siteplane 0.1.60 → 0.1.61

package/README.md

@@ -81,7 +81,10 @@ siteplane setup deploy --wait
 
 Commit only intended source before deploy. The CLI securely transfers its Production environment, adopts or
 starts one matching deployment and verifies the actual build and signed runtime. Unchanged resume creates no
-new deployment. A saved 15-minute provider deadline and operation identity prevent blind retries after response
+new deployment. If the linked project has multiple verified, non-redirecting Production domains, select the
+canonical one on the first run with `siteplane setup deploy --wait --production-origin <https-origin>`. The CLI
+rejects foreign, redirect, branch and unverified domains, stores the binding and reuses it on resume. A saved
+15-minute provider deadline and operation identity prevent blind retries after response
 loss. If that deadline expires after the deploy was requested, rerun the same command: each invocation gets a
 bounded 120-second readback of that same operation. A ready result is adopted; a still-running or unreachable
 provider remains resumable and never authorizes a second deploy. Uploads use committed source in a temporary
@@ -102,8 +105,8 @@ Before starting, add `.siteplane/credentials.json` to the repository’s `.gitig
 unprotected credentials before any provisioning request.
 
 ```bash
-npx -y siteplane@0.1.60 setup start --modules editing --instructions-file instructions.txt
-npx -y siteplane@0.1.60 setup context
+npx -y siteplane@0.1.61 setup start --modules editing --instructions-file instructions.txt
+npx -y siteplane@0.1.61 setup context
 ```
 
 Start performs read-only preflight and saves the installation key and original request privately before the

package/dist/bin/siteplane.js

@@ -5605,7 +5605,7 @@ ${task.goal}
 
 ${task.discovery.rules.map((rule) => `- ${rule}`).join("\n")}
 
-Run setup context for the current user instructions and authorized modules. Keep the user instructions distinct from your selection summary. Use setup deploy --wait for environment transfer and deployment; never read or print credential values. If a requested deploy passes its provider deadline, rerun the same command for a bounded readback of that operation; do not start a replacement while its outcome is unresolved. For image fields, withSiteplane adds only the exact Siteplane asset route and website /siteplane-assets/ pattern while preserving existing sources, loaders, and redirect policy. This grants no hosting permission. If the website uses a global or component image loader, keep it and verify Siteplane image delivery explicitly. Inspect CSP written by middleware/proxy/meta tags before deployment. Use the provider-selected public SITEPLANE_SITE_ORIGIN for local builds.
+Run setup context for the current user instructions and authorized modules. Keep the user instructions distinct from your selection summary. Use setup deploy --wait for environment transfer and deployment; never read or print credential values. If the linked provider project has multiple eligible Production domains, choose its canonical verified non-redirecting origin with --production-origin <https-origin>; before an origin-dependent local build use that exact value as SITEPLANE_SITE_ORIGIN, then pass the same origin to setup deploy. Resume reuses the stored choice. If a requested deploy passes its provider deadline, rerun the same command for a bounded readback of that operation; do not start a replacement while its outcome is unresolved. For image fields, withSiteplane adds only the exact Siteplane asset route and website /siteplane-assets/ pattern while preserving existing sources, loaders, and redirect policy. This grants no hosting permission. If the website uses a global or component image loader, keep it and verify Siteplane image delivery explicitly. Inspect CSP written by middleware/proxy/meta tags before deployment. Never use a wildcard, private host or different origin for local builds.
 `);
     for (const [path, content] of files) {
       if (path === layoutPath || path === nextPath || path === guidePath)
@@ -5902,6 +5902,17 @@ var digest = (value) => `sha256:${createHash4("sha256").update(stableJsonStringi
 function fail2(code, message) {
   throw new SetupFailure(code, message);
 }
+function normalizeProductionOrigin(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    fail2("production_origin_invalid", "Choose an absolute public HTTPS origin without a path, query, fragment or credentials.");
+  }
+  if (url.protocol !== "https:" || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+    fail2("production_origin_invalid", "Choose an absolute public HTTPS origin without a path, query, fragment or credentials.");
+  return url.origin;
+}
 var defaults = {
   preflight: setupPreflightCommand,
   context: siteSetupContextCommand,
@@ -5951,16 +5962,8 @@ async function setupDeployCommand(input, deps = defaults) {
         ...record ? { deploymentId: record.deploymentId, deadline: record.deadline } : {}
       };
     const { local, provider } = preflight;
-    if (local.git.changes.length || !local.git.revision || !local.git.branch)
-      fail2("uncommitted_source", "Commit only the intended setup source on a named branch before deployment. Siteplane does not stage, reset or publish unrelated local work.");
-    const revision = local.git.revision;
-    if (!/^[0-9a-f]{40}$/u.test(revision))
-      fail2("invalid_git_revision", "A full committed Git revision is required.");
-    try {
-      await assertExactSetupPackages(local.projectDirectory, config.packages);
-    } catch {
-      fail2("siteplane_package_pin_conflict", "Install the exact Siteplane package versions from the current task and commit their canonical lockfile.");
-    }
+    if (record && (record.projectId !== provider.projectId || record.teamId !== provider.teamId))
+      fail2("deployment_target_conflict", "This setup already belongs to a different provider project/team. Restore its original local link.");
     const recordedOperationDeadline = record && !["verified", "deployed", "failed"].includes(record.phase) ? Date.parse(record.deadline) : null;
     const isExpiredDeployReadback = record?.phase === "deploy_requested" && recordedOperationDeadline !== null && recordedOperationDeadline <= deps.now();
     let operationDeadline = isExpiredDeployReadback ? deps.now() + PROVIDER_RESUME_READBACK_TIMEOUT_MS : recordedOperationDeadline ?? deps.now() + PROVIDER_OPERATION_TIMEOUT_MS;
@@ -5971,14 +5974,9 @@ async function setupDeployCommand(input, deps = defaults) {
         fail2("provider_deadline_exceeded", deadlineExceededMessage);
       return milliseconds;
     };
-    const processCommand = async (binary, args, options) => {
-      const output = await deps.process(binary, args, {
-        ...options,
-        timeoutMs: Math.min(options.timeoutMs ?? 12e4, remaining())
-      });
-      remaining();
-      return output;
-    };
+    const selectedOrigin = input.productionOrigin ? normalizeProductionOrigin(input.productionOrigin) : null;
+    if (record && selectedOrigin && selectedOrigin !== record.origin)
+      fail2("production_origin_conflict", "This setup is already bound to another Production origin. Resume with the stored origin instead of changing it silently.");
     const scope = `teamId=${provider.teamId}`;
     const api = async (endpoint, body, method) => {
       remaining();
@@ -5994,11 +5992,32 @@ async function setupDeployCommand(input, deps = defaults) {
         gitBranch: z40.string().nullable().optional()
       }))
     }).parse(await api(`/v9/projects/${provider.projectId}/domains?${scope}`)).domains.filter((domain) => domain.verified && !domain.redirect && !domain.gitBranch);
-    const origin = record?.origin ?? (domains.length === 1 ? `https://${domains[0].name}` : null);
-    if (!origin || !domains.some((domain) => `https://${domain.name}` === origin))
-      fail2("production_origin_ambiguous", "The linked project needs one verified canonical Production domain, or the existing setup domain must still belong to it.");
-    if (record && (record.projectId !== provider.projectId || record.teamId !== provider.teamId))
-      fail2("deployment_target_conflict", "This setup already belongs to a different provider project/team. Restore its original local link.");
+    const eligibleOrigins = domains.map((domain) => new URL(`https://${domain.name}`).origin);
+    const origin = record?.origin ?? selectedOrigin ?? (eligibleOrigins.length === 1 ? eligibleOrigins[0] : null);
+    if (selectedOrigin && !eligibleOrigins.includes(selectedOrigin))
+      fail2("production_origin_not_bound", "The selected origin must be a verified, non-redirecting Production domain of this linked provider project.");
+    if (!origin)
+      fail2("production_origin_ambiguous", `Choose the canonical Production origin explicitly and rerun setup deploy --wait --production-origin <origin>. Eligible origins: ${eligibleOrigins.sort().join(", ") || "none"}.`);
+    if (!eligibleOrigins.includes(origin))
+      fail2("production_origin_not_bound", "The stored Production origin is no longer a verified, non-redirecting Production domain of this linked provider project.");
+    if (local.git.changes.length || !local.git.revision || !local.git.branch)
+      fail2("uncommitted_source", "Commit only the intended setup source on a named branch before deployment. Siteplane does not stage, reset or publish unrelated local work.");
+    const revision = local.git.revision;
+    if (!/^[0-9a-f]{40}$/u.test(revision))
+      fail2("invalid_git_revision", "A full committed Git revision is required.");
+    try {
+      await assertExactSetupPackages(local.projectDirectory, config.packages);
+    } catch {
+      fail2("siteplane_package_pin_conflict", "Install the exact Siteplane package versions from the current task and commit their canonical lockfile.");
+    }
+    const processCommand = async (binary, args, options) => {
+      const output = await deps.process(binary, args, {
+        ...options,
+        timeoutMs: Math.min(options.timeoutMs ?? 12e4, remaining())
+      });
+      remaining();
+      return output;
+    };
     const listEnv = async () => z40.object({ envs: z40.array(envSchema) }).parse(await api(`/v10/projects/${provider.projectId}/env?${scope}`)).envs;
     let env = await listEnv();
     const owned = (key) => {
@@ -6642,8 +6661,10 @@ async function runSetupCommand(args, dependencies) {
     return { exitCode: 0 };
   }
   if (area === "deploy") {
+    const productionOrigin = readOption(areaArgs, "--production-origin");
     const result2 = await dependencies.commands.setupDeployCommand({
       projectDir,
+      ...productionOrigin ? { productionOrigin } : {},
       onProgress: (progress) => dependencies.stderr(JSON.stringify({ status: "waiting", ...progress }))
     });
     dependencies.stdout(JSON.stringify(result2, null, 2));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "siteplane",
   "private": false,
-  "version": "0.1.60",
+  "version": "0.1.61",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",
   "publishConfig": {