siteplane 0.1.64 → 0.1.66

package/dist/index.js

@@ -631,6 +631,7 @@ var bookingPublicConfigSchema = z9.object({
   settings: z9.object({
     slotIntervalMinutes: z9.number().int().positive(),
     minLeadMinutes: z9.number().int().min(0),
+    minCancelLeadMinutes: z9.number().int().min(0),
     maxAdvanceDays: z9.number().int().min(1),
     requirePhone: z9.boolean(),
     collectNote: z9.boolean(),
@@ -839,7 +840,7 @@ var bookingManifestSchema = z9.object({
   siteId: z9.string().trim().min(1),
   siteKeyPrefix: z9.string().startsWith("bk_pub_"),
   bookingPageSlug: z9.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/).min(2).max(64),
-  embedMode: z9.enum(["script", "web_component", "iframe"]).optional(),
+  integration: z9.literal("rewrite").optional(),
   productionOrigin: z9.string().url().optional()
 }).passthrough();
 var secretManifestKeys = /* @__PURE__ */ new Set([
@@ -2242,117 +2243,63 @@ function collectRedactedBookingKeys(input, prefix = "") {
 }
 
 // ../cli/dist/booking/static-scan.js
+import ts2 from "typescript";
 function scanBookingSourceFiles(files, input) {
-  const embeds = files.flatMap(scanBookingEmbedFile);
-  const findings = embeds.map(createEmbedFoundIssue);
-  const hardErrors = embeds.length === 0 ? [
-    {
-      code: "booking_scan.embed_missing",
-      message: "No Siteplane Booking embed script, web component or iframe was found.",
+  const findings = [];
+  const hardErrors = [];
+  const warnings = [];
+  for (const file of files) {
+    let visit2 = function(node) {
+      if (ts2.isCallExpression(node) && ts2.isIdentifier(node.expression) && node.expression.text === "withSiteplane") {
+        const options = node.arguments[1];
+        const booking = options && property(options, "booking");
+        const site = booking && property(booking, "site");
+        if (site && ts2.isStringLiteralLike(site)) {
+          const issue = {
+            code: site.text === input.siteId ? "booking_scan.integration_found" : "booking_scan.site_mismatch",
+            message: site.text === input.siteId ? "Booking /booking rewrite configured for this Site ID." : "The Booking wrapper uses a different Site ID; use the Site ID supplied by Siteplane.",
+            filePath: file.filePath
+          };
+          (site.text === input.siteId ? findings : hardErrors).push(issue);
+        }
+      }
+      ts2.forEachChild(node, visit2);
+    };
+    var visit = visit2;
+    const source = ts2.createSourceFile(file.filePath, file.sourceText, ts2.ScriptTarget.Latest, true, ts2.ScriptKind.TSX);
+    visit2(source);
+  }
+  if (!findings.length && !hardErrors.length)
+    hardErrors.push({
+      code: "booking_scan.integration_missing",
+      message: "Could not verify withSiteplane(nextConfig, { booking: { site: <site-id> } }). Include next.config.ts in the scan and use a literal Site ID.",
+      filePath: "next.config.ts"
+    });
+  if (input.productionOrigin && !files.some((file) => file.sourceText.includes(input.productionOrigin)))
+    warnings.push({
+      code: "booking_scan.origin_not_detected",
+      message: "Verify the public booking address and its allowed origins in Siteplane settings.",
       filePath: "siteplane.booking.json"
-    }
-  ] : [];
-  const warnings = [
-    ...createPageSlugWarnings(embeds, input.bookingPageSlug),
-    ...createOriginWarnings(files, input.productionOrigin)
-  ];
-  const selectedEmbed = selectManifestEmbed(embeds);
-  const manifest = bookingManifestSchema.parse({
-    schemaVersion: 1,
-    siteId: input.siteId,
-    siteKeyPrefix: input.siteKeyPrefix,
-    bookingPageSlug: selectedEmbed?.pageSlug ?? input.bookingPageSlug,
-    ...selectedEmbed ? { embedMode: selectedEmbed.embedMode } : {},
-    ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
-  });
+    });
   return {
-    manifest,
+    manifest: bookingManifestSchema.parse({
+      schemaVersion: 1,
+      ...input,
+      integration: "rewrite"
+    }),
     findings,
     hardErrors,
     warnings,
     suggestions: []
   };
 }
-function scanBookingEmbedFile(file) {
-  const embeds = [];
-  const source = file.sourceText;
-  if (/\/embed\/booking\.js/u.test(source)) {
-    embeds.push({
-      filePath: file.filePath,
-      embedMode: "script"
-    });
+function property(node, name2) {
+  if (!ts2.isObjectLiteralExpression(node))
+    return;
+  for (const item of node.properties) {
+    if (ts2.isPropertyAssignment(item) && (ts2.isIdentifier(item.name) || ts2.isStringLiteral(item.name)) && item.name.text === name2)
+      return item.initializer;
   }
-  if (/<siteplane-booking\b/u.test(source)) {
-    const pageSlug = readAttributeValue(source, "booking-page-slug");
-    embeds.push({
-      filePath: file.filePath,
-      embedMode: "web_component",
-      ...pageSlug ? { pageSlug } : {}
-    });
-  }
-  for (const match of source.matchAll(/<iframe\b[^>]*>/giu)) {
-    const tag = match[0];
-    const src = readAttributeValue(tag, "src");
-    const pageSlug = src ? readBookingPageSlug(src) : void 0;
-    if (/data-siteplane-booking/u.test(tag) || pageSlug !== void 0) {
-      embeds.push({
-        filePath: file.filePath,
-        embedMode: "iframe",
-        ...pageSlug ? { pageSlug } : {}
-      });
-    }
-  }
-  return embeds;
-}
-function createEmbedFoundIssue(embed) {
-  return {
-    code: "booking_scan.embed_found",
-    message: "Siteplane Booking embed was found.",
-    filePath: embed.filePath,
-    embedMode: embed.embedMode,
-    ...embed.pageSlug ? { pageSlug: embed.pageSlug } : {}
-  };
-}
-function createPageSlugWarnings(embeds, expectedSlug) {
-  return embeds.filter((embed) => embed.pageSlug && embed.pageSlug !== expectedSlug).map((embed) => {
-    const pageSlug = embed.pageSlug;
-    return {
-      code: "booking_scan.page_slug_mismatch",
-      message: `Booking embed references page slug ${pageSlug}, but the manifest is configured for ${expectedSlug}.`,
-      filePath: embed.filePath,
-      embedMode: embed.embedMode,
-      ...pageSlug ? { pageSlug } : {}
-    };
-  });
-}
-function createOriginWarnings(files, productionOrigin) {
-  if (!productionOrigin) {
-    return [];
-  }
-  if (files.some((file) => file.sourceText.includes(productionOrigin))) {
-    return [];
-  }
-  return [
-    {
-      code: "booking_scan.origin_not_detected",
-      message: "The configured production origin was not found statically; verify it is registered as an allowed Booking origin in Siteplane.",
-      filePath: "siteplane.booking.json"
-    }
-  ];
-}
-function selectManifestEmbed(embeds) {
-  return embeds.find((embed) => embed.embedMode === "web_component") ?? embeds.find((embed) => embed.embedMode === "iframe") ?? embeds[0];
-}
-function readAttributeValue(source, attributeName) {
-  const escapedName = escapeRegExp(attributeName);
-  const match = new RegExp(`${escapedName}\\s*=\\s*["']([^"']+)["']`, "iu").exec(source);
-  return match?.[1];
-}
-function readBookingPageSlug(value) {
-  return /\/book\/([a-z0-9]+(?:-[a-z0-9]+)*)(?:[/?#]|$)/u.exec(value)?.[1];
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
 }
 
 // ../cli/dist/commands/analytics/check.js
@@ -2455,10 +2402,17 @@ var errorSchema = z30.object({
 import { randomUUID } from "crypto";
 
 // ../cli/dist/commands/booking/check.js
-import { readFile as readFile4 } from "fs/promises";
+import { dirname as dirname4, join as join2 } from "path";
+import { access, readFile as readFile4 } from "fs/promises";
 async function bookingCheckCommand(input) {
   const validatedManifest = await readBookingManifestFile(input.manifestPath);
-  const sourceFiles = await readSourceFiles(input.sourceFilePaths);
+  const configs = (await Promise.all(["next.config.ts", "next.config.js", "next.config.mjs"].map(async (name2) => {
+    const path = join2(dirname4(input.manifestPath), name2);
+    return await access(path).then(() => path, () => null);
+  }))).filter((path) => path !== null);
+  const sourceFiles = await readSourceFiles([
+    .../* @__PURE__ */ new Set([...input.sourceFilePaths, ...configs])
+  ]);
   const scanInput = {
     siteId: validatedManifest.manifest.siteId,
     siteKeyPrefix: validatedManifest.manifest.siteKeyPrefix,
@@ -2499,7 +2453,7 @@ function createBoundaryErrors(validation) {
 
 // ../cli/dist/commands/booking/init.js
 import { mkdir as mkdir4, writeFile as writeFile4 } from "fs/promises";
-import { dirname as dirname4, join as join2 } from "path";
+import { dirname as dirname5, join as join3 } from "path";
 async function bookingInitCommand(input) {
   const manifest = {
     schemaVersion: 1,
@@ -2508,7 +2462,7 @@ async function bookingInitCommand(input) {
     bookingPageSlug: input.bookingPageSlug,
     ...input.productionOrigin ? { productionOrigin: input.productionOrigin } : {}
   };
-  const manifestPath = join2(input.projectDir, "siteplane.booking.json");
+  const manifestPath = join3(input.projectDir, "siteplane.booking.json");
   const artifacts = createBookingArtifacts(input.agentClient);
   await writeBookingManifestFile(manifestPath, manifest);
   for (const artifact of artifacts) {
@@ -2548,16 +2502,18 @@ function createBookingArtifacts(agentClient) {
   return artifacts;
 }
 async function writeProjectFile(projectDir, relativePath, contents) {
-  const path = join2(projectDir, relativePath);
-  await mkdir4(dirname4(path), { recursive: true });
+  const path = join3(projectDir, relativePath);
+  await mkdir4(dirname5(path), { recursive: true });
   await writeFile4(path, contents, "utf8");
 }
 var bookingRulesTemplate = `# Siteplane Booking Rules
 
 - Do not change layout, copy, styling, animation or business logic while adding Booking.
-- Add only the Siteplane Booking embed script and a booking iframe or web component.
-- Use the configured booking page slug from siteplane.booking.json.
-- Register the production website origin in Siteplane before testing cross-origin embeds.
+- Integrate /booking on the customer domain through withSiteplane(nextConfig, { booking: { site: "<site-id>" } }); use the immutable Site ID supplied by Siteplane.
+- Use a normal <a href="/booking"> link, not next/link, an iframe or an embed script.
+- Preserve existing rewrites. Booking-only must not require Editor setup or siteplane.config.json.
+- Configure the public booking address in Siteplane; register its origin and call https://siteplane.io/api/booking/* directly with CORS, without a raw public key.
+- Preserve customer CSP and middleware; explain required Siteplane/Stripe permissions and exclude /booking from customer middleware.
 - Do not write setup tokens, project CLI tokens or private keys into source files.
 - Run npx siteplane booking check, npx siteplane booking sync and npx siteplane booking test after setup.
 - booking test stays in test_mode; live booking only starts after explicit dashboard activation.
@@ -2565,7 +2521,7 @@ var bookingRulesTemplate = `# Siteplane Booking Rules
 function bookingSkillTemplate(agentName) {
   return `# Siteplane Booking Skill
 
-Use this skill in ${agentName} before adding Siteplane Booking embeds.
+Use this skill in ${agentName} before integrating Siteplane Booking at /booking.
 
 ${bookingRulesTemplate}`;
 }
@@ -2640,9 +2596,9 @@ function requireContentExportScope(scopes) {
 }
 
 // ../cli/dist/config/project-config.js
-import { access, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
+import { access as access2, chmod, open, readFile as readFile5, rename, rm } from "fs/promises";
 import { randomUUID as randomUUID2 } from "crypto";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { z as z31 } from "zod";
 var siteplaneProjectConfigSchema = z31.object({
   version: z31.literal(2),
@@ -2658,7 +2614,7 @@ var siteplaneProjectConfigSchema = z31.object({
   fieldContractHash: z31.string().regex(/^sha256:[0-9a-f]{64}$/iu).optional()
 }).strict();
 async function readProjectPackageJson(projectDir) {
-  return JSON.parse(await readFile5(join3(projectDir, "package.json"), "utf8"));
+  return JSON.parse(await readFile5(join4(projectDir, "package.json"), "utf8"));
 }
 async function detectNextProject(projectDir) {
   const packageJson = await readProjectPackageJson(projectDir).catch(() => null);
@@ -2671,7 +2627,7 @@ async function detectNextProject(projectDir) {
     "next.config.ts"
   ]) {
     try {
-      await access(join3(projectDir, fileName));
+      await access2(join4(projectDir, fileName));
       return true;
     } catch {
     }
@@ -2679,13 +2635,13 @@ async function detectNextProject(projectDir) {
   return false;
 }
 async function writeProjectConfig(projectDir, config) {
-  const path = join3(projectDir, "siteplane.config.json");
+  const path = join4(projectDir, "siteplane.config.json");
   const parsed = siteplaneProjectConfigSchema.parse(config);
   await writeJsonAtomically(path, parsed, 420);
   return path;
 }
 async function readProjectConfig(projectDir) {
-  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join3(projectDir, "siteplane.config.json"), "utf8")));
+  return siteplaneProjectConfigSchema.parse(JSON.parse(await readFile5(join4(projectDir, "siteplane.config.json"), "utf8")));
 }
 async function writeJsonAtomically(path, value, mode) {
   const temporaryPath = `${path}.${randomUUID2()}.tmp`;
@@ -2713,7 +2669,7 @@ async function writeJsonAtomically(path, value, mode) {
 import { execFile } from "child_process";
 import { randomUUID as randomUUID3 } from "crypto";
 import { chmod as chmod2, lstat, mkdir as mkdir5, open as open2, readFile as readFile6, rename as rename2, rm as rm2 } from "fs/promises";
-import { dirname as dirname5, join as join4, relative } from "path";
+import { dirname as dirname6, join as join5, relative } from "path";
 import { promisify } from "util";
 import { z as z32 } from "zod";
 var localSetupInstallationSchema = z32.object({
@@ -2738,7 +2694,7 @@ var localSetupCredentialsSchema = z32.union([
   z32.object({ installation: localSetupInstallationSchema }).strict()
 ]);
 async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
-  const path = join4(projectDir, ".siteplane/credentials.json");
+  const path = join5(projectDir, ".siteplane/credentials.json");
   await assertCredentialFilesystemSafe(projectDir);
   const isTrackedFile = options.isTrackedFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "ls-files"));
   const isIgnoredFile = options.isIgnoredFile ?? ((targetPath) => gitPathMatches(projectDir, targetPath, "check-ignore"));
@@ -2753,8 +2709,8 @@ async function assertLocalCredentialsPathSafe(projectDir, options = {}) {
 async function assertCredentialFilesystemSafe(projectDir) {
   for (const [path, directory, mode] of [
     [projectDir, true, null],
-    [join4(projectDir, ".siteplane"), true, 448],
-    [join4(projectDir, ".siteplane/credentials.json"), false, 384]
+    [join5(projectDir, ".siteplane"), true, 448],
+    [join5(projectDir, ".siteplane/credentials.json"), false, 384]
   ]) {
     const stat = await lstat(path).catch((error) => {
       if (error.code === "ENOENT")
@@ -2777,7 +2733,7 @@ async function writeLocalCredentials(projectDir, credentials, options = {}) {
 async function writeLocalSetupCredentials(projectDir, credentials, options = {}) {
   const path = await assertLocalCredentialsPathSafe(projectDir, options);
   const parsed = localSetupCredentialsSchema.parse(credentials);
-  await mkdir5(dirname5(path), { recursive: true, mode: 448 });
+  await mkdir5(dirname6(path), { recursive: true, mode: 448 });
   await writeCredentialsAtomically(path, parsed);
   return path;
 }
@@ -2790,7 +2746,7 @@ async function readLocalCredentials(projectDir) {
 }
 async function readLocalSetupCredentials(projectDir) {
   await assertCredentialFilesystemSafe(projectDir);
-  return localSetupCredentialsSchema.parse(JSON.parse(await readFile6(join4(projectDir, ".siteplane/credentials.json"), "utf8")));
+  return localSetupCredentialsSchema.parse(JSON.parse(await readFile6(join5(projectDir, ".siteplane/credentials.json"), "utf8")));
 }
 async function writeCredentialsAtomically(path, credentials) {
   const temporaryPath = `${path}.${randomUUID3()}.tmp`;
@@ -2808,7 +2764,7 @@ async function writeCredentialsAtomically(path, credentials) {
   try {
     await rename2(temporaryPath, path);
     await chmod2(path, 384);
-    const directory = await open2(dirname5(path), "r");
+    const directory = await open2(dirname6(path), "r");
     try {
       await directory.sync();
     } finally {
@@ -2831,8 +2787,8 @@ async function gitPathMatches(projectDir, path, command) {
 }
 
 // ../cli/dist/commands/init.js
-import { access as access3 } from "fs/promises";
-import { join as join7, relative as relative3 } from "path";
+import { access as access4 } from "fs/promises";
+import { join as join8, relative as relative3 } from "path";
 import { z as z35 } from "zod";
 
 // ../cli/dist/commands/setup-preflight.js
@@ -2844,7 +2800,7 @@ import { parse as parseYaml } from "yaml";
 // ../cli/dist/config/installed-package.js
 import { createRequire } from "module";
 import { readFile as readFile7 } from "fs/promises";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { z as z33 } from "zod";
 var packageSchema = z33.object({
   name: z33.string().optional(),
@@ -2852,10 +2808,10 @@ var packageSchema = z33.object({
   peerDependencies: z33.record(z33.string(), z33.string()).optional()
 });
 async function readInstalledPackage(projectDir, name2) {
-  const require2 = createRequire(join5(projectDir, "package.json"));
+  const require2 = createRequire(join6(projectDir, "package.json"));
   for (const directory of require2.resolve.paths(name2) ?? []) {
     try {
-      return packageSchema.parse(JSON.parse(await readFile7(join5(directory, name2, "package.json"), "utf8")));
+      return packageSchema.parse(JSON.parse(await readFile7(join6(directory, name2, "package.json"), "utf8")));
     } catch (error) {
       if (error.code !== "ENOENT")
         throw error;
@@ -2865,8 +2821,8 @@ async function readInstalledPackage(projectDir, name2) {
 }
 
 // ../cli/dist/commands/setup-preflight.js
-import { access as access2, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
-import { dirname as dirname6, join as join6, relative as relative2, resolve, sep } from "path";
+import { access as access3, readFile as readFile8, realpath, readdir, readlink } from "fs/promises";
+import { dirname as dirname7, join as join7, relative as relative2, resolve, sep } from "path";
 import { z as z34 } from "zod";
 
 // ../cli/dist/commands/setup-process.js
@@ -2993,15 +2949,15 @@ var vercelProjectSchema = z34.object({
     productionBranch: z34.string().optional()
   }).nullable().optional()
 });
-var exists = async (path) => access2(path).then(() => true, () => false);
+var exists = async (path) => access3(path).then(() => true, () => false);
 var fail = (code, message) => {
   throw new SetupFailure(code, message);
 };
 var stable = (version2, major) => new RegExp(`^${major}\\.\\d+\\.\\d+$`, "u").test(version2);
 async function inspectSetupLocalProject(projectDir) {
   const projectDirectory = await realpath(resolve(projectDir));
-  const manifest = manifestSchema.parse(JSON.parse(await readFile8(join6(projectDirectory, "package.json"), "utf8")));
-  const apps = (await Promise.all(["app", "src/app"].map(async (path) => await exists(join6(projectDirectory, path)) ? path : null))).filter((path) => path !== null);
+  const manifest = manifestSchema.parse(JSON.parse(await readFile8(join7(projectDirectory, "package.json"), "utf8")));
+  const apps = (await Promise.all(["app", "src/app"].map(async (path) => await exists(join7(projectDirectory, path)) ? path : null))).filter((path) => path !== null);
   if (apps.length !== 1)
     fail("ambiguous_app_directory", "Select one Next.js App Router application with exactly one app/ or src/app/ directory.");
   const repositoryRoot = (await setupProcess("git", ["rev-parse", "--show-toplevel"], {
@@ -3015,8 +2971,8 @@ async function inspectSetupLocalProject(projectDir) {
       fail("git_submodule_conflict", "The repository contains Git submodules. Resolve the explicit deployment source boundary before setup; the CLI will not copy external repositories.");
     if (!entry.startsWith("120000 "))
       continue;
-    const path = join6(repositoryRoot, entry.slice(entry.indexOf("	") + 1));
-    const target = resolve(dirname6(path), await readlink(path));
+    const path = join7(repositoryRoot, entry.slice(entry.indexOf("	") + 1));
+    const target = resolve(dirname7(path), await readlink(path));
     const bound = relative2(repositoryRoot, target);
     if (bound.startsWith("..") || bound.startsWith(sep))
       fail("external_symlink_conflict", "A tracked symbolic link points outside this repository. Resolve that source boundary before setup; local external files cannot enter a deployment.");
@@ -3032,10 +2988,10 @@ async function inspectSetupLocalProject(projectDir) {
   ];
   let locks = [];
   for (; ; ) {
-    locks = (await Promise.all(lockNames.map(async (name3) => await exists(join6(lockfileRoot, name3)) ? name3 : null))).filter((name3) => name3 !== null);
-    if (locks.length || lockfileRoot === repositoryRoot || dirname6(lockfileRoot) === lockfileRoot)
+    locks = (await Promise.all(lockNames.map(async (name3) => await exists(join7(lockfileRoot, name3)) ? name3 : null))).filter((name3) => name3 !== null);
+    if (locks.length || lockfileRoot === repositoryRoot || dirname7(lockfileRoot) === lockfileRoot)
       break;
-    lockfileRoot = dirname6(lockfileRoot);
+    lockfileRoot = dirname7(lockfileRoot);
   }
   if (locks.length > 1)
     fail("conflicting_lockfiles", "Resolve conflicting package-manager lockfiles before setup; Siteplane does not replace them.");
@@ -3044,9 +3000,9 @@ async function inspectSetupLocalProject(projectDir) {
   const lockName = locks[0];
   if (!["package-lock.json", "pnpm-lock.yaml"].includes(lockName))
     fail("unsupported_package_manager", "This setup supports npm 10 or pnpm 9/10 with their canonical lockfile.");
-  const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join6(lockfileRoot, "package.json"), "utf8")));
+  const rootManifest = manifestSchema.parse(JSON.parse(await readFile8(join7(lockfileRoot, "package.json"), "utf8")));
   if (lockfileRoot !== projectDirectory) {
-    const workspaceFile = join6(lockfileRoot, "pnpm-workspace.yaml");
+    const workspaceFile = join7(lockfileRoot, "pnpm-workspace.yaml");
     const workspace = lockName === "pnpm-lock.yaml" && await exists(workspaceFile) ? z34.object({ packages: z34.array(z34.string()) }).parse(parseYaml(await readFile8(workspaceFile, "utf8"))).packages : z34.union([
       z34.array(z34.string()),
       z34.object({ packages: z34.array(z34.string()) }).transform((value) => value.packages)
@@ -3055,14 +3011,14 @@ async function inspectSetupLocalProject(projectDir) {
     if (!workspace.some((pattern) => !pattern.startsWith("!") && minimatch(selected, pattern)) || workspace.some((pattern) => pattern.startsWith("!") && minimatch(selected, pattern.slice(1))))
       fail("unbound_workspace_app", "The selected application is excluded from the canonical lockfile's workspace packages. Select its actual application root.");
   }
-  for (let ancestor = dirname6(lockfileRoot); ancestor.startsWith(repositoryRoot + sep) || ancestor === repositoryRoot; ancestor = dirname6(ancestor)) {
-    const ancestorLocks = await Promise.all(lockNames.map((name3) => exists(join6(ancestor, name3))));
+  for (let ancestor = dirname7(lockfileRoot); ancestor.startsWith(repositoryRoot + sep) || ancestor === repositoryRoot; ancestor = dirname7(ancestor)) {
+    const ancestorLocks = await Promise.all(lockNames.map((name3) => exists(join7(ancestor, name3))));
     if (ancestorLocks.some(Boolean))
       fail("ambiguous_lockfile_root", "Both the selected package and its repository ancestors contain lockfiles. Select one canonical workspace resolution before setup.");
     if (ancestor === repositoryRoot)
       break;
   }
-  const lockText = await readFile8(join6(lockfileRoot, lockName), "utf8");
+  const lockText = await readFile8(join7(lockfileRoot, lockName), "utf8");
   const npmLock = lockName === "package-lock.json" ? z34.object({
     lockfileVersion: z34.number(),
     packages: z34.record(z34.string(), z34.object({
@@ -3115,9 +3071,9 @@ async function inspectSetupLocalProject(projectDir) {
     fail("lockfile_format_conflict", "The canonical lockfile format does not match npm 10 or pnpm 9/10.");
   const sourceConflicts = [];
   for (const file of ["next.config.js", "next.config.mjs", "next.config.ts"]) {
-    if (!await exists(join6(projectDirectory, file)))
+    if (!await exists(join7(projectDirectory, file)))
       continue;
-    const source = await readFile8(join6(projectDirectory, file), "utf8");
+    const source = await readFile8(join7(projectDirectory, file), "utf8");
     if (/output\s*:\s*['"]export['"]/u.test(source))
       sourceConflicts.push("static_export");
     if (/\bbasePath\s*:/u.test(source))
@@ -3137,11 +3093,11 @@ async function inspectSetupLocalProject(projectDir) {
     "src/proxy.ts",
     "src/proxy.js"
   ]) {
-    if (await exists(join6(projectDirectory, name3))) {
+    if (await exists(join7(projectDirectory, name3))) {
       sourceConflicts.push(`inspect_routing:${name3}`);
-      if (await readlink(join6(projectDirectory, name3)).catch(() => null))
+      if (await readlink(join7(projectDirectory, name3)).catch(() => null))
         continue;
-      const policySource = await readFile8(join6(projectDirectory, name3), "utf8");
+      const policySource = await readFile8(join7(projectDirectory, name3), "utf8");
       if (/Content-Security-Policy|img-src|default-src/iu.test(policySource))
         sourceConflicts.push(`inspect_image_csp:${name3}`);
     }
@@ -3150,7 +3106,7 @@ async function inspectSetupLocalProject(projectDir) {
     for (const entry of await readdir(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink() || ["node_modules", ".git", ".next", ".siteplane", ".vercel"].includes(entry.name))
         continue;
-      const path = join6(directory, entry.name);
+      const path = join7(directory, entry.name);
       if (entry.isDirectory()) {
         await inspectSource(path);
         continue;
@@ -3170,7 +3126,7 @@ async function inspectSetupLocalProject(projectDir) {
         fail("next_security_advisory", `Next.js ${nextVersion} contains Server Actions affected by the July 2026 advisory. Review https://nextjs.org/blog/july-2026-security-release and explicitly update the affected dependency before setup.`);
     }
   }
-  await inspectSource(join6(projectDirectory, apps[0]));
+  await inspectSource(join7(projectDirectory, apps[0]));
   const gitRead = async (args) => setupProcess("git", args, { cwd: projectDirectory }).then((value) => value.trim(), () => null);
   return {
     projectDirectory,
@@ -3182,7 +3138,7 @@ async function inspectSetupLocalProject(projectDir) {
     nodeVersion: process.versions.node,
     packageManager: { name: name2, version: localVersion, declared },
     lockfile: {
-      path: relative2(repositoryRoot, join6(lockfileRoot, lockName)),
+      path: relative2(repositoryRoot, join7(lockfileRoot, lockName)),
       format,
       sha256: createHash2("sha256").update(lockText).digest("hex")
     },
@@ -3201,14 +3157,14 @@ async function setupPreflightCommand(input) {
     local = await inspectSetupLocalProject(input.projectDir);
     await assertLocalCredentialsPathSafe(input.projectDir);
     let linkDirectory = local.projectDirectory;
-    while (!await exists(join6(linkDirectory, ".vercel/project.json")) && linkDirectory !== local.repositoryRoot && dirname6(linkDirectory) !== linkDirectory)
-      linkDirectory = dirname6(linkDirectory);
-    if (!await exists(join6(linkDirectory, ".vercel/project.json")))
+    while (!await exists(join7(linkDirectory, ".vercel/project.json")) && linkDirectory !== local.repositoryRoot && dirname7(linkDirectory) !== linkDirectory)
+      linkDirectory = dirname7(linkDirectory);
+    if (!await exists(join7(linkDirectory, ".vercel/project.json")))
       fail("vercel_project_not_linked", "Link this application to its intended Vercel project before setup; Siteplane will not guess a target.");
     const linked = z34.object({
       projectId: z34.string().regex(/^prj_[A-Za-z0-9]+$/u),
       orgId: z34.string().regex(/^(?:team|user)_[A-Za-z0-9]+$/u)
-    }).parse(JSON.parse(await readFile8(join6(linkDirectory, ".vercel/project.json"), "utf8")));
+    }).parse(JSON.parse(await readFile8(join7(linkDirectory, ".vercel/project.json"), "utf8")));
     const project = vercelProjectSchema.parse(await setupVercelApi(linkDirectory, `/v9/projects/${linked.projectId}?teamId=${linked.orgId}`));
     if (project.id !== linked.projectId || project.accountId !== linked.orgId)
       fail("vercel_identity_conflict", "The provider project does not match the locally linked project and team.");
@@ -3346,7 +3302,7 @@ var bootstrapResponseSchema = z35.object({
 }).strict();
 async function bootstrapProjectConnection(input) {
   const fetcher = input.fetcher ?? fetch;
-  const existing = await access3(join7(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
+  const existing = await access4(join8(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
   const response = await fetcher(`${input.apiBaseUrl.replace(/\/$/, "")}/api/cli/setup/bootstrap`, {
     method: "POST",
     signal: AbortSignal.timeout(2e4),
@@ -3377,10 +3333,10 @@ async function acknowledgeBootstrapResponse(input) {
   }
 }
 async function persistSiteSetupBootstrap(input, bootstrap, appDirectory, installation) {
-  const previous = await access3(join7(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
+  const previous = await access4(join8(input.projectDir, "siteplane.config.json")).then(() => readProjectConfig(input.projectDir), () => null);
   if (previous && (previous.siteId !== bootstrap.siteId || previous.runId !== bootstrap.runId || previous.publicSiteKeyId !== bootstrap.publicSiteKeyId || previous.publicSiteKey !== bootstrap.publicSiteKey))
     throw new Error("The grant does not match this local Siteplane run. Preserve this directory and choose the correct owner connection.");
-  const previousCredentials = previous ? await access3(join7(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalSetupCredentials(input.projectDir), () => null) : null;
+  const previousCredentials = previous ? await access4(join8(input.projectDir, ".siteplane/credentials.json")).then(() => readLocalSetupCredentials(input.projectDir), () => null) : null;
   const credentialsPath = await writeLocalCredentials(input.projectDir, {
     ...previousCredentials && "adminSession" in previousCredentials && previousCredentials.adminSession ? { adminSession: previousCredentials.adminSession } : {},
     ...previousCredentials && "claimReceipt" in previousCredentials && previousCredentials.claimReceipt ? { claimReceipt: previousCredentials.claimReceipt } : {},
@@ -3433,7 +3389,7 @@ async function persistFeatureBootstrap(input, bootstrap) {
     throw new Error("Siteplane credentials could not be verified.");
   }
   return {
-    configPath: join7(input.projectDir, "siteplane.config.json"),
+    configPath: join8(input.projectDir, "siteplane.config.json"),
     credentialsPath
   };
 }
@@ -3456,7 +3412,7 @@ function readErrorMessage(payload) {
 
 // ../cli/dist/commands/scan.js
 import { readdir as readdir2 } from "fs/promises";
-import { extname, join as join8 } from "path";
+import { extname, join as join9 } from "path";
 var defaultScanRoots = ["app", "src", "pages", "components", "lib"];
 var excludedDirectories = /* @__PURE__ */ new Set([
   ".git",
@@ -3474,14 +3430,14 @@ async function resolveScanFilePaths(filePaths, options = {}) {
     return filePaths;
   }
   const projectDir = options.projectDir ?? process.cwd();
-  const discovered = await Promise.all(defaultScanRoots.map((root) => collectSourceFiles(join8(projectDir, root))));
+  const discovered = await Promise.all(defaultScanRoots.map((root) => collectSourceFiles(join9(projectDir, root))));
   return [...new Set(discovered.flat())].sort();
 }
 async function collectSourceFiles(directory) {
   const entries = await readdir2(directory, { withFileTypes: true }).catch(() => []);
   const files = [];
   for (const entry of entries) {
-    const entryPath = join8(directory, entry.name);
+    const entryPath = join9(directory, entry.name);
     if (entry.isDirectory()) {
       if (!excludedDirectories.has(entry.name)) {
         files.push(...await collectSourceFiles(entryPath));
@@ -3502,7 +3458,7 @@ import { promisify as promisify2 } from "util";
 import { z as z36 } from "zod";
 
 // ../cli/dist/scan/next-source-scan.js
-import ts2 from "typescript";
+import ts3 from "typescript";
 import { isAbsolute, relative as relative4 } from "path";
 var legacyEditableComponentPrefix = "Editable";
 var editableComponentNames = new Set(["Image", "Text", "LongText", "Link"].map((name2) => `${legacyEditableComponentPrefix}${name2}`));
@@ -3629,8 +3585,8 @@ async function readGitRevision(projectDir) {
 
 // ../cli/dist/commands/setup-start.js
 import { randomBytes, randomUUID as randomUUID4 } from "crypto";
-import { access as access4 } from "fs/promises";
-import { join as join9, relative as relative5 } from "path";
+import { access as access5 } from "fs/promises";
+import { join as join10, relative as relative5 } from "path";
 import { z as z37 } from "zod";
 var bootstrapResponseSchema2 = z37.object({
   ok: z37.literal(true),
@@ -3648,10 +3604,10 @@ var responseSchema2 = z38.object({
 }).strict();
 
 // ../cli/dist/commands/setup-prepare.js
-import { access as access5, lstat as lstat2, mkdir as mkdir6, open as open3, readFile as readFile10, rename as rename3, rm as rm3 } from "fs/promises";
+import { access as access6, lstat as lstat2, mkdir as mkdir6, open as open3, readFile as readFile10, rename as rename3, rm as rm3 } from "fs/promises";
 import { randomUUID as randomUUID5 } from "crypto";
-import { dirname as dirname7, join as join10, relative as relative6, sep as sep2 } from "path";
-import ts3 from "typescript";
+import { dirname as dirname8, join as join11, relative as relative6, sep as sep2 } from "path";
+import ts4 from "typescript";
 
 // ../cli/dist/commands/setup-lock.js
 import { randomUUID as randomUUID6 } from "crypto";
@@ -3664,7 +3620,7 @@ var ownerSchema = z39.object({ pid: z39.number().int().positive(), nonce: z39.st
 import { createHash as createHash3 } from "crypto";
 import { execFile as execFile3 } from "child_process";
 import { lstat as lstat4, readFile as readFile12, writeFile as writeFile5, mkdir as mkdir8 } from "fs/promises";
-import { dirname as dirname8, isAbsolute as isAbsolute2, join as join11, relative as relative7, resolve as resolve3, sep as sep3 } from "path";
+import { dirname as dirname9, isAbsolute as isAbsolute2, join as join12, relative as relative7, resolve as resolve3, sep as sep3 } from "path";
 import { isDeepStrictEqual, promisify as promisify3 } from "util";
 import { z as z40 } from "zod";
 var execute = promisify3(execFile3);
@@ -3704,15 +3660,15 @@ async function writeBuildProvenance(checkout, revision) {
     if (entry.mode !== "120000")
       continue;
     const { readlink: readlink2 } = await import("fs/promises");
-    const path = join11(checkout, entry.path);
-    const target2 = resolve3(dirname8(path), await readlink2(path));
+    const path = join12(checkout, entry.path);
+    const target2 = resolve3(dirname9(path), await readlink2(path));
     const bound = relative7(checkout, target2);
     if (bound.startsWith("..") || isAbsolute2(bound))
       throw new Error("A tracked symbolic link escapes the committed upload; resolve that source boundary before deployment.");
   }
   const providerConfigurations = await Promise.all(entries.filter((entry) => /(?:^|\/)vercel\.json$/u.test(entry.path)).map(async (entry) => ({
     path: entry.path,
-    source: await readFile12(join11(checkout, entry.path), "utf8")
+    source: await readFile12(join12(checkout, entry.path), "utf8")
   })));
   const record = schema.parse({
     version: 2,
@@ -3721,16 +3677,16 @@ async function writeBuildProvenance(checkout, revision) {
     entries,
     providerConfigurations
   });
-  const target = join11(checkout, name);
-  await mkdir8(dirname8(target), { recursive: true, mode: 448 });
+  const target = join12(checkout, name);
+  await mkdir8(dirname9(target), { recursive: true, mode: 448 });
   await writeFile5(target, JSON.stringify(record), { flag: "wx", mode: 384 });
 }
 
 // ../cli/dist/commands/setup-deploy.js
 import { createHash as createHash4, randomBytes as randomBytes2, randomUUID as randomUUID7 } from "crypto";
-import { access as access6, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
+import { access as access7, mkdir as mkdir9, mkdtemp, rm as rm5, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { z as z41 } from "zod";
 var envSchema = z41.object({
   id: z41.string(),