siteplane 0.1.49 → 0.1.50

package/dist/bin/siteplane.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/bin/run-siteplane.ts
-import { randomUUID as randomUUID7 } from "crypto";
-import { access as access6, readFile as readFile13 } from "fs/promises";
-import { join as join12, resolve as resolve4 } from "path";
+import { randomUUID as randomUUID8 } from "crypto";
+import { access as access7, readFile as readFile13 } from "fs/promises";
+import { join as join13, resolve as resolve4 } from "path";
 
 // ../cli/dist/analytics/manifest.js
 import { mkdir, readFile, writeFile } from "fs/promises";
@@ -11,7 +11,7 @@ import { dirname } from "path";
 
 // ../shared/dist/actors.js
 import { z } from "zod";
-var ACTOR_TYPES = ["workspace_member", "site_member", "agent", "system"];
+var ACTOR_TYPES = ["workspace_member", "site_member", "agent", "setup_guest", "system"];
 var actorTypeSchema = z.enum(ACTOR_TYPES);
 
 // ../shared/dist/analytics-defaults.js
@@ -1632,7 +1632,7 @@ var siteSetupTaskSchema = z16.object({
   progress: siteSetupTaskProgressSchema.nullable(),
   deployment: setupDeploymentRecordSchema.nullable(),
   revalidationGeneration: z16.number().int().positive(),
-  assignment: z16.literal("owned"),
+  assignment: z16.enum(["owned", "provisional", "claimed"]),
   deadline: z16.string().datetime().nullable(),
   userInstructions: z16.object({
     text: siteSetupOwnerEditabilityNoteSchema,
@@ -2306,6 +2306,17 @@ var checkSetupAssetTargetInputSchema = z25.object({
   intent: z25.enum(["start", "poll"])
 }).strict();
 
+// ../shared/dist/setup-installation.js
+import { z as z26 } from "zod";
+var setupInstallationRequestSchema = z26.object({
+  modules: siteSetupModulesSchema,
+  ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema,
+  provider: z26.object({
+    projectId: z26.string().min(1).max(200),
+    teamId: z26.string().min(1).max(200)
+  }).strict()
+}).strict();
+
 // ../cli/dist/analytics/manifest.js
 async function readAnalyticsManifestFile(manifestPath) {
   return validateAnalyticsManifestInput(JSON.parse(await readFile(manifestPath, "utf8")));
@@ -3130,16 +3141,16 @@ async function analyticsReadinessCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/public-key.js
-import { z as z26 } from "zod";
-var responseSchema = z26.object({
-  ok: z26.literal(true),
-  data: z26.object({
-    rawPublicKey: z26.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+import { z as z27 } from "zod";
+var responseSchema = z27.object({
+  ok: z27.literal(true),
+  data: z27.object({
+    rawPublicKey: z27.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
   })
 });
-var errorResponseSchema = z26.object({
-  error: z26.object({
-    code: z26.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+var errorResponseSchema = z27.object({
+  error: z27.object({
+    code: z27.string().regex(/^[a-z][a-z0-9_.-]+$/u)
   })
 });
 async function analyticsPublicKeyCommand(input) {
@@ -3161,13 +3172,13 @@ async function analyticsPublicKeyCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/prepare.js
-import { z as z27 } from "zod";
-var resultSchema = z27.object({
-  ok: z27.literal(true),
-  data: z27.object({
-    rawPublicKey: z27.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
-    generation: z27.number().int().positive(),
-    status: z27.enum([
+import { z as z28 } from "zod";
+var resultSchema = z28.object({
+  ok: z28.literal(true),
+  data: z28.object({
+    rawPublicKey: z28.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
+    generation: z28.number().int().positive(),
+    status: z28.enum([
       "setup_started",
       "test_mode",
       "active",
@@ -3177,8 +3188,8 @@ var resultSchema = z27.object({
     ])
   }).strict()
 }).strict();
-var errorSchema = z27.object({
-  error: z27.object({ code: z27.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
+var errorSchema = z28.object({
+  error: z28.object({ code: z28.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
 });
 async function analyticsPrepareCommand(input) {
   const response = await (input.fetchImpl ?? fetch)(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/prepare`, {
@@ -3398,19 +3409,19 @@ async function bookingTestCommand(input) {
 import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
 import { join as join3 } from "path";
-import { z as z28 } from "zod";
-var siteplaneProjectConfigSchema = z28.object({
-  version: z28.literal(2),
-  apiBaseUrl: z28.string().url(),
-  siteId: z28.string().uuid(),
-  publicSiteKeyId: z28.string().uuid(),
-  publicSiteKey: z28.string().trim().min(1),
-  runId: z28.string().uuid(),
-  appDirectory: z28.string().min(1),
-  taskContractVersion: z28.literal("siteplane.setup-task.v2"),
-  adminProtocolVersion: z28.literal(2),
+import { z as z29 } from "zod";
+var siteplaneProjectConfigSchema = z29.object({
+  version: z29.literal(2),
+  apiBaseUrl: z29.string().url(),
+  siteId: z29.string().uuid(),
+  publicSiteKeyId: z29.string().uuid(),
+  publicSiteKey: z29.string().trim().min(1),
+  runId: z29.string().uuid(),
+  appDirectory: z29.string().min(1),
+  taskContractVersion: z29.literal("siteplane.setup-task.v2"),
+  adminProtocolVersion: z29.literal(2),
   packages: siteSetupPackagesSchema,
-  fieldContractHash: z28.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+  fieldContractHash: z29.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectPackageJson(projectDir) {
   return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
@@ -3470,15 +3481,27 @@ import { randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
 import { dirname as dirname5, join as join4, relative } from "path";
 import { promisify } from "util";
-import { z as z29 } from "zod";
-var siteplaneCredentialsSchema = z29.object({
-  accessToken: z29.string().trim().min(1),
-  siteRevalidationSecret: z29.string().trim().min(1),
-  adminSession: z29.object({
-    secret: z29.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-    generation: z29.string().uuid()
+import { z as z30 } from "zod";
+var localSetupInstallationSchema = z30.object({
+  key: z30.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  idempotencyKey: z30.string().uuid(),
+  apiBaseUrl: z30.string().url(),
+  request: setupInstallationRequestSchema,
+  bootstrapAcknowledged: z30.boolean()
+}).strict();
+var siteplaneCredentialsSchema = z30.object({
+  accessToken: z30.string().trim().min(1),
+  siteRevalidationSecret: z30.string().trim().min(1),
+  installation: localSetupInstallationSchema.optional(),
+  adminSession: z30.object({
+    secret: z30.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    generation: z30.string().uuid()
   }).strict().optional()
 }).strict();
+var localSetupCredentialsSchema = z30.union([
+  siteplaneCredentialsSchema,
+  z30.object({ installation: localSetupInstallationSchema }).strict()
+]);
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
   const path = join4(projectDir, ".siteplane/credentials.json");
   await assertCredentialFilesystemSafe(projectDir);
@@ -3514,15 +3537,25 @@ async function assertCredentialFilesystemSafe(projectDir) {
   }
 }
 async function writeLocalCredentials(projectDir, credentials, options = {}) {
+  return writeLocalSetupCredentials(projectDir, siteplaneCredentialsSchema.parse(credentials), options);
+}
+async function writeLocalSetupCredentials(projectDir, credentials, options = {}) {
   const path = await assertLocalCredentialsPathSafe(projectDir, options);
-  const parsed = siteplaneCredentialsSchema.parse(credentials);
+  const parsed = localSetupCredentialsSchema.parse(credentials);
   await mkdir5(dirname5(path), { recursive: true, mode: 448 });
   await writeCredentialsAtomically(path, parsed);
   return path;
 }
 async function readLocalCredentials(projectDir) {
+  const credentials = await readLocalSetupCredentials(projectDir);
+  if (!("accessToken" in credentials)) {
+    throw new Error("setup_exchange_pending: Run siteplane setup start to finish the stored installation exchange.");
+  }
+  return credentials;
+}
+async function readLocalSetupCredentials(projectDir) {
   await assertCredentialFilesystemSafe(projectDir);
-  return siteplaneCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
+  return localSetupCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
 }
 async function writeCredentialsAtomically(path, credentials) {
   const temporaryPath = `${path}.${randomUUID3()}.tmp`;
@@ -3559,7 +3592,7 @@ async function gitPathMatches(projectDir, path, command) {
 // ../cli/dist/commands/init.js
 import { access as access3 } from "fs/promises";
 import { join as join7, relative as relative3 } from "path";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // ../cli/dist/commands/setup-preflight.js
 import { createHash as createHash2 } from "crypto";
@@ -3571,11 +3604,11 @@ import { parse as parseYaml } from "yaml";
 import { createRequire } from "module";
 import { readFile as readFile7 } from "fs/promises";
 import { join as join5 } from "path";
-import { z as z30 } from "zod";
-var packageSchema = z30.object({
-  name: z30.string().optional(),
-  version: z30.string(),
-  peerDependencies: z30.record(z30.string(), z30.string()).optional()
+import { z as z31 } from "zod";
+var packageSchema = z31.object({
+  name: z31.string().optional(),
+  version: z31.string(),
+  peerDependencies: z31.record(z31.string(), z31.string()).optional()
 });
 async function readInstalledPackage(projectDir, name2) {
   const require2 = createRequire(join5(projectDir, "package.json"));
@@ -3590,9 +3623,9 @@ async function readInstalledPackage(projectDir, name2) {
   throw new Error(`Install ${name2} with the canonical package manager before setup.`);
 }
 async function assertExactSetupPackages(projectDir, packages) {
-  const manifest = z30.object({
-    dependencies: z30.record(z30.string(), z30.string()).optional(),
-    devDependencies: z30.record(z30.string(), z30.string()).optional()
+  const manifest = z31.object({
+    dependencies: z31.record(z31.string(), z31.string()).optional(),
+    devDependencies: z31.record(z31.string(), z31.string()).optional()
   }).parse(JSON.parse(await readFile7(join5(projectDir, "package.json"), "utf8")));
   for (const [name2, version2] of [
     ["siteplane", packages.siteplane],
@@ -3609,7 +3642,7 @@ async function assertExactSetupPackages(projectDir, packages) {
 // ../cli/dist/commands/setup-preflight.js
 import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
 import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
-import { z as z31 } from "zod";
+import { z as z32 } from "zod";
 
 // ../cli/dist/commands/setup-process.js
 import { spawn } from "child_process";
@@ -3710,29 +3743,29 @@ async function setupVercelApi(cwd, endpoint, body, method, options) {
 }
 
 // ../cli/dist/commands/setup-preflight.js
-var manifestSchema = z31.object({
-  packageManager: z31.string().optional(),
-  engines: z31.object({ node: z31.string().optional() }).optional(),
-  dependencies: z31.record(z31.string(), z31.string()).optional(),
-  devDependencies: z31.record(z31.string(), z31.string()).optional(),
-  scripts: z31.record(z31.string(), z31.string()).optional(),
-  workspaces: z31.unknown().optional()
+var manifestSchema = z32.object({
+  packageManager: z32.string().optional(),
+  engines: z32.object({ node: z32.string().optional() }).optional(),
+  dependencies: z32.record(z32.string(), z32.string()).optional(),
+  devDependencies: z32.record(z32.string(), z32.string()).optional(),
+  scripts: z32.record(z32.string(), z32.string()).optional(),
+  workspaces: z32.unknown().optional()
 });
-var vercelProjectSchema = z31.object({
-  id: z31.string(),
-  accountId: z31.string(),
-  name: z31.string(),
-  nodeVersion: z31.string().nullable().optional(),
-  rootDirectory: z31.string().nullable().optional(),
-  framework: z31.string().nullable().optional(),
-  installCommand: z31.string().nullable().optional(),
-  buildCommand: z31.string().nullable().optional(),
-  link: z31.object({
-    type: z31.string(),
-    repo: z31.string().optional(),
-    repoId: z31.union([z31.string(), z31.number()]).optional(),
-    org: z31.string().optional(),
-    productionBranch: z31.string().optional()
+var vercelProjectSchema = z32.object({
+  id: z32.string(),
+  accountId: z32.string(),
+  name: z32.string(),
+  nodeVersion: z32.string().nullable().optional(),
+  rootDirectory: z32.string().nullable().optional(),
+  framework: z32.string().nullable().optional(),
+  installCommand: z32.string().nullable().optional(),
+  buildCommand: z32.string().nullable().optional(),
+  link: z32.object({
+    type: z32.string(),
+    repo: z32.string().optional(),
+    repoId: z32.union([z32.string(), z32.number()]).optional(),
+    org: z32.string().optional(),
+    productionBranch: z32.string().optional()
   }).nullable().optional()
 });
 var exists = async (path) => access2(path).then(() => true, () => false);
@@ -3789,9 +3822,9 @@ async function inspectSetupLocalProject(projectDir) {
   const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
   if (lockfileRoot !== projectDirectory) {
     const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
-    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z31.object({ packages: z31.array(z31.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z31.union([
-      z31.array(z31.string()),
-      z31.object({ packages: z31.array(z31.string()) }).transform((value) => value.packages)
+    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z32.object({ packages: z32.array(z32.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z32.union([
+      z32.array(z32.string()),
+      z32.object({ packages: z32.array(z32.string()) }).transform((value) => value.packages)
     ]).parse(rootManifest.workspaces);
     const selected = relative2(lockfileRoot, projectDirectory).split(sep).join("/");
     if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
@@ -3805,11 +3838,11 @@ async function inspectSetupLocalProject(projectDir) {
       break;
   }
   const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
-  const npmLock = lockName === "package-lock.json" ? z31.object({
-    lockfileVersion: z31.number(),
-    packages: z31.record(z31.string(), z31.object({
-      version: z31.string().optional(),
-      peerDependencies: z31.record(z31.string(), z31.string()).optional()
+  const npmLock = lockName === "package-lock.json" ? z32.object({
+    lockfileVersion: z32.number(),
+    packages: z32.record(z32.string(), z32.object({
+      version: z32.string().optional(),
+      peerDependencies: z32.record(z32.string(), z32.string()).optional()
     })).optional()
   }).parse(JSON.parse(lockText)) : null;
   async function version2(name3) {
@@ -3949,9 +3982,9 @@ async function setupPreflightCommand(input) {
       linkDirectory = dirname6(linkDirectory);
     if (!await exists(join6(linkDirectory, ".vercel/project.json")))
       fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
-    const linked = z31.object({
-      projectId: z31.string().regex(/^prj_[A-Za-z0-9]+$/u),
-      orgId: z31.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
+    const linked = z32.object({
+      projectId: z32.string().regex(/^prj_[A-Za-z0-9]+$/u),
+      orgId: z32.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
     }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
     const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
     if (project.id !== linked.projectId || project.accountId !== linked.orgId)
@@ -3965,11 +3998,11 @@ async function setupPreflightCommand(input) {
       fail("vercel_production_branch_conflict", "The local branch differs from the bound Vercel Production branch.");
     if (project.link?.repo && project.link.org && !local.git.remote?.replace(/\.git$/u, "").endsWith(`${project.link.org}/${project.link.repo}`))
       fail("vercel_git_conflict", "The local origin repository differs from the Vercel Git connection.");
-    const env = z31.object({
-      envs: z31.array(z31.object({
-        key: z31.string(),
-        value: z31.string().optional(),
-        target: z31.array(z31.string()).optional()
+    const env = z32.object({
+      envs: z32.array(z32.object({
+        key: z32.string(),
+        value: z32.string().optional(),
+        target: z32.array(z32.string()).optional()
       }))
     }).parse(await setupVercelApi(linkDirectory, `/v10/projects/${linked.projectId}/env?teamId=${linked.orgId}`));
     const corepack = env.envs.some((item) => item.key === "ENABLE_EXPERIMENTAL_COREPACK" && item.value === "1" && item.target?.includes("production"));
@@ -4059,26 +4092,26 @@ async function initCommand(input) {
     ]
   };
 }
-var siteSetupBootstrapDataSchema = z32.object({
-  credentialPurpose: z32.literal("site_setup"),
-  apiBaseUrl: z32.string().url(),
-  siteId: z32.string().uuid(),
-  publicSiteKeyId: z32.string().uuid(),
-  publicSiteKey: z32.string().trim().min(1),
-  accessToken: z32.string().trim().min(1),
-  siteRevalidationSecret: z32.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  runId: z32.string().uuid(),
+var siteSetupBootstrapDataSchema = z33.object({
+  credentialPurpose: z33.literal("site_setup"),
+  apiBaseUrl: z33.string().url(),
+  siteId: z33.string().uuid(),
+  publicSiteKeyId: z33.string().uuid(),
+  publicSiteKey: z33.string().trim().min(1),
+  accessToken: z33.string().trim().min(1),
+  siteRevalidationSecret: z33.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  runId: z33.string().uuid(),
   packages: siteSetupPackagesSchema
 }).strict();
-var featureBootstrapDataSchema = z32.object({
-  credentialPurpose: z32.enum(["analytics", "booking"]),
-  apiBaseUrl: z32.string().url(),
-  siteId: z32.string().uuid(),
-  accessToken: z32.string().trim().min(1)
+var featureBootstrapDataSchema = z33.object({
+  credentialPurpose: z33.enum(["analytics", "booking"]),
+  apiBaseUrl: z33.string().url(),
+  siteId: z33.string().uuid(),
+  accessToken: z33.string().trim().min(1)
 }).strict();
-var bootstrapResponseSchema = z32.object({
-  ok: z32.literal(true),
-  data: z32.discriminatedUnion("credentialPurpose", [
+var bootstrapResponseSchema = z33.object({
+  ok: z33.literal(true),
+  data: z33.discriminatedUnion("credentialPurpose", [
     siteSetupBootstrapDataSchema,
     featureBootstrapDataSchema
   ])
@@ -4115,15 +4148,16 @@ async function acknowledgeBootstrapResponse(input) {
     throw new Error("Siteplane setup acknowledgement failed.");
   }
 }
-async function persistSiteSetupBootstrap(input, bootstrap, appDirectory) {
+async function persistSiteSetupBootstrap(input, bootstrap, appDirectory, installation) {
   const previous = await access3(join7(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
   if (previous && (previous.siteId !== bootstrap.siteId || previous.runId !== bootstrap.runId || previous.publicSiteKeyId !== bootstrap.publicSiteKeyId || previous.publicSiteKey !== bootstrap.publicSiteKey))
     throw new Error("The grant does not match this local Siteplane run. Preserve this directory and choose the correct owner connection.");
-  const previousCredentials = previous ? await access3(join7(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalCredentials(input.projectDir), () => null) : null;
+  const previousCredentials = previous ? await access3(join7(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalSetupCredentials(input.projectDir), () => null) : null;
   const credentialsPath = await writeLocalCredentials(input.projectDir, {
-    ...previousCredentials?.adminSession ? { adminSession: previousCredentials.adminSession } : {},
+    ...previousCredentials && "adminSession" in previousCredentials && previousCredentials.adminSession ? { adminSession: previousCredentials.adminSession } : {},
     accessToken: bootstrap.accessToken,
-    siteRevalidationSecret: bootstrap.siteRevalidationSecret
+    siteRevalidationSecret: bootstrap.siteRevalidationSecret,
+    ...installation ?? previousCredentials?.installation ? { installation: installation ?? previousCredentials?.installation } : {}
   }, {
     ...input.isIgnoredFile ? { isIgnoredFile: input.isIgnoredFile } : {},
     ...input.isTrackedFile ? { isTrackedFile: input.isTrackedFile } : {}
@@ -4236,7 +4270,7 @@ async function collectSourceFiles(directory) {
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile9 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
@@ -4933,32 +4967,32 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z33.object({
-  code: z33.string().trim().min(1),
-  message: z33.string().trim().min(1)
+var safeErrorSchema = z34.object({
+  code: z34.string().trim().min(1),
+  message: z34.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z33.object({ ok: z33.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z33.object({
+var errorResponseSchema2 = z34.object({ ok: z34.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z34.object({
   task: siteSetupTaskSchema.refine((task) => task.run !== null)
 }).strict();
-var contextResponseSchema = z33.object({ ok: z33.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z33.object({
-  status: z33.enum(["applied", "ready_for_review"]),
-  runId: z33.string().uuid().optional(),
-  contractVersionId: z33.string().uuid().optional(),
-  fieldContractHash: z33.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z33.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z33.number().int().nonnegative().optional(),
-  routeCount: z33.number().int().nonnegative().optional()
+var contextResponseSchema = z34.object({ ok: z34.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z34.object({
+  status: z34.enum(["applied", "ready_for_review"]),
+  runId: z34.string().uuid().optional(),
+  contractVersionId: z34.string().uuid().optional(),
+  fieldContractHash: z34.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z34.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z34.number().int().nonnegative().optional(),
+  routeCount: z34.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z33.object({ ok: z33.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z33.object({
-  status: z33.literal("ready_for_review"),
-  runId: z33.string().uuid().optional(),
-  deploymentOrigin: z33.string().url().optional(),
-  deploymentRevision: z33.string().optional()
+var applyResponseSchema = z34.object({ ok: z34.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z34.object({
+  status: z34.literal("ready_for_review"),
+  runId: z34.string().uuid().optional(),
+  deploymentOrigin: z34.string().url().optional(),
+  deploymentRevision: z34.string().optional()
 }).strict();
-var verifyResponseSchema = z33.object({ ok: z33.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z34.object({ ok: z34.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -5122,21 +5156,154 @@ async function siteSetupActivityCommand(input) {
       message: "Choose inspecting, integrating, deploying, verifying or repairing."
     };
   const response = await postSiteSetup(input, "activity", activity.data);
-  const parsed = z33.object({
-    ok: z33.literal(true),
-    data: z33.object({ status: z33.enum(["recorded", "rate_limited"]) }).strict()
+  const parsed = z34.object({
+    ok: z34.literal(true),
+    data: z34.object({ status: z34.enum(["recorded", "rate_limited"]) }).strict()
   }).strict().safeParse(response.payload);
   return response.ok && parsed.success ? parsed.data.data : actionRequired(response.payload, "Setup activity could not be recorded.");
 }
 
+// ../cli/dist/commands/setup-start.js
+import { randomBytes, randomUUID as randomUUID4 } from "crypto";
+import { access as access4 } from "fs/promises";
+import { join as join9, relative as relative5 } from "path";
+import { z as z35 } from "zod";
+var bootstrapResponseSchema2 = z35.object({
+  ok: z35.literal(true),
+  data: siteSetupBootstrapDataSchema
+}).strict();
+async function setupStartCommand(input) {
+  await assertLocalCredentialsPathSafe(input.projectDir, input);
+  const [hasConfig, hasCredentials] = await Promise.all([
+    exists2(join9(input.projectDir, "siteplane.config.json")),
+    exists2(join9(input.projectDir, ".siteplane/credentials.json"))
+  ]);
+  if (hasConfig && !hasCredentials) {
+    throw new SetupFailure("local_credentials_missing", "This project has Siteplane configuration but no local credentials. Restore its credentials or explicitly start a new installation; public site identifiers cannot recover access.");
+  }
+  let credentials = hasCredentials ? await readLocalSetupCredentials(input.projectDir) : null;
+  const config = hasConfig ? await readProjectConfig(input.projectDir) : null;
+  const apiBaseUrl = new URL(input.apiBaseUrl).origin;
+  const previous = credentials?.installation;
+  if (config && new URL(config.apiBaseUrl).origin !== apiBaseUrl || previous && previous.apiBaseUrl !== apiBaseUrl) {
+    throw new SetupFailure("installation_origin_mismatch", "Use the API origin stored for this installation. Credentials are never transferred to another origin.");
+  }
+  if (previous && (input.modules && JSON.stringify(input.modules) !== JSON.stringify(previous.request.modules) || input.instructions !== void 0 && input.instructions !== previous.request.ownerEditabilityNote)) {
+    throw new SetupFailure("installation_request_conflict", "The stored installation has a different authorized request. Resume that request; module changes require explicit authorization in Siteplane.");
+  }
+  if (config && credentials && "accessToken" in credentials) {
+    if (previous && !previous.bootstrapAcknowledged)
+      await acknowledge(input, credentials);
+    return result("resumed", config.siteId, config.runId);
+  }
+  if (credentials && !previous) {
+    throw new SetupFailure("local_configuration_missing", "Restore the configuration belonging to these credentials. A new installation will not replace them.");
+  }
+  const preflight = await (input.preflight ?? setupPreflightCommand)({
+    projectDir: input.projectDir
+  });
+  if (preflight.status !== "ready")
+    throw new SetupFailure(preflight.code, preflight.message);
+  const request = setupInstallationRequestSchema.parse({
+    modules: input.modules ?? previous?.request.modules ?? ["editing"],
+    ownerEditabilityNote: input.instructions ?? previous?.request.ownerEditabilityNote ?? "",
+    provider: {
+      projectId: preflight.provider.projectId,
+      teamId: preflight.provider.teamId
+    }
+  });
+  if (previous && JSON.stringify(request) !== JSON.stringify(previous.request)) {
+    throw new SetupFailure("installation_request_conflict", "The local provider project or request changed. Resume from the original authorized project.");
+  }
+  const installation = previous ?? {
+    key: randomBytes(32).toString("base64url"),
+    idempotencyKey: randomUUID4(),
+    apiBaseUrl,
+    request,
+    bootstrapAcknowledged: false
+  };
+  if (!credentials) {
+    await writeLocalSetupCredentials(input.projectDir, { installation }, input);
+    credentials = await readLocalSetupCredentials(input.projectDir);
+    if (JSON.stringify(credentials.installation) !== JSON.stringify(installation)) {
+      throw new Error("The pending installation could not be verified.");
+    }
+  }
+  const payload = await installationRequest(input, installation, "provision");
+  const parsed = bootstrapResponseSchema2.parse(payload);
+  if (new URL(parsed.data.apiBaseUrl).origin !== apiBaseUrl) {
+    throw new SetupFailure("installation_origin_mismatch", "The setup response belongs to another API origin.");
+  }
+  await persistSiteSetupBootstrap(input, parsed.data, relative5(preflight.local.lockfileRoot, preflight.local.projectDirectory) || ".", installation);
+  await acknowledge(input, await readLocalSetupCredentials(input.projectDir));
+  return result("created", parsed.data.siteId, parsed.data.runId);
+}
+async function acknowledge(input, credentials) {
+  const installation = credentials.installation;
+  if (!installation || !("accessToken" in credentials))
+    throw new Error("Incomplete installation exchange.");
+  const payload = await installationRequest(input, installation, "acknowledge");
+  z35.object({
+    ok: z35.literal(true),
+    data: z35.object({ acknowledged: z35.literal(true) }).strict()
+  }).strict().parse(payload);
+  await writeLocalSetupCredentials(input.projectDir, {
+    ...credentials,
+    installation: { ...installation, bootstrapAcknowledged: true }
+  }, input);
+}
+async function installationRequest(input, installation, action) {
+  const response = await (input.fetcher ?? fetch)(`${installation.apiBaseUrl}/api/cli/setup/installations`, {
+    method: "POST",
+    redirect: "error",
+    signal: AbortSignal.timeout(2e4),
+    headers: {
+      authorization: `Bearer ${installation.key}`,
+      "content-type": "application/json",
+      "idempotency-key": installation.idempotencyKey
+    },
+    body: JSON.stringify({ action, request: installation.request })
+  });
+  const payload = await response.json();
+  if (!response.ok) {
+    const error = z35.object({
+      error: z35.object({
+        code: z35.string().regex(/^[a-z][a-z0-9_.]{0,100}$/u)
+      })
+    }).safeParse(payload);
+    throw new SetupFailure(error.success ? error.data.error.code : "setup_start_failed", "Siteplane could not complete this installation request. The saved local key and request are unchanged; retry after resolving the reported boundary.");
+  }
+  return payload;
+}
+function result(status, siteId, runId) {
+  return {
+    status,
+    siteId,
+    runId,
+    nextSteps: [
+      "Run npx siteplane setup context and follow its authorized task."
+    ]
+  };
+}
+async function exists2(path) {
+  try {
+    await access4(path);
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return false;
+    throw error;
+  }
+}
+
 // ../cli/dist/commands/setup-prepare.js
-import { access as access4, lstat as lstat2, mkdir as mkdir6, open as open3, readFile as readFile10, rename as rename3, rm as rm3 } from "fs/promises";
-import { randomUUID as randomUUID4 } from "crypto";
-import { dirname as dirname7, join as join9, relative as relative5, sep as sep2 } from "path";
+import { access as access5, lstat as lstat2, mkdir as mkdir6, open as open3, readFile as readFile10, rename as rename3, rm as rm3 } from "fs/promises";
+import { randomUUID as randomUUID5 } from "crypto";
+import { dirname as dirname7, join as join10, relative as relative6, sep as sep2 } from "path";
 import ts3 from "typescript";
-var exists2 = async (path) => access4(path).then(() => true, () => false);
+var exists3 = async (path) => access5(path).then(() => true, () => false);
 var importPath = (from, target) => {
-  const path = relative5(dirname7(from), target).split(sep2).join("/");
+  const path = relative6(dirname7(from), target).split(sep2).join("/");
   return path.startsWith(".") ? path : `./${path}`;
 };
 async function setupPrepareCommand(input) {
@@ -5158,18 +5325,18 @@ async function setupPrepareCommand(input) {
         message: "The verified setup is available for owner review; no preparation writes are needed."
       };
     const directory = preflight.local.projectDirectory;
-    const app = join9(directory, preflight.local.appDirectory);
-    const layouts = (await Promise.all(["layout.tsx", "layout.jsx", "layout.js"].map(async (name2) => await exists2(join9(app, name2)) ? join9(app, name2) : null))).filter((path) => path !== null);
+    const app = join10(directory, preflight.local.appDirectory);
+    const layouts = (await Promise.all(["layout.tsx", "layout.jsx", "layout.js"].map(async (name2) => await exists3(join10(app, name2)) ? join10(app, name2) : null))).filter((path) => path !== null);
     if (layouts.length !== 1)
       throw new SetupFailure("layout_integration_conflict", "Select one root layout and mount the Siteplane preview bridge there; preserve existing providers and rendering.");
     const layoutPath = layouts[0];
     const typed = layoutPath.endsWith(".tsx");
     const routeExtension = typed ? "ts" : "js";
-    const bridgePath = join9(app, "_siteplane", `bridge.${typed ? "tsx" : "jsx"}`);
+    const bridgePath = join10(app, "_siteplane", `bridge.${typed ? "tsx" : "jsx"}`);
     const portal = task.site.portalPath;
     if (!/^\/[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/u.test(portal))
       throw new SetupFailure("portal_route_conflict", "The selected portal path is not a supported single route segment.");
-    const adminRoot = join9(app, portal.slice(1));
+    const adminRoot = join10(app, portal.slice(1));
     for (const name2 of [
       "page.tsx",
       "page.jsx",
@@ -5177,12 +5344,12 @@ async function setupPrepareCommand(input) {
       "route.ts",
       "route.js"
     ]) {
-      if (await exists2(join9(adminRoot, name2)))
+      if (await exists3(join10(adminRoot, name2)))
         throw new SetupFailure("portal_route_conflict", "The selected admin path already belongs to the website. Choose an unused editor path in Siteplane.");
     }
-    const configPath = join9(directory, "siteplane.config.json");
-    const adminPath = join9(adminRoot, "[[...siteplane]]", `route.${routeExtension}`);
-    const revalidationPath = join9(app, "api/siteplane/revalidate", `route.${routeExtension}`);
+    const configPath = join10(directory, "siteplane.config.json");
+    const adminPath = join10(adminRoot, "[[...siteplane]]", `route.${routeExtension}`);
+    const revalidationPath = join10(app, "api/siteplane/revalidate", `route.${routeExtension}`);
     const commonOptions = `siteId: config.siteId,
     publicRuntimeKeyId: config.publicSiteKeyId,
     fieldContractHash: process.env.SITEPLANE_BUILD_FIELD_CONTRACT_HASH${typed ? "!" : ""},
@@ -5253,10 +5420,10 @@ export default function SiteplaneBridge() {
       files.set(layoutPath, `import SiteplaneBridge from "./_siteplane/bridge";
 ${layoutSource.slice(0, point)}<SiteplaneBridge />${layoutSource.slice(point)}`);
     }
-    const configs = (await Promise.all(["next.config.ts", "next.config.mjs", "next.config.js"].map(async (name2) => await exists2(join9(directory, name2)) ? join9(directory, name2) : null))).filter((path) => path !== null);
+    const configs = (await Promise.all(["next.config.ts", "next.config.mjs", "next.config.js"].map(async (name2) => await exists3(join10(directory, name2)) ? join10(directory, name2) : null))).filter((path) => path !== null);
     if (configs.length > 1)
       throw new SetupFailure("next_config_conflict", "Choose one existing Next.js configuration before setup.");
-    const nextPath = configs[0] ?? join9(directory, "next.config.mjs");
+    const nextPath = configs[0] ?? join10(directory, "next.config.mjs");
     const nextSource = configs.length ? await readFile10(nextPath, "utf8") : "export default {};\n";
     if (!/\bwithSiteplane\s*\(/u.test(nextSource)) {
       const ast = ts3.createSourceFile(nextPath, nextSource, ts3.ScriptTarget.Latest, true);
@@ -5267,7 +5434,7 @@ ${layoutSource.slice(0, point)}<SiteplaneBridge />${layoutSource.slice(point)}`)
       files.set(nextPath, `import { withSiteplane } from "siteplane/next";
 ${nextSource.slice(0, expression.getStart(ast))}withSiteplane(${expression.getText(ast)})${nextSource.slice(expression.end)}`);
     }
-    files.set(join9(directory, ".siteplane/setup-guide-v2.md"), `# Siteplane setup task v2
+    files.set(join10(directory, ".siteplane/setup-guide-v2.md"), `# Siteplane setup task v2
 
 ${task.goal}
 
@@ -5280,8 +5447,8 @@ Run setup context for the current user instructions and authorized modules. Keep
     for (const [path, content] of files) {
       if (path === layoutPath || path === nextPath)
         continue;
-      if (await exists2(path) && await readFile10(path, "utf8") !== content)
-        throw new SetupFailure("owned_file_conflict", `Preserve the existing ${relative5(directory, path)} and reconcile its integration with the current Siteplane guide before retrying.`);
+      if (await exists3(path) && await readFile10(path, "utf8") !== content)
+        throw new SetupFailure("owned_file_conflict", `Preserve the existing ${relative6(directory, path)} and reconcile its integration with the current Siteplane guide before retrying.`);
     }
     for (const path of files.keys())
       await assertSourcePath(directory, path);
@@ -5292,7 +5459,7 @@ Run setup context for the current user instructions and authorized modules. Keep
           return null;
         throw error;
       }));
-    const packageManifest = JSON.parse(await readFile10(join9(directory, "package.json"), "utf8"));
+    const packageManifest = JSON.parse(await readFile10(join10(directory, "package.json"), "utf8"));
     const pm = preflight.local.packageManager;
     const command = (args) => setupProcess("npx", ["--yes", `${pm.name}@${pm.version}`, ...args], {
       cwd: directory,
@@ -5347,7 +5514,7 @@ Run setup context for the current user instructions and authorized modules. Keep
         recursive: true,
         mode: path.includes(`${sep2}.siteplane${sep2}`) ? 448 : 493
       });
-      const temporary = `${path}.${randomUUID4()}.tmp`;
+      const temporary = `${path}.${randomUUID5()}.tmp`;
       const handle = await open3(temporary, "wx", path.includes(`${sep2}.siteplane${sep2}`) ? 384 : 420);
       try {
         await handle.writeFile(content, "utf8");
@@ -5366,7 +5533,7 @@ Run setup context for the current user instructions and authorized modules. Keep
         await handle.close().catch(() => void 0);
         await rm3(temporary, { force: true });
       }
-      written.push(relative5(directory, path));
+      written.push(relative6(directory, path));
     }
     return {
       status: "prepared",
@@ -5385,10 +5552,10 @@ Run setup context for the current user instructions and authorized modules. Keep
 }
 async function assertSourcePath(root, target) {
   let current = root;
-  for (const part of relative5(root, target).split(sep2)) {
+  for (const part of relative6(root, target).split(sep2)) {
     if (part === "..")
       throw new SetupFailure("unsafe_source_path", "The prepared file is outside the selected application.");
-    current = join9(current, part);
+    current = join10(current, part);
     const stat = await lstat2(current).catch((error) => {
       if (error.code === "ENOENT")
         return null;
@@ -5400,15 +5567,15 @@ async function assertSourcePath(root, target) {
 }
 
 // ../cli/dist/commands/setup-lock.js
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { lstat as lstat3, mkdir as mkdir7, open as open4, readFile as readFile11, rm as rm4, rmdir } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { z as z34 } from "zod";
-var ownerSchema = z34.object({ pid: z34.number().int().positive(), nonce: z34.string().uuid() }).strict();
+import { z as z36 } from "zod";
+var ownerSchema = z36.object({ pid: z36.number().int().positive(), nonce: z36.string().uuid() }).strict();
 async function withSetupLock(projectDir, work) {
   const gitPath = (await setupProcess("git", ["rev-parse", "--git-path", "siteplane-setup.lock"], { cwd: projectDir })).trim();
   const path = resolve2(projectDir, gitPath);
-  const owner = { pid: process.pid, nonce: randomUUID5() };
+  const owner = { pid: process.pid, nonce: randomUUID6() };
   for (let attempt = 0; ; attempt++) {
     try {
       const handle = await open4(path, "wx", 384);
@@ -5466,25 +5633,25 @@ function locked() {
 import { createHash as createHash3 } from "crypto";
 import { execFile as execFile3 } from "child_process";
 import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute2, join as join10, relative as relative6, resolve as resolve3, sep as sep3 } from "path";
+import { dirname as dirname8, isAbsolute as isAbsolute2, join as join11, relative as relative7, resolve as resolve3, sep as sep3 } from "path";
 import { isDeepStrictEqual, promisify as promisify3 } from "util";
-import { z as z35 } from "zod";
+import { z as z37 } from "zod";
 var execute = promisify3(execFile3);
 var name = ".siteplane/build-source.json";
-var oid = z35.string().regex(/^[0-9a-f]{40}$/u);
-var entrySchema = z35.object({
-  path: z35.string().min(1).max(4096),
-  mode: z35.enum(["100644", "100755", "120000"]),
+var oid = z37.string().regex(/^[0-9a-f]{40}$/u);
+var entrySchema = z37.object({
+  path: z37.string().min(1).max(4096),
+  mode: z37.enum(["100644", "100755", "120000"]),
   oid
 }).strict();
-var schema = z35.object({
-  version: z35.literal(2),
+var schema = z37.object({
+  version: z37.literal(2),
   revision: oid,
-  commit: z35.string().min(1).max(1048576),
-  entries: z35.array(entrySchema).min(1).max(1e5),
-  providerConfigurations: z35.array(z35.object({
-    path: z35.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
-    source: z35.string().max(1048576)
+  commit: z37.string().min(1).max(1048576),
+  entries: z37.array(entrySchema).min(1).max(1e5),
+  providerConfigurations: z37.array(z37.object({
+    path: z37.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
+    source: z37.string().max(1048576)
   }).strict()).max(1e3)
 }).strict();
 async function writeBuildProvenance(checkout, revision) {
@@ -5506,15 +5673,15 @@ async function writeBuildProvenance(checkout, revision) {
     if (entry.mode !== "120000")
       continue;
     const { readlink: readlink2 } = await import("fs/promises");
-    const path = join10(checkout, entry.path);
+    const path = join11(checkout, entry.path);
     const target2 = resolve3(dirname8(path), await readlink2(path));
-    const bound = relative6(checkout, target2);
+    const bound = relative7(checkout, target2);
     if (bound.startsWith("..") || isAbsolute2(bound))
       throw new Error("A tracked symbolic link escapes the committed upload; resolve that source boundary before deployment.");
   }
   const providerConfigurations = await Promise.all(entries.filter((entry) => /(?:^|\/)vercel\.json$/u.test(entry.path)).map(async (entry) => ({
     path: entry.path,
-    source: await readFile12(join10(checkout, entry.path), "utf8")
+    source: await readFile12(join11(checkout, entry.path), "utf8")
   })));
   const record = schema.parse({
     version: 2,
@@ -5523,48 +5690,48 @@ async function writeBuildProvenance(checkout, revision) {
     entries,
     providerConfigurations
   });
-  const target = join10(checkout, name);
+  const target = join11(checkout, name);
   await mkdir8(dirname8(target), { recursive: true, mode: 448 });
   await writeFile5(target, JSON.stringify(record), { flag: "wx", mode: 384 });
 }
 
 // ../cli/dist/commands/setup-deploy.js
-import { createHash as createHash4, randomBytes, randomUUID as randomUUID6 } from "crypto";
-import { access as access5, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
+import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as randomUUID7 } from "crypto";
+import { access as access6, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join11 } from "path";
-import { z as z36 } from "zod";
-var envSchema = z36.object({
-  id: z36.string(),
-  key: z36.string(),
-  target: z36.array(z36.string()),
-  type: z36.string(),
-  comment: z36.string().optional(),
-  updatedAt: z36.number().optional()
+import { join as join12 } from "path";
+import { z as z38 } from "zod";
+var envSchema = z38.object({
+  id: z38.string(),
+  key: z38.string(),
+  target: z38.array(z38.string()),
+  type: z38.string(),
+  comment: z38.string().optional(),
+  updatedAt: z38.number().optional()
 });
-var deploymentSchema = z36.object({
-  id: z36.string(),
-  projectId: z36.string(),
-  ownerId: z36.string().optional(),
-  target: z36.string().nullable(),
-  readyState: z36.string(),
-  createdAt: z36.number(),
-  url: z36.string(),
-  meta: z36.record(z36.string(), z36.unknown()).optional(),
-  gitSource: z36.object({ sha: z36.string().optional() }).nullable().optional()
+var deploymentSchema = z38.object({
+  id: z38.string(),
+  projectId: z38.string(),
+  ownerId: z38.string().optional(),
+  target: z38.string().nullable(),
+  readyState: z38.string(),
+  createdAt: z38.number(),
+  url: z38.string(),
+  meta: z38.record(z38.string(), z38.unknown()).optional(),
+  gitSource: z38.object({ sha: z38.string().optional() }).nullable().optional()
 });
-var buildProofSchema = z36.object({
-  node: z36.string(),
-  packageManager: z36.enum(["npm", "pnpm"]),
-  packageManagerVersion: z36.string(),
-  lockfileHash: z36.string(),
-  revision: z36.string(),
-  fieldContractHash: z36.string(),
-  siteplane: z36.string(),
-  runtimeNext: z36.string(),
-  analytics: z36.string().optional(),
-  next: z36.string(),
-  react: z36.string()
+var buildProofSchema = z38.object({
+  node: z38.string(),
+  packageManager: z38.enum(["npm", "pnpm"]),
+  packageManagerVersion: z38.string(),
+  lockfileHash: z38.string(),
+  revision: z38.string(),
+  fieldContractHash: z38.string(),
+  siteplane: z38.string(),
+  runtimeNext: z38.string(),
+  analytics: z38.string().optional(),
+  next: z38.string(),
+  react: z38.string()
 }).strict();
 var digest = (value) => `sha256:${createHash4("sha256").update(stableJsonStringify(value)).digest("hex")}`;
 function fail2(code, message) {
@@ -5585,7 +5752,7 @@ var defaults = {
 async function setupDeployCommand(input, deps = defaults) {
   let record = null;
   try {
-    if (!await access5(join11(input.projectDir, "siteplane.config.json")).then(() => true, () => false) || !await access5(join11(input.projectDir, ".siteplane/credentials.json")).then(() => true, () => false))
+    if (!await access6(join12(input.projectDir, "siteplane.config.json")).then(() => true, () => false) || !await access6(join12(input.projectDir, ".siteplane/credentials.json")).then(() => true, () => false))
       fail2("local_connection_missing", "Open this site's setup and choose Replace local connection, then initialize this folder with its new one-time grant.");
     await assertLocalCredentialsPathSafe(input.projectDir);
     const config = await readProjectConfig(input.projectDir);
@@ -5645,16 +5812,16 @@ async function setupDeployCommand(input, deps = defaults) {
     const scope = `teamId=${provider.teamId}`;
     const api = async (endpoint, body, method) => {
       remaining();
-      const result = await deps.api(local.projectDirectory, endpoint, body, method, { deadline: operationDeadline });
+      const result2 = await deps.api(local.projectDirectory, endpoint, body, method, { deadline: operationDeadline });
       remaining();
-      return result;
+      return result2;
     };
-    const domains = z36.object({
-      domains: z36.array(z36.object({
-        name: z36.string(),
-        verified: z36.boolean(),
-        redirect: z36.string().nullable().optional(),
-        gitBranch: z36.string().nullable().optional()
+    const domains = z38.object({
+      domains: z38.array(z38.object({
+        name: z38.string(),
+        verified: z38.boolean(),
+        redirect: z38.string().nullable().optional(),
+        gitBranch: z38.string().nullable().optional()
       }))
     }).parse(await api(`/v9/projects/${provider.projectId}/domains?${scope}`)).domains.filter((domain) => domain.verified && !domain.redirect && !domain.gitBranch);
     const origin = record?.origin ?? (domains.length === 1 ? `https://${domains[0].name}` : null);
@@ -5662,7 +5829,7 @@ async function setupDeployCommand(input, deps = defaults) {
       fail2("production_origin_ambiguous", "The linked project needs one verified canonical Production domain, or the existing setup domain must still belong to it.");
     if (record && (record.projectId !== provider.projectId || record.teamId !== provider.teamId))
       fail2("deployment_target_conflict", "This setup already belongs to a different provider project/team. Restore its original local link.");
-    const listEnv = async () => z36.object({ envs: z36.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
+    const listEnv = async () => z38.object({ envs: z38.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
     let env = await listEnv();
     const owned = (key) => {
       const matches2 = env.filter((item) => item.key === key && item.target.includes("production"));
@@ -5679,8 +5846,8 @@ async function setupDeployCommand(input, deps = defaults) {
       credentials = {
         ...credentials,
         adminSession: {
-          secret: randomBytes(32).toString("base64url"),
-          generation: randomUUID6()
+          secret: randomBytes2(32).toString("base64url"),
+          generation: randomUUID7()
         }
       };
       await writeLocalCredentials(input.projectDir, credentials);
@@ -5730,16 +5897,16 @@ async function setupDeployCommand(input, deps = defaults) {
       lockfileHash: local.lockfile.sha256
     });
     const save = async (next) => {
-      const result = await deps.post({ ...input, deadline: operationDeadline }, "deployment", {
+      const result2 = await deps.post({ ...input, deadline: operationDeadline }, "deployment", {
         action: "record",
         expectedOperationId: record?.operationId ?? null,
         record: next
       });
-      const parsed = z36.object({
-        ok: z36.literal(true),
-        data: z36.object({ record: setupDeploymentRecordSchema }).strict()
-      }).strict().safeParse(result.payload);
-      if (!result.ok || !parsed.success || stableJsonStringify(parsed.data.data.record) !== stableJsonStringify(next))
+      const parsed = z38.object({
+        ok: z38.literal(true),
+        data: z38.object({ record: setupDeploymentRecordSchema }).strict()
+      }).strict().safeParse(result2.payload);
+      if (!result2.ok || !parsed.success || stableJsonStringify(parsed.data.data.record) !== stableJsonStringify(next))
         fail2("deployment_record_unconfirmed", "The setup deployment record was not acknowledged. Reload context before continuing; no deployment is blindly repeated.");
       record = parsed.data.data.record;
       if (next.phase === "planned")
@@ -5747,7 +5914,7 @@ async function setupDeployCommand(input, deps = defaults) {
     };
     const fresh = () => ({
       version: 1,
-      operationId: randomUUID6(),
+      operationId: randomUUID7(),
       provider: "vercel",
       projectId: provider.projectId,
       teamId: provider.teamId,
@@ -5787,7 +5954,7 @@ async function setupDeployCommand(input, deps = defaults) {
       const item = owned(key);
       if (key === "SITEPLANE_ADMIN_SESSION_SECRET" && item && record.phase === "verified")
         continue;
-      const current = item ? z36.object({ key: z36.literal(key), value: z36.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`)).value : null;
+      const current = item ? z38.object({ key: z38.literal(key), value: z38.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`)).value : null;
       if (current !== value)
         pending.push({
           key,
@@ -5812,7 +5979,7 @@ async function setupDeployCommand(input, deps = defaults) {
         const item = owned(key);
         if (!item)
           fail2("environment_write_unconfirmed", "A Siteplane Production binding was not persisted; retry the same configuration.");
-        const observed = z36.object({ key: z36.literal(key), value: z36.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`));
+        const observed = z38.object({ key: z38.literal(key), value: z38.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`));
         if (observed.value !== value)
           fail2("environment_write_unconfirmed", "The provider readback does not match the authorized Siteplane value; no deployment was started.");
       }
@@ -5825,9 +5992,9 @@ async function setupDeployCommand(input, deps = defaults) {
     const detail = async (id) => deploymentSchema.parse(await api(`/v13/deployments/${encodeURIComponent(id)}?${scope}&withGitRepoInfo=true`));
     const matches = (deployment2) => deployment2.projectId === provider.projectId && deployment2.target === "production" && (!deployment2.ownerId || deployment2.ownerId === provider.teamId) && deployment2.createdAt >= Date.parse(record.environmentWrittenAt) && (deployment2.meta?.siteplaneOperationId === record.operationId || provider.git && (deployment2.gitSource?.sha ?? deployment2.meta?.githubCommitSha ?? deployment2.meta?.gitlabCommitSha ?? deployment2.meta?.bitbucketCommitSha ?? deployment2.meta?.gitCommitSha) === revision);
     const discover = async () => {
-      const result = z36.object({ deployments: z36.array(z36.object({ uid: z36.string() })) }).parse(await api(`/v6/deployments?${scope}&projectId=${provider.projectId}&target=production&since=${Date.parse(record.environmentWrittenAt)}&limit=100`));
+      const result2 = z38.object({ deployments: z38.array(z38.object({ uid: z38.string() })) }).parse(await api(`/v6/deployments?${scope}&projectId=${provider.projectId}&target=production&since=${Date.parse(record.environmentWrittenAt)}&limit=100`));
       const candidates = [];
-      for (const item of result.deployments) {
+      for (const item of result2.deployments) {
         const found = await detail(item.uid);
         if (matches(found))
           candidates.push(found);
@@ -5880,7 +6047,7 @@ async function setupDeployCommand(input, deps = defaults) {
             ], { cwd: local.projectDirectory, input: body, timeoutMs: 3e4 });
           }
         } else {
-          const upload = await mkdtemp(join11(tmpdir(), "siteplane-setup-upload-"));
+          const upload = await mkdtemp(join12(tmpdir(), "siteplane-setup-upload-"));
           try {
             await processCommand("git", [
               "clone",
@@ -5894,11 +6061,11 @@ async function setupDeployCommand(input, deps = defaults) {
               cwd: upload
             });
             await deps.writeBuildProvenance(upload, revision);
-            await mkdir9(join11(upload, ".vercel"), {
+            await mkdir9(join12(upload, ".vercel"), {
               recursive: true,
               mode: 448
             });
-            await writeFile6(join11(upload, ".vercel/project.json"), JSON.stringify({
+            await writeFile6(join12(upload, ".vercel/project.json"), JSON.stringify({
               projectId: provider.projectId,
               orgId: provider.teamId
             }), { mode: 384 });
@@ -6000,8 +6167,8 @@ async function setupDeployCommand(input, deps = defaults) {
 
 // src/bin/run-siteplane.ts
 async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
-  const writes = args[0] === "init" || args[0] === "analytics" && args[1] === "init" || args[0] === "setup" && ["apply", "prepare", "deploy"].includes(args[1] ?? "");
-  const missingDeploy = args[0] === "setup" && args[1] === "deploy" && !await access6(join12(dependencies.cwd(), "siteplane.config.json")).then(
+  const writes = args[0] === "init" || args[0] === "analytics" && args[1] === "init" || args[0] === "setup" && ["start", "apply", "prepare", "deploy"].includes(args[1] ?? "");
+  const missingDeploy = args[0] === "setup" && args[1] === "deploy" && !await access7(join13(dependencies.cwd(), "siteplane.config.json")).then(
     () => true,
     () => false
   );
@@ -6018,18 +6185,18 @@ async function runSiteplaneCliUnlocked(args, dependencies = createDefaultDepende
     if (!setupToken) {
       throw new Error("Usage: siteplane init --setup-token <one-time-grant>");
     }
-    const result = await dependencies.commands.initCommand({
+    const result2 = await dependencies.commands.initCommand({
       projectDir: dependencies.cwd(),
       setupToken,
       apiBaseUrl,
       ...readOptionalVercelAutomationBypassSecret(dependencies.env)
     });
-    dependencies.stdout(`Wrote ${result.configPath}`);
-    dependencies.stdout(`Wrote ${result.credentialsPath}`);
+    dependencies.stdout(`Wrote ${result2.configPath}`);
+    dependencies.stdout(`Wrote ${result2.credentialsPath}`);
     dependencies.stdout(
       "Siteplane setup connection stored securely. Next steps:"
     );
-    for (const nextStep of result.nextSteps)
+    for (const nextStep of result2.nextSteps)
       dependencies.stdout(`- ${nextStep}`);
     return { exitCode: 0 };
   }
@@ -6083,7 +6250,7 @@ async function runAnalyticsCommand(args, dependencies) {
     siteId: projectConfig.siteId,
     ...readOptionalVercelAutomationBypassSecret(dependencies.env)
   };
-  const manifestPath = join12(projectDir, "siteplane.analytics.json");
+  const manifestPath = join13(projectDir, "siteplane.analytics.json");
   if (subcommand === "init") {
     const { rawPublicKey } = await dependencies.commands.analyticsPrepareCommand({
       config
@@ -6095,15 +6262,15 @@ async function runAnalyticsCommand(args, dependencies) {
       );
     }
     const agentClient = readAnalyticsAgentClient(subcommandArgs);
-    const result = await dependencies.commands.analyticsInitCommand({
+    const result2 = await dependencies.commands.analyticsInitCommand({
       projectDir,
       siteId: projectConfig.siteId,
       siteKeyRef: "env:NEXT_PUBLIC_SITEPLANE_ANALYTICS_SITE_KEY",
       siteKeyLookup,
       ...agentClient ? { agentClient } : {}
     });
-    dependencies.stdout(`Wrote ${result.manifestPath}`);
-    for (const artifactPath of result.artifactPaths) {
+    dependencies.stdout(`Wrote ${result2.manifestPath}`);
+    for (const artifactPath of result2.artifactPaths) {
       dependencies.stdout(`Wrote ${artifactPath}`);
     }
     return { exitCode: 0 };
@@ -6115,18 +6282,18 @@ async function runAnalyticsCommand(args, dependencies) {
         projectDir
       }
     );
-    const artifactFilePaths = [join12(projectDir, ".siteplane/analytics.md")];
+    const artifactFilePaths = [join13(projectDir, ".siteplane/analytics.md")];
     const cspFilePaths = await existingPaths([
-      join12(projectDir, "next.config.js"),
-      join12(projectDir, "next.config.mjs"),
-      join12(projectDir, "next.config.ts"),
-      join12(projectDir, "middleware.ts"),
-      join12(projectDir, "src/middleware.ts")
+      join13(projectDir, "next.config.js"),
+      join13(projectDir, "next.config.mjs"),
+      join13(projectDir, "next.config.ts"),
+      join13(projectDir, "middleware.ts"),
+      join13(projectDir, "src/middleware.ts")
     ]);
     const check = await dependencies.commands.analyticsCheckCommand({
       manifestPath,
       sourceFilePaths,
-      packageJsonPath: join12(projectDir, "package.json"),
+      packageJsonPath: join13(projectDir, "package.json"),
       cspFilePaths,
       artifactFilePaths
     });
@@ -6194,50 +6361,66 @@ async function runSetupCommand(args, dependencies) {
   const connectionOptions = readOptionalVercelAutomationBypassSecret(
     dependencies.env
   );
+  if (area === "start") {
+    const instructionsFile = readOption(areaArgs, "--instructions-file");
+    const modules = readOption(areaArgs, "--modules");
+    const result2 = await dependencies.commands.setupStartCommand({
+      projectDir,
+      apiBaseUrl: readOption(areaArgs, "--api-base-url") ?? dependencies.env.SITEPLANE_API_BASE_URL ?? "https://siteplane.io",
+      ...modules ? { modules: modules.split(",") } : {},
+      ...instructionsFile ? {
+        instructions: await dependencies.readTextFile(
+          resolve4(projectDir, instructionsFile)
+        )
+      } : {}
+    });
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: 0 };
+  }
   if (area === "deploy") {
-    const result = await dependencies.commands.setupDeployCommand({
+    const result2 = await dependencies.commands.setupDeployCommand({
       projectDir,
       onProgress: (progress) => dependencies.stderr(JSON.stringify({ status: "waiting", ...progress }))
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "ready_for_review" ? 0 : 1 };
   }
   if (area === "preflight") {
-    const result = await dependencies.commands.setupPreflightCommand({
+    const result2 = await dependencies.commands.setupPreflightCommand({
       projectDir
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "ready" ? 0 : 1 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "ready" ? 0 : 1 };
   }
   if (area === "prepare") {
-    const result = await dependencies.commands.setupPrepareCommand({
+    const result2 = await dependencies.commands.setupPrepareCommand({
       projectDir
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "action_required" ? 1 : 0 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "action_required" ? 1 : 0 };
   }
   if (area === "context") {
-    const result = await dependencies.commands.siteSetupContextCommand({
+    const result2 = await dependencies.commands.siteSetupContextCommand({
       projectDir,
       ...connectionOptions
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "action_required" ? 1 : 0 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "action_required" ? 1 : 0 };
   }
   if (area === "activity") {
-    const result = await dependencies.commands.siteSetupActivityCommand({
+    const result2 = await dependencies.commands.siteSetupActivityCommand({
       projectDir,
       phase: readRequiredOption(areaArgs, "--phase"),
       ...connectionOptions
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "action_required" ? 1 : 0 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "action_required" ? 1 : 0 };
   }
   if (area === "apply") {
     const editorDefinition = await dependencies.readJsonFile(
       readRequiredOption(areaArgs, "--definition")
     );
-    const result = await dependencies.commands.siteSetupApplyCommand({
+    const result2 = await dependencies.commands.siteSetupApplyCommand({
       projectDir,
       editorDefinition,
       contentSelectionSummary: await dependencies.readTextFile(
@@ -6248,28 +6431,28 @@ async function runSetupCommand(args, dependencies) {
       ),
       ...connectionOptions
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "action_required" ? 1 : 0 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "action_required" ? 1 : 0 };
   }
   if (area === "verify") {
-    const result = await dependencies.commands.siteSetupVerifyCommand({
+    const result2 = await dependencies.commands.siteSetupVerifyCommand({
       projectDir,
       deploymentUrl: readRequiredOption(areaArgs, "--deployment-url"),
       wait: areaArgs.includes("--wait"),
       ...connectionOptions
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.status === "ready_for_review" ? 0 : 1 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "ready_for_review" ? 0 : 1 };
   }
   dependencies.stdout(
-    "Usage: siteplane setup <preflight|prepare|context|activity|apply|deploy|verify>"
+    "Usage: siteplane setup <start|preflight|prepare|context|activity|apply|deploy|verify>"
   );
   return { exitCode: 1 };
 }
 async function runBookingCommand(args, dependencies) {
   const [subcommand, ...subcommandArgs] = args;
   const projectDir = dependencies.cwd();
-  const manifestPath = join12(projectDir, "siteplane.booking.json");
+  const manifestPath = join13(projectDir, "siteplane.booking.json");
   if (subcommand === "init") {
     const siteId = readRequiredOption(subcommandArgs, "--site-id");
     const siteKeyPrefix = readRequiredOption(
@@ -6282,7 +6465,7 @@ async function runBookingCommand(args, dependencies) {
     );
     const productionOrigin = readOption(subcommandArgs, "--production-origin");
     const agentClient = readBookingAgentClient(subcommandArgs);
-    const result = await dependencies.commands.bookingInitCommand({
+    const result2 = await dependencies.commands.bookingInitCommand({
       projectDir,
       siteId,
       siteKeyPrefix,
@@ -6290,8 +6473,8 @@ async function runBookingCommand(args, dependencies) {
       ...productionOrigin ? { productionOrigin } : {},
       ...agentClient ? { agentClient } : {}
     });
-    dependencies.stdout(`Wrote ${result.manifestPath}`);
-    for (const artifactPath of result.artifactPaths) {
+    dependencies.stdout(`Wrote ${result2.manifestPath}`);
+    for (const artifactPath of result2.artifactPaths) {
       dependencies.stdout(`Wrote ${artifactPath}`);
     }
     return { exitCode: 0 };
@@ -6303,12 +6486,12 @@ async function runBookingCommand(args, dependencies) {
         projectDir
       }
     );
-    const result = await dependencies.commands.bookingCheckCommand({
+    const result2 = await dependencies.commands.bookingCheckCommand({
       manifestPath,
       sourceFilePaths
     });
-    dependencies.stdout(JSON.stringify(result, null, 2));
-    return { exitCode: result.ok ? 0 : 1 };
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.ok ? 0 : 1 };
   }
   if (subcommand === "sync") {
     const { config, manifest } = await readBookingProjectState(
@@ -6348,7 +6531,7 @@ async function runBookingCommand(args, dependencies) {
         resourceId: readOption(subcommandArgs, "--resource-id") ?? null,
         startUtc: readRequiredOption(subcommandArgs, "--start-utc"),
         customer,
-        clientToken: readOption(subcommandArgs, "--client-token") ?? randomUUID7(),
+        clientToken: readOption(subcommandArgs, "--client-token") ?? randomUUID8(),
         paymentChoice: "onsite"
       }
     });
@@ -6401,6 +6584,7 @@ function createDefaultDependencies() {
       siteSetupActivityCommand,
       siteSetupVerifyCommand,
       setupPreflightCommand,
+      setupStartCommand,
       setupPrepareCommand,
       setupDeployCommand,
       initCommand,
@@ -6464,7 +6648,7 @@ async function existingPaths(paths) {
   const existing = [];
   for (const path of paths) {
     try {
-      await access6(path);
+      await access7(path);
       existing.push(path);
     } catch {
     }
@@ -6492,8 +6676,8 @@ function readBookingAgentClient(args) {
 
 // src/bin/siteplane.ts
 async function main() {
-  const result = await runSiteplaneCli(process.argv.slice(2));
-  process.exitCode = result.exitCode;
+  const result2 = await runSiteplaneCli(process.argv.slice(2));
+  process.exitCode = result2.exitCode;
 }
 await main().catch((error) => {
   console.error(error instanceof Error ? error.message : String(error));