siteplane 0.1.52 → 0.1.53

package/dist/bin/siteplane.js

@@ -2330,6 +2330,47 @@ var setupInstallationRequestSchema = z26.object({
   }).strict()
 }).strict();
 
+// ../shared/dist/setup-claim.js
+import { z as z27 } from "zod";
+var setupClaimCodeSchema = z27.string().regex(/^[0-9A-HJKMNP-TV-Z]{8}$/u);
+var setupClaimBindingSchema = z27.object({
+  siteId: z27.string().uuid(),
+  runId: z27.string().uuid()
+});
+var setupClaimReceiptSchema = setupClaimBindingSchema.extend({
+  status: z27.literal("claimed"),
+  requestId: z27.string().uuid(),
+  workspaceId: z27.string().uuid(),
+  userId: z27.string().uuid(),
+  claimedAt: z27.string().datetime({ offset: true })
+}).strict();
+var setupClaimInspectionSchema = setupClaimBindingSchema.extend({
+  status: z27.literal("pending"),
+  requestId: z27.string().uuid(),
+  siteName: z27.string(),
+  userId: z27.string().uuid(),
+  accountEmail: z27.string().email(),
+  workspaceId: z27.string().uuid(),
+  workspaceName: z27.string(),
+  expiresAt: z27.string().datetime({ offset: true })
+}).strict();
+var setupClaimDenialSchema = z27.object({
+  status: z27.enum([
+    "invalid_claim_request",
+    "invalid_installation",
+    "already_claimed",
+    "project_expired",
+    "invalid_guest_session",
+    "stale_setup_review",
+    "verified_account_required",
+    "workspace_access_denied",
+    "workspace_entitlement_required",
+    "site_limit_reached",
+    "provisional_relationship_conflict",
+    "rate_limited"
+  ])
+}).strict();
+
 // ../cli/dist/analytics/manifest.js
 async function readAnalyticsManifestFile(manifestPath) {
   return validateAnalyticsManifestInput(JSON.parse(await readFile(manifestPath, "utf8")));
@@ -3154,16 +3195,16 @@ async function analyticsReadinessCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/public-key.js
-import { z as z27 } from "zod";
-var responseSchema = z27.object({
-  ok: z27.literal(true),
-  data: z27.object({
-    rawPublicKey: z27.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+import { z as z28 } from "zod";
+var responseSchema = z28.object({
+  ok: z28.literal(true),
+  data: z28.object({
+    rawPublicKey: z28.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
   })
 });
-var errorResponseSchema = z27.object({
-  error: z27.object({
-    code: z27.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+var errorResponseSchema = z28.object({
+  error: z28.object({
+    code: z28.string().regex(/^[a-z][a-z0-9_.-]+$/u)
   })
 });
 async function analyticsPublicKeyCommand(input) {
@@ -3185,13 +3226,13 @@ async function analyticsPublicKeyCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/prepare.js
-import { z as z28 } from "zod";
-var resultSchema = z28.object({
-  ok: z28.literal(true),
-  data: z28.object({
-    rawPublicKey: z28.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
-    generation: z28.number().int().positive(),
-    status: z28.enum([
+import { z as z29 } from "zod";
+var resultSchema = z29.object({
+  ok: z29.literal(true),
+  data: z29.object({
+    rawPublicKey: z29.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
+    generation: z29.number().int().positive(),
+    status: z29.enum([
       "setup_started",
       "test_mode",
       "active",
@@ -3201,8 +3242,8 @@ var resultSchema = z28.object({
     ])
   }).strict()
 }).strict();
-var errorSchema = z28.object({
-  error: z28.object({ code: z28.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
+var errorSchema = z29.object({
+  error: z29.object({ code: z29.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
 });
 async function analyticsPrepareCommand(input) {
   const response = await (input.fetchImpl ?? fetch)(`${input.config.apiBaseUrl.replace(/\/$/u, "")}/api/cli/analytics/prepare`, {
@@ -3422,19 +3463,19 @@ async function bookingTestCommand(input) {
 import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
 import { join as join3 } from "path";
-import { z as z29 } from "zod";
-var siteplaneProjectConfigSchema = z29.object({
-  version: z29.literal(2),
-  apiBaseUrl: z29.string().url(),
-  siteId: z29.string().uuid(),
-  publicSiteKeyId: z29.string().uuid(),
-  publicSiteKey: z29.string().trim().min(1),
-  runId: z29.string().uuid(),
-  appDirectory: z29.string().min(1),
-  taskContractVersion: z29.literal("siteplane.setup-task.v2"),
-  adminProtocolVersion: z29.literal(2),
+import { z as z30 } from "zod";
+var siteplaneProjectConfigSchema = z30.object({
+  version: z30.literal(2),
+  apiBaseUrl: z30.string().url(),
+  siteId: z30.string().uuid(),
+  publicSiteKeyId: z30.string().uuid(),
+  publicSiteKey: z30.string().trim().min(1),
+  runId: z30.string().uuid(),
+  appDirectory: z30.string().min(1),
+  taskContractVersion: z30.literal("siteplane.setup-task.v2"),
+  adminProtocolVersion: z30.literal(2),
   packages: siteSetupPackagesSchema,
-  fieldContractHash: z29.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+  fieldContractHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectPackageJson(projectDir) {
   return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
@@ -3494,26 +3535,27 @@ import { randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
 import { dirname as dirname5, join as join4, relative } from "path";
 import { promisify } from "util";
-import { z as z30 } from "zod";
-var localSetupInstallationSchema = z30.object({
-  key: z30.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  idempotencyKey: z30.string().uuid(),
-  apiBaseUrl: z30.string().url(),
+import { z as z31 } from "zod";
+var localSetupInstallationSchema = z31.object({
+  key: z31.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  idempotencyKey: z31.string().uuid(),
+  apiBaseUrl: z31.string().url(),
   request: setupInstallationRequestSchema,
-  bootstrapAcknowledged: z30.boolean()
+  bootstrapAcknowledged: z31.boolean()
 }).strict();
-var siteplaneCredentialsSchema = z30.object({
-  accessToken: z30.string().trim().min(1),
-  siteRevalidationSecret: z30.string().trim().min(1),
+var siteplaneCredentialsSchema = z31.object({
+  accessToken: z31.string().trim().min(1),
+  siteRevalidationSecret: z31.string().trim().min(1),
   installation: localSetupInstallationSchema.optional(),
-  adminSession: z30.object({
-    secret: z30.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-    generation: z30.string().uuid()
+  claimReceipt: setupClaimReceiptSchema.optional(),
+  adminSession: z31.object({
+    secret: z31.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    generation: z31.string().uuid()
   }).strict().optional()
 }).strict();
-var localSetupCredentialsSchema = z30.union([
+var localSetupCredentialsSchema = z31.union([
   siteplaneCredentialsSchema,
-  z30.object({ installation: localSetupInstallationSchema }).strict()
+  z31.object({ installation: localSetupInstallationSchema }).strict()
 ]);
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
   const path = join4(projectDir, ".siteplane/credentials.json");
@@ -3586,6 +3628,12 @@ async function writeCredentialsAtomically(path, credentials) {
   try {
     await rename2(temporaryPath, path);
     await chmod2(path, 384);
+    const directory = await open2(dirname5(path), "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
   } catch (error) {
     await rm2(temporaryPath, { force: true });
     throw error;
@@ -3605,7 +3653,7 @@ async function gitPathMatches(projectDir, path, command) {
 // ../cli/dist/commands/init.js
 import { access as access3 } from "fs/promises";
 import { join as join7, relative as relative3 } from "path";
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 
 // ../cli/dist/commands/setup-preflight.js
 import { createHash as createHash2 } from "crypto";
@@ -3617,11 +3665,11 @@ import { parse as parseYaml } from "yaml";
 import { createRequire } from "module";
 import { readFile as readFile7 } from "fs/promises";
 import { join as join5 } from "path";
-import { z as z31 } from "zod";
-var packageSchema = z31.object({
-  name: z31.string().optional(),
-  version: z31.string(),
-  peerDependencies: z31.record(z31.string(), z31.string()).optional()
+import { z as z32 } from "zod";
+var packageSchema = z32.object({
+  name: z32.string().optional(),
+  version: z32.string(),
+  peerDependencies: z32.record(z32.string(), z32.string()).optional()
 });
 async function readInstalledPackage(projectDir, name2) {
   const require2 = createRequire(join5(projectDir, "package.json"));
@@ -3636,9 +3684,9 @@ async function readInstalledPackage(projectDir, name2) {
   throw new Error(`Install ${name2} with the canonical package manager before setup.`);
 }
 async function assertExactSetupPackages(projectDir, packages) {
-  const manifest = z31.object({
-    dependencies: z31.record(z31.string(), z31.string()).optional(),
-    devDependencies: z31.record(z31.string(), z31.string()).optional()
+  const manifest = z32.object({
+    dependencies: z32.record(z32.string(), z32.string()).optional(),
+    devDependencies: z32.record(z32.string(), z32.string()).optional()
   }).parse(JSON.parse(await readFile7(join5(projectDir, "package.json"), "utf8")));
   for (const [name2, version2] of [
     ["siteplane", packages.siteplane],
@@ -3655,7 +3703,7 @@ async function assertExactSetupPackages(projectDir, packages) {
 // ../cli/dist/commands/setup-preflight.js
 import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
 import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
-import { z as z32 } from "zod";
+import { z as z33 } from "zod";
 
 // ../cli/dist/commands/setup-process.js
 import { spawn } from "child_process";
@@ -3756,29 +3804,29 @@ async function setupVercelApi(cwd, endpoint, body, method, options) {
 }
 
 // ../cli/dist/commands/setup-preflight.js
-var manifestSchema = z32.object({
-  packageManager: z32.string().optional(),
-  engines: z32.object({ node: z32.string().optional() }).optional(),
-  dependencies: z32.record(z32.string(), z32.string()).optional(),
-  devDependencies: z32.record(z32.string(), z32.string()).optional(),
-  scripts: z32.record(z32.string(), z32.string()).optional(),
-  workspaces: z32.unknown().optional()
+var manifestSchema = z33.object({
+  packageManager: z33.string().optional(),
+  engines: z33.object({ node: z33.string().optional() }).optional(),
+  dependencies: z33.record(z33.string(), z33.string()).optional(),
+  devDependencies: z33.record(z33.string(), z33.string()).optional(),
+  scripts: z33.record(z33.string(), z33.string()).optional(),
+  workspaces: z33.unknown().optional()
 });
-var vercelProjectSchema = z32.object({
-  id: z32.string(),
-  accountId: z32.string(),
-  name: z32.string(),
-  nodeVersion: z32.string().nullable().optional(),
-  rootDirectory: z32.string().nullable().optional(),
-  framework: z32.string().nullable().optional(),
-  installCommand: z32.string().nullable().optional(),
-  buildCommand: z32.string().nullable().optional(),
-  link: z32.object({
-    type: z32.string(),
-    repo: z32.string().optional(),
-    repoId: z32.union([z32.string(), z32.number()]).optional(),
-    org: z32.string().optional(),
-    productionBranch: z32.string().optional()
+var vercelProjectSchema = z33.object({
+  id: z33.string(),
+  accountId: z33.string(),
+  name: z33.string(),
+  nodeVersion: z33.string().nullable().optional(),
+  rootDirectory: z33.string().nullable().optional(),
+  framework: z33.string().nullable().optional(),
+  installCommand: z33.string().nullable().optional(),
+  buildCommand: z33.string().nullable().optional(),
+  link: z33.object({
+    type: z33.string(),
+    repo: z33.string().optional(),
+    repoId: z33.union([z33.string(), z33.number()]).optional(),
+    org: z33.string().optional(),
+    productionBranch: z33.string().optional()
   }).nullable().optional()
 });
 var exists = async (path) => access2(path).then(() => true, () => false);
@@ -3835,9 +3883,9 @@ async function inspectSetupLocalProject(projectDir) {
   const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
   if (lockfileRoot !== projectDirectory) {
     const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
-    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z32.object({ packages: z32.array(z32.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z32.union([
-      z32.array(z32.string()),
-      z32.object({ packages: z32.array(z32.string()) }).transform((value) => value.packages)
+    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z33.object({ packages: z33.array(z33.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z33.union([
+      z33.array(z33.string()),
+      z33.object({ packages: z33.array(z33.string()) }).transform((value) => value.packages)
     ]).parse(rootManifest.workspaces);
     const selected = relative2(lockfileRoot, projectDirectory).split(sep).join("/");
     if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
@@ -3851,11 +3899,11 @@ async function inspectSetupLocalProject(projectDir) {
       break;
   }
   const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
-  const npmLock = lockName === "package-lock.json" ? z32.object({
-    lockfileVersion: z32.number(),
-    packages: z32.record(z32.string(), z32.object({
-      version: z32.string().optional(),
-      peerDependencies: z32.record(z32.string(), z32.string()).optional()
+  const npmLock = lockName === "package-lock.json" ? z33.object({
+    lockfileVersion: z33.number(),
+    packages: z33.record(z33.string(), z33.object({
+      version: z33.string().optional(),
+      peerDependencies: z33.record(z33.string(), z33.string()).optional()
     })).optional()
   }).parse(JSON.parse(lockText)) : null;
   async function version2(name3) {
@@ -3995,9 +4043,9 @@ async function setupPreflightCommand(input) {
       linkDirectory = dirname6(linkDirectory);
     if (!await exists(join6(linkDirectory, ".vercel/project.json")))
       fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
-    const linked = z32.object({
-      projectId: z32.string().regex(/^prj_[A-Za-z0-9]+$/u),
-      orgId: z32.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
+    const linked = z33.object({
+      projectId: z33.string().regex(/^prj_[A-Za-z0-9]+$/u),
+      orgId: z33.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
     }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
     const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
     if (project.id !== linked.projectId || project.accountId !== linked.orgId)
@@ -4011,11 +4059,11 @@ async function setupPreflightCommand(input) {
       fail("vercel_production_branch_conflict", "The local branch differs from the bound Vercel Production branch.");
     if (project.link?.repo && project.link.org && !local.git.remote?.replace(/\.git$/u, "").endsWith(`${project.link.org}/${project.link.repo}`))
       fail("vercel_git_conflict", "The local origin repository differs from the Vercel Git connection.");
-    const env = z32.object({
-      envs: z32.array(z32.object({
-        key: z32.string(),
-        value: z32.string().optional(),
-        target: z32.array(z32.string()).optional()
+    const env = z33.object({
+      envs: z33.array(z33.object({
+        key: z33.string(),
+        value: z33.string().optional(),
+        target: z33.array(z33.string()).optional()
       }))
     }).parse(await setupVercelApi(linkDirectory, `/v10/projects/${linked.projectId}/env?teamId=${linked.orgId}`));
     const corepack = env.envs.some((item) => item.key === "ENABLE_EXPERIMENTAL_COREPACK" && item.value === "1" && item.target?.includes("production"));
@@ -4105,26 +4153,26 @@ async function initCommand(input) {
     ]
   };
 }
-var siteSetupBootstrapDataSchema = z33.object({
-  credentialPurpose: z33.literal("site_setup"),
-  apiBaseUrl: z33.string().url(),
-  siteId: z33.string().uuid(),
-  publicSiteKeyId: z33.string().uuid(),
-  publicSiteKey: z33.string().trim().min(1),
-  accessToken: z33.string().trim().min(1),
-  siteRevalidationSecret: z33.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  runId: z33.string().uuid(),
+var siteSetupBootstrapDataSchema = z34.object({
+  credentialPurpose: z34.literal("site_setup"),
+  apiBaseUrl: z34.string().url(),
+  siteId: z34.string().uuid(),
+  publicSiteKeyId: z34.string().uuid(),
+  publicSiteKey: z34.string().trim().min(1),
+  accessToken: z34.string().trim().min(1),
+  siteRevalidationSecret: z34.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  runId: z34.string().uuid(),
   packages: siteSetupPackagesSchema
 }).strict();
-var featureBootstrapDataSchema = z33.object({
-  credentialPurpose: z33.enum(["analytics", "booking"]),
-  apiBaseUrl: z33.string().url(),
-  siteId: z33.string().uuid(),
-  accessToken: z33.string().trim().min(1)
+var featureBootstrapDataSchema = z34.object({
+  credentialPurpose: z34.enum(["analytics", "booking"]),
+  apiBaseUrl: z34.string().url(),
+  siteId: z34.string().uuid(),
+  accessToken: z34.string().trim().min(1)
 }).strict();
-var bootstrapResponseSchema = z33.object({
-  ok: z33.literal(true),
-  data: z33.discriminatedUnion("credentialPurpose", [
+var bootstrapResponseSchema = z34.object({
+  ok: z34.literal(true),
+  data: z34.discriminatedUnion("credentialPurpose", [
     siteSetupBootstrapDataSchema,
     featureBootstrapDataSchema
   ])
@@ -4168,6 +4216,7 @@ async function persistSiteSetupBootstrap(input, bootstrap, appDirectory, install
   const previousCredentials = previous ? await access3(join7(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalSetupCredentials(input.projectDir), () => null) : null;
   const credentialsPath = await writeLocalCredentials(input.projectDir, {
     ...previousCredentials && "adminSession" in previousCredentials && previousCredentials.adminSession ? { adminSession: previousCredentials.adminSession } : {},
+    ...previousCredentials && "claimReceipt" in previousCredentials && previousCredentials.claimReceipt ? { claimReceipt: previousCredentials.claimReceipt } : {},
     accessToken: bootstrap.accessToken,
     siteRevalidationSecret: bootstrap.siteRevalidationSecret,
     ...installation ?? previousCredentials?.installation ? { installation: installation ?? previousCredentials?.installation } : {}
@@ -4283,7 +4332,7 @@ async function collectSourceFiles(directory) {
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile9 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
@@ -4980,32 +5029,32 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z34.object({
-  code: z34.string().trim().min(1),
-  message: z34.string().trim().min(1)
+var safeErrorSchema = z35.object({
+  code: z35.string().trim().min(1),
+  message: z35.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z34.object({ ok: z34.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z34.object({
+var errorResponseSchema2 = z35.object({ ok: z35.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z35.object({
   task: siteSetupTaskSchema.refine((task) => task.run !== null)
 }).strict();
-var contextResponseSchema = z34.object({ ok: z34.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z34.object({
-  status: z34.enum(["applied", "ready_for_review"]),
-  runId: z34.string().uuid().optional(),
-  contractVersionId: z34.string().uuid().optional(),
-  fieldContractHash: z34.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z34.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z34.number().int().nonnegative().optional(),
-  routeCount: z34.number().int().nonnegative().optional()
+var contextResponseSchema = z35.object({ ok: z35.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z35.object({
+  status: z35.enum(["applied", "ready_for_review"]),
+  runId: z35.string().uuid().optional(),
+  contractVersionId: z35.string().uuid().optional(),
+  fieldContractHash: z35.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z35.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z35.number().int().nonnegative().optional(),
+  routeCount: z35.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z34.object({ ok: z34.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z34.object({
-  status: z34.literal("ready_for_review"),
-  runId: z34.string().uuid().optional(),
-  deploymentOrigin: z34.string().url().optional(),
-  deploymentRevision: z34.string().optional()
+var applyResponseSchema = z35.object({ ok: z35.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z35.object({
+  status: z35.literal("ready_for_review"),
+  runId: z35.string().uuid().optional(),
+  deploymentOrigin: z35.string().url().optional(),
+  deploymentRevision: z35.string().optional()
 }).strict();
-var verifyResponseSchema = z34.object({ ok: z34.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z35.object({ ok: z35.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -5169,9 +5218,9 @@ async function siteSetupActivityCommand(input) {
       message: "Choose inspecting, integrating, deploying, verifying or repairing."
     };
   const response = await postSiteSetup(input, "activity", activity.data);
-  const parsed = z34.object({
-    ok: z34.literal(true),
-    data: z34.object({ status: z34.enum(["recorded", "rate_limited"]) }).strict()
+  const parsed = z35.object({
+    ok: z35.literal(true),
+    data: z35.object({ status: z35.enum(["recorded", "rate_limited"]) }).strict()
   }).strict().safeParse(response.payload);
   return response.ok && parsed.success ? parsed.data.data : actionRequired(response.payload, "Setup activity could not be recorded.");
 }
@@ -5180,9 +5229,9 @@ async function siteSetupActivityCommand(input) {
 import { randomBytes, randomUUID as randomUUID4 } from "crypto";
 import { access as access4 } from "fs/promises";
 import { join as join9, relative as relative5 } from "path";
-import { z as z35 } from "zod";
-var bootstrapResponseSchema2 = z35.object({
-  ok: z35.literal(true),
+import { z as z36 } from "zod";
+var bootstrapResponseSchema2 = z36.object({
+  ok: z36.literal(true),
   data: siteSetupBootstrapDataSchema
 }).strict();
 async function setupStartCommand(input) {
@@ -5256,9 +5305,9 @@ async function acknowledge(input, credentials) {
   if (!installation || !("accessToken" in credentials))
     throw new Error("Incomplete installation exchange.");
   const payload = await installationRequest(input, installation, "acknowledge");
-  z35.object({
-    ok: z35.literal(true),
-    data: z35.object({ acknowledged: z35.literal(true) }).strict()
+  z36.object({
+    ok: z36.literal(true),
+    data: z36.object({ acknowledged: z36.literal(true) }).strict()
   }).strict().parse(payload);
   await writeLocalSetupCredentials(input.projectDir, {
     ...credentials,
@@ -5279,9 +5328,9 @@ async function installationRequest(input, installation, action) {
   });
   const payload = await response.json();
   if (!response.ok) {
-    const error = z35.object({
-      error: z35.object({
-        code: z35.string().regex(/^[a-z][a-z0-9_.]{0,100}$/u)
+    const error = z36.object({
+      error: z36.object({
+        code: z36.string().regex(/^[a-z][a-z0-9_.]{0,100}$/u)
       })
     }).safeParse(payload);
     throw new SetupFailure(error.success ? error.data.error.code : "setup_start_failed", "Siteplane could not complete this installation request. The saved local key and request are unchanged; retry after resolving the reported boundary.");
@@ -5310,23 +5359,34 @@ async function exists2(path) {
 }
 
 // ../cli/dist/commands/setup-review.js
-import { z as z36 } from "zod";
-var responseSchema2 = z36.object({
-  ok: z36.literal(true),
-  data: z36.object({
-    reviewUrl: z36.string().url(),
-    expiresAt: z36.string().datetime({ offset: true })
+import { z as z37 } from "zod";
+var responseSchema2 = z37.object({
+  ok: z37.literal(true),
+  data: z37.object({
+    reviewUrl: z37.string().url(),
+    expiresAt: z37.string().datetime({ offset: true })
   }).strict()
 }).strict();
 async function setupReviewCommand(input) {
   const [config, credentials] = await Promise.all([
     readProjectConfig(input.projectDir),
-    readLocalCredentials(input.projectDir)
+    readLocalCredentials(input.projectDir).catch((error) => {
+      if (error.code === "ENOENT")
+        return null;
+      throw error;
+    })
   ]);
-  if (!credentials.installation)
+  if (credentials?.claimReceipt) {
+    if (credentials.claimReceipt.siteId !== config.siteId || credentials.claimReceipt.runId !== config.runId)
+      return { status: "action_required", code: "claim_binding_mismatch", message: "Restore the matching project configuration and credentials." };
+    const reviewUrl = new URL("/setup/review", config.apiBaseUrl);
+    reviewUrl.searchParams.set("siteId", config.siteId);
+    return { status: "ready", reviewUrl: reviewUrl.toString(), expiresAt: null };
+  }
+  if (!credentials?.installation)
     return {
       status: "action_required",
-      code: "local_installation_missing",
+      code: "local_credentials_missing",
       message: "Open this project's review from your Siteplane workspace. Guest review requires the original local installation credentials."
     };
   if (new URL(config.apiBaseUrl).origin !== new URL(credentials.installation.apiBaseUrl).origin)
@@ -5356,12 +5416,13 @@ async function setupReviewCommand(input) {
         throw new Error("Invalid review destination.");
       return { status: "ready", ...parsed.data.data };
     }
-    const denied = z36.object({
-      error: z36.object({
-        code: z36.enum([
+    const denied = z37.object({
+      error: z37.object({
+        code: z37.enum([
           "invalid_installation",
           "already_claimed",
           "project_expired",
+          "revoked",
           "review_not_ready",
           "rate_limited",
           "review_access_unavailable"
@@ -5371,7 +5432,7 @@ async function setupReviewCommand(input) {
     return {
       status: "action_required",
       code: denied.success ? denied.data.error.code : "review_access_unavailable",
-      message: "The review link is unavailable. Check the existing setup status; do not create another project."
+      message: denied.success && denied.data.error.code === "project_expired" ? "This provisional project has expired. Its review can no longer be claimed. Your website code and deployment remain unchanged." : denied.success && denied.data.error.code === "already_claimed" ? "This website is already in an account. Open it from your Siteplane workspace." : denied.success && denied.data.error.code === "revoked" ? "This installation's access was revoked. Open the website from its owning Siteplane workspace." : "The review link is unavailable. Check the existing setup status; do not create another project."
     };
   } catch {
     return {
@@ -5656,8 +5717,8 @@ async function assertSourcePath(root, target) {
 import { randomUUID as randomUUID6 } from "crypto";
 import { lstat as lstat3, mkdir as mkdir7, open as open4, readFile as readFile11, rm as rm4, rmdir } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { z as z37 } from "zod";
-var ownerSchema = z37.object({ pid: z37.number().int().positive(), nonce: z37.string().uuid() }).strict();
+import { z as z38 } from "zod";
+var ownerSchema = z38.object({ pid: z38.number().int().positive(), nonce: z38.string().uuid() }).strict();
 async function withSetupLock(projectDir, work) {
   const gitPath = (await setupProcess("git", ["rev-parse", "--git-path", "siteplane-setup.lock"], { cwd: projectDir })).trim();
   const path = resolve2(projectDir, gitPath);
@@ -5721,23 +5782,23 @@ import { execFile as execFile3 } from "child_process";
 import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join11, relative as relative7, resolve as resolve3, sep as sep3 } from "path";
 import { isDeepStrictEqual, promisify as promisify3 } from "util";
-import { z as z38 } from "zod";
+import { z as z39 } from "zod";
 var execute = promisify3(execFile3);
 var name = ".siteplane/build-source.json";
-var oid = z38.string().regex(/^[0-9a-f]{40}$/u);
-var entrySchema = z38.object({
-  path: z38.string().min(1).max(4096),
-  mode: z38.enum(["100644", "100755", "120000"]),
+var oid = z39.string().regex(/^[0-9a-f]{40}$/u);
+var entrySchema = z39.object({
+  path: z39.string().min(1).max(4096),
+  mode: z39.enum(["100644", "100755", "120000"]),
   oid
 }).strict();
-var schema = z38.object({
-  version: z38.literal(2),
+var schema = z39.object({
+  version: z39.literal(2),
   revision: oid,
-  commit: z38.string().min(1).max(1048576),
-  entries: z38.array(entrySchema).min(1).max(1e5),
-  providerConfigurations: z38.array(z38.object({
-    path: z38.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
-    source: z38.string().max(1048576)
+  commit: z39.string().min(1).max(1048576),
+  entries: z39.array(entrySchema).min(1).max(1e5),
+  providerConfigurations: z39.array(z39.object({
+    path: z39.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
+    source: z39.string().max(1048576)
   }).strict()).max(1e3)
 }).strict();
 async function writeBuildProvenance(checkout, revision) {
@@ -5786,38 +5847,38 @@ import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as r
 import { access as access6, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join12 } from "path";
-import { z as z39 } from "zod";
-var envSchema = z39.object({
-  id: z39.string(),
-  key: z39.string(),
-  target: z39.array(z39.string()),
-  type: z39.string(),
-  comment: z39.string().optional(),
-  updatedAt: z39.number().optional()
+import { z as z40 } from "zod";
+var envSchema = z40.object({
+  id: z40.string(),
+  key: z40.string(),
+  target: z40.array(z40.string()),
+  type: z40.string(),
+  comment: z40.string().optional(),
+  updatedAt: z40.number().optional()
 });
-var deploymentSchema = z39.object({
-  id: z39.string(),
-  projectId: z39.string(),
-  ownerId: z39.string().optional(),
-  target: z39.string().nullable(),
-  readyState: z39.string(),
-  createdAt: z39.number(),
-  url: z39.string(),
-  meta: z39.record(z39.string(), z39.unknown()).optional(),
-  gitSource: z39.object({ sha: z39.string().optional() }).nullable().optional()
+var deploymentSchema = z40.object({
+  id: z40.string(),
+  projectId: z40.string(),
+  ownerId: z40.string().optional(),
+  target: z40.string().nullable(),
+  readyState: z40.string(),
+  createdAt: z40.number(),
+  url: z40.string(),
+  meta: z40.record(z40.string(), z40.unknown()).optional(),
+  gitSource: z40.object({ sha: z40.string().optional() }).nullable().optional()
 });
-var buildProofSchema = z39.object({
-  node: z39.string(),
-  packageManager: z39.enum(["npm", "pnpm"]),
-  packageManagerVersion: z39.string(),
-  lockfileHash: z39.string(),
-  revision: z39.string(),
-  fieldContractHash: z39.string(),
-  siteplane: z39.string(),
-  runtimeNext: z39.string(),
-  analytics: z39.string().optional(),
-  next: z39.string(),
-  react: z39.string()
+var buildProofSchema = z40.object({
+  node: z40.string(),
+  packageManager: z40.enum(["npm", "pnpm"]),
+  packageManagerVersion: z40.string(),
+  lockfileHash: z40.string(),
+  revision: z40.string(),
+  fieldContractHash: z40.string(),
+  siteplane: z40.string(),
+  runtimeNext: z40.string(),
+  analytics: z40.string().optional(),
+  next: z40.string(),
+  react: z40.string()
 }).strict();
 var digest = (value) => `sha256:${createHash4("sha256").update(stableJsonStringify(value)).digest("hex")}`;
 function fail2(code, message) {
@@ -5902,12 +5963,12 @@ async function setupDeployCommand(input, deps = defaults) {
       remaining();
       return result2;
     };
-    const domains = z39.object({
-      domains: z39.array(z39.object({
-        name: z39.string(),
-        verified: z39.boolean(),
-        redirect: z39.string().nullable().optional(),
-        gitBranch: z39.string().nullable().optional()
+    const domains = z40.object({
+      domains: z40.array(z40.object({
+        name: z40.string(),
+        verified: z40.boolean(),
+        redirect: z40.string().nullable().optional(),
+        gitBranch: z40.string().nullable().optional()
       }))
     }).parse(await api(`/v9/projects/${provider.projectId}/domains?${scope}`)).domains.filter((domain) => domain.verified && !domain.redirect && !domain.gitBranch);
     const origin = record?.origin ?? (domains.length === 1 ? `https://${domains[0].name}` : null);
@@ -5915,7 +5976,7 @@ async function setupDeployCommand(input, deps = defaults) {
       fail2("production_origin_ambiguous", "The linked project needs one verified canonical Production domain, or the existing setup domain must still belong to it.");
     if (record && (record.projectId !== provider.projectId || record.teamId !== provider.teamId))
       fail2("deployment_target_conflict", "This setup already belongs to a different provider project/team. Restore its original local link.");
-    const listEnv = async () => z39.object({ envs: z39.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
+    const listEnv = async () => z40.object({ envs: z40.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
     let env = await listEnv();
     const owned = (key) => {
       const matches2 = env.filter((item) => item.key === key && item.target.includes("production"));
@@ -5988,9 +6049,9 @@ async function setupDeployCommand(input, deps = defaults) {
         expectedOperationId: record?.operationId ?? null,
         record: next
       });
-      const parsed = z39.object({
-        ok: z39.literal(true),
-        data: z39.object({ record: setupDeploymentRecordSchema }).strict()
+      const parsed = z40.object({
+        ok: z40.literal(true),
+        data: z40.object({ record: setupDeploymentRecordSchema }).strict()
       }).strict().safeParse(result2.payload);
       if (!result2.ok || !parsed.success || stableJsonStringify(parsed.data.data.record) !== stableJsonStringify(next))
         fail2("deployment_record_unconfirmed", "The setup deployment record was not acknowledged. Reload context before continuing; no deployment is blindly repeated.");
@@ -6040,7 +6101,7 @@ async function setupDeployCommand(input, deps = defaults) {
       const item = owned(key);
       if (key === "SITEPLANE_ADMIN_SESSION_SECRET" && item && record.phase === "verified")
         continue;
-      const current = item ? z39.object({ key: z39.literal(key), value: z39.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`)).value : null;
+      const current = item ? z40.object({ key: z40.literal(key), value: z40.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`)).value : null;
       if (current !== value)
         pending.push({
           key,
@@ -6065,7 +6126,7 @@ async function setupDeployCommand(input, deps = defaults) {
         const item = owned(key);
         if (!item)
           fail2("environment_write_unconfirmed", "A Siteplane Production binding was not persisted; retry the same configuration.");
-        const observed = z39.object({ key: z39.literal(key), value: z39.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`));
+        const observed = z40.object({ key: z40.literal(key), value: z40.string() }).parse(await api(`/v1/projects/${provider.projectId}/env/${encodeURIComponent(item.id)}?${scope}`));
         if (observed.value !== value)
           fail2("environment_write_unconfirmed", "The provider readback does not match the authorized Siteplane value; no deployment was started.");
       }
@@ -6078,7 +6139,7 @@ async function setupDeployCommand(input, deps = defaults) {
     const detail = async (id) => deploymentSchema.parse(await api(`/v13/deployments/${encodeURIComponent(id)}?${scope}&withGitRepoInfo=true`));
     const matches = (deployment2) => deployment2.projectId === provider.projectId && deployment2.target === "production" && (!deployment2.ownerId || deployment2.ownerId === provider.teamId) && deployment2.createdAt >= Date.parse(record.environmentWrittenAt) && (deployment2.meta?.siteplaneOperationId === record.operationId || provider.git && (deployment2.gitSource?.sha ?? deployment2.meta?.githubCommitSha ?? deployment2.meta?.gitlabCommitSha ?? deployment2.meta?.bitbucketCommitSha ?? deployment2.meta?.gitCommitSha) === revision);
     const discover = async () => {
-      const result2 = z39.object({ deployments: z39.array(z39.object({ uid: z39.string() })) }).parse(await api(`/v6/deployments?${scope}&projectId=${provider.projectId}&target=production&since=${Date.parse(record.environmentWrittenAt)}&limit=100`));
+      const result2 = z40.object({ deployments: z40.array(z40.object({ uid: z40.string() })) }).parse(await api(`/v6/deployments?${scope}&projectId=${provider.projectId}&target=production&since=${Date.parse(record.environmentWrittenAt)}&limit=100`));
       const candidates = [];
       for (const item of result2.deployments) {
         const found = await detail(item.uid);
@@ -6252,9 +6313,91 @@ async function setupDeployCommand(input, deps = defaults) {
   }
 }
 
+// ../cli/dist/commands/setup-claim.js
+import { z as z41 } from "zod";
+async function setupClaimCommand(input) {
+  const code = setupClaimCodeSchema.safeParse(input.code);
+  const requestId = z41.string().uuid().safeParse(input.claimRequestId);
+  if (!code.success || input.action === "confirm" && !requestId.success)
+    return required("invalid_claim_request", "Inspect the code from your review, then confirm that concrete request with --code and --request after the user's explicit approval.");
+  const [config, credentials] = await Promise.all([readProjectConfig(input.projectDir), readLocalCredentials(input.projectDir)]);
+  const stored = credentials.claimReceipt;
+  if (stored && (stored.siteId !== config.siteId || stored.runId !== config.runId))
+    return required("claim_binding_mismatch", "Restore the matching local project configuration and credentials.");
+  if (stored && (input.action !== "confirm" || stored.requestId !== input.claimRequestId))
+    return required("already_claimed", "This installation already has a saved claim receipt. Continue the existing setup.");
+  if (stored && !credentials.installation)
+    return { status: "claimed", receipt: stored, acknowledgementPending: false };
+  if (!credentials.installation)
+    return required("local_installation_missing", "Claim requires this project's original local installation credentials.");
+  if (new URL(config.apiBaseUrl).origin !== new URL(credentials.installation.apiBaseUrl).origin)
+    return required("installation_origin_mismatch", "Restore the matching local project configuration and credentials.");
+  const send = async (body) => {
+    const response = await (input.fetcher ?? fetch)(new URL("/api/cli/setup/claim", config.apiBaseUrl), {
+      method: "POST",
+      signal: AbortSignal.timeout(2e4),
+      headers: {
+        authorization: `Bearer ${credentials.installation.key}`,
+        "content-type": "application/json",
+        ...input.vercelAutomationBypassSecret ? { "x-vercel-protection-bypass": input.vercelAutomationBypassSecret } : {}
+      },
+      body: JSON.stringify({ siteId: config.siteId, runId: config.runId, ...body })
+    });
+    return { response, payload: await response.json() };
+  };
+  let receipt = stored;
+  if (!receipt) {
+    if (input.action === "confirm")
+      await assertLocalCredentialsPathSafe(input.projectDir);
+    try {
+      const { response, payload } = await send({
+        action: input.action,
+        code: code.data,
+        ...input.action === "confirm" ? { claimRequestId: input.claimRequestId } : {}
+      });
+      if (!response.ok) {
+        const denied = z41.object({ error: z41.object({ code: setupClaimDenialSchema.shape.status }) }).safeParse(payload);
+        return required(denied.success ? denied.data.error.code : "claim_unavailable", "Claim was not acknowledged. Check the review and retry the same request; do not create another project.");
+      }
+      if (input.action === "inspect") {
+        const inspected = z41.object({ ok: z41.literal(true), data: setupClaimInspectionSchema }).strict().parse(payload).data;
+        if (inspected.siteId !== config.siteId || inspected.runId !== config.runId)
+          throw new Error("Claim binding mismatch.");
+        return {
+          status: "pending",
+          request: inspected,
+          nextAction: "Show this account, workspace and website to the user. Only after their explicit approval, run setup claim confirm with the same code and this requestId."
+        };
+      }
+      receipt = z41.object({ ok: z41.literal(true), data: setupClaimReceiptSchema }).strict().parse(payload).data;
+      if (receipt.siteId !== config.siteId || receipt.runId !== config.runId || receipt.requestId !== input.claimRequestId)
+        throw new Error("Claim receipt binding mismatch.");
+    } catch {
+      return required("claim_unavailable", "Claim was not acknowledged. Retry the same code and request so the committed receipt can be recovered.");
+    }
+    await writeLocalCredentials(input.projectDir, { ...credentials, claimReceipt: receipt });
+  }
+  let acknowledgementSettled = false;
+  try {
+    const { response, payload } = await send({ action: "acknowledge", claimRequestId: receipt.requestId });
+    const result2 = z41.object({ ok: z41.literal(true), data: z41.object({ acknowledged: z41.boolean() }).strict() }).strict().safeParse(payload);
+    acknowledgementSettled = response.ok && result2.success;
+  } catch {
+  }
+  if (acknowledgementSettled) {
+    const retained = { ...credentials };
+    delete retained.installation;
+    await writeLocalCredentials(input.projectDir, { ...retained, claimReceipt: receipt });
+  }
+  return { status: "claimed", receipt, acknowledgementPending: !acknowledgementSettled };
+}
+function required(code, message) {
+  return { status: "action_required", code, message };
+}
+
 // src/bin/run-siteplane.ts
 async function runSiteplaneCli(args, dependencies = createDefaultDependencies()) {
-  const writes = args[0] === "init" || args[0] === "analytics" && args[1] === "init" || args[0] === "setup" && ["start", "apply", "prepare", "deploy"].includes(args[1] ?? "");
+  const writes = args[0] === "init" || args[0] === "analytics" && args[1] === "init" || args[0] === "setup" && (["start", "apply", "prepare", "deploy"].includes(args[1] ?? "") || args[1] === "claim" && args[2] === "confirm");
   const missingDeploy = args[0] === "setup" && args[1] === "deploy" && !await access7(join13(dependencies.cwd(), "siteplane.config.json")).then(
     () => true,
     () => false
@@ -6491,6 +6634,20 @@ async function runSetupCommand(args, dependencies) {
     dependencies.stdout(JSON.stringify(result2, null, 2));
     return { exitCode: result2.status === "ready" ? 0 : 1 };
   }
+  if (area === "claim") {
+    const action = areaArgs[0];
+    if (action !== "inspect" && action !== "confirm")
+      throw new Error("Use setup claim inspect --code <code>, then setup claim confirm --code <code> --request <requestId> after the user's explicit approval.");
+    const result2 = await dependencies.commands.setupClaimCommand({
+      projectDir,
+      action,
+      code: readOption(areaArgs, "--code") ?? "",
+      ...readOption(areaArgs, "--request") ? { claimRequestId: readOption(areaArgs, "--request") } : {},
+      ...connectionOptions
+    });
+    dependencies.stdout(JSON.stringify(result2, null, 2));
+    return { exitCode: result2.status === "action_required" ? 1 : 0 };
+  }
   if (area === "context") {
     const result2 = await dependencies.commands.siteSetupContextCommand({
       projectDir,
@@ -6537,7 +6694,7 @@ async function runSetupCommand(args, dependencies) {
     return { exitCode: result2.status === "ready_for_review" ? 0 : 1 };
   }
   dependencies.stdout(
-    "Usage: siteplane setup <start|preflight|prepare|context|activity|apply|deploy|verify|review>"
+    "Usage: siteplane setup <start|preflight|prepare|context|activity|apply|deploy|verify|review|claim>"
   );
   return { exitCode: 1 };
 }
@@ -6678,6 +6835,7 @@ function createDefaultDependencies() {
       setupPreflightCommand,
       setupStartCommand,
       setupReviewCommand,
+      setupClaimCommand,
       setupPrepareCommand,
       setupDeployCommand,
       initCommand,