siteplane 0.1.60 → 0.1.62

package/dist/next.js

@@ -2098,8 +2098,95 @@ var editorColorSchemes = editorColorSchemeSchema.options;
 var editorColorModeSchema = z20.enum(["light", "dark"]);
 var editorColorModes = editorColorModeSchema.options;
 
-// ../shared/dist/site-slug.js
+// ../shared/dist/editor-organization.js
 import { z as z21 } from "zod";
+var labelSchema = z21.string().trim().min(1).max(120);
+var updateFieldSchema = z21.object({
+  operation: z21.literal("update_field"),
+  siteId: z21.string().uuid(),
+  fieldId: fieldIdSchema,
+  label: labelSchema.optional(),
+  description: z21.string().trim().max(500).nullable().optional(),
+  section: labelSchema.nullable().optional(),
+  subsection: labelSchema.nullable().optional(),
+  sortOrder: z21.number().int().nonnegative().optional(),
+  status: z21.enum(["hidden", "active"]).optional()
+});
+var updateEditorOrganizationInputSchema = z21.discriminatedUnion("operation", [
+  updateFieldSchema,
+  z21.object({
+    operation: z21.literal("rename_section"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    currentSection: labelSchema,
+    nextSection: labelSchema
+  }),
+  z21.object({
+    operation: z21.literal("create_group"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    section: labelSchema,
+    fieldIds: z21.array(fieldIdSchema).max(200).default([])
+  }),
+  z21.object({
+    operation: z21.literal("delete_section"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    section: labelSchema
+  }),
+  z21.object({
+    operation: z21.literal("move_section"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    section: labelSchema,
+    direction: z21.enum(["up", "down"])
+  }),
+  z21.object({
+    operation: z21.literal("create_subgroup"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    section: labelSchema,
+    subsection: labelSchema,
+    fieldIds: z21.array(fieldIdSchema).min(1).max(200)
+  }),
+  z21.object({
+    operation: z21.literal("update_subgroup"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema,
+    currentSection: labelSchema,
+    currentSubsection: labelSchema,
+    section: labelSchema,
+    subsection: labelSchema.nullable()
+  }),
+  z21.object({
+    operation: z21.literal("rename_route"),
+    siteId: z21.string().uuid(),
+    routeKey: siteFieldRouteKeySchema.refine((value) => value !== "$global", "Global content has no page label."),
+    label: labelSchema
+  })
+]).and(z21.object({
+  review: z21.object({
+    runId: z21.string().uuid(),
+    expectedReviewVersion: z21.number().int().positive()
+  }).strict().optional()
+})).superRefine((input, context) => {
+  if (input.operation === "update_field" && input.label === void 0 && input.description === void 0 && input.section === void 0 && input.subsection === void 0 && input.sortOrder === void 0 && input.status === void 0) {
+    context.addIssue({
+      code: "custom",
+      message: "At least one field organization value is required."
+    });
+  }
+  if (input.operation === "update_field" && input.section === null && typeof input.subsection === "string") {
+    context.addIssue({
+      code: "custom",
+      message: "A subgroup requires a group.",
+      path: ["subsection"]
+    });
+  }
+});
+
+// ../shared/dist/site-slug.js
+import { z as z22 } from "zod";
 var SITE_SLUG_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
 var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "account",
@@ -2116,31 +2203,31 @@ var RESERVED_SITE_SLUGS = /* @__PURE__ */ new Set([
   "support",
   "workspace"
 ]);
-var siteSlugSchema = z21.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
+var siteSlugSchema = z22.string().regex(SITE_SLUG_PATTERN, "Invalid site slug").refine((value) => !RESERVED_SITE_SLUGS.has(value), "Reserved site slug");
 
 // ../shared/dist/entitlements.js
-import { z as z22 } from "zod";
-var entitlementSnapshotSchema = z22.object({
-  planKey: z22.string().trim().min(1),
-  sitesLimit: z22.number().int().positive(),
-  siteMembersPerSiteLimit: z22.number().int().positive(),
-  customAdminDomainsEnabled: z22.boolean(),
-  agentMcpEnabled: z22.boolean(),
-  emailNotificationsEnabled: z22.boolean(),
-  analyticsEnabled: z22.boolean(),
-  analyticsSitesLimit: z22.number().int().min(0),
-  analyticsPortalPerformanceEnabled: z22.boolean(),
-  analyticsMonthlyReportsEnabled: z22.boolean(),
-  analyticsAiSummaryEnabled: z22.boolean(),
-  analyticsRawEventRetentionDays: z22.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
-  analyticsMonthlyEventLimit: z22.number().int().min(0),
-  bookingEnabled: z22.boolean().default(false),
-  bookingSitesLimit: z22.number().int().min(0).default(0),
-  bookingPortalManagementEnabled: z22.boolean().default(false),
-  bookingResourcesPerSiteLimit: z22.number().int().min(0).default(0),
-  bookingServicesPerSiteLimit: z22.number().int().min(0).default(0),
-  bookingMonthlyBookingsLimit: z22.number().int().min(0).default(0),
-  bookingRemindersEnabled: z22.boolean().default(false)
+import { z as z23 } from "zod";
+var entitlementSnapshotSchema = z23.object({
+  planKey: z23.string().trim().min(1),
+  sitesLimit: z23.number().int().positive(),
+  siteMembersPerSiteLimit: z23.number().int().positive(),
+  customAdminDomainsEnabled: z23.boolean(),
+  agentMcpEnabled: z23.boolean(),
+  emailNotificationsEnabled: z23.boolean(),
+  analyticsEnabled: z23.boolean(),
+  analyticsSitesLimit: z23.number().int().min(0),
+  analyticsPortalPerformanceEnabled: z23.boolean(),
+  analyticsMonthlyReportsEnabled: z23.boolean(),
+  analyticsAiSummaryEnabled: z23.boolean(),
+  analyticsRawEventRetentionDays: z23.number().int().min(1).max(ANALYTICS_RETENTION_DEFAULTS.maxRawEventRetentionDaysWithoutAdr),
+  analyticsMonthlyEventLimit: z23.number().int().min(0),
+  bookingEnabled: z23.boolean().default(false),
+  bookingSitesLimit: z23.number().int().min(0).default(0),
+  bookingPortalManagementEnabled: z23.boolean().default(false),
+  bookingResourcesPerSiteLimit: z23.number().int().min(0).default(0),
+  bookingServicesPerSiteLimit: z23.number().int().min(0).default(0),
+  bookingMonthlyBookingsLimit: z23.number().int().min(0).default(0),
+  bookingRemindersEnabled: z23.boolean().default(false)
 });
 var EARLY_ACCESS_PLAN = {
   planKey: "early_access_2026",
@@ -2169,7 +2256,7 @@ var EARLY_ACCESS_PLAN = {
 var maxFirstPartyImageUploadBytes = 4 * 1024 * 1024;
 
 // ../shared/dist/readiness.js
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 var READINESS_CHECK_KEYS = [
   "agent_instructions_installed",
   "runtime_package_connected",
@@ -2184,118 +2271,118 @@ var READINESS_STATUSES = [
   "failing",
   "warning"
 ];
-var readinessCheckKeySchema = z23.enum(READINESS_CHECK_KEYS);
-var readinessStatusSchema = z23.enum(READINESS_STATUSES);
+var readinessCheckKeySchema = z24.enum(READINESS_CHECK_KEYS);
+var readinessStatusSchema = z24.enum(READINESS_STATUSES);
 
 // ../shared/dist/site.js
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var SITE_STATUSES = [
   "setup",
   "active",
   "disabled",
   "archived"
 ];
-var siteStatusSchema = z24.enum(SITE_STATUSES);
-var websiteUrlSchema = z24.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
+var siteStatusSchema = z25.enum(SITE_STATUSES);
+var websiteUrlSchema = z25.string().trim().url().refine((value) => value.startsWith("https://") || value.startsWith("http://"), "Website URL must use http or https");
 
 // ../shared/dist/setup-assets.js
-import { z as z25 } from "zod";
-var configureSetupAssetTargetInputSchema = z25.object({
-  siteId: z25.string().uuid(),
-  runId: z25.string().uuid(),
-  expectedReviewVersion: z25.number().int().positive(),
-  expectedSnapshotHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  mutationId: z25.string().uuid(),
-  expectedApprovalId: z25.string().uuid().nullable(),
-  targetId: z25.string().uuid().nullable(),
-  targetType: z25.enum(["repo_static_assets", "siteplane_managed_fallback"]),
-  approveManagedHosting: z25.boolean()
+import { z as z26 } from "zod";
+var configureSetupAssetTargetInputSchema = z26.object({
+  siteId: z26.string().uuid(),
+  runId: z26.string().uuid(),
+  expectedReviewVersion: z26.number().int().positive(),
+  expectedSnapshotHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  mutationId: z26.string().uuid(),
+  expectedApprovalId: z26.string().uuid().nullable(),
+  targetId: z26.string().uuid().nullable(),
+  targetType: z26.enum(["repo_static_assets", "siteplane_managed_fallback"]),
+  approveManagedHosting: z26.boolean()
 }).strict().refine((value) => value.targetType === "siteplane_managed_fallback" || !value.approveManagedHosting);
-var setupAssetTargetApprovalSchema = z25.object({
-  id: z25.string().uuid(),
-  runId: z25.string().uuid(),
-  reviewVersion: z25.number().int().positive(),
-  snapshotHash: z25.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  targetId: z25.string().uuid(),
-  targetType: z25.enum(["repo_static_assets", "siteplane_managed_fallback"]),
-  targetRevision: z25.number().int().positive(),
-  deploymentOrigin: z25.string().url(),
-  gitConnectionId: z25.string().uuid().nullable(),
-  gitRevision: z25.number().int().positive().nullable(),
-  managedHostingApproved: z25.boolean(),
-  actorUserId: z25.string().uuid(),
-  approvedAt: z25.string().datetime({ offset: true })
+var setupAssetTargetApprovalSchema = z26.object({
+  id: z26.string().uuid(),
+  runId: z26.string().uuid(),
+  reviewVersion: z26.number().int().positive(),
+  snapshotHash: z26.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  targetId: z26.string().uuid(),
+  targetType: z26.enum(["repo_static_assets", "siteplane_managed_fallback"]),
+  targetRevision: z26.number().int().positive(),
+  deploymentOrigin: z26.string().url(),
+  gitConnectionId: z26.string().uuid().nullable(),
+  gitRevision: z26.number().int().positive().nullable(),
+  managedHostingApproved: z26.boolean(),
+  actorUserId: z26.string().uuid(),
+  approvedAt: z26.string().datetime({ offset: true })
 }).strict();
-var setupAssetReadinessSchema = z25.union([
-  z25.object({
-    status: z25.enum([
+var setupAssetReadinessSchema = z26.union([
+  z26.object({
+    status: z26.enum([
       "not_required",
       "needs_choice",
       "stale_setup_review",
       "permission_denied"
     ])
   }).strict(),
-  z25.object({
-    status: z25.literal("stale_approval"),
+  z26.object({
+    status: z26.literal("stale_approval"),
     approval: setupAssetTargetApprovalSchema.optional()
   }).strict(),
-  z25.object({
-    status: z25.literal("not_verified"),
+  z26.object({
+    status: z26.literal("not_verified"),
     approval: setupAssetTargetApprovalSchema,
-    jobId: z25.string().uuid().optional(),
-    checkedAt: z25.string().datetime({ offset: true }).nullable().optional()
+    jobId: z26.string().uuid().optional(),
+    checkedAt: z26.string().datetime({ offset: true }).nullable().optional()
   }).strict(),
-  z25.object({
-    status: z25.enum(["ready", "checking", "retrying"]),
+  z26.object({
+    status: z26.enum(["ready", "checking", "retrying"]),
     approval: setupAssetTargetApprovalSchema,
-    jobId: z25.string().uuid(),
-    checkedAt: z25.string().datetime({ offset: true }).nullable()
+    jobId: z26.string().uuid(),
+    checkedAt: z26.string().datetime({ offset: true }).nullable()
   }).strict().refine((value) => value.status !== "ready" || value.checkedAt !== null)
 ]);
-var checkSetupAssetTargetInputSchema = z25.object({
-  siteId: z25.string().uuid(),
-  runId: z25.string().uuid(),
-  approvalId: z25.string().uuid(),
-  intent: z25.enum(["start", "poll"])
+var checkSetupAssetTargetInputSchema = z26.object({
+  siteId: z26.string().uuid(),
+  runId: z26.string().uuid(),
+  approvalId: z26.string().uuid(),
+  intent: z26.enum(["start", "poll"])
 }).strict();
 
 // ../shared/dist/setup-installation.js
-import { z as z26 } from "zod";
-var setupInstallationRequestSchema = z26.object({
+import { z as z27 } from "zod";
+var setupInstallationRequestSchema = z27.object({
   modules: siteSetupModulesSchema,
   ownerEditabilityNote: siteSetupOwnerEditabilityNoteSchema,
-  provider: z26.object({
-    projectId: z26.string().min(1).max(200),
-    teamId: z26.string().min(1).max(200)
+  provider: z27.object({
+    projectId: z27.string().min(1).max(200),
+    teamId: z27.string().min(1).max(200)
   }).strict()
 }).strict();
 
 // ../shared/dist/setup-claim.js
-import { z as z27 } from "zod";
-var setupClaimCodeSchema = z27.string().regex(/^[0-9A-HJKMNP-TV-Z]{8}$/u);
-var setupClaimBindingSchema = z27.object({
-  siteId: z27.string().uuid(),
-  runId: z27.string().uuid()
+import { z as z28 } from "zod";
+var setupClaimCodeSchema = z28.string().regex(/^[0-9A-HJKMNP-TV-Z]{8}$/u);
+var setupClaimBindingSchema = z28.object({
+  siteId: z28.string().uuid(),
+  runId: z28.string().uuid()
 });
 var setupClaimReceiptSchema = setupClaimBindingSchema.extend({
-  status: z27.literal("claimed"),
-  requestId: z27.string().uuid(),
-  workspaceId: z27.string().uuid(),
-  userId: z27.string().uuid(),
-  claimedAt: z27.string().datetime({ offset: true })
+  status: z28.literal("claimed"),
+  requestId: z28.string().uuid(),
+  workspaceId: z28.string().uuid(),
+  userId: z28.string().uuid(),
+  claimedAt: z28.string().datetime({ offset: true })
 }).strict();
 var setupClaimInspectionSchema = setupClaimBindingSchema.extend({
-  status: z27.literal("pending"),
-  requestId: z27.string().uuid(),
-  siteName: z27.string(),
-  userId: z27.string().uuid(),
-  accountEmail: z27.string().email(),
-  workspaceId: z27.string().uuid(),
-  workspaceName: z27.string(),
-  expiresAt: z27.string().datetime({ offset: true })
+  status: z28.literal("pending"),
+  requestId: z28.string().uuid(),
+  siteName: z28.string(),
+  userId: z28.string().uuid(),
+  accountEmail: z28.string().email(),
+  workspaceId: z28.string().uuid(),
+  workspaceName: z28.string(),
+  expiresAt: z28.string().datetime({ offset: true })
 }).strict();
-var setupClaimDenialSchema = z27.object({
-  status: z27.enum([
+var setupClaimDenialSchema = z28.object({
+  status: z28.enum([
     "invalid_claim_request",
     "invalid_installation",
     "already_claimed",
@@ -2363,16 +2450,16 @@ function createAnalyticsCliRequestHeaders(config) {
 }
 
 // ../cli/dist/commands/analytics/public-key.js
-import { z as z28 } from "zod";
-var responseSchema = z28.object({
-  ok: z28.literal(true),
-  data: z28.object({
-    rawPublicKey: z28.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
+import { z as z29 } from "zod";
+var responseSchema = z29.object({
+  ok: z29.literal(true),
+  data: z29.object({
+    rawPublicKey: z29.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/)
   })
 });
-var errorResponseSchema = z28.object({
-  error: z28.object({
-    code: z28.string().regex(/^[a-z][a-z0-9_.-]+$/u)
+var errorResponseSchema = z29.object({
+  error: z29.object({
+    code: z29.string().regex(/^[a-z][a-z0-9_.-]+$/u)
   })
 });
 async function analyticsPublicKeyCommand(input) {
@@ -2394,13 +2481,13 @@ async function analyticsPublicKeyCommand(input) {
 }
 
 // ../cli/dist/commands/analytics/prepare.js
-import { z as z29 } from "zod";
-var resultSchema = z29.object({
-  ok: z29.literal(true),
-  data: z29.object({
-    rawPublicKey: z29.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
-    generation: z29.number().int().positive(),
-    status: z29.enum([
+import { z as z30 } from "zod";
+var resultSchema = z30.object({
+  ok: z30.literal(true),
+  data: z30.object({
+    rawPublicKey: z30.string().regex(/^pk_siteplane_[A-Za-z0-9_-]{16}_[A-Za-z0-9_-]{43}$/u),
+    generation: z30.number().int().positive(),
+    status: z30.enum([
       "setup_started",
       "test_mode",
       "active",
@@ -2410,8 +2497,8 @@ var resultSchema = z29.object({
     ])
   }).strict()
 }).strict();
-var errorSchema = z29.object({
-  error: z29.object({ code: z29.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
+var errorSchema = z30.object({
+  error: z30.object({ code: z30.string().regex(/^[a-z][a-z0-9_.-]+$/u) })
 });
 
 // ../cli/dist/commands/analytics/test.js
@@ -2444,19 +2531,19 @@ ${bookingRulesTemplate}`;
 import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
 import { join as join3 } from "path";
-import { z as z30 } from "zod";
-var siteplaneProjectConfigSchema = z30.object({
-  version: z30.literal(2),
-  apiBaseUrl: z30.string().url(),
-  siteId: z30.string().uuid(),
-  publicSiteKeyId: z30.string().uuid(),
-  publicSiteKey: z30.string().trim().min(1),
-  runId: z30.string().uuid(),
-  appDirectory: z30.string().min(1),
-  taskContractVersion: z30.literal("siteplane.setup-task.v2"),
-  adminProtocolVersion: z30.literal(2),
+import { z as z31 } from "zod";
+var siteplaneProjectConfigSchema = z31.object({
+  version: z31.literal(2),
+  apiBaseUrl: z31.string().url(),
+  siteId: z31.string().uuid(),
+  publicSiteKeyId: z31.string().uuid(),
+  publicSiteKey: z31.string().trim().min(1),
+  runId: z31.string().uuid(),
+  appDirectory: z31.string().min(1),
+  taskContractVersion: z31.literal("siteplane.setup-task.v2"),
+  adminProtocolVersion: z31.literal(2),
   packages: siteSetupPackagesSchema,
-  fieldContractHash: z30.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
+  fieldContractHash: z31.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectConfig(projectDir) {
   return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
@@ -2468,27 +2555,27 @@ import { randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
 import { dirname as dirname5, join as join4, relative } from "path";
 import { promisify } from "util";
-import { z as z31 } from "zod";
-var localSetupInstallationSchema = z31.object({
-  key: z31.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  idempotencyKey: z31.string().uuid(),
-  apiBaseUrl: z31.string().url(),
+import { z as z32 } from "zod";
+var localSetupInstallationSchema = z32.object({
+  key: z32.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  idempotencyKey: z32.string().uuid(),
+  apiBaseUrl: z32.string().url(),
   request: setupInstallationRequestSchema,
-  bootstrapAcknowledged: z31.boolean()
+  bootstrapAcknowledged: z32.boolean()
 }).strict();
-var siteplaneCredentialsSchema = z31.object({
-  accessToken: z31.string().trim().min(1),
-  siteRevalidationSecret: z31.string().trim().min(1),
+var siteplaneCredentialsSchema = z32.object({
+  accessToken: z32.string().trim().min(1),
+  siteRevalidationSecret: z32.string().trim().min(1),
   installation: localSetupInstallationSchema.optional(),
   claimReceipt: setupClaimReceiptSchema.optional(),
-  adminSession: z31.object({
-    secret: z31.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-    generation: z31.string().uuid()
+  adminSession: z32.object({
+    secret: z32.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+    generation: z32.string().uuid()
   }).strict().optional()
 }).strict();
-var localSetupCredentialsSchema = z31.union([
+var localSetupCredentialsSchema = z32.union([
   siteplaneCredentialsSchema,
-  z31.object({ installation: localSetupInstallationSchema }).strict()
+  z32.object({ installation: localSetupInstallationSchema }).strict()
 ]);
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
   const path = join4(projectDir, ".siteplane/credentials.json");
@@ -2549,7 +2636,7 @@ async function gitPathMatches(projectDir, path, command) {
 // ../cli/dist/commands/init.js
 import { access as access3 } from "fs/promises";
 import { join as join7, relative as relative3 } from "path";
-import { z as z34 } from "zod";
+import { z as z35 } from "zod";
 
 // ../cli/dist/commands/setup-preflight.js
 import { createHash as createHash2 } from "crypto";
@@ -2561,11 +2648,11 @@ import { parse as parseYaml } from "yaml";
 import { createRequire } from "module";
 import { readFile as readFile7 } from "fs/promises";
 import { join as join5 } from "path";
-import { z as z32 } from "zod";
-var packageSchema = z32.object({
-  name: z32.string().optional(),
-  version: z32.string(),
-  peerDependencies: z32.record(z32.string(), z32.string()).optional()
+import { z as z33 } from "zod";
+var packageSchema = z33.object({
+  name: z33.string().optional(),
+  version: z33.string(),
+  peerDependencies: z33.record(z33.string(), z33.string()).optional()
 });
 async function readInstalledPackage(projectDir, name2) {
   const require2 = createRequire(join5(projectDir, "package.json"));
@@ -2583,7 +2670,7 @@ async function readInstalledPackage(projectDir, name2) {
 // ../cli/dist/commands/setup-preflight.js
 import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
 import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
-import { z as z33 } from "zod";
+import { z as z34 } from "zod";
 
 // ../cli/dist/commands/setup-process.js
 import { spawn } from "child_process";
@@ -2684,29 +2771,29 @@ async function setupVercelApi(cwd, endpoint, body, method, options) {
 }
 
 // ../cli/dist/commands/setup-preflight.js
-var manifestSchema = z33.object({
-  packageManager: z33.string().optional(),
-  engines: z33.object({ node: z33.string().optional() }).optional(),
-  dependencies: z33.record(z33.string(), z33.string()).optional(),
-  devDependencies: z33.record(z33.string(), z33.string()).optional(),
-  scripts: z33.record(z33.string(), z33.string()).optional(),
-  workspaces: z33.unknown().optional()
+var manifestSchema = z34.object({
+  packageManager: z34.string().optional(),
+  engines: z34.object({ node: z34.string().optional() }).optional(),
+  dependencies: z34.record(z34.string(), z34.string()).optional(),
+  devDependencies: z34.record(z34.string(), z34.string()).optional(),
+  scripts: z34.record(z34.string(), z34.string()).optional(),
+  workspaces: z34.unknown().optional()
 });
-var vercelProjectSchema = z33.object({
-  id: z33.string(),
-  accountId: z33.string(),
-  name: z33.string(),
-  nodeVersion: z33.string().nullable().optional(),
-  rootDirectory: z33.string().nullable().optional(),
-  framework: z33.string().nullable().optional(),
-  installCommand: z33.string().nullable().optional(),
-  buildCommand: z33.string().nullable().optional(),
-  link: z33.object({
-    type: z33.string(),
-    repo: z33.string().optional(),
-    repoId: z33.union([z33.string(), z33.number()]).optional(),
-    org: z33.string().optional(),
-    productionBranch: z33.string().optional()
+var vercelProjectSchema = z34.object({
+  id: z34.string(),
+  accountId: z34.string(),
+  name: z34.string(),
+  nodeVersion: z34.string().nullable().optional(),
+  rootDirectory: z34.string().nullable().optional(),
+  framework: z34.string().nullable().optional(),
+  installCommand: z34.string().nullable().optional(),
+  buildCommand: z34.string().nullable().optional(),
+  link: z34.object({
+    type: z34.string(),
+    repo: z34.string().optional(),
+    repoId: z34.union([z34.string(), z34.number()]).optional(),
+    org: z34.string().optional(),
+    productionBranch: z34.string().optional()
   }).nullable().optional()
 });
 var exists = async (path) => access2(path).then(() => true, () => false);
@@ -2763,9 +2850,9 @@ async function inspectSetupLocalProject(projectDir) {
   const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
   if (lockfileRoot !== projectDirectory) {
     const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
-    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z33.object({ packages: z33.array(z33.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z33.union([
-      z33.array(z33.string()),
-      z33.object({ packages: z33.array(z33.string()) }).transform((value) => value.packages)
+    const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z34.object({ packages: z34.array(z34.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z34.union([
+      z34.array(z34.string()),
+      z34.object({ packages: z34.array(z34.string()) }).transform((value) => value.packages)
     ]).parse(rootManifest.workspaces);
     const selected = relative2(lockfileRoot, projectDirectory).split(sep).join("/");
     if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
@@ -2779,11 +2866,11 @@ async function inspectSetupLocalProject(projectDir) {
       break;
   }
   const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
-  const npmLock = lockName === "package-lock.json" ? z33.object({
-    lockfileVersion: z33.number(),
-    packages: z33.record(z33.string(), z33.object({
-      version: z33.string().optional(),
-      peerDependencies: z33.record(z33.string(), z33.string()).optional()
+  const npmLock = lockName === "package-lock.json" ? z34.object({
+    lockfileVersion: z34.number(),
+    packages: z34.record(z34.string(), z34.object({
+      version: z34.string().optional(),
+      peerDependencies: z34.record(z34.string(), z34.string()).optional()
     })).optional()
   }).parse(JSON.parse(lockText)) : null;
   async function version2(name3) {
@@ -2921,9 +3008,9 @@ async function setupPreflightCommand(input) {
       linkDirectory = dirname6(linkDirectory);
     if (!await exists(join6(linkDirectory, ".vercel/project.json")))
       fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
-    const linked = z33.object({
-      projectId: z33.string().regex(/^prj_[A-Za-z0-9]+$/u),
-      orgId: z33.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
+    const linked = z34.object({
+      projectId: z34.string().regex(/^prj_[A-Za-z0-9]+$/u),
+      orgId: z34.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
     }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
     const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
     if (project.id !== linked.projectId || project.accountId !== linked.orgId)
@@ -2937,11 +3024,11 @@ async function setupPreflightCommand(input) {
       fail("vercel_production_branch_conflict", "The local branch differs from the bound Vercel Production branch.");
     if (project.link?.repo && project.link.org && !local.git.remote?.replace(/\.git$/u, "").endsWith(`${project.link.org}/${project.link.repo}`))
       fail("vercel_git_conflict", "The local origin repository differs from the Vercel Git connection.");
-    const env = z33.object({
-      envs: z33.array(z33.object({
-        key: z33.string(),
-        value: z33.string().optional(),
-        target: z33.array(z33.string()).optional()
+    const env = z34.object({
+      envs: z34.array(z34.object({
+        key: z34.string(),
+        value: z34.string().optional(),
+        target: z34.array(z34.string()).optional()
       }))
     }).parse(await setupVercelApi(linkDirectory, `/v10/projects/${linked.projectId}/env?teamId=${linked.orgId}`));
     const corepack = env.envs.some((item) => item.key === "ENABLE_EXPERIMENTAL_COREPACK" && item.value === "1" && item.target?.includes("production"));
@@ -2959,6 +3046,11 @@ async function setupPreflightCommand(input) {
       fail("vercel_package_manager_conflict", "The provider install command conflicts with the canonical lockfile.");
     if (overridePin && local.packageManager.declared && `${overridePin[1]}@${overridePin[2]}` !== local.packageManager.declared)
       fail("vercel_package_manager_conflict", "The Vercel install override conflicts with the exact packageManager declaration.");
+    const build = project.buildCommand;
+    const buildPin = build ? /\b(npm|pnpm|yarn|bun)@(\d+\.\d+\.\d+)\b/u.exec(build) : null;
+    const buildFamily = buildPin?.[1] ?? (build ? /(?:^|[;&|]\s*)(npm|pnpm|yarn|bun)\s+(?:run\s+)?build\b/u.exec(build)?.[1] : null);
+    if (buildFamily && (buildFamily !== local.packageManager.name || buildPin && local.packageManager.declared && `${buildPin[1]}@${buildPin[2]}` !== local.packageManager.declared))
+      fail("vercel_package_manager_conflict", "The explicit Vercel build command conflicts with the selected package manager or its declared version. Align the existing build override and rerun preflight; no setup writes were performed.");
     return {
       status: "ready",
       local,
@@ -3003,26 +3095,26 @@ function safeGitRemote(value) {
 }
 
 // ../cli/dist/commands/init.js
-var siteSetupBootstrapDataSchema = z34.object({
-  credentialPurpose: z34.literal("site_setup"),
-  apiBaseUrl: z34.string().url(),
-  siteId: z34.string().uuid(),
-  publicSiteKeyId: z34.string().uuid(),
-  publicSiteKey: z34.string().trim().min(1),
-  accessToken: z34.string().trim().min(1),
-  siteRevalidationSecret: z34.string().regex(/^[A-Za-z0-9_-]{43}$/u),
-  runId: z34.string().uuid(),
+var siteSetupBootstrapDataSchema = z35.object({
+  credentialPurpose: z35.literal("site_setup"),
+  apiBaseUrl: z35.string().url(),
+  siteId: z35.string().uuid(),
+  publicSiteKeyId: z35.string().uuid(),
+  publicSiteKey: z35.string().trim().min(1),
+  accessToken: z35.string().trim().min(1),
+  siteRevalidationSecret: z35.string().regex(/^[A-Za-z0-9_-]{43}$/u),
+  runId: z35.string().uuid(),
   packages: siteSetupPackagesSchema
 }).strict();
-var featureBootstrapDataSchema = z34.object({
-  credentialPurpose: z34.enum(["analytics", "booking"]),
-  apiBaseUrl: z34.string().url(),
-  siteId: z34.string().uuid(),
-  accessToken: z34.string().trim().min(1)
+var featureBootstrapDataSchema = z35.object({
+  credentialPurpose: z35.enum(["analytics", "booking"]),
+  apiBaseUrl: z35.string().url(),
+  siteId: z35.string().uuid(),
+  accessToken: z35.string().trim().min(1)
 }).strict();
-var bootstrapResponseSchema = z34.object({
-  ok: z34.literal(true),
-  data: z34.discriminatedUnion("credentialPurpose", [
+var bootstrapResponseSchema = z35.object({
+  ok: z35.literal(true),
+  data: z35.discriminatedUnion("credentialPurpose", [
     siteSetupBootstrapDataSchema,
     featureBootstrapDataSchema
   ])
@@ -3073,7 +3165,7 @@ async function collectSourceFiles(directory) {
 import { execFile as execFile2 } from "child_process";
 import { readFile as readFile9 } from "fs/promises";
 import { promisify as promisify2 } from "util";
-import { z as z35 } from "zod";
+import { z as z36 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
 import ts2 from "typescript";
@@ -3778,32 +3870,32 @@ function isPositionalFieldReference(value) {
 
 // ../cli/dist/commands/site-setup.js
 var execFileAsync2 = promisify2(execFile2);
-var safeErrorSchema = z35.object({
-  code: z35.string().trim().min(1),
-  message: z35.string().trim().min(1)
+var safeErrorSchema = z36.object({
+  code: z36.string().trim().min(1),
+  message: z36.string().trim().min(1)
 }).passthrough();
-var errorResponseSchema2 = z35.object({ ok: z35.literal(false), error: safeErrorSchema }).passthrough();
-var contextDataSchema = z35.object({
+var errorResponseSchema2 = z36.object({ ok: z36.literal(false), error: safeErrorSchema }).passthrough();
+var contextDataSchema = z36.object({
   task: siteSetupTaskSchema.refine((task) => task.run !== null)
 }).strict();
-var contextResponseSchema = z35.object({ ok: z35.literal(true), data: contextDataSchema }).strict();
-var applyDataSchema = z35.object({
-  status: z35.enum(["applied", "ready_for_review"]),
-  runId: z35.string().uuid().optional(),
-  contractVersionId: z35.string().uuid().optional(),
-  fieldContractHash: z35.string().regex(/^sha256:[0-9a-f]{64}$/u),
-  editorDefinitionHash: z35.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
-  fieldCount: z35.number().int().nonnegative().optional(),
-  routeCount: z35.number().int().nonnegative().optional()
+var contextResponseSchema = z36.object({ ok: z36.literal(true), data: contextDataSchema }).strict();
+var applyDataSchema = z36.object({
+  status: z36.enum(["applied", "ready_for_review"]),
+  runId: z36.string().uuid().optional(),
+  contractVersionId: z36.string().uuid().optional(),
+  fieldContractHash: z36.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  editorDefinitionHash: z36.string().regex(/^sha256:[0-9a-f]{64}$/u).optional(),
+  fieldCount: z36.number().int().nonnegative().optional(),
+  routeCount: z36.number().int().nonnegative().optional()
 }).strict();
-var applyResponseSchema = z35.object({ ok: z35.literal(true), data: applyDataSchema }).strict();
-var verifyDataSchema = z35.object({
-  status: z35.literal("ready_for_review"),
-  runId: z35.string().uuid().optional(),
-  deploymentOrigin: z35.string().url().optional(),
-  deploymentRevision: z35.string().optional()
+var applyResponseSchema = z36.object({ ok: z36.literal(true), data: applyDataSchema }).strict();
+var verifyDataSchema = z36.object({
+  status: z36.literal("ready_for_review"),
+  runId: z36.string().uuid().optional(),
+  deploymentOrigin: z36.string().url().optional(),
+  deploymentRevision: z36.string().optional()
 }).strict();
-var verifyResponseSchema = z35.object({ ok: z35.literal(true), data: verifyDataSchema }).strict();
+var verifyResponseSchema = z36.object({ ok: z36.literal(true), data: verifyDataSchema }).strict();
 async function siteSetupContextCommand(input) {
   const response = await postSiteSetup(input, "context", {});
   const parsed = contextResponseSchema.safeParse(response.payload);
@@ -3900,19 +3992,19 @@ async function readGitRevision(projectDir) {
 import { randomBytes, randomUUID as randomUUID4 } from "crypto";
 import { access as access4 } from "fs/promises";
 import { join as join9, relative as relative5 } from "path";
-import { z as z36 } from "zod";
-var bootstrapResponseSchema2 = z36.object({
-  ok: z36.literal(true),
+import { z as z37 } from "zod";
+var bootstrapResponseSchema2 = z37.object({
+  ok: z37.literal(true),
   data: siteSetupBootstrapDataSchema
 }).strict();
 
 // ../cli/dist/commands/setup-review.js
-import { z as z37 } from "zod";
-var responseSchema2 = z37.object({
-  ok: z37.literal(true),
-  data: z37.object({
-    reviewUrl: z37.string().url(),
-    expiresAt: z37.string().datetime({ offset: true })
+import { z as z38 } from "zod";
+var responseSchema2 = z38.object({
+  ok: z38.literal(true),
+  data: z38.object({
+    reviewUrl: z38.string().url(),
+    expiresAt: z38.string().datetime({ offset: true })
   }).strict()
 }).strict();
 
@@ -3926,8 +4018,8 @@ import ts3 from "typescript";
 import { randomUUID as randomUUID6 } from "crypto";
 import { lstat as lstat3, mkdir as mkdir7, open as open4, readFile as readFile11, rm as rm4, rmdir } from "fs/promises";
 import { resolve as resolve2 } from "path";
-import { z as z38 } from "zod";
-var ownerSchema = z38.object({ pid: z38.number().int().positive(), nonce: z38.string().uuid() }).strict();
+import { z as z39 } from "zod";
+var ownerSchema = z39.object({ pid: z39.number().int().positive(), nonce: z39.string().uuid() }).strict();
 
 // ../cli/dist/config/build-provenance.js
 import { createHash as createHash3 } from "crypto";
@@ -3935,23 +4027,23 @@ import { execFile as execFile3 } from "child_process";
 import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute2, join as join11, relative as relative7, resolve as resolve3, sep as sep3 } from "path";
 import { isDeepStrictEqual, promisify as promisify3 } from "util";
-import { z as z39 } from "zod";
+import { z as z40 } from "zod";
 var execute = promisify3(execFile3);
 var name = ".siteplane/build-source.json";
-var oid = z39.string().regex(/^[0-9a-f]{40}$/u);
-var entrySchema = z39.object({
-  path: z39.string().min(1).max(4096),
-  mode: z39.enum(["100644", "100755", "120000"]),
+var oid = z40.string().regex(/^[0-9a-f]{40}$/u);
+var entrySchema = z40.object({
+  path: z40.string().min(1).max(4096),
+  mode: z40.enum(["100644", "100755", "120000"]),
   oid
 }).strict();
-var schema = z39.object({
-  version: z39.literal(2),
+var schema = z40.object({
+  version: z40.literal(2),
   revision: oid,
-  commit: z39.string().min(1).max(1048576),
-  entries: z39.array(entrySchema).min(1).max(1e5),
-  providerConfigurations: z39.array(z39.object({
-    path: z39.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
-    source: z39.string().max(1048576)
+  commit: z40.string().min(1).max(1048576),
+  entries: z40.array(entrySchema).min(1).max(1e5),
+  providerConfigurations: z40.array(z40.object({
+    path: z40.string().max(4096).regex(/(?:^|\/)vercel\.json$/u),
+    source: z40.string().max(1048576)
   }).strict()).max(1e3)
 }).strict();
 var gitHash = (type, content) => createHash3("sha1").update(`${type} ${content.length}\0`).update(content).digest("hex");
@@ -4051,7 +4143,7 @@ async function readBuildProvenance(projectDirectory) {
       const original = configurations.get(entry.path);
       if (contents && original && entry.mode !== "120000") {
         try {
-          const object = z39.record(z39.string(), z39.unknown());
+          const object = z40.record(z40.string(), z40.unknown());
           const actual = object.parse(JSON.parse(contents.toString("utf8")));
           const expected = object.parse(JSON.parse(original));
           if (!Object.hasOwn(expected, "version") && actual.version === 2)
@@ -4105,38 +4197,38 @@ import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as r
 import { access as access6, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join12 } from "path";
-import { z as z40 } from "zod";
-var envSchema = z40.object({
-  id: z40.string(),
-  key: z40.string(),
-  target: z40.array(z40.string()),
-  type: z40.string(),
-  comment: z40.string().optional(),
-  updatedAt: z40.number().optional()
+import { z as z41 } from "zod";
+var envSchema = z41.object({
+  id: z41.string(),
+  key: z41.string(),
+  target: z41.array(z41.string()),
+  type: z41.string(),
+  comment: z41.string().optional(),
+  updatedAt: z41.number().optional()
 });
-var deploymentSchema = z40.object({
-  id: z40.string(),
-  projectId: z40.string(),
-  ownerId: z40.string().optional(),
-  target: z40.string().nullable(),
-  readyState: z40.string(),
-  createdAt: z40.number(),
-  url: z40.string(),
-  meta: z40.record(z40.string(), z40.unknown()).optional(),
-  gitSource: z40.object({ sha: z40.string().optional() }).nullable().optional()
+var deploymentSchema = z41.object({
+  id: z41.string(),
+  projectId: z41.string(),
+  ownerId: z41.string().optional(),
+  target: z41.string().nullable(),
+  readyState: z41.string(),
+  createdAt: z41.number(),
+  url: z41.string(),
+  meta: z41.record(z41.string(), z41.unknown()).optional(),
+  gitSource: z41.object({ sha: z41.string().optional() }).nullable().optional()
 });
-var buildProofSchema = z40.object({
-  node: z40.string(),
-  packageManager: z40.enum(["npm", "pnpm"]),
-  packageManagerVersion: z40.string(),
-  lockfileHash: z40.string(),
-  revision: z40.string(),
-  fieldContractHash: z40.string(),
-  siteplane: z40.string(),
-  runtimeNext: z40.string(),
-  analytics: z40.string().optional(),
-  next: z40.string(),
-  react: z40.string()
+var buildProofSchema = z41.object({
+  node: z41.string(),
+  packageManager: z41.enum(["npm", "pnpm"]),
+  packageManagerVersion: z41.string(),
+  lockfileHash: z41.string(),
+  revision: z41.string(),
+  fieldContractHash: z41.string(),
+  siteplane: z41.string(),
+  runtimeNext: z41.string(),
+  analytics: z41.string().optional(),
+  next: z41.string(),
+  react: z41.string()
 }).strict();
 var defaults = {
   preflight: setupPreflightCommand,
@@ -4152,7 +4244,7 @@ var defaults = {
 };
 
 // ../cli/dist/commands/setup-claim.js
-import { z as z41 } from "zod";
+import { z as z42 } from "zod";
 
 // src/next.ts
 var SiteplaneNextContractError = class extends Error {
@@ -4216,7 +4308,7 @@ async function withSiteplane(nextConfig, options = {}) {
   const imageOrigin = hasImages ? readImageWebsiteOrigin() : null;
   return {
     ...nextConfig,
-    ...imageOrigin ? { images: prepareImagePatterns(nextConfig.images, imageOrigin) } : {},
+    ...hasImages ? { images: prepareImagePatterns(nextConfig.images, imageOrigin) } : {},
     headers: async () => frameHeaders(
       await nextConfig.headers?.() ?? [],
       new URL(config.apiBaseUrl).origin,
@@ -4243,40 +4335,24 @@ async function readGitRevision2(projectDir) {
 }
 function frameHeaders(rules, adminOrigin, imageOrigin) {
   const policy = `frame-ancestors 'self' ${adminOrigin}`;
+  const hasFrameOptions = rules.some((rule) => rule.headers.some((header) => header.key.toLowerCase() === "x-frame-options"));
   const prepared = rules.map((rule) => ({
     ...rule,
     headers: rule.headers.map((header) => {
-      if (header.key.toLowerCase() === "x-frame-options" && /^(DENY|SAMEORIGIN)$/iu.test(header.value.trim()))
-        throw new SiteplaneNextContractError(
-          "frame_policy_conflict",
-          "The existing X-Frame-Options blocks the Siteplane preview. Reconcile that explicit website policy with the canonical admin origin."
-        );
       if (header.key.toLowerCase() !== "content-security-policy") return header;
-      const ancestors = /(?:^|;)\s*frame-ancestors\s+([^;]+)/iu.exec(
-        header.value
-      )?.[1];
-      if (ancestors && (!ancestors.split(/\s+/u).includes(adminOrigin) || ancestors.includes("*")))
-        throw new SiteplaneNextContractError(
-          "frame_policy_conflict",
-          "Keep the existing CSP directives and explicitly allow only the canonical Siteplane admin origin in frame-ancestors."
-        );
-      const value = ancestors ? header.value : `${header.value.replace(/;\s*$/u, "")}; ${policy}`;
-      return {
-        ...header,
-        value: imageOrigin ? prepareImageCsp(value, imageOrigin) : value
-      };
+      const ancestors = /(?:^|;)\s*frame-ancestors\s+([^;]+)/iu.test(header.value);
+      const value = ancestors || hasFrameOptions ? header.value : `${header.value.replace(/;\s*$/u, "")}; ${policy}`;
+      return { ...header, value: imageOrigin ? prepareImageCsp(value, imageOrigin) : value };
     })
   }));
-  return [
-    {
-      source: "/:path*",
-      headers: [{ key: "Content-Security-Policy", value: policy }]
-    },
+  return hasFrameOptions ? prepared : [
+    { source: "/:path*", headers: [{ key: "Content-Security-Policy", value: policy }] },
     ...prepared
   ];
 }
 var managedImageOrigin = "https://siteplane.io";
 function readImageWebsiteOrigin() {
+  if (!process.env.SITEPLANE_SITE_ORIGIN) return null;
   try {
     const value = process.env.SITEPLANE_SITE_ORIGIN;
     const url = new URL(value ?? "");
@@ -4286,16 +4362,17 @@ function readImageWebsiteOrigin() {
   } catch {
     throw new SiteplaneNextContractError(
       "image_origin_missing",
-      "Image fields require SITEPLANE_SITE_ORIGIN to be the exact public HTTPS website origin. setup deploy sets it from the verified provider domain; use that same origin for local builds. Never substitute a wildcard or private host."
+      "If configured, SITEPLANE_SITE_ORIGIN must be the exact public HTTPS website origin. setup deploy sets it from the verified provider domain; local fallback-image builds can omit it. Never substitute a wildcard or private host."
     );
   }
 }
 function prepareImagePatterns(images, websiteOrigin) {
   const remotePatterns = [...images?.remotePatterns ?? []];
-  for (const [origin, pathname] of [
-    [managedImageOrigin, "/api/assets/*/content"],
-    [websiteOrigin, "/siteplane-assets/**"]
-  ]) {
+  const destinations = [
+    [managedImageOrigin, "/api/assets/*/content"]
+  ];
+  if (websiteOrigin) destinations.push([websiteOrigin, "/siteplane-assets/**"]);
+  for (const [origin, pathname] of destinations) {
     const pattern = {
       protocol: "https",
       hostname: new URL(origin).hostname,