifestSchema = z5.object({
-  schemaVersion: z5.literal(ANALYTICS_SCHEMA_VERSION),
-  siteId: z5.string().min(1),
-  siteKeyRef: z5.string().regex(/^env:[A-Z][A-Z0-9_]*$/u, {
+var analyticsManifestSchema = z6.object({
+  schemaVersion: z6.literal(ANALYTICS_SCHEMA_VERSION),
+  siteId: z6.string().min(1),
+  siteKeyRef: z6.string().regex(/^env:[A-Z][A-Z0-9_]*$/u, {
     message: "siteKeyRef must be an environment-variable reference."
   }),
-  siteKeyLookup: z5.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}$/),
-  routes: z5.array(analyticsManifestRouteSchema),
-  targets: z5.array(analyticsManifestTargetSchema),
+  siteKeyLookup: z6.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}$/),
+  routes: z6.array(analyticsManifestRouteSchema),
+  targets: z6.array(analyticsManifestTargetSchema),
   metadata: analyticsManifestRecordSchema.optional(),
-  siteKey: z5.string().optional(),
-  secretKey: z5.string().optional(),
-  rawKey: z5.string().optional(),
-  token: z5.string().optional(),
-  accessToken: z5.string().optional()
+  siteKey: z6.string().optional(),
+  secretKey: z6.string().optional(),
+  rawKey: z6.string().optional(),
+  token: z6.string().optional(),
+  accessToken: z6.string().optional()
 }).passthrough().superRefine((manifest, context) => {
   const targetIds = /* @__PURE__ */ new Set();
   for (const [index, target] of manifest.targets.entries()) {
@@ -407,9 +438,9 @@ function isPlainRecord(value) {
 }
 
 // ../shared/dist/analytics-metrics.js
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 var analyticsVisitorQualities = ["exact", "estimated"];
-var analyticsVisitorQualitySchema = z6.enum(analyticsVisitorQualities);
+var analyticsVisitorQualitySchema = z7.enum(analyticsVisitorQualities);
 var analyticsKpiKeys = [
   "pageViews",
   "sessions",
@@ -421,7 +452,7 @@ var analyticsKpiKeys = [
   "conversionRate",
   "inquiryRate"
 ];
-var analyticsKpiKeySchema = z6.enum(analyticsKpiKeys);
+var analyticsKpiKeySchema = z7.enum(analyticsKpiKeys);
 
 // ../shared/dist/analytics-privacy.js
 var serverPropertySchemas = {
@@ -459,7 +490,7 @@ function revenuePropertySchema() {
 }
 
 // ../shared/dist/assets.js
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var ASSET_STAGES = ["staging", "final", "deleted"];
 var ASSET_VISIBILITIES = ["private", "public", "deleted"];
 var ASSET_USAGE_ENTITY_TYPES = [
@@ -468,13 +499,13 @@ var ASSET_USAGE_ENTITY_TYPES = [
   "change_set",
   "published_value"
 ];
-var assetStageSchema = z7.enum(ASSET_STAGES);
-var assetVisibilitySchema = z7.enum(ASSET_VISIBILITIES);
-var assetUsageEntityTypeSchema = z7.enum(ASSET_USAGE_ENTITY_TYPES);
-var brandingAccentColorSchema = z7.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/);
+var assetStageSchema = z8.enum(ASSET_STAGES);
+var assetVisibilitySchema = z8.enum(ASSET_VISIBILITIES);
+var assetUsageEntityTypeSchema = z8.enum(ASSET_USAGE_ENTITY_TYPES);
+var brandingAccentColorSchema = z8.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/);
 
 // ../shared/dist/booking-contracts.js
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var bookingStatuses = [
   "pending_payment",
   "confirmed",
@@ -529,30 +560,30 @@ var bookingResourceKinds = [
   "equipment",
   "other"
 ];
-var bookingStatusSchema = z8.enum(bookingStatuses);
-var bookingPaymentStatusSchema = z8.enum(bookingPaymentStatuses);
-var bookingAccountReadinessStatusSchema = z8.enum(bookingAccountReadinessStatuses);
-var bookingRefundStatusSchema = z8.enum(bookingRefundStatuses);
-var bookingDisputeStatusSchema = z8.enum(bookingDisputeStatuses);
-var bookingPaymentModeSchema = z8.enum(bookingPaymentModes);
-var bookingPaymentCollectionTypeSchema = z8.enum(bookingPaymentCollectionTypes);
-var bookingPaymentCollectionSchema = z8.discriminatedUnion("type", [
-  z8.object({ type: z8.literal("full_amount") }).strict(),
-  z8.object({
-    type: z8.literal("deposit_percent"),
-    depositPercent: z8.number().int().min(10).max(90)
+var bookingStatusSchema = z9.enum(bookingStatuses);
+var bookingPaymentStatusSchema = z9.enum(bookingPaymentStatuses);
+var bookingAccountReadinessStatusSchema = z9.enum(bookingAccountReadinessStatuses);
+var bookingRefundStatusSchema = z9.enum(bookingRefundStatuses);
+var bookingDisputeStatusSchema = z9.enum(bookingDisputeStatuses);
+var bookingPaymentModeSchema = z9.enum(bookingPaymentModes);
+var bookingPaymentCollectionTypeSchema = z9.enum(bookingPaymentCollectionTypes);
+var bookingPaymentCollectionSchema = z9.discriminatedUnion("type", [
+  z9.object({ type: z9.literal("full_amount") }).strict(),
+  z9.object({
+    type: z9.literal("deposit_percent"),
+    depositPercent: z9.number().int().min(10).max(90)
   }).strict()
 ]);
 var bookingPaymentChoices = ["onsite", "online"];
-var bookingPaymentChoiceSchema = z8.enum(bookingPaymentChoices);
-var bookingPaymentSnapshotSchema = z8.object({
-  snapshotId: z8.string().uuid(),
-  snapshotVersion: z8.number().int().positive(),
-  currency: z8.literal("EUR"),
-  totalAmountCents: z8.number().int().min(0),
-  onlineAmountCents: z8.number().int().min(0),
-  onsiteRemainderCents: z8.number().int().min(0),
-  maxStripeRefundAmountCents: z8.number().int().min(0)
+var bookingPaymentChoiceSchema = z9.enum(bookingPaymentChoices);
+var bookingPaymentSnapshotSchema = z9.object({
+  snapshotId: z9.string().uuid(),
+  snapshotVersion: z9.number().int().positive(),
+  currency: z9.literal("EUR"),
+  totalAmountCents: z9.number().int().min(0),
+  onlineAmountCents: z9.number().int().min(0),
+  onsiteRemainderCents: z9.number().int().min(0),
+  maxStripeRefundAmountCents: z9.number().int().min(0)
 }).strict().superRefine((snapshot, context) => {
   if (snapshot.onlineAmountCents + snapshot.onsiteRemainderCents !== snapshot.totalAmountCents) {
     context.addIssue({
@@ -567,17 +598,17 @@ var bookingPaymentSnapshotSchema = z8.object({
     });
   }
 });
-var bookingServiceVariantSchema = z8.object({
-  id: z8.string().uuid(),
-  name: z8.string().trim().min(1).max(120),
-  durationMinutes: z8.number().int().min(1).max(1440),
-  priceCents: z8.number().int().min(0).nullable()
+var bookingServiceVariantSchema = z9.object({
+  id: z9.string().uuid(),
+  name: z9.string().trim().min(1).max(120),
+  durationMinutes: z9.number().int().min(1).max(1440),
+  priceCents: z9.number().int().min(0).nullable()
 }).strict();
-var bookingServiceVariantsSchema = z8.array(bookingServiceVariantSchema).min(1).max(20);
-var isoDateSchema = z8.string().regex(/^\d{4}-\d{2}-\d{2}$/);
-var utcDateTimeSchema = z8.string().datetime();
-var bookingLocalTimeSchema = z8.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/);
-var bookingAvailabilityIntervalsSchema = z8.array(z8.object({
+var bookingServiceVariantsSchema = z9.array(bookingServiceVariantSchema).min(1).max(20);
+var isoDateSchema = z9.string().regex(/^\d{4}-\d{2}-\d{2}$/);
+var utcDateTimeSchema = z9.string().datetime();
+var bookingLocalTimeSchema = z9.string().regex(/^(?:[01]\d|2[0-3]):[0-5]\d$/);
+var bookingAvailabilityIntervalsSchema = z9.array(z9.object({
   start: bookingLocalTimeSchema,
   end: bookingLocalTimeSchema
 }).strict().refine((interval) => interval.end > interval.start)).superRefine((intervals, context) => {
@@ -592,75 +623,75 @@ var bookingAvailabilityIntervalsSchema = z8.array(z8.object({
     }
   }
 });
-var bookingPublicConfigSchema = z8.object({
-  site: z8.object({
-    displayName: z8.string().trim().min(1),
-    timezone: z8.string().trim().min(1),
-    locale: z8.string().trim().min(2),
-    bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
-    privacyUrl: z8.string().url().nullable()
+var bookingPublicConfigSchema = z9.object({
+  site: z9.object({
+    displayName: z9.string().trim().min(1),
+    timezone: z9.string().trim().min(1),
+    locale: z9.string().trim().min(2),
+    bookingPageSlug: z9.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+    privacyUrl: z9.string().url().nullable()
   }),
-  branding: z8.object({
-    logoUrl: z8.string().url().nullable(),
-    accentColor: z8.string().trim().min(1).nullable()
+  branding: z9.object({
+    logoUrl: z9.string().url().nullable(),
+    accentColor: z9.string().trim().min(1).nullable()
   }),
-  settings: z8.object({
-    slotIntervalMinutes: z8.number().int().positive(),
-    minLeadMinutes: z8.number().int().min(0),
-    maxAdvanceDays: z8.number().int().min(1),
-    requirePhone: z8.boolean(),
-    collectNote: z8.boolean(),
-    confirmationMessage: z8.string().nullable()
+  settings: z9.object({
+    slotIntervalMinutes: z9.number().int().positive(),
+    minLeadMinutes: z9.number().int().min(0),
+    maxAdvanceDays: z9.number().int().min(1),
+    requirePhone: z9.boolean(),
+    collectNote: z9.boolean(),
+    confirmationMessage: z9.string().nullable()
   }),
   /** Freitexte des Salons, im Kassen-Schritt vor der Bestaetigung sichtbar. */
-  policies: z8.object({
-    cancellation: z8.string().nullable(),
-    lateArrival: z8.string().nullable()
+  policies: z9.object({
+    cancellation: z9.string().nullable(),
+    lateArrival: z9.string().nullable()
   }),
-  payment: z8.object({
+  payment: z9.object({
     mode: bookingPaymentModeSchema,
     collection: bookingPaymentCollectionSchema,
-    onlinePaymentsReady: z8.boolean()
+    onlinePaymentsReady: z9.boolean()
   }).strict(),
-  serviceCategories: z8.array(z8.object({
-    id: z8.string().uuid(),
-    name: z8.string().trim().min(1),
-    sortOrder: z8.number().int()
+  serviceCategories: z9.array(z9.object({
+    id: z9.string().uuid(),
+    name: z9.string().trim().min(1),
+    sortOrder: z9.number().int()
   })),
-  serviceSubcategories: z8.array(z8.object({
-    id: z8.string().uuid(),
-    categoryId: z8.string().uuid(),
-    name: z8.string().trim().min(1),
-    sortOrder: z8.number().int()
+  serviceSubcategories: z9.array(z9.object({
+    id: z9.string().uuid(),
+    categoryId: z9.string().uuid(),
+    name: z9.string().trim().min(1),
+    sortOrder: z9.number().int()
   })),
-  services: z8.array(z8.object({
-    id: z8.string().trim().min(1),
-    name: z8.string().trim().min(1),
-    durationMinutes: z8.number().int().positive(),
-    priceCents: z8.number().int().min(0).nullable(),
-    currency: z8.string().regex(/^[A-Z]{3}$/),
-    description: z8.string().nullable(),
-    categoryId: z8.string().uuid(),
-    subcategoryId: z8.string().uuid().nullable(),
+  services: z9.array(z9.object({
+    id: z9.string().trim().min(1),
+    name: z9.string().trim().min(1),
+    durationMinutes: z9.number().int().positive(),
+    priceCents: z9.number().int().min(0).nullable(),
+    currency: z9.string().regex(/^[A-Z]{3}$/),
+    description: z9.string().nullable(),
+    categoryId: z9.string().uuid(),
+    subcategoryId: z9.string().uuid().nullable(),
     variants: bookingServiceVariantsSchema,
-    allowsAnyResource: z8.boolean(),
-    sortOrder: z8.number().int()
+    allowsAnyResource: z9.boolean(),
+    sortOrder: z9.number().int()
   })),
-  resources: z8.array(z8.object({
-    id: z8.string().trim().min(1),
-    name: z8.string().trim().min(1),
-    kind: z8.enum(bookingResourceKinds)
+  resources: z9.array(z9.object({
+    id: z9.string().trim().min(1),
+    name: z9.string().trim().min(1),
+    kind: z9.enum(bookingResourceKinds)
   })),
-  serviceResources: z8.array(z8.object({
-    serviceId: z8.string().trim().min(1),
-    resourceId: z8.string().trim().min(1)
+  serviceResources: z9.array(z9.object({
+    serviceId: z9.string().trim().min(1),
+    resourceId: z9.string().trim().min(1)
   }))
 });
-var bookingItemSchema = z8.object({
-  serviceId: z8.string().trim().min(1),
-  variantId: z8.string().trim().min(1)
+var bookingItemSchema = z9.object({
+  serviceId: z9.string().trim().min(1),
+  variantId: z9.string().trim().min(1)
 }).strict();
-var bookingItemsSchema = z8.array(bookingItemSchema).min(1).max(10);
+var bookingItemsSchema = z9.array(bookingItemSchema).min(1).max(10);
 function parseBookingItemsParam(value) {
   const items = value.split(",").map((entry) => entry.trim()).filter((entry) => entry !== "").map((entry) => {
     const [serviceId, variantId, ...rest] = entry.split(":");
@@ -668,36 +699,36 @@ function parseBookingItemsParam(value) {
   });
   return items.every((item) => item !== null) ? items : null;
 }
-var bookingSlotsQuerySchema = z8.object({
-  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
-  resourceId: z8.string().trim().min(1).optional(),
+var bookingSlotsQuerySchema = z9.object({
+  items: z9.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z9.string().trim().min(1).optional(),
   fromDate: isoDateSchema,
   toDate: isoDateSchema
 });
-var bookingSlotsResponseSchema = z8.object({
-  timezone: z8.string().trim().min(1),
+var bookingSlotsResponseSchema = z9.object({
+  timezone: z9.string().trim().min(1),
   items: bookingItemsSchema,
   // Reine Behandlungsdauer ohne Puffer: das UI zeigt damit die Terminspanne,
   // ohne selbst rechnen zu muessen.
-  totalDurationMinutes: z8.number().int().min(1),
-  mode: z8.enum(["any", "resource"]),
-  slots: z8.array(z8.object({
+  totalDurationMinutes: z9.number().int().min(1),
+  mode: z9.enum(["any", "resource"]),
+  slots: z9.array(z9.object({
     startUtc: utcDateTimeSchema,
-    resourceId: z8.string().trim().min(1).optional()
+    resourceId: z9.string().trim().min(1).optional()
   }))
 });
-var bookingAvailabilityQuerySchema = z8.object({
-  items: z8.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
-  resourceId: z8.string().trim().min(1).optional(),
+var bookingAvailabilityQuerySchema = z9.object({
+  items: z9.preprocess((value) => typeof value === "string" ? parseBookingItemsParam(value) : value, bookingItemsSchema),
+  resourceId: z9.string().trim().min(1).optional(),
   fromDate: isoDateSchema,
   toDate: isoDateSchema
 });
-var bookingAvailabilityResponseSchema = z8.object({
-  timezone: z8.string().trim().min(1),
-  totalDurationMinutes: z8.number().int().min(1),
-  days: z8.array(z8.object({
+var bookingAvailabilityResponseSchema = z9.object({
+  timezone: z9.string().trim().min(1),
+  totalDurationMinutes: z9.number().int().min(1),
+  days: z9.array(z9.object({
     date: isoDateSchema,
-    hasSlots: z8.boolean()
+    hasSlots: z9.boolean()
   })),
   /** Erster Tag mit Slot ab `fromDate`, auch ausserhalb des Fensters. */
   nextAvailableDate: isoDateSchema.nullable()
@@ -715,72 +746,72 @@ var bookingPublicErrorCodes = [
   "too_late",
   "not_found"
 ];
-var bookingPublicErrorSchema = z8.object({
-  error: z8.enum(bookingPublicErrorCodes),
-  message: z8.string().optional(),
-  requestId: z8.string().optional()
+var bookingPublicErrorSchema = z9.object({
+  error: z9.enum(bookingPublicErrorCodes),
+  message: z9.string().optional(),
+  requestId: z9.string().optional()
 }).strict();
-var bookingCreateRequestSchema = z8.object({
+var bookingCreateRequestSchema = z9.object({
   items: bookingItemsSchema,
-  resourceId: z8.string().min(1).nullable(),
+  resourceId: z9.string().min(1).nullable(),
   startUtc: utcDateTimeSchema,
-  customer: z8.object({
-    name: z8.string().min(1).max(120),
-    email: z8.string().email().max(254),
-    phone: z8.string().max(32).optional(),
-    note: z8.string().max(1e3).optional()
+  customer: z9.object({
+    name: z9.string().min(1).max(120),
+    email: z9.string().email().max(254),
+    phone: z9.string().max(32).optional(),
+    note: z9.string().max(1e3).optional()
   }).strict(),
-  hp: z8.string().optional(),
-  clientToken: z8.string().uuid(),
+  hp: z9.string().optional(),
+  clientToken: z9.string().uuid(),
   paymentChoice: bookingPaymentChoiceSchema,
   // Werbe-Einwilligung. Bestaetigung, Erinnerung und Storno-Link sind davon
   // unabhaengig und werden immer versendet.
-  consent: z8.object({
-    marketingEmail: z8.boolean(),
-    marketingSms: z8.boolean()
+  consent: z9.object({
+    marketingEmail: z9.boolean(),
+    marketingSms: z9.boolean()
   }).strict().optional()
 }).strict();
-var bookingPublicPaymentResponseSchema = z8.object({
-  clientSecret: z8.string().min(1),
-  stripeAccountId: z8.string().startsWith("acct_")
+var bookingPublicPaymentResponseSchema = z9.object({
+  clientSecret: z9.string().min(1),
+  stripeAccountId: z9.string().startsWith("acct_")
 }).strict();
-var bookingCreateResponseSchema = z8.union([
-  z8.object({
-    status: z8.literal("confirmed"),
-    booking: z8.object({
-      id: z8.string().min(1),
+var bookingCreateResponseSchema = z9.union([
+  z9.object({
+    status: z9.literal("confirmed"),
+    booking: z9.object({
+      id: z9.string().min(1),
       startUtc: utcDateTimeSchema,
       endUtc: utcDateTimeSchema,
-      timezone: z8.string().trim().min(1),
-      serviceName: z8.string().trim().min(1),
-      resourceName: z8.string().trim().min(1)
+      timezone: z9.string().trim().min(1),
+      serviceName: z9.string().trim().min(1),
+      resourceName: z9.string().trim().min(1)
     }).strict(),
-    manageUrl: z8.string().url(),
-    confirmationMessage: z8.string().nullable()
+    manageUrl: z9.string().url(),
+    confirmationMessage: z9.string().nullable()
   }).strict(),
-  z8.object({
-    status: z8.literal("pending_payment"),
-    bookingId: z8.string().min(1),
+  z9.object({
+    status: z9.literal("pending_payment"),
+    bookingId: z9.string().min(1),
     holdExpiresAt: utcDateTimeSchema,
     payment: bookingPublicPaymentResponseSchema,
-    statusToken: z8.string().min(20),
-    manageUrl: z8.string().url().optional()
+    statusToken: z9.string().min(20),
+    manageUrl: z9.string().url().optional()
   }).strict(),
   bookingPublicErrorSchema
 ]);
-var bookingStatusResponseSchema = z8.object({
+var bookingStatusResponseSchema = z9.object({
   bookingStatus: bookingStatusSchema,
   paymentStatus: bookingPaymentStatusSchema,
   refundStatus: bookingRefundStatusSchema,
   disputeStatus: bookingDisputeStatusSchema,
   holdExpiresAt: utcDateTimeSchema.nullable()
 }).strict();
-var bookingCancelRequestSchema = z8.object({
-  token: z8.string().min(20)
+var bookingCancelRequestSchema = z9.object({
+  token: z9.string().min(20)
 });
-var bookingCancelResponseSchema = z8.union([
-  z8.object({
-    status: z8.enum(["cancelled", "already_cancelled", "too_late", "not_found"])
+var bookingCancelResponseSchema = z9.union([
+  z9.object({
+    status: z9.enum(["cancelled", "already_cancelled", "too_late", "not_found"])
   }),
   bookingPublicErrorSchema
 ]);
@@ -789,57 +820,57 @@ var bookingMoveErrorCodes = [
   "booking_not_movable",
   "not_found"
 ];
-var bookingMoveRequestSchema = z8.object({
-  bookingId: z8.string().uuid(),
+var bookingMoveRequestSchema = z9.object({
+  bookingId: z9.string().uuid(),
   newStartUtc: utcDateTimeSchema,
-  newResourceId: z8.string().uuid().optional(),
-  notifyCustomer: z8.boolean().default(false),
-  reason: z8.string().max(500).optional()
-});
-var bookingMoveResponseSchema = z8.union([
-  z8.object({
-    status: z8.literal("moved"),
-    bookingId: z8.string().uuid(),
+  newResourceId: z9.string().uuid().optional(),
+  notifyCustomer: z9.boolean().default(false),
+  reason: z9.string().max(500).optional()
+});
+var bookingMoveResponseSchema = z9.union([
+  z9.object({
+    status: z9.literal("moved"),
+    bookingId: z9.string().uuid(),
     startUtc: utcDateTimeSchema,
     endUtc: utcDateTimeSchema,
-    resourceId: z8.string().uuid()
+    resourceId: z9.string().uuid()
   }),
-  z8.object({
-    error: z8.enum(bookingMoveErrorCodes),
-    message: z8.string().optional(),
-    requestId: z8.string().optional()
+  z9.object({
+    error: z9.enum(bookingMoveErrorCodes),
+    message: z9.string().optional(),
+    requestId: z9.string().optional()
   })
 ]);
-var bookingManifestSchema = z8.object({
-  schemaVersion: z8.number().int().positive(),
-  siteId: z8.string().trim().min(1),
-  siteKeyPrefix: z8.string().startsWith("bk_pub_"),
-  bookingPageSlug: z8.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
-  embedMode: z8.enum(["script", "web_component", "iframe"]).optional(),
-  productionOrigin: z8.string().url().optional()
+var bookingManifestSchema = z9.object({
+  schemaVersion: z9.number().int().positive(),
+  siteId: z9.string().trim().min(1),
+  siteKeyPrefix: z9.string().startsWith("bk_pub_"),
+  bookingPageSlug: z9.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
+  embedMode: z9.enum(["script", "web_component", "iframe"]).optional(),
+  productionOrigin: z9.string().url().optional()
 }).passthrough();
 
 // ../shared/dist/booking-defaults.js
 var BOOKING_CREATE_PAYLOAD_LIMIT_BYTES = 16 * 1024;
 
 // ../shared/dist/bridge-protocol.js
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 
 // ../shared/dist/field-id.js
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var FIELD_ID_PATTERN = /^[a-z][a-z0-9_-]*(\.[a-z][a-z0-9_-]*)+$/;
-var fieldIdSchema = z9.string().regex(FIELD_ID_PATTERN, "Invalid field id");
+var fieldIdSchema = z10.string().regex(FIELD_ID_PATTERN, "Invalid field id");
 function isFieldId(value) {
   return typeof value === "string" && fieldIdSchema.safeParse(value).success;
 }
 
 // ../shared/dist/field-types.js
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var FIELD_TYPES = ["text", "longText", "image", "link"];
-var fieldTypeSchema = z10.enum(FIELD_TYPES);
+var fieldTypeSchema = z11.enum(FIELD_TYPES);
 
 // ../shared/dist/image-value.js
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 var SUPPORTED_IMAGE_CONTENT_TYPES = [
   "image/jpeg",
   "image/png",
@@ -848,21 +879,21 @@ var SUPPORTED_IMAGE_CONTENT_TYPES = [
 ];
 var maxImageUploadBytes = 10 * 1024 * 1024;
 var largeImageWarningBytes = 2 * 1024 * 1024;
-var imageContentTypeSchema = z11.enum(SUPPORTED_IMAGE_CONTENT_TYPES);
-var imageCropSchema = z11.object({
-  x: z11.number().min(0).max(100),
-  y: z11.number().min(0).max(100),
-  zoom: z11.number().min(1).max(4),
-  aspectRatio: z11.number().positive().max(10)
-});
-var imageValueSchema = z11.object({
-  src: z11.string().trim().min(1),
-  alt: z11.string().trim().min(1).max(300),
-  width: z11.number().int().positive().optional(),
-  height: z11.number().int().positive().optional(),
+var imageContentTypeSchema = z12.enum(SUPPORTED_IMAGE_CONTENT_TYPES);
+var imageCropSchema = z12.object({
+  x: z12.number().min(0).max(100),
+  y: z12.number().min(0).max(100),
+  zoom: z12.number().min(1).max(4),
+  aspectRatio: z12.number().positive().max(10)
+});
+var imageValueSchema = z12.object({
+  src: z12.string().trim().min(1),
+  alt: z12.string().trim().min(1).max(300),
+  width: z12.number().int().positive().optional(),
+  height: z12.number().int().positive().optional(),
   crop: imageCropSchema.optional(),
-  assetId: z11.string().uuid().optional(),
-  finalStorageProvider: z11.enum([
+  assetId: z12.string().uuid().optional(),
+  finalStorageProvider: z12.enum([
     "repo_static_assets",
     "repo_handoff",
     "site_owned_storage",
@@ -871,31 +902,36 @@ var imageValueSchema = z11.object({
 });
 
 // ../shared/dist/setup-deployment.js
-import { z as z12 } from "zod";
-var version = z12.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
-var hash = z12.string().regex(/^sha256:[0-9a-f]{64}$/u);
-var setupDeploymentRecordSchema = z12.object({
-  version: z12.literal(1),
-  operationId: z12.string().uuid(),
-  provider: z12.literal("vercel"),
-  projectId: z12.string().regex(/^prj_[A-Za-z0-9]+$/u),
-  teamId: z12.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u),
-  origin: z12.string().url().refine((value) => {
+import { z as z13 } from "zod";
+var version = z13.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u);
+var siteSetupPackagesSchema = z13.object({
+  siteplane: version,
+  runtimeNext: version,
+  analytics: version.optional()
+}).strict();
+var hash = z13.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var setupDeploymentRecordSchema = z13.object({
+  version: z13.literal(1),
+  operationId: z13.string().uuid(),
+  provider: z13.literal("vercel"),
+  projectId: z13.string().regex(/^prj_[A-Za-z0-9]+$/u),
+  teamId: z13.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u),
+  origin: z13.string().url().refine((value) => {
     const url = new URL(value);
     return url.protocol === "https:" && url.origin === value && !url.username && !url.password;
   }),
-  deploymentId: z12.string().regex(/^dpl_[A-Za-z0-9]+$/u).nullable(),
-  revision: z12.string().regex(/^[0-9a-f]{40}$/u),
+  deploymentId: z13.string().regex(/^dpl_[A-Za-z0-9]+$/u).nullable(),
+  revision: z13.string().regex(/^[0-9a-f]{40}$/u),
   fieldContractHash: hash,
-  packages: z12.object({ siteplane: version, runtimeNext: version }).strict(),
+  packages: siteSetupPackagesSchema,
   configurationFingerprint: hash,
-  adminSecretGeneration: z12.string().uuid(),
-  revalidationGeneration: z12.number().int().positive(),
-  startedAt: z12.string().datetime(),
-  environmentWrittenAt: z12.string().datetime().nullable(),
-  deployRequestedAt: z12.string().datetime().nullable(),
-  deadline: z12.string().datetime(),
-  phase: z12.enum([
+  adminSecretGeneration: z13.string().uuid(),
+  revalidationGeneration: z13.number().int().positive(),
+  startedAt: z13.string().datetime(),
+  environmentWrittenAt: z13.string().datetime().nullable(),
+  deployRequestedAt: z13.string().datetime().nullable(),
+  deadline: z13.string().datetime(),
+  phase: z13.enum([
     "planned",
     "environment_written",
     "deploy_requested",
@@ -903,37 +939,37 @@ var setupDeploymentRecordSchema = z12.object({
     "verified",
     "failed"
   ]),
-  build: z12.object({
+  build: z13.object({
     node: version,
-    packageManager: z12.enum(["npm", "pnpm"]),
+    packageManager: z13.enum(["npm", "pnpm"]),
     packageManagerVersion: version,
     lockfileHash: hash
   }).strict().nullable()
 }).strict();
-var setupDeploymentInputSchema = z12.discriminatedUnion("action", [
-  z12.object({ action: z12.literal("read") }).strict(),
-  z12.object({
-    action: z12.literal("record"),
-    expectedOperationId: z12.string().uuid().nullable(),
+var setupDeploymentInputSchema = z13.discriminatedUnion("action", [
+  z13.object({ action: z13.literal("read") }).strict(),
+  z13.object({
+    action: z13.literal("record"),
+    expectedOperationId: z13.string().uuid().nullable(),
     record: setupDeploymentRecordSchema
   }).strict()
 ]);
 
 // ../shared/dist/site-setup.js
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // ../shared/dist/site-field-contract.js
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 
 // ../shared/dist/fallback-hash.js
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var SAFE_REPRESENTATION_REASONS = [
   "asset_import_rewritten",
   "relative_url_normalized",
   "line_endings_normalized",
   "image_value_serialized"
 ];
-var safeRepresentationReasonSchema = z13.enum(SAFE_REPRESENTATION_REASONS);
+var safeRepresentationReasonSchema = z14.enum(SAFE_REPRESENTATION_REASONS);
 function canonicalizeFallbackValue(input) {
   const fieldType = fieldTypeSchema.parse(input.fieldType);
   if (input.safeRepresentationReason !== void 0) {
@@ -969,10 +1005,10 @@ function createCanonicalFallbackHash(input) {
   const payload = stableJsonStringify(canonical);
   return `sha256:${sha256Hex(payload)}`;
 }
-var linkFallbackSchema = z13.object({
-  href: z13.string().trim().min(1),
-  label: z13.string().trim().min(1).optional(),
-  target: z13.enum(["_self", "_blank"]).optional()
+var linkFallbackSchema = z14.object({
+  href: z14.string().trim().min(1),
+  label: z14.string().trim().min(1).optional(),
+  target: z14.enum(["_self", "_blank"]).optional()
 }).passthrough();
 function normalizeLineEndings(value) {
   return value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
@@ -1150,67 +1186,67 @@ var SHA256_CONSTANTS = [
 // ../shared/dist/site-field-contract.js
 var fieldContractVersion = "1.0.0";
 var scannerContractVersion = "1.0.0";
-var siteFieldStatusSchema = z14.enum(["hidden", "active"]);
-var semanticVersionSchema = z14.string().regex(/^\d+\.\d+\.\d+$/u);
-var siteFieldRouteKeySchema = z14.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
-var repositoryRelativePosixPathSchema = z14.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
-var sourceMappingSchema = z14.object({
-  kind: z14.literal("function"),
+var siteFieldStatusSchema = z15.enum(["hidden", "active"]);
+var semanticVersionSchema = z15.string().regex(/^\d+\.\d+\.\d+$/u);
+var siteFieldRouteKeySchema = z15.string().trim().refine((value) => value === "$global" || value.startsWith("/") && !value.includes("?") && !value.includes("#") && (value === "/" || !value.endsWith("/")), "Route keys must be canonical paths or $global.");
+var repositoryRelativePosixPathSchema = z15.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.includes("\\") && !/^[a-z]:/iu.test(value) && !value.split("/").includes(".."), "Source paths must be repository-relative POSIX paths.");
+var sourceMappingSchema = z15.object({
+  kind: z15.literal("function"),
   filePath: repositoryRelativePosixPathSchema,
-  exportName: z14.string().trim().min(1).optional(),
-  sourcePath: z14.string().trim().min(1).optional(),
+  exportName: z15.string().trim().min(1).optional(),
+  sourcePath: z15.string().trim().min(1).optional(),
   editTarget: fieldIdSchema.optional()
 }).strict();
-var domMappingSchema = z14.object({
-  attribute: z14.literal("data-siteplane-field-id"),
-  previewStrategy: z14.enum(["dom", "event"])
+var domMappingSchema = z15.object({
+  attribute: z15.literal("data-siteplane-field-id"),
+  previewStrategy: z15.enum(["dom", "event"])
 }).strict();
-var fieldBaseSchema = z14.object({
+var fieldBaseSchema = z15.object({
   fieldId: fieldIdSchema,
   routeKey: siteFieldRouteKeySchema,
   source: sourceMappingSchema,
   dom: domMappingSchema.optional()
 }).strict();
-var linkFallbackSchema2 = z14.object({
-  href: z14.string().trim().min(1),
-  label: z14.string().trim().min(1).optional(),
-  target: z14.enum(["_self", "_blank"]).optional()
+var linkFallbackSchema2 = z15.object({
+  href: z15.string().trim().min(1),
+  label: z15.string().trim().min(1).optional(),
+  target: z15.enum(["_self", "_blank"]).optional()
 }).strict();
-var imageFallbackSchema = z14.object({
-  src: z14.string().trim().min(1),
-  alt: z14.string().trim().max(300),
-  width: z14.number().int().positive().optional(),
-  height: z14.number().int().positive().optional(),
-  crop: z14.object({
-    x: z14.number().min(0).max(100),
-    y: z14.number().min(0).max(100),
-    zoom: z14.number().min(1).max(4),
-    aspectRatio: z14.number().positive().max(10)
+var imageFallbackSchema = z15.object({
+  src: z15.string().trim().min(1),
+  alt: z15.string().trim().max(300),
+  width: z15.number().int().positive().optional(),
+  height: z15.number().int().positive().optional(),
+  crop: z15.object({
+    x: z15.number().min(0).max(100),
+    y: z15.number().min(0).max(100),
+    zoom: z15.number().min(1).max(4),
+    aspectRatio: z15.number().positive().max(10)
   }).strict().optional()
 }).strict();
-var siteFieldContractFieldSchema = z14.discriminatedUnion("fieldType", [
+var siteFieldContractFieldSchema = z15.discriminatedUnion("fieldType", [
   fieldBaseSchema.extend({
-    fieldType: z14.literal("text"),
-    fallback: z14.string()
+    fieldType: z15.literal("text"),
+    fallback: z15.string()
   }),
   fieldBaseSchema.extend({
-    fieldType: z14.literal("longText"),
-    fallback: z14.string()
+    fieldType: z15.literal("longText"),
+    fallback: z15.string()
   }),
   fieldBaseSchema.extend({
-    fieldType: z14.literal("link"),
+    fieldType: z15.literal("link"),
     fallback: linkFallbackSchema2
   }),
   fieldBaseSchema.extend({
-    fieldType: z14.literal("image"),
+    fieldType: z15.literal("image"),
     fallback: imageFallbackSchema
   })
 ]);
-var siteFieldContractV1Schema = z14.object({
-  version: z14.literal(1),
+var siteFieldContractV1Schema = z15.object({
+  version: z15.literal(1),
   fieldContractVersion: semanticVersionSchema,
   scannerContractVersion: semanticVersionSchema,
-  fields: z14.array(siteFieldContractFieldSchema)
+  fields: z15.array(siteFieldContractFieldSchema)
 }).strict().superRefine((contract, context) => {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, field] of contract.fields.entries()) {
@@ -1270,20 +1306,20 @@ var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH = 2e3;
 var SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES = 8e3;
 var CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES = 32 * 1024;
 var CONTINUE_SITE_SETUP_HTTP_BODY_MAX_BYTES = 64 * 1024;
-var siteSetupRunStatusSchema = z15.enum(SITE_SETUP_RUN_STATUSES);
-var siteSetupRunModeSchema = z15.enum(SITE_SETUP_RUN_MODES);
-var siteSetupErrorCodeSchema = z15.enum(SITE_SETUP_ERROR_CODES);
-var editorFieldSchema = z15.object({
+var siteSetupRunStatusSchema = z16.enum(SITE_SETUP_RUN_STATUSES);
+var siteSetupRunModeSchema = z16.enum(SITE_SETUP_RUN_MODES);
+var siteSetupErrorCodeSchema = z16.enum(SITE_SETUP_ERROR_CODES);
+var editorFieldSchema = z16.object({
   fieldId: fieldIdSchema,
-  label: z15.string().trim().min(1),
-  subsection: z15.string().trim().min(1).optional(),
-  description: z15.string().trim().min(1).optional(),
-  required: z15.boolean().optional(),
-  maxLength: z15.number().int().positive().optional()
+  label: z16.string().trim().min(1),
+  subsection: z16.string().trim().min(1).optional(),
+  description: z16.string().trim().min(1).optional(),
+  required: z16.boolean().optional(),
+  maxLength: z16.number().int().positive().optional()
 }).strict();
-var editorSectionSchema = z15.object({
-  label: z15.string().trim().min(1),
-  fields: z15.array(editorFieldSchema).min(1)
+var editorSectionSchema = z16.object({
+  label: z16.string().trim().min(1),
+  fields: z16.array(editorFieldSchema).min(1)
 }).strict().superRefine((section, context) => {
   const closedSubsections = /* @__PURE__ */ new Set();
   let currentSubsection;
@@ -1302,10 +1338,10 @@ var editorSectionSchema = z15.object({
     }
   }
 });
-var editorRouteSchema = z15.object({
+var editorRouteSchema = z16.object({
   routeKey: siteFieldRouteKeySchema,
-  label: z15.string().trim().min(1),
-  sections: z15.array(editorSectionSchema).min(1)
+  label: z16.string().trim().min(1),
+  sections: z16.array(editorSectionSchema).min(1)
 }).strict().superRefine((route, context) => {
   const sections = /* @__PURE__ */ new Set();
   for (const [index, section] of route.sections.entries()) {
@@ -1319,9 +1355,9 @@ var editorRouteSchema = z15.object({
     sections.add(section.label);
   }
 });
-var editorDefinitionV1Schema = z15.object({
-  version: z15.literal(1),
-  routes: z15.array(editorRouteSchema).min(1)
+var editorDefinitionV1Schema = z16.object({
+  version: z16.literal(1),
+  routes: z16.array(editorRouteSchema).min(1)
 }).strict().superRefine((definition, context) => {
   const routes = /* @__PURE__ */ new Set();
   const fields = /* @__PURE__ */ new Set();
@@ -1359,7 +1395,7 @@ var editorDefinitionV1Schema = z15.object({
 var forbiddenControlOrBidi = /[\u0000-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 var forbiddenOwnerNoteControlOrBidi = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/u;
 var unsafeLocator = /<\/?[a-z][^>]*>|\b(?:javascript|data:text\/html)\s*:|\bon[a-z]+\s*=/iu;
-var renderedPathSchema = z15.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
+var renderedPathSchema = z16.string().trim().transform((value) => value !== "/" ? value.replace(/\/+$/u, "") : value).superRefine((value, context) => {
   if (!value.startsWith("/") || value === "$global" || value.includes("?") || value.includes("#")) {
     context.addIssue({
       code: "custom",
@@ -1369,7 +1405,7 @@ var renderedPathSchema = z15.string().trim().transform((value) => value !== "/"
   addSafeByteIssues(value, CONTINUE_SITE_SETUP_RENDERED_PATH_MAX_BYTES, "renderedPath", context);
 });
 function normalizedSafeTextSchema(maxBytes, label) {
-  return z15.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z15.string().min(1)).superRefine((value, context) => {
+  return z16.string().transform((value) => value.trim().replace(new RegExp("\\p{White_Space}+", "gu"), " ")).pipe(z16.string().min(1)).superRefine((value, context) => {
     addSafeByteIssues(value, maxBytes, label, context);
     if (label === "locatorHint" && unsafeLocator.test(value)) {
       context.addIssue({
@@ -1386,12 +1422,12 @@ var correctionItemBase = {
   requestedLabel: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_LABEL_MAX_BYTES, "requestedLabel").optional(),
   requestedSection: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_SECTION_MAX_BYTES, "requestedSection").optional(),
   requestedSubsection: normalizedSafeTextSchema(CONTINUE_SITE_SETUP_REQUESTED_SUBSECTION_MAX_BYTES, "requestedSubsection").optional(),
-  requestedSortOrder: z15.number().int().nonnegative().optional()
+  requestedSortOrder: z16.number().int().nonnegative().optional()
 };
-var setupCorrectionItemSchema = z15.discriminatedUnion("kind", [
-  z15.object({ kind: z15.literal("text"), ...correctionItemBase }).strict(),
-  z15.object({ kind: z15.literal("link"), ...correctionItemBase }).strict(),
-  z15.object({ kind: z15.literal("image"), ...correctionItemBase }).strict()
+var setupCorrectionItemSchema = z16.discriminatedUnion("kind", [
+  z16.object({ kind: z16.literal("text"), ...correctionItemBase }).strict(),
+  z16.object({ kind: z16.literal("link"), ...correctionItemBase }).strict(),
+  z16.object({ kind: z16.literal("image"), ...correctionItemBase }).strict()
 ]).superRefine((item, context) => {
   if (item.requestedSubsection && !item.requestedSection) {
     context.addIssue({
@@ -1401,7 +1437,7 @@ var setupCorrectionItemSchema = z15.discriminatedUnion("kind", [
     });
   }
 });
-var setupCorrectionItemsSchema = z15.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS).superRefine((items, context) => {
+var setupCorrectionItemsSchema = z16.array(setupCorrectionItemSchema).max(CONTINUE_SITE_SETUP_MAX_ITEMS).superRefine((items, context) => {
   const bytes = utf8Bytes(stableJsonStringify(items));
   if (bytes > CONTINUE_SITE_SETUP_ITEMS_MAX_BYTES) {
     context.addIssue({
@@ -1410,7 +1446,7 @@ var setupCorrectionItemsSchema = z15.array(setupCorrectionItemSchema).max(CONTIN
     });
   }
 });
-var siteSetupOwnerEditabilityNoteSchema = z15.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
+var siteSetupOwnerEditabilityNoteSchema = z16.string().max(SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_LENGTH).superRefine((value, context) => {
   if (utf8Bytes(value) > SITE_SETUP_OWNER_EDITABILITY_NOTE_MAX_BYTES) {
     context.addIssue({
       code: "custom",
@@ -1435,7 +1471,7 @@ var SITE_SETUP_MODULE_SCOPES = {
     "analytics:public_key_read"
   ]
 };
-var siteSetupModulesSchema = z15.array(z15.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
+var siteSetupModulesSchema = z16.array(z16.enum(["editing", "analytics"])).min(1).max(2).refine((modules) => modules[0] === "editing" && (modules.length === 1 || modules[1] === "analytics"), "Choose Editing with optional Analytics.");
 function siteSetupScopes(modules) {
   return modules.flatMap((module) => [...SITE_SETUP_MODULE_SCOPES[module]]);
 }
@@ -1443,15 +1479,15 @@ function hasExactSiteSetupScopes(scopes, modules) {
   const matches = (expected) => scopes.length === expected.length && expected.every((scope) => scopes.includes(scope));
   return modules ? matches(siteSetupScopes(modules)) : matches(siteSetupScopes(["editing"])) || matches(siteSetupScopes(["editing", "analytics"]));
 }
-var siteSetupActivityInputSchema = z15.object({
-  phase: z15.enum([
+var siteSetupActivityInputSchema = z16.object({
+  phase: z16.enum([
     "inspecting",
     "integrating",
     "deploying",
     "verifying",
     "repairing"
   ]),
-  textId: z15.enum([
+  textId: z16.enum([
     "inspecting",
     "integrating",
     "deploying",
@@ -1460,8 +1496,8 @@ var siteSetupActivityInputSchema = z15.object({
   ])
 }).strict().refine((value) => value.phase === value.textId, "Activity text must describe its phase.");
 var nextActionFields = {
-  actor: z15.enum(["agent", "user", "siteplane"]),
-  boundary: z15.enum([
+  actor: z16.enum(["agent", "user", "siteplane"]),
+  boundary: z16.enum([
     "source",
     "environment",
     "deployment",
@@ -1469,33 +1505,33 @@ var nextActionFields = {
     "authorization",
     "review"
   ]),
-  precondition: z15.string().min(1).max(1e3),
-  instruction: z15.string().min(1).max(2e3),
-  expectedEvidence: z15.string().min(1).max(1e3)
+  precondition: z16.string().min(1).max(1e3),
+  instruction: z16.string().min(1).max(2e3),
+  expectedEvidence: z16.string().min(1).max(1e3)
 };
-var siteSetupNextActionSchema = z15.discriminatedUnion("kind", [
-  z15.object({
+var siteSetupNextActionSchema = z16.discriminatedUnion("kind", [
+  z16.object({
     ...nextActionFields,
-    kind: z15.literal("run_command"),
-    command: z15.string().min(1).max(500)
+    kind: z16.literal("run_command"),
+    command: z16.string().min(1).max(500)
   }).strict(),
-  z15.object({ ...nextActionFields, kind: z15.literal("agent_edit") }).strict(),
-  z15.object({ ...nextActionFields, kind: z15.literal("needs_user_action") }).strict(),
-  z15.object({ ...nextActionFields, kind: z15.literal("wait") }).strict(),
-  z15.object({ ...nextActionFields, kind: z15.literal("done") }).strict()
+  z16.object({ ...nextActionFields, kind: z16.literal("agent_edit") }).strict(),
+  z16.object({ ...nextActionFields, kind: z16.literal("needs_user_action") }).strict(),
+  z16.object({ ...nextActionFields, kind: z16.literal("wait") }).strict(),
+  z16.object({ ...nextActionFields, kind: z16.literal("done") }).strict()
 ]);
-var siteSetupTaskRunSchema = z15.object({
-  runId: z15.string().uuid(),
+var siteSetupTaskRunSchema = z16.object({
+  runId: z16.string().uuid(),
   mode: siteSetupRunModeSchema,
   status: siteSetupRunStatusSchema,
-  fieldContractHash: z15.string().nullable(),
-  deploymentOrigin: z15.string().url().nullable(),
-  deploymentRevision: z15.string().nullable(),
-  publicRuntimeKeyId: z15.string().uuid().nullable(),
-  reviewVersion: z15.string().nullable()
+  fieldContractHash: z16.string().nullable(),
+  deploymentOrigin: z16.string().url().nullable(),
+  deploymentRevision: z16.string().nullable(),
+  publicRuntimeKeyId: z16.string().uuid().nullable(),
+  reviewVersion: z16.number().int().positive()
 }).strict();
-var siteSetupTaskProgressSchema = z15.object({
-  progressStage: z15.enum([
+var siteSetupTaskProgressSchema = z16.object({
+  progressStage: z16.enum([
     "waiting_for_connection",
     "agent_connected",
     "project_context_loaded",
@@ -1505,73 +1541,70 @@ var siteSetupTaskProgressSchema = z15.object({
     "action_required",
     "completed"
   ]),
-  lastVerifiedAt: z15.string().datetime().nullable(),
-  lastActivityAt: z15.string().datetime(),
-  activitySource: z15.enum(["user", "server", "agent"]),
+  lastVerifiedAt: z16.string().datetime().nullable(),
+  lastActivityAt: z16.string().datetime(),
+  activitySource: z16.enum(["user", "server", "agent"]),
   activityPhase: siteSetupActivityInputSchema.shape.phase.nullable(),
   activityTextId: siteSetupActivityInputSchema.shape.textId.nullable()
 }).strict();
-var siteSetupTaskSchema = z15.object({
-  contractVersion: z15.literal("siteplane.setup-task.v2"),
-  workflow: z15.enum(["initial_setup", "structure_update"]),
-  goal: z15.string().min(1),
+var siteSetupTaskSchema = z16.object({
+  contractVersion: z16.literal("siteplane.setup-task.v2"),
+  workflow: z16.enum(["initial_setup", "structure_update"]),
+  goal: z16.string().min(1),
   modules: siteSetupModulesSchema,
-  authorizationVersion: z15.number().int().positive(),
-  authorizedScopes: z15.array(z15.string()).min(2),
-  site: z15.object({
-    siteId: z15.string().uuid(),
-    portalPath: z15.string(),
-    adminOrigin: z15.string().url()
+  authorizationVersion: z16.number().int().positive(),
+  authorizedScopes: z16.array(z16.string()).min(2),
+  site: z16.object({
+    siteId: z16.string().uuid(),
+    portalPath: z16.string(),
+    adminOrigin: z16.string().url()
   }).strict().nullable(),
   run: siteSetupTaskRunSchema.nullable(),
   progress: siteSetupTaskProgressSchema.nullable(),
   deployment: setupDeploymentRecordSchema.nullable(),
-  revalidationGeneration: z15.number().int().positive(),
-  assignment: z15.literal("owned"),
-  deadline: z15.string().datetime().nullable(),
-  userInstructions: z15.object({
+  revalidationGeneration: z16.number().int().positive(),
+  assignment: z16.literal("owned"),
+  deadline: z16.string().datetime().nullable(),
+  userInstructions: z16.object({
     text: siteSetupOwnerEditabilityNoteSchema,
-    source: z15.literal("user"),
-    trust: z15.literal("untrusted")
+    source: z16.literal("user"),
+    trust: z16.literal("untrusted")
   }).strict(),
   corrections: setupCorrectionItemsSchema,
-  contentSelectionSummary: z15.object({
+  contentSelectionSummary: z16.object({
     text: siteSetupOwnerEditabilityNoteSchema,
-    source: z15.literal("agent"),
-    trust: z15.literal("untrusted")
+    source: z16.literal("agent"),
+    trust: z16.literal("untrusted")
   }).strict().nullable(),
-  environmentBindings: z15.array(z15.object({
-    name: z15.string().regex(/^[A-Z][A-Z0-9_]+$/u),
-    source: z15.string().min(1),
-    sensitivity: z15.enum(["public", "secret"]),
-    usage: z15.enum(["build", "server", "build_and_server"]),
-    evidence: z15.string().min(1)
+  environmentBindings: z16.array(z16.object({
+    name: z16.string().regex(/^[A-Z][A-Z0-9_]+$/u),
+    source: z16.string().min(1),
+    sensitivity: z16.enum(["public", "secret"]),
+    usage: z16.enum(["build", "server", "build_and_server"]),
+    evidence: z16.string().min(1)
   }).strict()),
   nextAction: siteSetupNextActionSchema,
-  error: z15.object({
-    code: z15.string().regex(/^[a-z0-9_.]+$/u).max(160),
+  error: z16.object({
+    code: z16.string().regex(/^[a-z0-9_.]+$/u).max(160),
     boundary: nextActionFields.boundary,
     responsibleActor: nextActionFields.actor,
-    retryable: z15.boolean(),
-    retryAfter: z15.number().int().nonnegative().nullable(),
-    requestId: z15.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
+    retryable: z16.boolean(),
+    retryAfter: z16.number().int().nonnegative().nullable(),
+    requestId: z16.string().regex(/^[A-Za-z0-9_-]+$/u).max(128)
   }).strict().nullable(),
-  packages: z15.object({
-    siteplane: z15.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z15.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  communication: z15.object({
-    beforeSourceChanges: z15.string().min(1),
-    updates: z15.array(z15.string().min(1)).min(1),
-    blocker: z15.string().min(1)
+  packages: siteSetupPackagesSchema,
+  communication: z16.object({
+    beforeSourceChanges: z16.string().min(1),
+    updates: z16.array(z16.string().min(1)).min(1),
+    blocker: z16.string().min(1)
   }).strict(),
-  discovery: z15.object({
-    inspectPublicRoutes: z15.boolean(),
-    contentKinds: z15.array(z15.enum(["text", "longText", "link", "image"])).min(1),
-    rules: z15.array(z15.string().min(1)).min(1)
+  discovery: z16.object({
+    inspectPublicRoutes: z16.boolean(),
+    contentKinds: z16.array(z16.enum(["text", "longText", "link", "image"])).min(1),
+    rules: z16.array(z16.string().min(1)).min(1)
   }).strict(),
-  steps: z15.array(z15.object({
-    id: z15.enum([
+  steps: z16.array(z16.object({
+    id: z16.enum([
       "inspect_repository",
       "install_packages",
       "instrument_fields",
@@ -1579,32 +1612,52 @@ var siteSetupTaskSchema = z15.object({
       "deploy_production",
       "verify_deployment"
     ]),
-    instruction: z15.string().min(1)
+    instruction: z16.string().min(1)
   }).strict()).length(6),
-  completion: z15.object({
-    verifiedStatus: z15.literal("ready_for_review"),
-    instruction: z15.string().min(1)
+  completion: z16.object({
+    verifiedStatus: z16.literal("ready_for_review"),
+    instruction: z16.string().min(1)
   }).strict()
-}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.");
-var canonicalHashSchema = z15.string().regex(/^sha256:[0-9a-f]{64}$/iu);
+}).strict().refine((task) => hasExactSiteSetupScopes(task.authorizedScopes, task.modules), "Task scopes must exactly match its modules.").refine((task) => task.modules.includes("analytics") === (task.packages.analytics !== void 0), "The Analytics package pin must be present exactly when Analytics is selected.");
+var canonicalHashSchema = z16.string().regex(/^sha256:[0-9a-f]{64}$/iu);
 var deploymentRevisionSchema = normalizedSafeTextSchema(256, "deploymentRevision");
-var continueSiteSetupInputSchema = z15.object({
-  siteId: z15.string().uuid(),
-  runId: z15.string().uuid(),
+var continueSiteSetupInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
+  expectedReviewVersion: z16.number().int().positive(),
+  mutationId: z16.string().uuid(),
+  intent: z16.enum(["continue_review", "correct_completed_review"]),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   correctionItems: setupCorrectionItemsSchema,
   ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema.optional()
 }).strict();
-var saveSiteSetupOwnerNoteInputSchema = z15.object({
-  siteId: z15.string().uuid(),
-  runId: z15.string().uuid(),
+var saveSiteSetupOwnerNoteInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
+  expectedReviewVersion: z16.number().int().positive(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema
 }).strict();
-var siteSetupContextInputSchema = z15.object({}).strict();
-var siteSetupApplyInputSchema = z15.object({
+var setupReviewPreferenceSelectionSchema = z16.object({
+  analyticsMode: z16.enum(["disabled", "session_only"]).nullable(),
+  assetTargetType: z16.enum(["repo_static_assets", "siteplane_managed_fallback"]).nullable(),
+  assetTargetId: z16.string().uuid().nullable()
+}).strict().refine((value) => value.assetTargetType !== null || value.assetTargetId === null, {
+  message: "An asset target requires its delivery type."
+});
+var setupReviewPreferencesSchema = setupReviewPreferenceSelectionSchema.safeExtend({
+  managedHostingApproved: z16.boolean()
+});
+var saveSetupReviewPreferencesInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
+  expectedReviewVersion: z16.number().int().positive(),
+  preferences: setupReviewPreferenceSelectionSchema
+}).strict();
+var siteSetupContextInputSchema = z16.object({}).strict();
+var siteSetupApplyInputSchema = z16.object({
   fieldContract: siteFieldContractV1Schema,
   editorDefinition: editorDefinitionV1Schema,
   contentSelectionSummary: siteSetupOwnerEditabilityNoteSchema.refine((text) => text.trim().length > 0, "Describe the selected content, important exclusions and any open gaps.")
@@ -1671,37 +1724,44 @@ var siteSetupApplyInputSchema = z15.object({
     }
   }
 });
-var siteSetupVerifyInputSchema = z15.object({
-  deploymentUrl: z15.string().url().refine((value) => value.startsWith("https://")),
+var siteSetupVerifyInputSchema = z16.object({
+  deploymentUrl: z16.string().url().refine((value) => value.startsWith("https://")),
   deploymentRevision: deploymentRevisionSchema,
-  wait: z15.boolean().optional()
+  wait: z16.boolean().optional()
 }).strict();
-var siteSetupEvidenceInputSchema = z15.object({
-  siteId: z15.string().uuid(),
-  runId: z15.string().uuid(),
+var siteSetupEvidenceInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
   expectedFieldContractHash: canonicalHashSchema,
-  expectedDeploymentOrigin: z15.string().url().refine((value) => value.startsWith("https://")),
+  expectedDeploymentOrigin: z16.string().url().refine((value) => value.startsWith("https://")),
   expectedDeploymentRevision: deploymentRevisionSchema,
-  publicRuntimeKeyId: z15.string().uuid(),
+  publicRuntimeKeyId: z16.string().uuid(),
   bridgeSessionId: normalizedSafeTextSchema(256, "bridgeSessionId"),
-  observations: z15.array(z15.object({
+  observations: z16.array(z16.object({
     fieldId: fieldIdSchema,
     routeKey: siteFieldRouteKeySchema,
     renderedPath: renderedPathSchema,
-    targetResolved: z15.boolean(),
-    previewAck: z15.boolean()
+    targetResolved: z16.boolean(),
+    previewAck: z16.boolean()
   }).strict().refine((value) => !value.previewAck || value.targetResolved, "Preview ACK requires a resolved target.")).min(1).max(200)
 }).strict();
-var completeSiteSetupInputSchema = z15.object({
-  siteId: z15.string().uuid(),
-  runId: z15.string().uuid(),
+var completeSetupReviewInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
+  expectedReviewVersion: z16.number().int().positive(),
   expectedFieldContractHash: canonicalHashSchema,
   expectedDeploymentRevision: deploymentRevisionSchema,
   expectedReadyFingerprint: canonicalHashSchema
 }).strict();
-var refreshSiteSetupDeploymentInputSchema = z15.object({
-  siteId: z15.string().uuid(),
-  deploymentUrl: z15.string().url().refine((value) => value.startsWith("https://")),
+var activateSiteSetupInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  runId: z16.string().uuid(),
+  expectedReviewVersion: z16.number().int().positive(),
+  expectedSnapshotHash: canonicalHashSchema
+}).strict();
+var refreshSiteSetupDeploymentInputSchema = z16.object({
+  siteId: z16.string().uuid(),
+  deploymentUrl: z16.string().url().refine((value) => value.startsWith("https://")),
   deploymentRevision: deploymentRevisionSchema
 }).strict();
 function addSafeByteIssues(value, maxBytes, label, context) {
@@ -1721,37 +1781,61 @@ function addSafeByteIssues(value, maxBytes, label, context) {
 function utf8Bytes(value) {
   return new TextEncoder().encode(value).byteLength;
 }
+var setupActivationApprovalSchema = z16.object({
+  reviewVersion: z16.number().int().positive(),
+  snapshotHash: canonicalHashSchema,
+  analytics: z16.object({
+    status: z16.enum(["active", "skipped"]),
+    reviewVersion: z16.number().int().positive(),
+    generation: z16.number().int().nonnegative()
+  }).optional()
+});
+var activateSetupModulesInputSchema = activateSiteSetupInputSchema.extend({
+  analytics: z16.discriminatedUnion("decision", [
+    z16.object({ decision: z16.literal("pending") }).strict(),
+    z16.object({
+      decision: z16.literal("enable"),
+      expectedInstallationGeneration: z16.number().int().positive(),
+      measurementApproved: z16.literal(true)
+    }).strict(),
+    z16.object({
+      decision: z16.literal("skip"),
+      expectedInstallationGeneration: z16.number().int().nonnegative(),
+      continueWithoutAnalytics: z16.literal(true)
+    }).strict()
+  ])
+}).strict();
 
 // ../shared/dist/bridge-protocol.js
 var BRIDGE_PROTOCOL_VERSION = 2;
-var bridgeRectSchema = z16.object({
-  x: z16.number(),
-  y: z16.number(),
-  width: z16.number().nonnegative(),
-  height: z16.number().nonnegative()
-});
-var previewTextValueSchema = z16.object({
-  fieldType: z16.enum(["text", "longText"]),
-  value: z16.string()
-});
-var previewLinkValueSchema = z16.object({
-  fieldType: z16.literal("link"),
-  value: z16.object({
-    href: z16.string().trim().min(1),
-    label: z16.string().trim().min(1).optional()
+var bridgeRectSchema = z17.object({
+  x: z17.number(),
+  y: z17.number(),
+  width: z17.number().nonnegative(),
+  height: z17.number().nonnegative()
+});
+var previewTextValueSchema = z17.object({
+  fieldType: z17.enum(["text", "longText"]),
+  value: z17.string()
+});
+var previewLinkValueSchema = z17.object({
+  fieldType: z17.literal("link"),
+  value: z17.object({
+    href: z17.string().trim().min(1),
+    label: z17.string().trim().min(1).optional()
   })
 });
-var previewImageValueSchema = z16.object({
-  fieldType: z16.literal("image"),
+var previewImageValueSchema = z17.object({
+  fieldType: z17.literal("image"),
   value: imageValueSchema
 });
-var bridgePreviewValueSchema = z16.discriminatedUnion("fieldType", [
+var bridgePreviewValueSchema = z17.discriminatedUnion("fieldType", [
   previewTextValueSchema,
   previewLinkValueSchema,
   previewImageValueSchema
 ]);
-var fieldSelectionModeSchema = z16.enum(["replace", "range", "toggle"]);
-var fieldBridgeMissingContentActionSchema = z16.enum([
+var fieldSelectionModeSchema = z17.enum(["replace", "range", "toggle"]);
+var fieldBridgeMissingContentActionSchema = z17.enum([
   "add",
   "select",
   "remove"
@@ -1768,79 +1852,81 @@ var FIELD_BRIDGE_MESSAGE_TYPES = [
   "siteplane:field-bridge:set-visual-control-state",
   "siteplane:field-bridge:missing-content",
   "siteplane:field-bridge:preview-scrolled",
+  "siteplane:field-bridge:analytics-probe",
+  "siteplane:field-bridge:analytics-probe-result",
   "siteplane:field-bridge:error"
 ];
-var canonicalFieldContractHashSchema = z16.string().regex(/^sha256:[0-9a-f]{64}$/u);
-var bridgeSectionSchema = z16.string().trim().min(1).max(256);
-var realRenderedPathSchema = z16.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
-var fieldBridgeIdentitySchema = z16.object({
-  publicRuntimeKeyId: z16.string().uuid(),
+var canonicalFieldContractHashSchema = z17.string().regex(/^sha256:[0-9a-f]{64}$/u);
+var bridgeSectionSchema = z17.string().trim().min(1).max(256);
+var realRenderedPathSchema = z17.string().trim().refine((value) => value.startsWith("/") && value !== "$global" && !value.includes("?") && !value.includes("#"), "A field bridge rendered path must be a real canonical path.");
+var fieldBridgeIdentitySchema = z17.object({
+  publicRuntimeKeyId: z17.string().uuid(),
   fieldContractHash: canonicalFieldContractHashSchema,
-  deploymentRevision: z16.string().trim().min(1).max(256)
+  deploymentRevision: z17.string().trim().min(1).max(256)
 }).strict();
-var fieldBridgeBaseSchema = z16.object({
-  version: z16.literal(BRIDGE_PROTOCOL_VERSION),
-  type: z16.enum(FIELD_BRIDGE_MESSAGE_TYPES),
-  siteId: z16.string().uuid(),
-  sessionId: z16.string().trim().min(1),
-  publicRuntimeKeyId: z16.string().uuid(),
+var fieldBridgeBaseSchema = z17.object({
+  version: z17.literal(BRIDGE_PROTOCOL_VERSION),
+  type: z17.enum(FIELD_BRIDGE_MESSAGE_TYPES),
+  siteId: z17.string().uuid(),
+  sessionId: z17.string().trim().min(1),
+  publicRuntimeKeyId: z17.string().uuid(),
   fieldContractHash: canonicalFieldContractHashSchema,
-  deploymentRevision: z16.string().trim().min(1).max(256),
-  requestId: z16.string().trim().min(1),
-  sentAt: z16.string().datetime()
+  deploymentRevision: z17.string().trim().min(1).max(256),
+  requestId: z17.string().trim().min(1),
+  sentAt: z17.string().datetime()
 }).strict();
-var fieldBridgeFieldSchema = z16.object({
+var fieldBridgeFieldSchema = z17.object({
   fieldId: fieldIdSchema,
   fieldType: fieldTypeSchema,
   routeKey: siteFieldRouteKeySchema,
   renderedPath: realRenderedPathSchema,
-  sourcePath: z16.string().trim().min(1).optional(),
+  sourcePath: z17.string().trim().min(1).optional(),
   editTarget: fieldIdSchema,
   rect: bridgeRectSchema,
-  targetResolved: z16.literal(true),
+  targetResolved: z17.literal(true),
   currentValue: bridgePreviewValueSchema.optional()
 }).strict();
 var fieldBridgeInitMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:init"),
-  payload: z16.object({
-    adminOrigin: z16.string().url(),
-    customerOrigin: z16.string().url(),
+  type: z17.literal("siteplane:field-bridge:init"),
+  payload: z17.object({
+    adminOrigin: z17.string().url(),
+    customerOrigin: z17.string().url(),
     renderedPath: realRenderedPathSchema
   }).strict()
 });
 var fieldBridgeReadyMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:ready"),
-  payload: z16.object({
+  type: z17.literal("siteplane:field-bridge:ready"),
+  payload: z17.object({
     renderedPath: realRenderedPathSchema,
-    fieldCount: z16.number().int().nonnegative(),
-    capabilities: z16.tuple([
-      z16.literal("field_selection"),
-      z16.literal("preview_values"),
-      z16.literal("field_evidence"),
-      z16.literal("visual_field_control")
-    ])
+    fieldCount: z17.number().int().nonnegative(),
+    capabilities: z17.tuple([
+      z17.literal("field_selection"),
+      z17.literal("preview_values"),
+      z17.literal("field_evidence"),
+      z17.literal("visual_field_control")
+    ]).rest(z17.literal("analytics_preview_readiness")).refine((capabilities) => capabilities.length <= 5)
   }).strict()
 });
 var fieldBridgeFieldsMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:fields"),
-  payload: z16.object({
+  type: z17.literal("siteplane:field-bridge:fields"),
+  payload: z17.object({
     renderedPath: realRenderedPathSchema,
-    fields: z16.array(fieldBridgeFieldSchema)
+    fields: z17.array(fieldBridgeFieldSchema)
   }).strict()
 });
 var fieldBridgeSelectFieldMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:select-field"),
-  payload: z16.object({
+  type: z17.literal("siteplane:field-bridge:select-field"),
+  payload: z17.object({
     fieldId: fieldIdSchema,
     selectionMode: fieldSelectionModeSchema
   }).strict()
 });
 var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:set-selected-field"),
-  payload: z16.object({
-    fieldIds: z16.array(fieldIdSchema).max(200),
+  type: z17.literal("siteplane:field-bridge:set-selected-field"),
+  payload: z17.object({
+    fieldIds: z17.array(fieldIdSchema).max(200),
     primaryFieldId: fieldIdSchema.nullable(),
-    scrollIntoView: z16.boolean().optional()
+    scrollIntoView: z17.boolean().optional()
   }).strict().superRefine((value, context) => {
     if (value.fieldIds.length > 0 && value.primaryFieldId === null) {
       context.addIssue({
@@ -1859,58 +1945,76 @@ var fieldBridgeSetSelectedFieldMessageSchema = fieldBridgeBaseSchema.extend({
   })
 });
 var fieldBridgeApplyPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:apply-preview-values"),
-  payload: z16.object({ values: z16.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
+  type: z17.literal("siteplane:field-bridge:apply-preview-values"),
+  payload: z17.object({ values: z17.record(fieldIdSchema, bridgePreviewValueSchema) }).strict()
 });
 var fieldBridgeTestPreviewValuesMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:test-preview-values"),
-  payload: z16.object({ fieldIds: z16.array(fieldIdSchema).min(1).max(200) }).strict()
+  type: z17.literal("siteplane:field-bridge:test-preview-values"),
+  payload: z17.object({ fieldIds: z17.array(fieldIdSchema).min(1).max(200) }).strict()
 });
 var fieldBridgePreviewAckMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:preview-ack"),
-  payload: z16.object({
-    ackRequestId: z16.string().trim().min(1),
-    kind: z16.enum(["apply", "test"]),
+  type: z17.literal("siteplane:field-bridge:preview-ack"),
+  payload: z17.object({
+    ackRequestId: z17.string().trim().min(1),
+    kind: z17.enum(["apply", "test"]),
     renderedPath: realRenderedPathSchema,
-    fieldIds: z16.array(fieldIdSchema).max(200)
+    fieldIds: z17.array(fieldIdSchema).max(200)
   }).strict()
 });
 var fieldBridgeSetVisualControlStateMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:set-visual-control-state"),
-  payload: z16.object({
-    enabled: z16.boolean(),
-    fieldProximityEnabled: z16.boolean(),
-    pendingKeys: z16.array(z16.string().trim().min(1).max(2048)).max(50),
-    activeFieldIds: z16.array(fieldIdSchema),
-    fieldSections: z16.record(fieldIdSchema, bridgeSectionSchema),
-    selectedPending: z16.array(z16.object({
-      key: z16.string().trim().min(1).max(2048),
-      locatorHint: z16.string().trim().min(1).max(2048)
+  type: z17.literal("siteplane:field-bridge:set-visual-control-state"),
+  payload: z17.object({
+    enabled: z17.boolean(),
+    fieldProximityEnabled: z17.boolean(),
+    pendingKeys: z17.array(z17.string().trim().min(1).max(2048)).max(50),
+    activeFieldIds: z17.array(fieldIdSchema),
+    fieldSections: z17.record(fieldIdSchema, bridgeSectionSchema),
+    selectedPending: z17.array(z17.object({
+      key: z17.string().trim().min(1).max(2048),
+      locatorHint: z17.string().trim().min(1).max(2048)
     }).strict()).max(50),
-    scrollPendingIntoView: z16.boolean().optional()
+    scrollPendingIntoView: z17.boolean().optional()
   }).strict()
 });
 var fieldBridgeMissingContentMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:missing-content"),
-  payload: z16.object({
+  type: z17.literal("siteplane:field-bridge:missing-content"),
+  payload: z17.object({
     action: fieldBridgeMissingContentActionSchema,
     item: setupCorrectionItemSchema,
     suggestedSection: bridgeSectionSchema.optional()
   }).strict()
 });
 var fieldBridgePreviewScrolledMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:preview-scrolled"),
-  payload: z16.object({ renderedPath: realRenderedPathSchema }).strict()
+  type: z17.literal("siteplane:field-bridge:preview-scrolled"),
+  payload: z17.object({ renderedPath: realRenderedPathSchema }).strict()
+});
+var analyticsPreviewChallengeSchema = z17.object({
+  bridgeSessionId: z17.string().uuid(),
+  challenge: z17.string().min(32).max(512),
+  testRunId: z17.string().trim().min(1).max(160),
+  expiresAt: z17.string().datetime()
+}).strict();
+var fieldBridgeAnalyticsProbeSchema = fieldBridgeBaseSchema.extend({
+  type: z17.literal("siteplane:field-bridge:analytics-probe"),
+  requestId: z17.string().min(1).max(256),
+  payload: analyticsPreviewChallengeSchema
+});
+var fieldBridgeAnalyticsProbeResultSchema = fieldBridgeBaseSchema.extend({
+  type: z17.literal("siteplane:field-bridge:analytics-probe-result"),
+  payload: z17.object({
+    ackRequestId: z17.string().min(1).max(256),
+    status: z17.enum(["recorded", "failed"])
+  }).strict()
 });
 var fieldBridgeErrorMessageSchema = fieldBridgeBaseSchema.extend({
-  type: z16.literal("siteplane:field-bridge:error"),
-  payload: z16.object({
-    code: z16.string().trim().min(1),
-    message: z16.string().trim().min(1),
-    recoverable: z16.boolean().default(false)
+  type: z17.literal("siteplane:field-bridge:error"),
+  payload: z17.object({
+    code: z17.string().trim().min(1),
+    message: z17.string().trim().min(1),
+    recoverable: z17.boolean().default(false)
   }).strict()
 });
-var fieldBridgeMessageSchema = z16.discriminatedUnion("type", [
+var fieldBridgeMessageSchema = z17.discriminatedUnion("type", [
   fieldBridgeInitMessageSchema,
   fieldBridgeReadyMessageSchema,
   fieldBridgeFieldsMessageSchema,
@@ -1922,55 +2026,57 @@ var fieldBridgeMessageSchema = z16.discriminatedUnion("type", [
   fieldBridgeSetVisualControlStateMessageSchema,
   fieldBridgeMissingContentMessageSchema,
   fieldBridgePreviewScrolledMessageSchema,
-  fieldBridgeErrorMessageSchema
+  fieldBridgeErrorMessageSchema,
+  fieldBridgeAnalyticsProbeSchema,
+  fieldBridgeAnalyticsProbeResultSchema
 ]);
 
 // ../shared/dist/commands.js
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // ../shared/dist/errors.js
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 var UI_ERROR_CATEGORIES = [
   "site_member",
   "workspace_member",
   "internal"
 ];
-var uiErrorCategorySchema = z17.enum(UI_ERROR_CATEGORIES);
-var commandErrorPayloadSchema = z17.object({
-  code: z17.string().min(1),
-  message: z17.string().min(1),
+var uiErrorCategorySchema = z18.enum(UI_ERROR_CATEGORIES);
+var commandErrorPayloadSchema = z18.object({
+  code: z18.string().min(1),
+  message: z18.string().min(1),
   category: uiErrorCategorySchema,
-  details: z17.record(z17.string(), z17.unknown()).optional()
+  details: z18.record(z18.string(), z18.unknown()).optional()
 });
 
 // ../shared/dist/commands.js
-var commandSuccessSchema = z18.object({
-  ok: z18.literal(true),
-  data: z18.unknown()
+var commandSuccessSchema = z19.object({
+  ok: z19.literal(true),
+  data: z19.unknown()
 });
-var commandErrorSchema = z18.object({
-  ok: z18.literal(false),
+var commandErrorSchema = z19.object({
+  ok: z19.literal(false),
   error: commandErrorPayloadSchema
 });
-var commandResultSchema = z18.discriminatedUnion("ok", [
+var commandResultSchema = z19.discriminatedUnion("ok", [
   commandSuccessSchema,
   commandErrorSchema
 ]);
 
 // ../shared/dist/editor-settings.js
-import { z as z19 } from "zod";
-var editorColorSchemeSchema = z19.enum([
+import { z as z20 } from "zod";
+var editorColorSchemeSchema = z20.enum([
   "paper",
   "slate",
   "siteplane",
   "bloom"
 ]);
 var editorColorSchemes = editorColorSchemeSchema.options;
-var editorColorModeSchema = z19.enum(["light", "dark"]);
+var editorColorModeSchema = z20.enum(["light", "dark"]);
 var editorColorModes = editorColorModeSchema.options;
 
 // ../shared/dist/site-slug.js
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var SITE_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "account",
@@ -1987,31 +2093,31 @@ var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "support",
   "workspace"
 ]);
-var siteSlugSchema = z20.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
+var siteSlugSchema = z21.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
 
 // ../shared/dist/entitlements.js
-import { z as z21 } from "zod";
-var entitlementSnapshotSchema = z21.object({
-  planKey: z21.string().trim().min(1),
-  sitesLimit: z21.number().int().positive(),
-  siteMembersPerSiteLimit: z21.number().int().positive(),
-  customAdminDomainsEnabled: z21.boolean(),
-  agentMcpEnabled: z21.boolean(),
-  emailNotificationsEnabled: z21.boolean(),
-  analyticsEnabled: z21.boolean(),
-  analyticsSitesLimit: z21.number().int().min(0),
-  analyticsPortalPerformanceEnabled: z21.boolean(),
-  analyticsMonthlyReportsEnabled: z21.boolean(),
-  analyticsAiSummaryEnabled: z21.boolean(),
-  analyticsRawEventRetentionDays: z21.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
-  analyticsMonthlyEventLimit: z21.number().int().min(0),
-  bookingEnabled: z21.boolean().default(false),
-  bookingSitesLimit: z21.number().int().min(0).default(0),
-  bookingPortalManagementEnabled: z21.boolean().default(false),
-  bookingResourcesPerSiteLimit: z21.number().int().min(0).default(0),
-  bookingServicesPerSiteLimit: z21.number().int().min(0).default(0),
-  bookingMonthlyBookingsLimit: z21.number().int().min(0).default(0),
-  bookingRemindersEnabled: z21.boolean().default(false)
+import { z as z22 } from "zod";
+var entitlementSnapshotSchema = z22.object({
+  planKey: z22.string().trim().min(1),
+  sitesLimit: z22.number().int().positive(),
+  siteMembersPerSiteLimit: z22.number().int().positive(),
+  customAdminDomainsEnabled: z22.boolean(),
+  agentMcpEnabled: z22.boolean(),
+  emailNotificationsEnabled: z22.boolean(),
+  analyticsEnabled: z22.boolean(),
+  analyticsSitesLimit: z22.number().int().min(0),
+  analyticsPortalPerformanceEnabled: z22.boolean(),
+  analyticsMonthlyReportsEnabled: z22.boolean(),
+  analyticsAiSummaryEnabled: z22.boolean(),
+  analyticsRawEventRetentionDays: z22.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
+  analyticsMonthlyEventLimit: z22.number().int().min(0),
+  bookingEnabled: z22.boolean().default(false),
+  bookingSitesLimit: z22.number().int().min(0).default(0),
+  bookingPortalManagementEnabled: z22.boolean().default(false),
+  bookingResourcesPerSiteLimit: z22.number().int().min(0).default(0),
+  bookingServicesPerSiteLimit: z22.number().int().min(0).default(0),
+  bookingMonthlyBookingsLimit: z22.number().int().min(0).default(0),
+  bookingRemindersEnabled: z22.boolean().default(false)
 });
 var EARLY_ACCESS_PLAN = {
   planKey: "early_access_2026",
@@ -2037,7 +2143,7 @@ var EARLY_ACCESS_PLAN = {
 };
 
 // ../shared/dist/readiness.js
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 var READINESS_CHECK_KEYS = [
   "agent_instructions_installed",
   "runtime_package_connected",
@@ -2052,19 +2158,80 @@ var READINESS_STATUSES = [
   "failing",
   "warning"
 ];
-var readinessCheckKeySchema = z22.enum(READINESS_CHECK_KEYS);
-var readinessStatusSchema = z22.enum(READINESS_STATUSES);
+var readinessCheckKeySchema = z23.enum(READINESS_CHECK_KEYS);
+var readinessStatusSchema = z23.enum(READINESS_STATUSES);
 
 // ../shared/dist/site.js
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var SITE_STATUSES = [
   "setup",
   "active",
   "disabled",
   "archived"
 ];
-var siteStatusSchema = z23.enum(SITE_STATUSES);
-var websiteUrlSchema = z23.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+var siteStatusSchema = z24.enum(SITE_STATUSES);
+var websiteUrlSchema = z24.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+
+// ../shared/dist/setup-assets.js
+import { z as z25 } from "zod";
+var configureSetupAssetTargetInputSchema = z25.object({
+  siteId: z25.string().uuid(),
+  runId: z25.string().uuid(),
+  expectedReviewVersion: z25.number().int().positive(),
+  expectedSnapshotHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  mutationId: z25.string().uuid(),
+  expectedApprovalId: z25.string().uuid().nullable(),
+  targetId: z25.string().uuid().nullable(),
+  targetType: z25.enum(["repo_static_assets", "siteplane_managed_fallback"]),
+  approveManagedHosting: z25.boolean()
+}).strict().refine((value) => value.targetType === "siteplane_managed_fallback" || !value.approveManagedHosting);
+var setupAssetTargetApprovalSchema = z25.object({
+  id: z25.string().uuid(),
+  runId: z25.string().uuid(),
+  reviewVersion: z25.number().int().positive(),
+  snapshotHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  targetId: z25.string().uuid(),
+  targetType: z25.enum(["repo_static_assets", "siteplane_managed_fallback"]),
+  targetRevision: z25.number().int().positive(),
+  deploymentOrigin: z25.string().url(),
+  gitConnectionId: z25.string().uuid().nullable(),
+  gitRevision: z25.number().int().positive().nullable(),
+  managedHostingApproved: z25.boolean(),
+  actorUserId: z25.string().uuid(),
+  approvedAt: z25.string().datetime({ offset: true })
+}).strict();
+var setupAssetReadinessSchema = z25.union([
+  z25.object({
+    status: z25.enum([
+      "not_required",
+      "needs_choice",
+      "stale_setup_review",
+      "permission_denied"
+    ])
+  }).strict(),
+  z25.object({
+    status: z25.literal("stale_approval"),
+    approval: setupAssetTargetApprovalSchema.optional()
+  }).strict(),
+  z25.object({
+    status: z25.literal("not_verified"),
+    approval: setupAssetTargetApprovalSchema,
+    jobId: z25.string().uuid().optional(),
+    checkedAt: z25.string().datetime({ offset: true }).nullable().optional()
+  }).strict(),
+  z25.object({
+    status: z25.enum(["ready", "checking", "retrying"]),
+    approval: setupAssetTargetApprovalSchema,
+    jobId: z25.string().uuid(),
+    checkedAt: z25.string().datetime({ offset: true }).nullable()
+  }).strict().refine((value) => value.status !== "ready" || value.checkedAt !== null)
+]);
+var checkSetupAssetTargetInputSchema = z25.object({
+  siteId: z25.string().uuid(),
+  runId: z25.string().uuid(),
+  approvalId: z25.string().uuid(),
+  intent: z25.enum(["start", "poll"])
+}).strict();
 
 // ../cli/dist/analytics/static-scan.js
 import ts from "typescript";
@@ -2088,6 +2255,9 @@ Analytics contract hash: ${ANALYTICS_CONTRACT_HASH}
 - Use stable data-siteplane-target-id values that do not depend on visible copy.
 - Use public site keys only through environment references.
 - Do not write secret analytics keys, setup tokens or project CLI tokens into source files.
+- Mount the SDK once in the existing client lifecycle. Wire installDataAttributeTracking and createNextAppRouterNavigationAdapter to analytics.track/getRouteViewId/setPageContext, feed initial and subsequent Next.js pathname changes, and refresh attribute targets after navigation. Dispose attribute tracking and the SDK on unmount.
+- Inspect existing consent management. Pass consentAdapter with getConsent and subscribe to initSiteplaneAnalytics for an existing CMP; return unknown while unresolved, disabled for denial and a permitted mode only for its actual visitor grant. Subscribe returns cleanup. Do not mirror CMP snapshots with setConsent or replace stored opt-outs.
+- Omit consentAdapter only after confirming no existing CMP. An unrecognized CMP blocks Analytics with a concrete repair diagnostic; do not invent a grant or a no-op adapter to pass a check.
 - Suppress editor-preview traffic from live analytics.
 - Run npx siteplane analytics check, npx siteplane analytics sync and npx siteplane analytics test after setup.
 `;
@@ -2101,19 +2271,70 @@ ${analyticsRulesTemplate}`;
 // ../cli/dist/commands/analytics/import.js
 import { createHash } from "crypto";
 
+// ../cli/dist/commands/analytics/sync.js
+function createAnalyticsCliRequestHeaders(config) {
+  const headers = {
+    authorization: `Bearer ${config.accessToken}`,
+    "content-type": "application/json"
+  };
+  const bypassSecret = config.vercelAutomationBypassSecret?.trim();
+  if (bypassSecret) {
+    headers["x-vercel-protection-bypass"] = bypassSecret;
+  }
+  return headers;
+}
+
 // ../cli/dist/commands/analytics/public-key.js
-import { z as z24 } from "zod";
-var responseSchema = z24.object({
-  ok: z24.literal(true),
-  data: z24.object({
-    rawPublicKey: z24.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+import { z as z26 } from "zod";
+var responseSchema = z26.object({
+  ok: z26.literal(true),
+  data: z26.object({
+    rawPublicKey: z26.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
   })
 });
-var errorResponseSchema = z24.object({
-  error: z24.object({
-    code: z24.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+var errorResponseSchema = z26.object({
+  error: z26.object({
+    code: z26.string().regex(/^[a-z][a-z0-9_.-]+$/u)
   })
 });
+async function analyticsPublicKeyCommand(input) {
+  const fetcher = input.fetchImpl ?? fetch;
+  const response = await fetcher(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/public-key`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(2e4),
+    headers: createAnalyticsCliRequestHeaders(input.config),
+    body: JSON.stringify({ siteId: input.config.siteId })
+  });
+  const payload = await response.json().catch(() => null);
+  const parsed = responseSchema.safeParse(payload);
+  if (!response.ok || !parsed.success) {
+    const error = errorResponseSchema.safeParse(payload);
+    throw new Error(`${error.success ? error.data.error.code : "analytics_public_key.invalid_response"}: Unable to read the active Analytics public key.`);
+  }
+  return parsed.data.data.rawPublicKey;
+}
+
+// ../cli/dist/commands/analytics/prepare.js
+import { z as z27 } from "zod";
+var resultSchema = z27.object({
+  ok: z27.literal(true),
+  data: z27.object({
+    rawPublicKey: z27.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
+    generation: z27.number().int().positive(),
+    status: z27.enum([
+      "setup_started",
+      "test_mode",
+      "active",
+      "paused",
+      "error",
+      "deleting"
+    ])
+  }).strict()
+}).strict();
+var errorSchema = z27.object({
+  error: z27.object({ code: z27.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
+});
 
 // ../cli/dist/commands/analytics/test.js
 import { randomUUID } from "crypto";
@@ -2145,22 +2366,19 @@ ${bookingRulesTemplate}`;
 import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
 import { join as join3 } from "path";
-import { z as z25 } from "zod";
-var siteplaneProjectConfigSchema = z25.object({
-  version: z25.literal(2),
-  apiBaseUrl: z25.string().url(),
-  siteId: z25.string().uuid(),
-  publicSiteKeyId: z25.string().uuid(),
-  publicSiteKey: z25.string().trim().min(1),
-  runId: z25.string().uuid(),
-  appDirectory: z25.string().min(1),
-  taskContractVersion: z25.literal("siteplane.setup-task.v2"),
-  adminProtocolVersion: z25.literal(2),
-  packages: z25.object({
-    siteplane: z25.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z25.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict(),
-  fieldContractHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+import { z as z28 } from "zod";
+var siteplaneProjectConfigSchema = z28.object({
+  version: z28.literal(2),
+  apiBaseUrl: z28.string().url(),
+  siteId: z28.string().uuid(),
+  publicSiteKeyId: z28.string().uuid(),
+  publicSiteKey: z28.string().trim().min(1),
+  runId: z28.string().uuid(),
+  appDirectory: z28.string().min(1),
+  taskContractVersion: z28.literal("siteplane.setup-task.v2"),
+  adminProtocolVersion: z28.literal(2),
+  packages: siteSetupPackagesSchema,
+  fieldContractHash: z28.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectConfig(projectDir) {
   return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
@@ -2172,13 +2390,13 @@ import { randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
 import { dirname as dirname5, join as join4, relative } from "path";
 import { promisify } from "util";
-import { z as z26 } from "zod";
-var siteplaneCredentialsSchema = z26.object({
-  accessToken: z26.string().trim().min(1),
-  siteRevalidationSecret: z26.string().trim().min(1),
-  adminSession: z26.object({
-    secret: z26.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-    generation: z26.string().uuid()
+import { z as z29 } from "zod";
+var siteplaneCredentialsSchema = z29.object({
+  accessToken: z29.string().trim().min(1),
+  siteRevalidationSecret: z29.string().trim().min(1),
+  adminSession: z29.object({
+    secret: z29.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    generation: z29.string().uuid()
   }).strict().optional()
 }).strict();
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
@@ -2233,7 +2451,7 @@ async function gitPathMatches(projectDir, path, command) {
 // ../cli/dist/commands/init.js
 import { access as access3 } from "fs/promises";
 import { join as join7, relative as relative3 } from "path";
-import { z as z29 } from "zod";
+import { z as z32 } from "zod";
 
 // ../cli/dist/commands/setup-preflight.js
 import { createHash as createHash2 } from "crypto";
@@ -2245,11 +2463,11 @@ import { parse as parseYaml } from "yaml";
 import { createRequire } from "module";
 import { readFile as readFile7 } from "fs/promises";
 import { join as join5 } from "path";
-import { z as z27 } from "zod";
-var packageSchema = z27.object({
-  name: z27.string().optional(),
-  version: z27.string(),
-  peerDependencies: z27.record(z27.string(), z27.string()).optional()
+import { z as z30 } from "zod";
+var packageSchema = z30.object({
+  name: z30.string().optional(),
+  version: z30.string(),
+  peerDependencies: z30.record(z30.string(), z30.string()).optional()
 });
 async function readInstalledPackage(projectDir, name2) {
   const require2 = createRequire(join5(projectDir, "package.json"));
@@ -2267,7 +2485,7 @@ async function readInstalledPackage(projectDir, name2) {
 // ../cli/dist/commands/setup-preflight.js
 import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
 import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
-import { z as z28 } from "zod";
+import { z as z31 } from "zod";
 
 // ../cli/dist/commands/setup-process.js
 import { spawn } from "child_process";
@@ -2368,29 +2586,29 @@ async function setupVercelApi(cwd, endpoint, body, method, options) {
 }
 
 // ../cli/dist/commands/setup-preflight.js
-var manifestSchema = z28.object({
-  packageManager: z28.string().optional(),
-  engines: z28.object({ node: z28.string().optional() }).optional(),
-  dependencies: z28.record(z28.string(), z28.string()).optional(),
-  devDependencies: z28.record(z28.string(), z28.string()).optional(),
-  scripts: z28.record(z28.string(), z28.string()).optional(),
-  workspaces: z28.unknown().optional()
-});
-var vercelProjectSchema = z28.object({
-  id: z28.string(),
-  accountId: z28.string(),
-  name: z28.string(),
-  nodeVersion: z28.string().nullable().optional(),
-  rootDirectory: z28.string().nullable().optional(),
-  framework: z28.string().nullable().optional(),
-  installCommand: z28.string().nullable().optional(),
-  buildCommand: z28.string().nullable().optional(),
-  link: z28.object({
-    type: z28.string(),
-    repo: z28.string().optional(),
-    repoId: z28.union([z28.string(), z28.number()]).optional(),
-    org: z28.string().optional(),
-    productionBranch: z28.string().optional()
+var manifestSchema = z31.object({
+  packageManager: z31.string().optional(),
+  engines: z31.object({ node: z31.string().optional() }).optional(),
+  dependencies: z31.record(z31.string(), z31.string()).optional(),
+  devDependencies: z31.record(z31.string(), z31.string()).optional(),
+  scripts: z31.record(z31.string(), z31.string()).optional(),
+  workspaces: z31.unknown().optional()
+});
+var vercelProjectSchema = z31.object({
+  id: z31.string(),
+  accountId: z31.string(),
+  name: z31.string(),
+  nodeVersion: z31.string().nullable().optional(),
+  rootDirectory: z31.string().nullable().optional(),
+  framework: z31.string().nullable().optional(),
+  installCommand: z31.string().nullable().optional(),
+  buildCommand: z31.string().nullable().optional(),
+  link: z31.object({
+    type: z31.string(),
+    repo: z31.string().optional(),
+    repoId: z31.union([z31.string(), z31.number()]).optional(),
+    org: z31.string().optional(),
+    productionBranch: z31.string().optional()
   }).nullable().optional()
 });
 var exists = async (path) => access2(path).then(() => true, () => false);
@@ -2447,9 +2665,9 @@ async function inspectSetupLocalProject(projectDir) {
   const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
   if (lockfileRoot !== projectDirectory) {
     const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
-    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z28.object({ packages: z28.array(z28.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z28.union([
-      z28.array(z28.string()),
-      z28.object({ packages: z28.array(z28.string()) }).transform((value) => value.packages)
+    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z31.object({ packages: z31.array(z31.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z31.union([
+      z31.array(z31.string()),
+      z31.object({ packages: z31.array(z31.string()) }).transform((value) => value.packages)
     ]).parse(rootManifest.workspaces);
     const selected = relative2(lockfileRoot, projectDirectory).split(sep).join("/");
     if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
@@ -2463,11 +2681,11 @@ async function inspectSetupLocalProject(projectDir) {
       break;
   }
   const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
-  const npmLock = lockName === "package-lock.json" ? z28.object({
-    lockfileVersion: z28.number(),
-    packages: z28.record(z28.string(), z28.object({
-      version: z28.string().optional(),
-      peerDependencies: z28.record(z28.string(), z28.string()).optional()
+  const npmLock = lockName === "package-lock.json" ? z31.object({
+    lockfileVersion: z31.number(),
+    packages: z31.record(z31.string(), z31.object({
+      version: z31.string().optional(),
+      peerDependencies: z31.record(z31.string(), z31.string()).optional()
     })).optional()
   }).parse(JSON.parse(lockText)) : null;
   async function version2(name3) {
@@ -2522,8 +2740,12 @@ async function inspectSetupLocalProject(projectDir) {
       sourceConflicts.push("static_export");
     if (/\bbasePath\s*:/u.test(source))
       sourceConflicts.push("base_path");
+    if (/\bloaderFile\s*:|\bloader\s*:\s*['"](?:custom|imgix|cloudinary|akamai)['"]/u.test(source))
+      sourceConflicts.push(`inspect_image_loader:${file}`);
+    if (/\bmaximumRedirects\s*:\s*[1-9]/u.test(source))
+      sourceConflicts.push(`inspect_image_redirects:${file}`);
   }
-  if (sourceConflicts.length)
+  if (sourceConflicts.some((conflict) => conflict === "static_export" || conflict === "base_path"))
     fail("unsupported_server_configuration", "Resolve static export/basePath configuration explicitly; Siteplane requires its server-side admin and revalidation handlers.");
   for (const name3 of [
     "middleware.ts",
@@ -2535,8 +2757,14 @@ async function inspectSetupLocalProject(projectDir) {
     "src/proxy.ts",
     "src/proxy.js"
   ]) {
-    if (await exists(join6(projectDirectory, name3)))
+    if (await exists(join6(projectDirectory, name3))) {
       sourceConflicts.push(`inspect_routing:${name3}`);
+      if (await readlink(join6(projectDirectory, name3)).catch(() => null))
+        continue;
+      const policySource = await readFile8(join6(projectDirectory, name3), "utf8");
+      if (/Content-Security-Policy|img-src|default-src/iu.test(policySource))
+        sourceConflicts.push(`inspect_image_csp:${name3}`);
+    }
   }
   async function inspectSource(directory) {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
@@ -2550,6 +2778,8 @@ async function inspectSetupLocalProject(projectDir) {
       if (!/\.[cm]?[jt]sx?$/u.test(entry.name))
         continue;
       const source = await readFile8(path, "utf8");
+      if (/Content-Security-Policy|img-src|default-src/iu.test(source))
+        sourceConflicts.push(`inspect_image_csp:${relative2(projectDirectory, path)}`);
       if (/from\s*["']next\/image["']/u.test(source))
         sourceConflicts.push(`inspect_image_policy:${relative2(projectDirectory, path)}`);
       if (/\b(?:Cookiebot|OneTrust|cookieyes|consentManager|cookieConsent)\b/iu.test(source))
@@ -2595,9 +2825,9 @@ async function setupPreflightCommand(input) {
       linkDirectory = dirname6(linkDirectory);
     if (!await exists(join6(linkDirectory, ".vercel/project.json")))
       fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
-    const linked = z28.object({
-      projectId: z28.string().regex(/^prj_[A-Za-z0-9]+$/u),
-      orgId: z28.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
+    const linked = z31.object({
+      projectId: z31.string().regex(/^prj_[A-Za-z0-9]+$/u),
+      orgId: z31.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
     }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
     const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
     if (project.id !== linked.projectId || project.accountId !== linked.orgId)
@@ -2611,11 +2841,11 @@ async function setupPreflightCommand(input) {
       fail("vercel_production_branch_conflict", "The local branch differs from the bound Vercel Production branch.");
     if (project.link?.repo && project.link.org && !local.git.remote?.replace(/\.git$/u, "").endsWith(`${project.link.org}/${project.link.repo}`))
       fail("vercel_git_conflict", "The local origin repository differs from the Vercel Git connection.");
-    const env = z28.object({
-      envs: z28.array(z28.object({
-        key: z28.string(),
-        value: z28.string().optional(),
-        target: z28.array(z28.string()).optional()
+    const env = z31.object({
+      envs: z31.array(z31.object({
+        key: z31.string(),
+        value: z31.string().optional(),
+        target: z31.array(z31.string()).optional()
       }))
     }).parse(await setupVercelApi(linkDirectory, `/v10/projects/${linked.projectId}/env?teamId=${linked.orgId}`));
     const corepack = env.envs.some((item) => item.key === "ENABLE_EXPERIMENTAL_COREPACK" && item.value === "1" && item.target?.includes("production"));
@@ -2677,29 +2907,26 @@ function safeGitRemote(value) {
 }
 
 // ../cli/dist/commands/init.js
-var siteSetupBootstrapDataSchema = z29.object({
-  credentialPurpose: z29.literal("site_setup"),
-  apiBaseUrl: z29.string().url(),
-  siteId: z29.string().uuid(),
-  publicSiteKeyId: z29.string().uuid(),
-  publicSiteKey: z29.string().trim().min(1),
-  accessToken: z29.string().trim().min(1),
-  siteRevalidationSecret: z29.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  runId: z29.string().uuid(),
-  packages: z29.object({
-    siteplane: z29.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u),
-    runtimeNext: z29.string().regex(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u)
-  }).strict()
+var siteSetupBootstrapDataSchema = z32.object({
+  credentialPurpose: z32.literal("site_setup"),
+  apiBaseUrl: z32.string().url(),
+  siteId: z32.string().uuid(),
+  publicSiteKeyId: z32.string().uuid(),
+  publicSiteKey: z32.string().trim().min(1),
+  accessToken: z32.string().trim().min(1),
+  siteRevalidationSecret: z32.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  runId: z32.string().uuid(),
+  packages: siteSetupPackagesSchema
 }).strict();
-var featureBootstrapDataSchema = z29.object({
-  credentialPurpose: z29.enum(["analytics", "booking"]),
-  apiBaseUrl: z29.string().url(),
-  siteId: z29.string().uuid(),
-  accessToken: z29.string().trim().min(1)
+var featureBootstrapDataSchema = z32.object({
+  credentialPurpose: z32.enum(["analytics", "booking"]),
+  apiBaseUrl: z32.string().url(),
+  siteId: z32.string().uuid(),
+  accessToken: z32.string().trim().min(1)
 }).strict();
-var bootstrapResponseSchema = z29.object({
-  ok: z29.literal(true),
-  data: z29.discriminatedUnion("credentialPurpose", [
+var bootstrapResponseSchema = z32.object({
+  ok: z32.literal(true),
+  data: z32.discriminatedUnion("credentialPurpose", [
     siteSetupBootstrapDataSchema,
     featureBootstrapDataSchema
   ])
@@ -2750,7 +2977,7 @@ async function collectSourceFiles(directory) {
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile9 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z30 } from "zod";
+import { z as z33 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
@@ -3417,30 +3644,32 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z30.object({
-  code: z30.string().trim().min(1),
-  message: z30.string().trim().min(1)
+var safeErrorSchema = z33.object({
+  code: z33.string().trim().min(1),
+  message: z33.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z30.object({ ok: z30.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z30.object({ task: siteSetupTaskSchema }).strict();
-var contextResponseSchema = z30.object({ ok: z30.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z30.object({
-  status: z30.enum(["applied", "ready_for_review"]),
-  runId: z30.string().uuid().optional(),
-  contractVersionId: z30.string().uuid().optional(),
-  fieldContractHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z30.number().int().nonnegative().optional(),
-  routeCount: z30.number().int().nonnegative().optional()
+var errorResponseSchema2 = z33.object({ ok: z33.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z33.object({
+  task: siteSetupTaskSchema.refine((task) => task.run !== null)
+}).strict();
+var contextResponseSchema = z33.object({ ok: z33.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z33.object({
+  status: z33.enum(["applied", "ready_for_review"]),
+  runId: z33.string().uuid().optional(),
+  contractVersionId: z33.string().uuid().optional(),
+  fieldContractHash: z33.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z33.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z33.number().int().nonnegative().optional(),
+  routeCount: z33.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z30.object({ ok: z30.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z30.object({
-  status: z30.literal("ready_for_review"),
-  runId: z30.string().uuid().optional(),
-  deploymentOrigin: z30.string().url().optional(),
-  deploymentRevision: z30.string().optional()
+var applyResponseSchema = z33.object({ ok: z33.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z33.object({
+  status: z33.literal("ready_for_review"),
+  runId: z33.string().uuid().optional(),
+  deploymentOrigin: z33.string().url().optional(),
+  deploymentRevision: z33.string().optional()
 }).strict();
-var verifyResponseSchema = z30.object({ ok: z30.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z33.object({ ok: z33.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -3543,8 +3772,8 @@ import ts3 from "typescript";
 import { randomUUID as randomUUID5 } from "crypto";
 import { lstat as lstat3, mkdir as mkdir7, open as open4, readFile as readFile11, rm as rm4, rmdir } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { z as z31 } from "zod";
-var ownerSchema = z31.object({ pid: z31.number().int().positive(), nonce: z31.string().uuid() }).strict();
+import { z as z34 } from "zod";
+var ownerSchema = z34.object({ pid: z34.number().int().positive(), nonce: z34.string().uuid() }).strict();
 
 // ../cli/dist/config/build-provenance.js
 import { createHash as createHash3 } from "crypto";
@@ -3552,23 +3781,23 @@ import { execFile as execFile3 } from "child_process";
 import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join10, relative as relative6, resolve as resolve3, sep as sep3 } from "path";
 import { isDeepStrictEqual, promisify as promisify3 } from "util";
-import { z as z32 } from "zod";
+import { z as z35 } from "zod";
 var execute = promisify3(execFile3);
 var name = ".siteplane/build-source.json";
-var oid = z32.string().regex(/^[0-9a-f]{40}$/u);
-var entrySchema = z32.object({
-  path: z32.string().min(1).max(4096),
-  mode: z32.enum(["100644", "100755", "120000"]),
+var oid = z35.string().regex(/^[0-9a-f]{40}$/u);
+var entrySchema = z35.object({
+  path: z35.string().min(1).max(4096),
+  mode: z35.enum(["100644", "100755", "120000"]),
   oid
 }).strict();
-var schema = z32.object({
-  version: z32.literal(2),
+var schema = z35.object({
+  version: z35.literal(2),
   revision: oid,
-  commit: z32.string().min(1).max(1048576),
-  entries: z32.array(entrySchema).min(1).max(1e5),
-  providerConfigurations: z32.array(z32.object({
-    path: z32.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
-    source: z32.string().max(1048576)
+  commit: z35.string().min(1).max(1048576),
+  entries: z35.array(entrySchema).min(1).max(1e5),
+  providerConfigurations: z35.array(z35.object({
+    path: z35.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
+    source: z35.string().max(1048576)
   }).strict()).max(1e3)
 }).strict();
 var gitHash = (type, content) => createHash3("sha1").update(`${type} ${content.length}\0`).update(content).digest("hex");
@@ -3668,7 +3897,7 @@ async function readBuildProvenance(projectDirectory) {
       const original = configurations.get(entry.path);
       if (contents && original && entry.mode !== "120000") {
         try {
-          const object = z32.record(z32.string(), z32.unknown());
+          const object = z35.record(z35.string(), z35.unknown());
           const actual = object.parse(JSON.parse(contents.toString("utf8")));
           const expected = object.parse(JSON.parse(original));
           if (!Object.hasOwn(expected, "version") && actual.version === 2)
@@ -3722,37 +3951,38 @@ import { createHash as createHash4, randomBytes, randomUUID as randomUUID6 } fro
 import { access as access5, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join11 } from "path";
-import { z as z33 } from "zod";
-var envSchema = z33.object({
-  id: z33.string(),
-  key: z33.string(),
-  target: z33.array(z33.string()),
-  type: z33.string(),
-  comment: z33.string().optional(),
-  updatedAt: z33.number().optional()
-});
-var deploymentSchema = z33.object({
-  id: z33.string(),
-  projectId: z33.string(),
-  ownerId: z33.string().optional(),
-  target: z33.string().nullable(),
-  readyState: z33.string(),
-  createdAt: z33.number(),
-  url: z33.string(),
-  meta: z33.record(z33.string(), z33.unknown()).optional(),
-  gitSource: z33.object({ sha: z33.string().optional() }).nullable().optional()
-});
-var buildProofSchema = z33.object({
-  node: z33.string(),
-  packageManager: z33.enum(["npm", "pnpm"]),
-  packageManagerVersion: z33.string(),
-  lockfileHash: z33.string(),
-  revision: z33.string(),
-  fieldContractHash: z33.string(),
-  siteplane: z33.string(),
-  runtimeNext: z33.string(),
-  next: z33.string(),
-  react: z33.string()
+import { z as z36 } from "zod";
+var envSchema = z36.object({
+  id: z36.string(),
+  key: z36.string(),
+  target: z36.array(z36.string()),
+  type: z36.string(),
+  comment: z36.string().optional(),
+  updatedAt: z36.number().optional()
+});
+var deploymentSchema = z36.object({
+  id: z36.string(),
+  projectId: z36.string(),
+  ownerId: z36.string().optional(),
+  target: z36.string().nullable(),
+  readyState: z36.string(),
+  createdAt: z36.number(),
+  url: z36.string(),
+  meta: z36.record(z36.string(), z36.unknown()).optional(),
+  gitSource: z36.object({ sha: z36.string().optional() }).nullable().optional()
+});
+var buildProofSchema = z36.object({
+  node: z36.string(),
+  packageManager: z36.enum(["npm", "pnpm"]),
+  packageManagerVersion: z36.string(),
+  lockfileHash: z36.string(),
+  revision: z36.string(),
+  fieldContractHash: z36.string(),
+  siteplane: z36.string(),
+  runtimeNext: z36.string(),
+  analytics: z36.string().optional(),
+  next: z36.string(),
+  react: z36.string()
 }).strict();
 var defaults = {
   preflight: setupPreflightCommand,
@@ -3762,6 +3992,7 @@ var defaults = {
   verify: siteSetupVerifyCommand,
   post: postSiteSetup,
   writeBuildProvenance,
+  analyticsPublicKey: analyticsPublicKeyCommand,
   now: Date.now,
   pause: (milliseconds) => new Promise((resolve5) => setTimeout(resolve5, milliseconds))
 };
@@ -3836,11 +4067,17 @@ async function withSiteplane(nextConfig, options = {}) {
       buildRevision,
       scan.fieldContractHash
     );
+  const hasImages = scan.contract.fields.some(
+    (field) => field.fieldType === "image"
+  );
+  const imageOrigin = hasImages ? readImageWebsiteOrigin() : null;
   return {
     ...nextConfig,
+    ...imageOrigin ? { images: prepareImagePatterns(nextConfig.images, imageOrigin) } : {},
     headers: async () => frameHeaders(
       await nextConfig.headers?.() ?? [],
-      new URL(config.apiBaseUrl).origin
+      new URL(config.apiBaseUrl).origin,
+      imageOrigin
     ),
     env: {
       ...nextConfig.env ?? {},
@@ -3861,7 +4098,7 @@ async function readGitRevision2(projectDir) {
     return "";
   }
 }
-function frameHeaders(rules, adminOrigin) {
+function frameHeaders(rules, adminOrigin, imageOrigin) {
   const policy = `frame-ancestors 'self' ${adminOrigin}`;
   const prepared = rules.map((rule) => ({
     ...rule,
@@ -3880,9 +4117,10 @@ function frameHeaders(rules, adminOrigin) {
           "frame_policy_conflict",
           "Keep the existing CSP directives and explicitly allow only the canonical Siteplane admin origin in frame-ancestors."
         );
+      const value = ancestors ? header.value : `${header.value.replace(/;\s*$/u, "")}; ${policy}`;
       return {
         ...header,
-        value: ancestors ? header.value : `${header.value.replace(/;\s*$/u, "")}; ${policy}`
+        value: imageOrigin ? prepareImageCsp(value, imageOrigin) : value
       };
     })
   }));
@@ -3894,13 +4132,98 @@ function frameHeaders(rules, adminOrigin) {
     ...prepared
   ];
 }
+var managedImageOrigin = "https://siteplane.io";
+function readImageWebsiteOrigin() {
+  try {
+    const value = process.env.SITEPLANE_SITE_ORIGIN;
+    const url = new URL(value ?? "");
+    if (url.protocol !== "https:" || url.username || url.password || url.port || url.pathname !== "/" || url.search || url.hash || !url.hostname.includes(".") || /(?:^|\.)(?:localhost|local|internal)$/iu.test(url.hostname) || /^[\d.]+$/u.test(url.hostname) || url.hostname.includes(":"))
+      throw new Error("Invalid image origin");
+    return url.origin;
+  } catch {
+    throw new SiteplaneNextContractError(
+      "image_origin_missing",
+      "Image fields require SITEPLANE_SITE_ORIGIN to be the exact public HTTPS website origin. setup deploy sets it from the verified provider domain; use that same origin for local builds. Never substitute a wildcard or private host."
+    );
+  }
+}
+function prepareImagePatterns(images, websiteOrigin) {
+  if (images?.loaderFile || images?.loader && images.loader !== "default")
+    throw new SiteplaneNextContractError(
+      "image_policy_conflict",
+      "The website uses a custom image loader. Reconcile its handling of Siteplane and repository image URLs while preserving existing images; do not bypass optimization globally."
+    );
+  if (images?.maximumRedirects !== void 0 && images.maximumRedirects !== 0)
+    throw new SiteplaneNextContractError(
+      "image_policy_conflict",
+      "The website explicitly follows image redirects. Resolve redirecting sources before setting maximumRedirects to 0; Siteplane image destinations must be fetched directly."
+    );
+  const remotePatterns = [...images?.remotePatterns ?? []];
+  for (const [origin, pathname] of [
+    [managedImageOrigin, "/api/assets/*/content"],
+    [websiteOrigin, "/siteplane-assets/**"]
+  ]) {
+    const pattern = {
+      protocol: "https",
+      hostname: new URL(origin).hostname,
+      port: "",
+      pathname,
+      search: ""
+    };
+    if (!remotePatterns.some(
+      (existing) => existing.protocol === pattern.protocol && existing.hostname === pattern.hostname && existing.port === "" && existing.pathname === pathname && existing.search === ""
+    ))
+      remotePatterns.push(pattern);
+  }
+  const localPatterns = images?.localPatterns ? [...images.localPatterns] : void 0;
+  if (localPatterns && !localPatterns.some(
+    (pattern) => pattern.pathname === "/siteplane-assets/**" && pattern.search === ""
+  ))
+    localPatterns.push({ pathname: "/siteplane-assets/**", search: "" });
+  return {
+    ...images,
+    remotePatterns,
+    ...localPatterns ? { localPatterns } : {},
+    maximumRedirects: 0
+  };
+}
+function prepareImageCsp(policy, websiteOrigin) {
+  if (policy.includes(","))
+    throw new SiteplaneNextContractError(
+      "image_policy_conflict",
+      "Split combined CSP policies into separate header rules before image preparation; preserve every existing directive."
+    );
+  const directives = policy.split(";").map((part) => part.trim()).filter(Boolean);
+  const find = (name2) => directives.map((part, index) => ({ index, tokens: part.split(/\s+/u) })).filter((part) => part.tokens[0]?.toLowerCase() === name2);
+  const image = find("img-src"), defaults2 = find("default-src");
+  if (image.length > 1 || defaults2.length > 1)
+    throw new SiteplaneNextContractError(
+      "image_policy_conflict",
+      "Remove ambiguous duplicate img-src/default-src directives before image preparation without changing unrelated policies."
+    );
+  const existing = image[0] ?? defaults2[0];
+  if (!existing) return policy;
+  const sources = existing.tokens.slice(1).filter((source) => source !== "'none'");
+  for (const source of [
+    `${managedImageOrigin}/api/assets/`,
+    `${websiteOrigin}/siteplane-assets/`,
+    `${websiteOrigin}/_next/image`
+  ]) {
+    if (!sources.includes(source)) sources.push(source);
+  }
+  const value = `img-src ${sources.join(" ")}`;
+  if (image[0]) directives[image[0].index] = value;
+  else directives.push(value);
+  return directives.join("; ");
+}
 async function emitBuildProof(projectDir, packages, revision, fieldContractHash) {
   const [cli, runtime, next, react] = await Promise.all(
     ["siteplane", "@siteplane/runtime-next", "next", "react"].map(
       (name2) => readInstalledPackage(projectDir, name2)
     )
   );
-  if (cli.version !== packages.siteplane || runtime.version !== packages.runtimeNext)
+  const analytics = packages.analytics ? await readInstalledPackage(projectDir, "@siteplane/analytics") : void 0;
+  if (analytics?.version !== packages.analytics || cli.version !== packages.siteplane || runtime.version !== packages.runtimeNext)
     throw new SiteplaneNextContractError(
       "build_identity_missing",
       "The provider installed different Siteplane package versions than the task requires."
@@ -3937,7 +4260,7 @@ async function emitBuildProof(projectDir, packages, revision, fieldContractHash)
       "The provider build is missing the selected canonical lockfile."
     );
   console.info(
-    `SITEPLANE_BUILD_PROOF=${JSON.stringify({ node: process.versions.node, packageManager, packageManagerVersion, lockfileHash: `sha256:${createHash5("sha256").update(lock).digest("hex")}`, revision, fieldContractHash, siteplane: cli.version, runtimeNext: runtime.version, next: next.version, react: react.version })}`
+    `SITEPLANE_BUILD_PROOF=${JSON.stringify({ node: process.versions.node, packageManager, packageManagerVersion, lockfileHash: `sha256:${createHash5("sha256").update(lock).digest("hex")}`, revision, fieldContractHash, siteplane: cli.version, runtimeNext: runtime.version, ...analytics ? { analytics: analytics.version } : {}, next: next.version, react: react.version })}`
   );
 }
 export {