@wix/himalaya-cli 0.1037.0 → 0.1038.0

package/dist/cli.mjs

@@ -1123,6 +1123,14 @@ var init_mobile_ux_contract = __esm({
 | Screen | Job | Primary action | Data | Notes |
 | --- | --- | --- | --- | --- |
 
+## Data access
+<!-- \`himi test\` checks every write to Wix it sees against this table. One row per screen id (and
+     role); \`Wix writes\` is \`none\`, or the approved writes named by action (\`bookSelected\`),
+     endpoint (\`POST /bookings/v2/bookings\`), capability (\`registerDirect\`) or kind (\`payment\`).
+     \`himi docs himi-test\` -> "Writes to Wix". -->
+| Screen | Role | Reads | Wix writes | Prohibited |
+| --- | --- | --- | --- | --- |
+
 ## Platform envelope
 - Required: iOS, Android
 - Optional: web, desktop, watch, widgets
@@ -1528,7 +1536,9 @@ export default defineService("home", {
           surfaceTertiary: { light: "#eef1f4", dark: "#1c2128" },
           textPrimary: { light: "#1f2328", dark: "#e6edf3" },
           textSecondary: { light: "#57606a", dark: "#9198a1" },
-          textOnAccent: { light: "#ffffff", dark: "#ffffff" },
+          // Dark ink on the dark arm: white on #388bfd is 3.34:1 and fails AA, which the tokens
+          // pass now warns about (#3275); #0d1117 on it is 5.66:1.
+          textOnAccent: { light: "#ffffff", dark: "#0d1117" },
           accentPrimary: { light: "#0969da", dark: "#388bfd" },
           border: { light: "#d0d7de", dark: "#30363d" },
           danger: { light: "#cf222e", dark: "#f85149" },
@@ -11088,6 +11098,74 @@ var init_token_colors = __esm({
   }
 });
 
+// ../../core/ts/src/idiom.ts
+function authored(overlays, name) {
+  return typeof name === "string" && overlays !== void 0 && Object.hasOwn(overlays, name) && overlays[name] !== null && typeof overlays[name] === "object" && !Array.isArray(overlays[name]);
+}
+function selectIdiomOverlay(doc, ctx = {}) {
+  const policy = doc.idiomPolicy;
+  const overlays = doc.idiom;
+  const isRecord3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+  if (!isRecord3(policy) || !isRecord3(overlays)) return void 0;
+  const kind = policy.policy ?? "follow-surface";
+  if (kind === "none") return void 0;
+  if (kind === "pinned") return authored(overlays, policy.pin) ? policy.pin : void 0;
+  if (kind !== "follow-surface") return void 0;
+  const surfaces = policy.surfaces;
+  const candidates = [
+    ctx.surface !== void 0 && isRecord3(surfaces) && Object.hasOwn(surfaces, ctx.surface) ? surfaces[ctx.surface] : void 0,
+    ...ctx.native ?? [],
+    policy.fallback
+  ];
+  return candidates.find((c) => authored(overlays, c));
+}
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function deepMerge(base, overlay) {
+  if (!isPlainObject(overlay) || !isPlainObject(base)) return overlay;
+  const out = { ...base };
+  for (const [key2, value] of Object.entries(overlay)) {
+    if (UNSAFE_KEYS.has(key2)) continue;
+    out[key2] = Object.hasOwn(base, key2) ? deepMerge(base[key2], value) : value;
+  }
+  return out;
+}
+function mergeIdiomOverlay(base, overlay) {
+  const merged = deepMerge(base, overlay);
+  const baseColors = base.colors;
+  const overlayColors = overlay.colors;
+  if (isPlainObject(baseColors) && isPlainObject(overlayColors)) {
+    const colors = { ...merged.colors };
+    for (const [name, value] of Object.entries(overlayColors)) {
+      if (UNSAFE_KEYS.has(name)) continue;
+      const was = Object.hasOwn(baseColors, name) ? baseColors[name] : void 0;
+      if (typeof was === "string" && isPlainObject(value)) colors[name] = { light: was, ...value };
+    }
+    merged.colors = colors;
+  }
+  return merged;
+}
+function resolveIdiom(tokens, ctx = {}) {
+  const doc = tokens;
+  const name = selectIdiomOverlay(doc, ctx);
+  if (name === void 0) return tokens;
+  const merged = mergeIdiomOverlay(tokens, doc.idiom[name]);
+  const { idiomPolicy: _applied, ...final } = merged;
+  return final;
+}
+var IDIOM_CONTEXTS, UNSAFE_KEYS;
+var init_idiom = __esm({
+  "../../core/ts/src/idiom.ts"() {
+    IDIOM_CONTEXTS = {
+      ios: { native: ["ios"] },
+      android: { native: ["material"] },
+      mac: { native: ["desktop", "ios"], surface: "mac" }
+    };
+    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+  }
+});
+
 // src/token-lint.ts
 import { existsSync as existsSync13, readFileSync as readFileSync14 } from "node:fs";
 import { join as join16 } from "node:path";
@@ -11178,11 +11256,109 @@ function tokenColorIssues(dir, tokensPathOverride) {
       `${tokensPath}: colors.${problem.path} is ${problem.value} \u2014 the native runtimes parse only #RRGGBB or #RRGGBBAA` + (problem.suggestion ? `. Write ${problem.suggestion}.` : `, and this value names no colour that can be converted for you. Write the hex it should be.`)
     );
   }
+  const base = contrastFindings(colors);
+  for (const f of base) warn(`${tokensPath}: ${f.render(f.schemes)}`);
+  if (idiom !== null && typeof idiom === "object" && !Array.isArray(idiom)) {
+    const seen = new Set(base.flatMap((f) => f.schemes.map((s) => `${f.key}|${s}`)));
+    for (const [overlay, layer] of Object.entries(idiom)) {
+      const layerColors = layer?.colors;
+      if (layerColors === null || typeof layerColors !== "object" || Array.isArray(layerColors)) continue;
+      const merged = mergeIdiomOverlay({ colors }, { colors: layerColors }).colors;
+      for (const f of contrastFindings(merged)) {
+        const added = f.schemes.filter((s) => !seen.has(`${f.key}|${s}`));
+        if (added.length) warn(`${tokensPath}: under the idiom.${overlay} overlay, ${f.render(added)}`);
+      }
+    }
+  }
   return issues;
 }
+function schemeValue(token, scheme) {
+  let v = token;
+  if (token !== null && typeof token === "object" && !Array.isArray(token)) {
+    const o = token;
+    v = scheme === "highContrast" ? o.highContrast ?? o.dark ?? o.light : scheme === "dark" ? o.dark ?? o.light : o.light;
+  }
+  return typeof v === "string" && isCanonicalHex(v) ? v.trim().toUpperCase() : void 0;
+}
+function paintedOver(fg, bg) {
+  if (bg.length === 9 && bg.slice(7) !== "FF") return void 0;
+  if (fg.length === 9) return mixHex(fg.slice(0, 7), bg.slice(0, 7), parseInt(fg.slice(7), 16) / 255);
+  return fg;
+}
+function sameHueForContrast(fg, bg, target = AA_TEXT) {
+  const base = fg.slice(0, 7);
+  const opaqueBg = bg.slice(0, 7);
+  const pole = contrastRatio("#000000", opaqueBg) >= contrastRatio("#FFFFFF", opaqueBg) ? "#000000" : "#FFFFFF";
+  for (let step = 0; step <= 100; step++) {
+    const candidate = mixHex(base, pole, 1 - step / 100);
+    if (contrastRatio(candidate, opaqueBg) >= target) return candidate;
+  }
+  return void 0;
+}
+function contrastFindings(colors) {
+  const declared = /* @__PURE__ */ new Set(["light"]);
+  for (const v of Object.values(colors)) {
+    if (v === null || typeof v !== "object" || Array.isArray(v)) continue;
+    for (const s of SCHEMES) if (s in v) declared.add(s);
+  }
+  const findings = /* @__PURE__ */ new Map();
+  for (const pair of CONTRAST_PAIRS) {
+    const fgName = pair.fg;
+    if (colors[fgName] === void 0 || colors[pair.bg] === void 0) continue;
+    for (const scheme of SCHEMES) {
+      if (!declared.has(scheme)) continue;
+      const fg = schemeValue(colors[fgName], scheme);
+      const bg = schemeValue(colors[pair.bg], scheme);
+      if (!fg || !bg) continue;
+      const painted = paintedOver(fg, bg);
+      if (!painted) continue;
+      const opaqueBg = bg.slice(0, 7);
+      const ratio = contrastRatio(painted, opaqueBg);
+      if (ratio >= AA_TEXT) continue;
+      const key2 = `${fgName}|${pair.bg}|${fg}|${bg}`;
+      const same2 = findings.get(key2);
+      if (same2) {
+        same2.schemes.push(scheme);
+        continue;
+      }
+      const darker = contrastRatio("#000000", opaqueBg) >= contrastRatio("#FFFFFF", opaqueBg);
+      const ink = darker ? "#000000" : "#FFFFFF";
+      const suggestion = pair.suggest === "same-hue" ? sameHueForContrast(painted, opaqueBg) : pair.suggest === "ink" && contrastRatio(ink, opaqueBg) >= AA_TEXT ? ink : void 0;
+      const fix = !suggestion ? ` Pick a ${fgName} that clears ${AA_TEXT}:1 against ${pair.bg}.` : pair.suggest === "same-hue" ? ` A ${darker ? "darker" : "lighter"} ${fgName} of the same hue that clears it is ${suggestion} (${contrastRatio(suggestion, opaqueBg).toFixed(2)}:1).` : ` ${suggestion} clears it (${contrastRatio(suggestion, opaqueBg).toFixed(2)}:1).`;
+      findings.set(key2, {
+        key: key2,
+        schemes: [scheme],
+        render: (schemes) => `colors.${fgName} (${fg}) on colors.${pair.bg} (${bg}) is ${ratio.toFixed(2)}:1 in ${schemes.join(" / ")} \u2014 below the WCAG AA ${AA_TEXT}:1 for text. ${fgName} is ${pair.use}, so that text is hard to read.${fix}`
+      });
+    }
+  }
+  return [...findings.values()];
+}
+var AA_TEXT, CONTRAST_PAIRS, SCHEMES, channels, toHex, mixHex;
 var init_token_lint = __esm({
   "src/token-lint.ts"() {
     init_token_colors();
+    init_idiom();
+    AA_TEXT = 4.5;
+    CONTRAST_PAIRS = [
+      {
+        fg: "accentPrimary",
+        bg: "surfacePrimary",
+        use: "the text colour of secondary, plain and link buttons, selected tab labels and inline action text",
+        suggest: "same-hue"
+      },
+      { fg: "accentText", bg: "surfacePrimary", use: "the dedicated colour for accent-coloured text", suggest: "same-hue" },
+      { fg: "textOnAccent", bg: "accentPrimary", use: "the label on filled (primary) buttons and selected chips", suggest: "ink" },
+      { fg: "textPrimary", bg: "surfacePrimary", use: "body and title text" },
+      { fg: "textSecondary", bg: "surfacePrimary", use: "secondary text (subtitles, captions, metadata)" }
+    ];
+    SCHEMES = ["light", "dark", "highContrast"];
+    channels = (hex2) => [1, 3, 5].map((i) => parseInt(hex2.slice(i, i + 2), 16));
+    toHex = (rgb) => `#${rgb.map((c) => Math.round(Math.min(255, Math.max(0, c))).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
+    mixHex = (a, b, w) => {
+      const [ca, cb] = [channels(a), channels(b)];
+      return toHex(ca.map((c, i) => c * w + cb[i] * (1 - w)));
+    };
   }
 });
 
@@ -11841,8 +12017,8 @@ async function sharpOrThrow() {
 async function inspectIconPixels(png) {
   const sharp = await sharpOrThrow();
   const { data, info } = await sharp(png).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
-  const { width, height, channels: channels2 } = info;
-  if (channels2 !== 4) throw new Error(`app-icons: expected RGBA after ensureAlpha, got ${channels2} channels`);
+  const { width, height, channels: channels3 } = info;
+  if (channels3 !== 4) throw new Error(`app-icons: expected RGBA after ensureAlpha, got ${channels3} channels`);
   let minAlpha = 255;
   let transparent = 0;
   for (let i = 3; i < data.length; i += 4) {
@@ -12691,75 +12867,6 @@ var init_face_source = __esm({
   }
 });
 
-// ../../core/ts/src/idiom.ts
-function authored(overlays, name) {
-  return typeof name === "string" && overlays !== void 0 && Object.hasOwn(overlays, name) && overlays[name] !== null && typeof overlays[name] === "object" && !Array.isArray(overlays[name]);
-}
-function selectIdiomOverlay(doc, ctx = {}) {
-  const policy = doc.idiomPolicy;
-  const overlays = doc.idiom;
-  const isRecord3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
-  if (!isRecord3(policy) || !isRecord3(overlays)) return void 0;
-  const kind = policy.policy ?? "follow-surface";
-  if (kind === "none") return void 0;
-  if (kind === "pinned") return authored(overlays, policy.pin) ? policy.pin : void 0;
-  if (kind !== "follow-surface") return void 0;
-  const surfaces = policy.surfaces;
-  const candidates = [
-    ctx.surface !== void 0 && isRecord3(surfaces) && Object.hasOwn(surfaces, ctx.surface) ? surfaces[ctx.surface] : void 0,
-    ...ctx.native ?? [],
-    policy.fallback
-  ];
-  return candidates.find((c) => authored(overlays, c));
-}
-function isPlainObject(v) {
-  return v !== null && typeof v === "object" && !Array.isArray(v);
-}
-function deepMerge(base, overlay) {
-  if (!isPlainObject(overlay) || !isPlainObject(base)) return overlay;
-  const out = { ...base };
-  for (const [key2, value] of Object.entries(overlay)) {
-    if (UNSAFE_KEYS.has(key2)) continue;
-    out[key2] = Object.hasOwn(base, key2) ? deepMerge(base[key2], value) : value;
-  }
-  return out;
-}
-function mergeIdiomOverlay(base, overlay) {
-  const merged = deepMerge(base, overlay);
-  const baseColors = base.colors;
-  const overlayColors = overlay.colors;
-  if (isPlainObject(baseColors) && isPlainObject(overlayColors)) {
-    const colors = { ...merged.colors };
-    for (const [name, value] of Object.entries(overlayColors)) {
-      if (UNSAFE_KEYS.has(name)) continue;
-      const was = Object.hasOwn(baseColors, name) ? baseColors[name] : void 0;
-      if (typeof was === "string" && isPlainObject(value)) colors[name] = { light: was, ...value };
-    }
-    merged.colors = colors;
-  }
-  return merged;
-}
-function resolveIdiom(tokens, ctx = {}) {
-  const doc = tokens;
-  const name = selectIdiomOverlay(doc, ctx);
-  if (name === void 0) return tokens;
-  const merged = mergeIdiomOverlay(tokens, doc.idiom[name]);
-  const { idiomPolicy: _applied, ...final } = merged;
-  return final;
-}
-var IDIOM_CONTEXTS, UNSAFE_KEYS;
-var init_idiom = __esm({
-  "../../core/ts/src/idiom.ts"() {
-    "use strict";
-    IDIOM_CONTEXTS = {
-      ios: { native: ["ios"] },
-      android: { native: ["material"] },
-      mac: { native: ["desktop", "ios"], surface: "mac" }
-    };
-    UNSAFE_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
-  }
-});
-
 // ../../core/web-renderer/src/idiom-controls.ts
 function pickRole(colors, role) {
   if (typeof role === "string") return role;
@@ -20137,7 +20244,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -23724,7 +23830,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -36627,6 +36732,8 @@ async function bootScreenWorker(opts) {
     ...opts.inputOverride ?? {}
   };
   const appear = opts.skipAppear ? null : rootOnAppear(opts.descriptor);
+  const hostCalls = [];
+  const host = hostDispatch(opts.localDbSchema, declaredCapabilitiesOf(opts.descriptor), opts.capabilitySuccess === true, opts.clock ?? CRAWL_CLOCK);
   const w = await bootBundleWorker(opts.bundleJs, {
     wixCall: opts.wixCall,
     input,
@@ -36635,7 +36742,10 @@ async function bootScreenWorker(opts) {
     // while the worker believed it was 2026, so a modelled session carried a timestamp fifty-six
     // years before the "now" the app computes against — inconsistent rendered dates, and any
     // time-dependent branch taking the wrong arm.
-    dispatch: hostDispatch(opts.localDbSchema, declaredCapabilitiesOf(opts.descriptor), opts.capabilitySuccess === true, opts.clock ?? CRAWL_CLOCK),
+    dispatch: (action, params) => {
+      hostCalls.push(String(action));
+      return host(action, params);
+    },
     deviceParity: true,
     clock: opts.clock ?? CRAWL_CLOCK,
     seed: opts.seed ?? 1,
@@ -36658,7 +36768,12 @@ async function bootScreenWorker(opts) {
   }
   for (let i = 0; i < 20; i++) await yieldMacrotask();
   const { state, defects } = snapshot(w);
-  return { ...w, state: Object.keys(state).length ? state : w.services, defects, ...deadLifecycle ? { deadLifecycle } : {} };
+  return { ...w, hostCalls, state: Object.keys(state).length ? state : w.services, defects, ...deadLifecycle ? { deadLifecycle } : {} };
+}
+function effectSince(w, mark, action, componentId) {
+  const wix = w.calls.slice(mark.wix);
+  const host = w.hostCalls.slice(mark.host);
+  return wix.length || host.length ? { action, componentId, wix, host } : null;
 }
 function resolveSiteRows(itemsPath, valueOf) {
   if (!itemsPath || itemsPath === UNTRACKED_ITEMS) return void 0;
@@ -36719,7 +36834,10 @@ async function crawlScreenCapabilitySuccess(opts) {
     const r = await crawlScreenInner({ ...opts, capabilitySuccess: true });
     return {
       findings: r.findings.map((f) => ({ ...f, axis: f.axis ? `capability:success+${f.axis}` : "capability:success" })),
-      modelled: modelled.length
+      modelled: modelled.length,
+      // The success arm is where a paid flow goes on past `isAvailable` to `proceedToPayment`, so
+      // its effects are the write inventory's too — unlike its counts, they cannot double anything.
+      ...r.effects?.length ? { effects: r.effects } : {}
     };
   });
 }
@@ -36759,6 +36877,9 @@ async function crawlScreenJourney(opts) {
     });
     const sites = actionSitesForDescriptor(opts.descriptor);
     let stepsExercised = 0;
+    const effects = [];
+    const bootEffect = effectSince(worker, { wix: 0, host: 0 }, "boot", null);
+    if (bootEffect) effects.push(bootEffect);
     for (const step of opts.journey.steps) {
       const declared = sites.find((site2) => site2.actionId === step.action && (step.component === void 0 || site2.componentId === step.component));
       if (!declared) {
@@ -36781,6 +36902,7 @@ async function crawlScreenJourney(opts) {
         fail2(`journey "${opts.journey.name}" names unavailable worker action ${step.action}`, step);
         continue;
       }
+      const mark = { wix: worker.calls.length, host: worker.hostCalls.length };
       try {
         await handle.dispatch(parsed.action, ...workerArgs({ params: { ...site.params ?? {}, ...site.args ?? {}, ...step.params ?? {} } }));
         for (let i = 0; i < 8; i++) await yieldMacrotask();
@@ -36788,6 +36910,8 @@ async function crawlScreenJourney(opts) {
       } catch (error) {
         fail2(`journey "${opts.journey.name}" step ${step.action} threw: ${errText(error)}`, step);
       }
+      const stepEffect = effectSince(worker, mark, site.actionId, site.componentId);
+      if (stepEffect) effects.push(stepEffect);
     }
     const settled = snapshot(worker);
     if (worker.errors.length) {
@@ -36797,7 +36921,7 @@ async function crawlScreenJourney(opts) {
     for (const expected of opts.journey.expectText) {
       if (!values.includes(expected)) fail2(`journey "${opts.journey.name}" never rendered its expected visible result: ${JSON.stringify(expected)}`);
     }
-    return { screen: opts.screenId, journey: opts.journey.name, stepsExercised, findings };
+    return { screen: opts.screenId, journey: opts.journey.name, stepsExercised, findings, ...effects.length ? { effects } : {} };
   });
 }
 async function crawlScreenInner(opts) {
@@ -36812,6 +36936,7 @@ async function crawlScreenInner(opts) {
   const actionsSkipped = [];
   const navEdges = [];
   const unobservedActions = [];
+  const effects = [];
   let observations;
   let seedWords = [];
   const harvestStaticEdges = (state) => {
@@ -37095,6 +37220,8 @@ async function crawlScreenInner(opts) {
       harvestStaticEdges(first.state);
       drainWorkerEdges(first, "worker:boot");
       drainPollDirectives(first, "boot");
+      const bootEffect = effectSince(first, { wix: 0, host: 0 }, "boot", null);
+      if (bootEffect) effects.push(bootEffect);
       if (/\bwixApi\b/.test(bundleJs) && first.calls.length === 0) {
         const inputGated = /himalaya\??\.input\b|\binput\s*[.?]/.test(bundleJs);
         findings.push({
@@ -37180,6 +37307,7 @@ async function crawlScreenInner(opts) {
       const dispatched = typed ? { ...effective, args: { ...effective.args ?? {}, [typed.key]: typed.value } } : effective;
       const before = JSON.stringify(preState);
       const callsBefore = w.calls.length;
+      const hostBefore = w.hostCalls.length;
       const errors = [];
       try {
         await handle.dispatch(parsed.action, ...workerArgs(dispatched));
@@ -37192,6 +37320,8 @@ async function crawlScreenInner(opts) {
       const navCountBefore = navEdges.length;
       drainWorkerEdges(w, `worker:${site.actionId}`);
       drainPollDirectives(w, trigger);
+      const tapEffect = effectSince(w, { wix: callsBefore, host: hostBefore }, site.actionId, site.componentId);
+      if (tapEffect) effects.push(tapEffect);
       if (!errors.length && navEdges.length === navCountBefore && w.calls.length === callsBefore && JSON.stringify(state) === before) {
         if (typed) {
           findings.push({
@@ -37256,6 +37386,7 @@ async function crawlScreenInner(opts) {
     actionsExercised: exercised,
     actionsSkipped,
     navEdges: edges,
+    ...effects.length ? { effects } : {},
     ...observations ? { observations } : {},
     ...unobservedActions.length ? { unobservedActions } : {},
     findings: dedupe(findings),
@@ -37474,6 +37605,7 @@ async function crawlScreenDeep(opts, deep) {
     const queue = [[]];
     let dispatches = 0;
     let capped = false;
+    const effects = [];
     const boot = () => bootScreenWorker({
       bundleJs,
       descriptor,
@@ -37494,6 +37626,13 @@ async function crawlScreenDeep(opts, deep) {
       }
       const path2 = queue.shift();
       const w = await boot();
+      let pending = null;
+      const flushStep = () => {
+        if (!pending) return;
+        const e = effectSince(w, pending.mark, pending.site.actionId, pending.site.componentId);
+        if (e) effects.push(e);
+        pending = null;
+      };
       try {
         let threwAt = null;
         for (const [step, siteIdx] of path2.entries()) {
@@ -37515,6 +37654,8 @@ async function crawlScreenDeep(opts, deep) {
             break;
           }
           dispatches += 1;
+          flushStep();
+          pending = { mark: { wix: w.calls.length, host: w.hostCalls.length }, site };
           try {
             await handle.dispatch(parsed.action, ...workerArgs(effective));
           } catch (e) {
@@ -37535,8 +37676,12 @@ async function crawlScreenDeep(opts, deep) {
             break;
           }
         }
-        if (threwAt) continue;
+        if (threwAt) {
+          flushStep();
+          continue;
+        }
         for (let i = 0; i < 20; i++) await yieldMacrotask();
+        flushStep();
         const { state, defects } = snapshot(w);
         const hash = deepStateSignature(state, defects);
         if (visited.has(hash)) continue;
@@ -37581,7 +37726,7 @@ async function crawlScreenDeep(opts, deep) {
         w.dispose();
       }
     }
-    return { findings: dedupe(findings), nodesVisited: visited.size, dispatches, capped };
+    return { findings: dedupe(findings), nodesVisited: visited.size, dispatches, capped, ...effects.length ? { effects } : {} };
   });
 }
 function effectiveSiteForRow(site, row) {
@@ -40896,11 +41041,11 @@ function notCarriedDiff(local, base) {
   const CARRIED = /* @__PURE__ */ new Set(["screens", "bundles", "tokensHash", "appConfigHash"]);
   const PROVENANCE = /* @__PURE__ */ new Set(["releaseId", "gitSha", "shellSha", "label", "notes", "publishedAt", "publishedBy", "attestation", "forcedPastErrors", "app", "appSourceHash"]);
   const REPORTED_IN_DETAIL = /* @__PURE__ */ new Set(["assets", "minBinaryVersion", "iconHash"]);
-  const comparable = (key2, value) => key2 === "widgets" ? stableWidgets(value) : value;
+  const comparable2 = (key2, value) => key2 === "widgets" ? stableWidgets(value) : value;
   for (const key2 of /* @__PURE__ */ new Set([...Object.keys(local), ...Object.keys(base)])) {
     if (CARRIED.has(key2) || PROVENANCE.has(key2) || REPORTED_IN_DETAIL.has(key2)) continue;
-    const l = comparable(key2, local[key2] ?? null);
-    const b = comparable(key2, base[key2] ?? null);
+    const l = comparable2(key2, local[key2] ?? null);
+    const b = comparable2(key2, base[key2] ?? null);
     const ls = JSON.stringify(l) ?? "null";
     const bs = JSON.stringify(b) ?? "null";
     if (ls === bs) continue;
@@ -42067,6 +42212,7 @@ var init_home_descriptor = __esm({
 var template_trim_exports = {};
 __export(template_trim_exports, {
   TrimRefusal: () => TrimRefusal,
+  compareErrors: () => compareErrors,
   leftoverNavRefs: () => leftoverNavRefs,
   linearSafePattern: () => linearSafePattern,
   parseApp: () => parseApp,
@@ -42835,6 +42981,16 @@ async function runTemplateTrim(req, deps) {
       if (!existsSync42(path2) || !readFileSync46(path2).equals(original)) writeFileSync15(path2, original);
     }
     for (const name of [...moved].reverse()) renameSync4(join39(backup, "tier5-src", name), join39(dir, "tier5-src", name));
+    moved.length = 0;
+  };
+  const apply = () => {
+    const moveDir = deps.moveDir ?? renameSync4;
+    for (const name of plan.removedWorkers) {
+      moveDir(join39(dir, "tier5-src", name), join39(backup, "tier5-src", name));
+      moved.push(name);
+    }
+    if (plan.dev !== dev) writeFileSync15(devPath, plan.dev);
+    if (plan.config !== config) writeFileSync15(configPath, plan.config);
   };
   const dropBackup = () => {
     rmSync8(backup, { recursive: true, force: true });
@@ -42873,13 +43029,7 @@ async function runTemplateTrim(req, deps) {
     return { code: 1, result: { ok: false, error: `could not back up the app before trimming it (${e.message}); nothing was changed`, rolledBack: true, ...base() } };
   }
   try {
-    const moveDir = deps.moveDir ?? renameSync4;
-    for (const name of plan.removedWorkers) {
-      moveDir(join39(dir, "tier5-src", name), join39(backup, "tier5-src", name));
-      moved.push(name);
-    }
-    if (plan.dev !== dev) writeFileSync15(devPath, plan.dev);
-    if (plan.config !== config) writeFileSync15(configPath, plan.config);
+    apply();
   } catch (e) {
     return abort("the trim failed while writing", e);
   }
@@ -42896,9 +43046,53 @@ async function runTemplateTrim(req, deps) {
   } catch (e) {
     return abort("the trim could not be checked", e, validate3);
   }
+  let compared;
+  if (failure && validate3 && validate3.code !== 0 && comparable(validate3)) {
+    try {
+      restore();
+    } catch (e) {
+      return abort(String(failure.error), e, validate3);
+    }
+    let original;
+    try {
+      original = await deps.validate(dir, { fresh: true });
+    } catch {
+    }
+    if (original && comparable(original)) {
+      compared = compareErrors(validate3.errors ?? [], original.code === 0 ? [] : original.errors ?? []);
+    }
+    const clean2 = compared !== void 0 && compared.introduced.length === 0;
+    if (clean2 || req.force) {
+      try {
+        apply();
+      } catch (e) {
+        return abort("the trim failed while re-applying it after validating the untrimmed app", e, validate3);
+      }
+    }
+    if (clean2) failure = void 0;
+    else if (compared) {
+      failure = {
+        ...failure,
+        error: `himi validate --strict failed on the trimmed app \u2014 the trim introduced ${plural(compared.introduced.length, "error")} the untrimmed app does not have: ${summarize3(compared.introduced)}`,
+        introducedErrors: compared.introduced,
+        preExistingErrors: compared.preExisting
+      };
+    }
+  }
   if (!failure) {
     dropBackup();
-    return { code: 0, result: { ok: true, ...base(validate3) } };
+    const preExisting = compared?.preExisting ?? [];
+    return {
+      code: 0,
+      result: {
+        ok: true,
+        ...base(validate3),
+        ...preExisting.length ? {
+          preExistingErrors: preExisting,
+          note: `trimmed; ${plural(preExisting.length, "error")} ${preExisting.length === 1 ? "was" : "were"} already present before trim: ${summarize3(preExisting)}`
+        } : {}
+      }
+    };
   }
   if (req.force) {
     return {
@@ -42917,7 +43111,36 @@ async function runTemplateTrim(req, deps) {
     result: { ok: false, ...failure, rolledBack: true, hint: "nothing changed \u2014 fix what validate reports (or keep more screens) and trim again, or pass --force to keep the trimmed tree anyway", ...base(validate3) }
   };
 }
-var TrimRefusal, LIT, ATOM, QUANT, CAP, SAFE_ROUTE_PATTERN, lineOf, isStatic, entryLabel, isNode3, asItems, NAV_SCREEN_KEYS, sorted, refuse3;
+function comparable(v) {
+  if (v.code === 0) return true;
+  if (!v.errors?.length) return false;
+  return v.counts === void 0 || v.counts.errors === v.errors.length;
+}
+function compareErrors(trimmed, original) {
+  const left = /* @__PURE__ */ new Map();
+  for (const e of original) left.set(e.id, (left.get(e.id) ?? 0) + 1);
+  const out = { preExisting: [], introduced: [] };
+  for (const e of trimmed) {
+    const n = left.get(e.id) ?? 0;
+    if (n > 0) {
+      left.set(e.id, n - 1);
+      out.preExisting.push(e);
+    } else out.introduced.push(e);
+  }
+  return out;
+}
+function summarize3(errors) {
+  const one = (e) => {
+    const rule = e.pass ? e.ruleCode && e.ruleCode !== e.pass ? `${e.pass}/${e.ruleCode}` : e.pass : e.ruleCode;
+    const place = e.screen ? `on ${e.screen}` : e.path ? `in ${e.path}` : void 0;
+    const where = [rule, place].filter(Boolean).join(" ");
+    const msg = e.message.length > 160 ? `${e.message.slice(0, 157)}...` : e.message;
+    return where ? `${where}: ${msg}` : msg;
+  };
+  const shown2 = errors.slice(0, 5).map(one).join("; ");
+  return errors.length > 5 ? `${shown2}; and ${errors.length - 5} more` : shown2;
+}
+var TrimRefusal, LIT, ATOM, QUANT, CAP, SAFE_ROUTE_PATTERN, lineOf, isStatic, entryLabel, isNode3, asItems, NAV_SCREEN_KEYS, sorted, refuse3, plural;
 var init_template_trim = __esm({
   "src/template-trim.ts"() {
     init_validate_descriptor();
@@ -42951,6 +43174,7 @@ var init_template_trim = __esm({
     NAV_SCREEN_KEYS = /* @__PURE__ */ new Set(["screenId", "parentScreenId", "contentScreenId", "badgeScreenId"]);
     sorted = (xs) => [...new Set(xs)].sort();
     refuse3 = (e) => ({ code: 2, result: { ok: false, error: e.message, ...e.detail } });
+    plural = (n, word) => `${n} ${word}${n === 1 ? "" : "s"}`;
   }
 });
 
@@ -44232,6 +44456,184 @@ var init_eject = __esm({
   }
 });
 
+// src/wix-writes.ts
+import { existsSync as existsSync46, readFileSync as readFileSync50 } from "node:fs";
+import { join as join43 } from "node:path";
+function isProvenRead(method, path2) {
+  if (/[#\x00-\x1F\x7F]/.test(path2)) return false;
+  const verb = method.toUpperCase();
+  if (verb === "GET") return true;
+  const bare = path2.split("?")[0].replace(/\/+$/, "");
+  return verb === "POST" && /\/(query|search|list[^/]*|get[^/]*|count|aggregate|facets|connections)$/i.test(bare);
+}
+function nativeWriteOf(verb) {
+  const exact = NATIVE_WRITES[verb];
+  if (exact) return { canonical: verb, ...exact };
+  const member = MEMBER_VERB.exec(verb);
+  if (member) return { canonical: `himi.wix.${member[1]}`, ...NATIVE_WRITES[`himi.wix.${member[1]}`] };
+  return null;
+}
+function writesFromEffects(screen, effects) {
+  const out = [];
+  for (const e of effects ?? []) {
+    const base = { screen, action: e.action, ...e.componentId ? { component: e.componentId } : {} };
+    for (const call of e.wix) {
+      const sp = call.indexOf(" ");
+      const method = (sp < 0 ? call : call.slice(0, sp)).toUpperCase();
+      const path2 = sp < 0 ? "" : call.slice(sp + 1);
+      if (isProvenRead(method, path2)) continue;
+      out.push({ ...base, via: "wix", method, path: path2.split("?")[0] });
+    }
+    for (const verb of e.host) {
+      const native = nativeWriteOf(verb);
+      if (native) out.push({ ...base, via: "native", capability: verb, kind: native.kind, what: native.what });
+    }
+  }
+  return dedupeWrites(out);
+}
+function dedupeWrites(list) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const w of list) {
+    const k = writeKey(w);
+    if (seen.has(k)) continue;
+    seen.add(k);
+    out.push(w);
+  }
+  return out;
+}
+function unreachedNativeWrites(screen, bundleJs, observed) {
+  if (!bundleJs) return [];
+  const seen = new Set(observed.filter((w) => w.screen === screen && w.via === "native").map((w) => nativeWriteOf(w.capability)?.canonical));
+  const out = [];
+  for (const [verb, native] of Object.entries(NATIVE_WRITES)) {
+    if (seen.has(verb)) continue;
+    if (!BUNDLE_TEXT[verb].test(bundleJs)) continue;
+    out.push({ screen, action: "unreached", via: "native", capability: verb, kind: native.kind, what: native.what });
+  }
+  return out;
+}
+function parseDataAccess(text5, from) {
+  const body = text5.replace(/<!--[\s\S]*?(?:-->|$)/g, "");
+  const heading = new RegExp(`(?:^|\\n)##[ \\t]+${DATA_ACCESS_HEADING}\\b[^\\n]*([\\s\\S]*?)(?=\\n##[ \\t]|$)`, "i").exec(body);
+  if (!heading) return null;
+  const lines = heading[1].split("\n").map((l) => l.trim()).filter((l) => l.startsWith("|"));
+  if (lines.length < 2) return null;
+  const cells = (line) => line.replace(/^\|/, "").replace(/\|\s*$/, "").split("|").map((c) => c.trim());
+  const header = cells(lines[0]).map((c) => unquote(c).toLowerCase());
+  const screenCol = header.findIndex((h) => /^screens?$/.test(h));
+  let writesCol = header.findIndex((h) => /^wix writes?$/.test(h));
+  if (writesCol < 0) writesCol = header.findIndex((h) => /^writes?$/.test(h));
+  if (screenCol < 0 || writesCol < 0) return null;
+  const rows = [];
+  for (const line of lines.slice(1)) {
+    if (/^\|?\s*:?-+:?\s*(\|\s*:?-+:?\s*)*\|?$/.test(line)) continue;
+    const row = cells(line);
+    const screen = unquote(row[screenCol] ?? "");
+    if (!screen) continue;
+    const cell = unquote(row[writesCol] ?? "");
+    const entries = cell.split(/[,;]/).map((e) => e.trim()).filter((e) => e && !NONE.test(e));
+    rows.push({ screen, allowed: NONE.test(cell) || !entries.length ? null : entries });
+  }
+  return rows.length ? { from, rows } : null;
+}
+function readDataAccess(dir) {
+  for (const name of ["SPEC.md", "MOBILE-UX.md"]) {
+    const p = join43(dir, name);
+    if (!existsSync46(p)) continue;
+    let text5;
+    try {
+      text5 = readFileSync50(p, "utf8");
+    } catch {
+      continue;
+    }
+    const plan = parseDataAccess(text5, name);
+    if (plan) return plan;
+  }
+  return null;
+}
+function entryApproves(entry, w) {
+  const e = entry.trim();
+  const lower = e.toLowerCase();
+  const actionTail = w.action.split(".").pop() ?? w.action;
+  if (e === w.action || e === actionTail) return true;
+  if (w.via === "native") {
+    const tail = w.capability.split(".").pop();
+    if (e === w.capability || e === tail || e === nativeWriteOf(w.capability)?.canonical) return true;
+    if (w.kind === "payment" && /^payments?$/.test(lower)) return true;
+    if (w.kind === "member-signup" && /^(sign-?up|register|registration|member[- ]signup)$/.test(lower)) return true;
+    return false;
+  }
+  const m = /^(?:(GET|POST|PUT|PATCH|DELETE)\s+)?(\/\S*|https?:\/\/\S+)$/i.exec(e);
+  if (!m) return false;
+  if (m[1] && m[1].toUpperCase() !== w.method) return false;
+  return pathPattern(m[2]).test(w.path);
+}
+function pathPattern(p) {
+  const body = p.replace(/\/+$/, "").split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join("[^/]+");
+  return new RegExp(`^${body}/?$`);
+}
+function unapprovedWriteFindings(writes, plan) {
+  if (!plan) return [];
+  const byScreen = /* @__PURE__ */ new Map();
+  for (const row of plan.rows) {
+    const list = byScreen.get(row.screen) ?? [];
+    list.push(row);
+    byScreen.set(row.screen, list);
+  }
+  const findings = [];
+  for (const w of writes) {
+    const rows = byScreen.get(w.screen) ?? byScreen.get("*");
+    const unreached = w.action === "unreached";
+    const trigger = w.action === "boot" || unreached ? "boot" : { tap: w.component ?? null, key: "write", action: w.action };
+    const does = unreached ? `can write to Wix (${writeLabel(w)} \u2014 its worker bundle calls it, on a path this crawl did not reach)` : `writes to Wix (${writeLabel(w)})`;
+    const hint = `Before publishing, reconcile this with the owner-approved plan: remove the action (or trim the screen with \`himi template trim\`) if the owner did not approve it, or name the write in ${plan.from}'s \`## ${DATA_ACCESS_HEADING}\` table \u2014 ` + (unreached ? "" : `its action (\`${w.action.split(".").pop()}\`), `) + (w.via === "wix" ? `its endpoint (\`${w.method} ${w.path}\`)` : `its capability (\`${w.capability.split(".").pop()}\`)`) + ` \u2014 once they have.`;
+    if (!rows) {
+      findings.push({
+        screen: w.screen,
+        trigger,
+        invariant: "write-not-approved",
+        severity: "warning",
+        message: `${does}, and ${plan.from}'s data-access table has no row for this screen`,
+        hint
+      });
+      continue;
+    }
+    const allowed2 = rows.flatMap((r) => r.allowed ?? []);
+    if (allowed2.some((entry) => entryApproves(entry, w))) continue;
+    findings.push({
+      screen: w.screen,
+      trigger,
+      invariant: "write-not-approved",
+      severity: "warning",
+      message: allowed2.length ? `${does}, which ${plan.from}'s data-access table does not name for this screen (approved: ${allowed2.join(", ")})` : `${does}, but ${plan.from}'s data-access table approves no writes on this screen`,
+      hint
+    });
+  }
+  return findings;
+}
+var NATIVE_WRITES, MEMBER_VERB, BUNDLE_TEXT, writeKey, writeLabel, DATA_ACCESS_HEADING, NONE, unquote;
+var init_wix_writes = __esm({
+  "src/wix-writes.ts"() {
+    NATIVE_WRITES = {
+      "himi.wix.registerDirect": { kind: "member-signup", what: "creates a site member" },
+      "himi.wix.resetPassword": { kind: "member-account", what: "sends a site member a password-reset email" },
+      "capability.wix_cashier.proceedToPayment": { kind: "payment", what: "charges the customer through the Wix cashier" }
+    };
+    MEMBER_VERB = /^[a-z_]+\.wix\.(registerDirect|resetPassword)$/;
+    BUNDLE_TEXT = {
+      "himi.wix.registerDirect": /["'`][a-z_]+\.wix\.registerDirect["'`]|\}(?:\.wix)?\.registerDirect`/,
+      "himi.wix.resetPassword": /["'`][a-z_]+\.wix\.resetPassword["'`]|\}(?:\.wix)?\.resetPassword`/,
+      "capability.wix_cashier.proceedToPayment": /capability\.wix_cashier\.proceedToPayment["'`]/
+    };
+    writeKey = (w) => [w.screen, w.action, w.via, w.method ?? "", w.path ?? "", w.capability ?? ""].join("|");
+    writeLabel = (w) => w.via === "wix" ? `${w.method} ${w.path}` : `${w.capability} (${w.what})`;
+    DATA_ACCESS_HEADING = "Data access";
+    NONE = /^(|-+|—|–|none|no|nothing|n\/a|na|read[- ]only|reads? only|✗|×)$/i;
+    unquote = (cell) => cell.replace(/`/g, "").trim();
+  }
+});
+
 // src/test.ts
 var test_exports = {};
 __export(test_exports, {
@@ -44248,14 +44650,14 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync46, mkdirSync as mkdirSync23, readFileSync as readFileSync50, writeFileSync as writeFileSync19 } from "node:fs";
-import { join as join43, resolve as resolve40 } from "node:path";
+import { existsSync as existsSync47, mkdirSync as mkdirSync23, readFileSync as readFileSync51, writeFileSync as writeFileSync19 } from "node:fs";
+import { join as join44, resolve as resolve40 } from "node:path";
 function readTestConfig(dir) {
   const p = resolve40(dir, TEST_CONFIG_FILE);
-  if (!existsSync46(p)) return {};
+  if (!existsSync47(p)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync50(p, "utf8"));
+    parsed = JSON.parse(readFileSync51(p, "utf8"));
   } catch (e) {
     throw new Error(`${TEST_CONFIG_FILE} is not valid JSON \u2014 ${e.message}`);
   }
@@ -44288,6 +44690,10 @@ function readTestConfig(dir) {
         if (step.component !== void 0 && typeof step.component !== "string") throw new Error(`${TEST_CONFIG_FILE}: journeys[${i}].steps[${stepIndex}].component must be a string`);
         if (step.params !== void 0 && (!step.params || typeof step.params !== "object" || Array.isArray(step.params))) throw new Error(`${TEST_CONFIG_FILE}: journeys[${i}].steps[${stepIndex}].params must be an object`);
       });
+      const input = journey.input;
+      if (input !== void 0 && (!input || typeof input !== "object" || Array.isArray(input) || Object.values(input).some((v) => typeof v !== "string"))) {
+        throw new Error(`${TEST_CONFIG_FILE}: journeys[${i}].input must be an object of string values \u2014 the screen input a nav edge would send, e.g. { "id": "svc-0001" }`);
+      }
       if (!Array.isArray(journey.expectText) || !journey.expectText.length || journey.expectText.some((text5) => typeof text5 !== "string" || !text5.trim())) {
         throw new Error(`${TEST_CONFIG_FILE}: journeys[${i}] needs non-empty expectText values that prove a visible result`);
       }
@@ -44298,7 +44704,7 @@ function readTestConfig(dir) {
 function readNetRules(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync50(path2, "utf8"));
+    parsed = JSON.parse(readFileSync51(path2, "utf8"));
   } catch (e) {
     throw new Error(`--net ${path2} could not be read as JSON \u2014 ${e.message}`);
   }
@@ -44319,7 +44725,7 @@ function readNetRules(path2) {
 function defaultNetRules(dir) {
   for (const rel of ["dev/net-mocks.json", "tests/net-mocks.json"]) {
     const p = resolve40(dir, rel);
-    if (existsSync46(p)) {
+    if (existsSync47(p)) {
       const rules = readNetRules(p);
       if (rules.length) return { rules, from: rel };
     }
@@ -44335,7 +44741,7 @@ function readCannedResponses() {
   ];
   for (const url of candidates) {
     try {
-      const parsed = JSON.parse(readFileSync50(url, "utf8"));
+      const parsed = JSON.parse(readFileSync51(url, "utf8"));
       const byKey = {};
       for (const [k, v] of Object.entries(parsed)) {
         if (!k.startsWith("//")) byKey[k] = v;
@@ -44357,9 +44763,7 @@ function makeRecordingWixCall(send2, token, app) {
       refused.push(`${verb} ${path2}`);
       throw new Error(`--record refused ${verb} ${path2}: the path carries a fragment or control character \u2014 not a provable read`);
     }
-    const bare = path2.split("?")[0].replace(/\/+$/, "");
-    const readShaped = verb === "GET" || verb === "POST" && /\/(query|search|list[^/]*|get[^/]*|count|aggregate|facets|connections)$/i.test(bare);
-    if (!readShaped) {
+    if (!isProvenRead(verb, path2)) {
       refused.push(`${verb} ${path2}`);
       throw new Error(`--record refused ${verb} ${path2}: recording sends only proven reads (GET, or POST ending in /query, /search, /list*, /get*, /count, /aggregate, /facets, /connections) \u2014 if this IS a read, add its rule to dev/net-mocks.json by hand`);
     }
@@ -44427,8 +44831,8 @@ function writeRecordedMocks(opts) {
     mkdir: (p) => mkdirSync23(p, { recursive: true }),
     write: (p, s) => writeFileSync19(p, s)
   };
-  fs.mkdir(join43(opts.dir, "dev"));
-  fs.write(join43(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
+  fs.mkdir(join44(opts.dir, "dev"));
+  fs.write(join44(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
   return { ok: true, rules, to: "dev/net-mocks.json" };
 }
 function scopeDescriptors(descriptors, requestedIds, invalidScreens) {
@@ -44496,6 +44900,7 @@ async function runCrawl(opts) {
   const suppressed = [];
   const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s) => (s.screen === void 0 || s.screen === screen) && (s.action === void 0 || s.action === actionId) && (s.component === void 0 || s.component === componentId) && (s.invariant === void 0 || s.invariant === invariant));
   const results = [];
+  const writes = [];
   const uncoveredByScreen = /* @__PURE__ */ new Map();
   const coverageFns = /* @__PURE__ */ new Map();
   const bundleOf = new Map(descriptors.map((d) => [d.screenId, d]));
@@ -44533,18 +44938,21 @@ async function runCrawl(opts) {
     const cov = baked.bundleJs && deps.startWorkerCoverage ? await deps.startWorkerCoverage() : null;
     const r = await deps.crawlScreen(args);
     results.push(r);
+    writes.push(...writesFromEffects(baked.screenId, r.effects));
     for (const journey of opts.config?.journeys?.filter((candidate) => candidate.screen === baked.screenId) ?? []) {
       if (!deps.crawlScreenJourney) {
         journeyFindings.push({ screen: baked.screenId, trigger: "boot", invariant: "journey-failed", severity: "error", message: `journey "${journey.name}" cannot run because this CLI's crawl engine is too old`, hint: "Upgrade @wix/himalaya-cli so typed journeys run instead of being silently skipped." });
         journeyResults.push({ name: journey.name, screen: baked.screenId, stepsExercised: 0, ok: false });
         continue;
       }
-      const jr = await deps.crawlScreenJourney({ ...args, journey });
+      const jr = await deps.crawlScreenJourney({ ...args, ...journey.input ? { inputOverride: journey.input } : {}, journey });
+      writes.push(...writesFromEffects(baked.screenId, jr.effects));
       journeyFindings.push(...jr.findings);
       journeyResults.push({ name: journey.name, screen: baked.screenId, stepsExercised: jr.stepsExercised, ok: jr.findings.length === 0 });
     }
     if (opts.deep && opts.deep >= 2 && deps.crawlScreenDeep && baked.bundleJs) {
       const dr = await deps.crawlScreenDeep(args, { depth: opts.deep });
+      writes.push(...writesFromEffects(baked.screenId, dr.effects));
       deepTotals.nodesVisited += dr.nodesVisited;
       deepTotals.dispatches += dr.dispatches;
       deepTotals.capped = deepTotals.capped || dr.capped;
@@ -44584,6 +44992,7 @@ async function runCrawl(opts) {
     }
     if (deps.crawlScreenCapabilitySuccess && baked.bundleJs) {
       const cr = await deps.crawlScreenCapabilitySuccess(args);
+      writes.push(...writesFromEffects(baked.screenId, cr.effects));
       capabilityModelled += cr.modelled;
       const keyOfC = deps.findingKey ?? ((f) => `${f.invariant}|${f.at ?? ""}|${f.screen}|${f.message}`);
       const seen = new Set([...r.findings, ...relationFindings].map(keyOfC));
@@ -44660,6 +45069,7 @@ async function runCrawl(opts) {
           list.push(...fns);
           coverageFns.set(target, list);
         }
+        writes.push(...writesFromEffects(target, er.effects));
         edgesFollowed.push({ target, from: shape.from, params: shape.params, via: shape.via });
         if (!er.findings.some((f) => f.invariant === "no-request-issued") && !opts.tabRoots?.has(target) && !fetchProven.has(target)) {
           fetchProven.set(target, { from: shape.from, params: shape.params });
@@ -44684,7 +45094,11 @@ async function runCrawl(opts) {
       if (uncovered.length) uncoveredByScreen.set(screen, uncovered);
     }
   }
-  const all = [...results.flatMap((r) => r.findings), ...hostileFindings, ...deepFindings, ...journeyFindings, ...edgeFindings, ...relationFindings].filter((f) => {
+  const inventory = dedupeWrites(writes);
+  const unreachedWrites = targets.flatMap((d) => unreachedNativeWrites(d.screenId, d.bundleJs, inventory));
+  const plan = readDataAccess(opts.dir);
+  const writeFindings = unapprovedWriteFindings([...inventory, ...unreachedWrites], plan);
+  const all = [...results.flatMap((r) => r.findings), ...hostileFindings, ...deepFindings, ...journeyFindings, ...edgeFindings, ...relationFindings, ...writeFindings].filter((f) => {
     if (f.invariant === "no-request-issued" && !f.axis && fetchProven.has(f.screen)) {
       const by = fetchProven.get(f.screen);
       if (!retired.some((x) => x.screen === f.screen)) retired.push({ screen: f.screen, from: by.from, params: by.params });
@@ -44738,6 +45152,9 @@ async function runCrawl(opts) {
     ...deps.crawlScreenRelations ? { relations: { checked: relationsChecked, byKind: relationsByKind } } : {},
     ...deps.crawlScreenCapabilitySuccess ? { capabilities: { modelled: capabilityModelled } } : {},
     ...journeyResults.length ? { journeys: journeyResults } : {},
+    writes: inventory,
+    ...unreachedWrites.length ? { unreachedWrites } : {},
+    ...plan ? { writesPlan: { from: plan.from, rows: plan.rows.length } } : {},
     ...results.some((r) => r.observations) ? { observations: Object.fromEntries(results.filter((r) => r.observations).map((r) => [r.screen, r.observations])) } : {}
   };
 }
@@ -44823,6 +45240,17 @@ function formatReport(r) {
     }
     out.push("");
   }
+  if (r.writes?.length || r.unreachedWrites?.length) {
+    out.push(`  Writes to Wix (${r.writes.length}) \u2014 every write the crawl saw a worker attempt (none reached Wix). A write behind a form or a selection shows only under --deep or a journey:`);
+    const byScreenW = /* @__PURE__ */ new Map();
+    for (const w of r.writes) byScreenW.set(w.screen, [...byScreenW.get(w.screen) ?? [], w]);
+    for (const [screen, list] of [...byScreenW].sort(([a], [b]) => a.localeCompare(b))) {
+      for (const w of list) out.push(`    ${screen}  ${w.action === "boot" ? "on appear" : w.action}  ${writeLabel(w)}`);
+    }
+    for (const w of r.unreachedWrites ?? []) out.push(`    ${w.screen}  (not reached \u2014 in its worker bundle)  ${writeLabel(w)}`);
+    out.push(r.writesPlan ? `    checked against ${r.writesPlan.from}'s \`## ${DATA_ACCESS_HEADING}\` table (${r.writesPlan.rows} row${r.writesPlan.rows === 1 ? "" : "s"}) \u2014 unapproved writes are write-not-approved warnings above` : `    no \`## ${DATA_ACCESS_HEADING}\` table (Screen + Wix writes columns) in SPEC.md or MOBILE-UX.md, so nothing checked these against the approved plan \u2014 \`himi docs himi-test\` \u2192 "Writes to Wix"`);
+    out.push("");
+  }
   if (r.shots?.written && r.shots.dir) {
     out.push(`  ${r.shots.written} screenshot${r.shots.written === 1 ? "" : "s"} \u2192 ${r.shots.dir}/`);
   }
@@ -44875,6 +45303,7 @@ var init_test = __esm({
   "src/test.ts"() {
     init_wix_gateway_rules();
     init_crawl_layers();
+    init_wix_writes();
     TEST_CONFIG_FILE = "himi-test.json";
     triggerLabel = (f) => (f.trigger === "boot" ? "on appear" : `${f.trigger.key} ${f.trigger.tap ?? "(no id)"} \u2192 ${f.trigger.action}`) + (f.axis ? `  [${f.axis}]` : "");
   }
@@ -44885,14 +45314,14 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync47, readFileSync as readFileSync51 } from "node:fs";
-import { join as join44 } from "node:path";
+import { existsSync as existsSync48, readFileSync as readFileSync52 } from "node:fs";
+import { join as join45 } from "node:path";
 function mobileUxIssues(dir, strict) {
-  const file = join44(dir, "MOBILE-UX.md");
-  if (!existsSync47(file)) return [];
+  const file = join45(dir, "MOBILE-UX.md");
+  if (!existsSync48(file)) return [];
   let text5;
   try {
-    text5 = readFileSync51(file, "utf8");
+    text5 = readFileSync52(file, "utf8");
   } catch {
     return [];
   }
@@ -46567,8 +46996,8 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync52, existsSync as existsSync48 } from "node:fs";
-import { join as join45, resolve as resolve41 } from "node:path";
+import { readFileSync as readFileSync53, existsSync as existsSync49 } from "node:fs";
+import { join as join46, resolve as resolve41 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
   if (explicitUrl) return { mode: "remote", baseUrl: explicitUrl };
@@ -46587,9 +47016,9 @@ async function loadFunctionsApp(dir) {
   }
   const sources = {};
   for (const definition of config.functions.functions) {
-    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join45(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync48);
+    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join46(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync49);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
-    sources[definition.name] = readFileSync52(source, "utf8");
+    sources[definition.name] = readFileSync53(source, "utf8");
   }
   const data = config.cms || config.data ? mergeDataResources(config) : void 0;
   const dataErrors = validateDataResources(data, loaded.name).filter((issue2) => issue2.severity === "error");
@@ -46741,10 +47170,10 @@ __export(studio_reel_exports, {
   utcDay: () => utcDay
 });
 import { createHash as createHash24 } from "node:crypto";
-import { lstatSync as lstatSync7, readFileSync as readFileSync53 } from "node:fs";
-import { basename as basename11, join as join46 } from "node:path";
+import { lstatSync as lstatSync7, readFileSync as readFileSync54 } from "node:fs";
+import { basename as basename11, join as join47 } from "node:path";
 function loadMemory2(dir) {
-  const m = readJson4(join46(dir, ".himi", "studio", "memory.json"));
+  const m = readJson4(join47(dir, ".himi", "studio", "memory.json"));
   if (!isObj2(m) || m.version !== 1 || !isObj2(m.shots) || !Array.isArray(m.timeline)) return null;
   const shots = [];
   for (const [id, s] of Object.entries(m.shots)) {
@@ -46781,8 +47210,8 @@ function planReel(dir) {
   const memory = loadMemory2(dir);
   const { entries } = readProgress(dir);
   const summary = summarizeProgress(entries);
-  const manifest = readJson4(join46(dir, "himalaya.content.json"));
-  const tokens = readJson4(join46(dir, "tokens.json"));
+  const manifest = readJson4(join47(dir, "himalaya.content.json"));
+  const tokens = readJson4(join47(dir, "tokens.json"));
   const accentToken = tokens?.colors?.accentPrimary;
   const accentRaw = typeof accentToken === "string" ? accentToken : accentToken?.light;
   const accent = typeof accentRaw === "string" && ACCENT.test(accentRaw) ? accentRaw : DEFAULT_ACCENT;
@@ -46824,10 +47253,10 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
   const verified = (f) => {
     if (!HISTORY_NAME.test(f)) return null;
     try {
-      const path2 = join46(dir, HISTORY_DIR, f);
+      const path2 = join47(dir, HISTORY_DIR, f);
       const st = lstatSync7(path2);
       if (!st.isFile() || st.nlink !== 1) return null;
-      const bytes2 = readFileSync53(path2);
+      const bytes2 = readFileSync54(path2);
       return createHash24("sha256").update(bytes2).digest("hex") === f.slice(0, 64) && imageExtension(bytes2) === f.slice(65) ? bytes2 : null;
     } catch {
       return null;
@@ -46961,7 +47390,7 @@ var init_studio_reel = __esm({
     mimeOf = (file) => MIME2[file.slice(65)] ?? "image/png";
     readJson4 = (file) => {
       try {
-        return JSON.parse(readFileSync53(file, "utf8"));
+        return JSON.parse(readFileSync54(file, "utf8"));
       } catch {
         return null;
       }
@@ -46992,9 +47421,9 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync49, mkdtempSync as mkdtempSync2, readFileSync as readFileSync54, rmSync as rmSync11, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync50, mkdtempSync as mkdtempSync2, readFileSync as readFileSync55, rmSync as rmSync11, writeFileSync as writeFileSync20 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join47 } from "node:path";
+import { join as join48 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function nativeDecodePackageDir() {
   return fileURLToPath20(new URL("../../../core/runtime/ios/HimalayaCore/", import.meta.url));
@@ -47004,8 +47433,8 @@ function nativeDecodeAndroidHarnessDir() {
 }
 function nativeOracleShipped() {
   return {
-    ios: existsSync49(join47(nativeDecodePackageDir(), "Package.swift")),
-    android: existsSync49(join47(nativeDecodeAndroidHarnessDir(), "gradlew"))
+    ios: existsSync50(join48(nativeDecodePackageDir(), "Package.swift")),
+    android: existsSync50(join48(nativeDecodeAndroidHarnessDir(), "gradlew"))
   };
 }
 function detectNativeDecode(options = {}) {
@@ -47016,7 +47445,7 @@ function detectNativeDecode(options = {}) {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
   if (!swiftAvailable) return { platform: "ios", available: false, reason: "swift is not on PATH" };
-  const packageAvailable = options.packageAvailable ?? existsSync49(join47(packageDir, "Package.swift"));
+  const packageAvailable = options.packageAvailable ?? existsSync50(join48(packageDir, "Package.swift"));
   if (!packageAvailable) {
     return {
       platform: "ios",
@@ -47028,7 +47457,7 @@ function detectNativeDecode(options = {}) {
 }
 function localPropertiesSdk(harnessDir) {
   try {
-    const match = readFileSync54(join47(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
+    const match = readFileSync55(join48(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
     return match?.[1]?.trim().replace(/\\([ :\\])/g, "$1") ?? null;
   } catch {
     return null;
@@ -47036,8 +47465,8 @@ function localPropertiesSdk(harnessDir) {
 }
 function detectAndroidNativeDecode(options = {}) {
   const harnessDir = options.harnessDir ?? nativeDecodeAndroidHarnessDir();
-  const gradlew = join47(harnessDir, "gradlew");
-  const gradlewAvailable = options.gradlewAvailable ?? existsSync49(gradlew);
+  const gradlew = join48(harnessDir, "gradlew");
+  const gradlewAvailable = options.gradlewAvailable ?? existsSync50(gradlew);
   if (!gradlewAvailable) {
     return {
       platform: "android",
@@ -47047,7 +47476,7 @@ function detectAndroidNativeDecode(options = {}) {
   }
   const androidHome = options.androidHome ?? process.env.ANDROID_HOME ?? "";
   const sdk = androidHome.trim() || (options.localPropertiesSdk !== void 0 ? options.localPropertiesSdk : localPropertiesSdk(harnessDir));
-  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync49(sdk));
+  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync50(sdk));
   if (!sdkAvailable) {
     return {
       platform: "android",
@@ -47119,14 +47548,14 @@ function parseNativeDecodeOutput(stdout, expectedScreenIds, platform = "ios") {
   return verdicts;
 }
 function runNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join47(tmpdir3(), "himi-native-decode-"));
+  const descriptorDir = mkdtempSync2(join48(tmpdir3(), "himi-native-decode-"));
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync20(join47(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync20(join48(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -47138,7 +47567,7 @@ function runNativeDecode(options) {
       encoding: "utf8"
     }).trim();
     options.progress?.(`running real Swift decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
-    const stdout = execFileSync5(join47(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
+    const stdout = execFileSync5(join48(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });
@@ -47156,15 +47585,15 @@ function runNativeDecode(options) {
   }
 }
 function runAndroidNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join47(tmpdir3(), "himi-native-decode-android-"));
-  const outputPath = join47(descriptorDir, "verdicts.ndjson");
+  const descriptorDir = mkdtempSync2(join48(tmpdir3(), "himi-native-decode-android-"));
+  const outputPath = join48(descriptorDir, "verdicts.ndjson");
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync20(join47(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync20(join48(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -47179,7 +47608,7 @@ function runAndroidNativeDecode(options) {
       stdio: ["ignore", "ignore", "pipe"],
       encoding: "utf8"
     });
-    const stdout = readFileSync54(outputPath, "utf8");
+    const stdout = readFileSync55(outputPath, "utf8");
     return {
       platform: "android",
       verdicts: parseNativeDecodeOutput(stdout, options.descriptors.map((descriptor) => descriptor.screenId), "android"),
@@ -47249,13 +47678,13 @@ __export(browser_authoring_exports, {
 });
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash25, randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync50, readdirSync as readdirSync24, readFileSync as readFileSync55, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
-import { join as join48, posix, relative as relative8, sep as sep12 } from "node:path";
+import { existsSync as existsSync51, readdirSync as readdirSync24, readFileSync as readFileSync56, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
+import { join as join49, posix, relative as relative8, sep as sep12 } from "node:path";
 function humanMs(ms) {
   return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
 }
 function collectWorkerSources(tier5SrcDir, bundleName) {
-  const root = join48(tier5SrcDir, bundleName);
+  const root = join49(tier5SrcDir, bundleName);
   const files = {};
   const visitedDirs = /* @__PURE__ */ new Set();
   const walk2 = (abs, rel) => {
@@ -47263,16 +47692,16 @@ function collectWorkerSources(tier5SrcDir, bundleName) {
     if (visitedDirs.has(real)) return;
     visitedDirs.add(real);
     for (const name of readdirSync24(abs).sort()) {
-      const childAbs = join48(abs, name);
+      const childAbs = join49(abs, name);
       const childRel = posix.join(rel, name);
       if (statSync12(childAbs).isDirectory()) {
         walk2(childAbs, childRel);
       } else if (/\.(ts|tsx|js|mjs|json)$/.test(name)) {
-        files[childRel] = readFileSync55(childAbs, "utf8");
+        files[childRel] = readFileSync56(childAbs, "utf8");
       }
     }
   };
-  if (!existsSync50(root)) return null;
+  if (!existsSync51(root)) return null;
   walk2(root, `/tier5-src/${bundleName}`);
   const entry = [`/tier5-src/${bundleName}/index.ts`, `/tier5-src/${bundleName}/index.js`].find((p) => p in files);
   if (!entry) return null;
@@ -47289,20 +47718,20 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       const spec = m[1];
       const virtual = posix.normalize(posix.join(dir, spec));
       if (!virtual.startsWith("/tier5-src/")) continue;
-      const onDisk = join48(tier5SrcDir, virtual.slice("/tier5-src/".length));
+      const onDisk = join49(tier5SrcDir, virtual.slice("/tier5-src/".length));
       const candidates = [
         onDisk,
         `${onDisk}.ts`,
         `${onDisk}.js`,
         onDisk.replace(/\.js$/, ".ts"),
-        join48(onDisk, "index.ts"),
-        join48(onDisk, "index.js")
+        join49(onDisk, "index.ts"),
+        join49(onDisk, "index.js")
       ];
       for (const abs of candidates) {
-        if (!existsSync50(abs) || statSync12(abs).isDirectory()) continue;
+        if (!existsSync51(abs) || statSync12(abs).isDirectory()) continue;
         const key2 = `/tier5-src/${relative8(tier5SrcDir, abs).split(sep12).join(posix.sep)}`;
         if (key2 in files) break;
-        files[key2] = readFileSync55(abs, "utf8");
+        files[key2] = readFileSync56(abs, "utf8");
         queue.push(key2);
         break;
       }
@@ -47337,7 +47766,7 @@ function collectSdkModules(files, resolveSubpath) {
 function sdkSubpathReader(resolve48) {
   return (sub) => {
     try {
-      return readFileSync55(resolve48(`@wix/himalaya/${sub}`), "utf8");
+      return readFileSync56(resolve48(`@wix/himalaya/${sub}`), "utf8");
     } catch {
       return null;
     }
@@ -47509,8 +47938,8 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync51, mkdirSync as mkdirSync24, readFileSync as readFileSync56, writeFileSync as writeFileSync21 } from "node:fs";
-import { dirname as dirname26, join as join49 } from "node:path";
+import { existsSync as existsSync52, mkdirSync as mkdirSync24, readFileSync as readFileSync57, writeFileSync as writeFileSync21 } from "node:fs";
+import { dirname as dirname26, join as join50 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
 }
@@ -47690,11 +48119,11 @@ function assembleLedger(r, options = {}) {
   return out;
 }
 function trendAndStore(dir, entries, suppressed) {
-  const p = join49(dir, LEDGER_FILE);
+  const p = join50(dir, LEDGER_FILE);
   let previous = null;
   try {
-    if (existsSync51(p)) {
-      const parsed = JSON.parse(readFileSync56(p, "utf8"));
+    if (existsSync52(p)) {
+      const parsed = JSON.parse(readFileSync57(p, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k) => typeof k === "string");
     }
   } catch {
@@ -47733,11 +48162,11 @@ function formatLedger(entries, trend) {
   return out.join("\n");
 }
 function diffAndStoreObservations(dir, current) {
-  const p = join49(dir, OBS_FILE);
+  const p = join50(dir, OBS_FILE);
   let previous = null;
   try {
-    if (existsSync51(p)) {
-      const parsed = JSON.parse(readFileSync56(p, "utf8"));
+    if (existsSync52(p)) {
+      const parsed = JSON.parse(readFileSync57(p, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v) => Array.isArray(v) && v.every((l) => typeof l === "string")
       )) {
@@ -47786,8 +48215,8 @@ var LEDGER_FILE, OBS_FILE;
 var init_coverage = __esm({
   "src/coverage.ts"() {
     init_native_decode();
-    LEDGER_FILE = join49(".himi", "test-ledger.json");
-    OBS_FILE = join49(".himi", "test-observations.json");
+    LEDGER_FILE = join50(".himi", "test-ledger.json");
+    OBS_FILE = join50(".himi", "test-observations.json");
   }
 });
 
@@ -47798,11 +48227,11 @@ __export(design_kits_exports, {
   kitsDir: () => kitsDir,
   listKits: () => listKits2
 });
-import { existsSync as existsSync52, readFileSync as readFileSync57, readdirSync as readdirSync25 } from "node:fs";
-import { join as join50, basename as basename12 } from "node:path";
+import { existsSync as existsSync53, readFileSync as readFileSync58, readdirSync as readdirSync25 } from "node:fs";
+import { join as join51, basename as basename12 } from "node:path";
 import { fileURLToPath as fileURLToPath21 } from "node:url";
 function kitsDir() {
-  return KIT_DIR_CANDIDATES.find((p) => existsSync52(p));
+  return KIT_DIR_CANDIDATES.find((p) => existsSync53(p));
 }
 function listKits2() {
   const dir = kitsDir();
@@ -47826,7 +48255,7 @@ In a published @wix/himalaya-cli this is a packaging bug \u2014 the kits should
   if (!kits.includes(name)) {
     return { ok: false, kit: name, kits, problems: [`no design kit named "${name}". Available: ${kits.join(", ")}`] };
   }
-  const raw = readFileSync57(join50(dir, `${name}.json`), "utf8");
+  const raw = readFileSync58(join51(dir, `${name}.json`), "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -47850,9 +48279,9 @@ var init_design_kits = __esm({
   "src/design-kits.ts"() {
     KIT_DIR_CANDIDATES = [
       // in-repo: tools/himi-cli/src/design-kits.ts → <repo>/stdlib/design-kits/
-      join50(fileURLToPath21(new URL("../../..", import.meta.url)), "stdlib", "design-kits"),
+      join51(fileURLToPath21(new URL("../../..", import.meta.url)), "stdlib", "design-kits"),
       // published CLI: <pkg>/dist/cli.mjs → <pkg>/stdlib/design-kits/
-      join50(fileURLToPath21(new URL("..", import.meta.url)), "stdlib", "design-kits")
+      join51(fileURLToPath21(new URL("..", import.meta.url)), "stdlib", "design-kits")
     ];
   }
 });
@@ -47866,11 +48295,11 @@ __export(assets_exports, {
   removeAssetPayload: () => removeAssetPayload,
   verifyReport: () => verifyReport
 });
-import { readFileSync as readFileSync58 } from "node:fs";
+import { readFileSync as readFileSync59 } from "node:fs";
 import { basename as basename13 } from "node:path";
 function declaredAssets(dir) {
   return collectAssets(dir).map((a) => {
-    const bytes2 = readFileSync58(a.path);
+    const bytes2 = readFileSync59(a.path);
     return {
       name: a.name,
       sha256: assetSha256(bytes2),
@@ -47947,7 +48376,7 @@ function verifyReport(dir, app, manifest) {
   };
 }
 function addAssetPayload(manifest, filePath, opts) {
-  const bytes2 = readFileSync58(filePath);
+  const bytes2 = readFileSync59(filePath);
   const name = opts.name ?? basename13(filePath);
   const sha2565 = assetSha256(bytes2);
   const record2 = {
@@ -49587,21 +50016,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-3uQs-pBH.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1050432, sha256: "928dfeb0c4f367f39a34c92f32a7194f483918a869912cf33ad05bc8d6f8a483" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1050440, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1055050, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1543634, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1634558, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1725542, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1816522, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1907394, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1998374, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2107010, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2216094, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2325142, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2432842, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2520950, length: 4947, sha256: "d5b6c88c0e67711667b4df9d04e74e4a77af7131bd8082754447cbfd69a173a8" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2525897, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-BJFiKWYO.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1051133, sha256: "99b754e0231cb82ad2cafbca64ba3cd3bdc74aa53d8351f6a57828034c3a3f44" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1051141, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1055751, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1544335, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1635259, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1726243, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1817223, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1908095, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 1999075, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2107711, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2216795, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2325843, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2433543, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2521651, length: 4947, sha256: "1c4dfb3d465449d6a73677293df29d93b1c236b46602b553a58ef6e89c52de11" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2526598, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -49617,9 +50046,9 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync as cpSync2, existsSync as existsSync53, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync3, readFileSync as readFileSync59, rmSync as rmSync12, statSync as statSync13 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync54, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync3, readFileSync as readFileSync60, rmSync as rmSync12, statSync as statSync13 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname27, join as join51 } from "node:path";
+import { dirname as dirname27, join as join52 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
 function makePackageRunHandler(opts) {
   const store = new FileReleaseStore(opts.releaseRoot);
@@ -49647,9 +50076,9 @@ async function fetchBytes(url) {
 }
 async function resolvePackage(source, workDir) {
   const isUrl2 = /^https?:\/\//i.test(source);
-  if (!isUrl2 && existsSync53(source) && statSync13(source).isDirectory()) {
-    const appDirManifest = join51(source, "release-manifest.json");
-    if (existsSync53(appDirManifest)) {
+  if (!isUrl2 && existsSync54(source) && statSync13(source).isDirectory()) {
+    const appDirManifest = join52(source, "release-manifest.json");
+    if (existsSync54(appDirManifest)) {
       const opened2 = openPackageDir(source);
       if (!opened2.validation.ok) {
         throw new Error(`package is not valid:
@@ -49658,9 +50087,9 @@ async function resolvePackage(source, workDir) {
       const app2 = opened2.header?.app ?? opened2.manifest?.app;
       if (!app2) throw new Error(`${source} has no app id (no himi-package.json and no manifest.app)`);
       if (!isSafeAppId(app2)) throw new Error(`${source} declares an unsafe app id ${JSON.stringify(app2)} \u2014 refusing to open it`);
-      const root2 = workDir ?? mkdtempSync3(join51(tmpdir4(), "himi-run-"));
-      const target = join51(root2, app2);
-      if (join51(source) !== target) {
+      const root2 = workDir ?? mkdtempSync3(join52(tmpdir4(), "himi-run-"));
+      const target = join52(root2, app2);
+      if (join52(source) !== target) {
         mkdirSync25(root2, { recursive: true });
         rmSync12(target, { recursive: true, force: true });
         cpSync2(source, target, { recursive: true });
@@ -49677,8 +50106,8 @@ async function resolvePackage(source, workDir) {
     }
     throw new Error(`${source} is a directory but has no release-manifest.json \u2014 is it a package?`);
   }
-  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync59(source);
-  const root = workDir ?? mkdtempSync3(join51(tmpdir4(), "himi-run-"));
+  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync60(source);
+  const root = workDir ?? mkdtempSync3(join52(tmpdir4(), "himi-run-"));
   const { app, appDir: appDir2 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir2);
   if (!opened.validation.ok) {
@@ -49701,14 +50130,14 @@ async function loadPreviewAssets() {
     const mod = await Promise.resolve().then(() => (init_preview_assets_generated(), preview_assets_generated_exports));
     const here = dirname27(fileURLToPath22(import.meta.url));
     const candidates = [
-      join51(here, "preview-assets.generated.bin"),
+      join52(here, "preview-assets.generated.bin"),
       // published: copied next to the bundled CLI
-      join51(here, "../../../packages/serve/src/preview-assets.generated.bin")
+      join52(here, "../../../packages/serve/src/preview-assets.generated.bin")
       // in-repo checkout
     ];
     for (const path2 of candidates) {
-      if (!existsSync53(path2)) continue;
-      const blob = readFileSync59(path2);
+      if (!existsSync54(path2)) continue;
+      const blob = readFileSync60(path2);
       return mod.assemblePreviewAssetsFromBlob(new Uint8Array(blob.buffer, blob.byteOffset, blob.byteLength));
     }
     return /* @__PURE__ */ new Map();
@@ -49805,9 +50234,9 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync2, constants, existsSync as existsSync54, fstatSync, lstatSync as lstatSync8, statSync as statSync14, mkdirSync as mkdirSync26, openSync as openSync2, readFileSync as readFileSync60, realpathSync as realpathSync6, renameSync as renameSync5, rmSync as rmSync13, writeFileSync as writeFileSync22, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync2, constants, existsSync as existsSync55, fstatSync, lstatSync as lstatSync8, statSync as statSync14, mkdirSync as mkdirSync26, openSync as openSync2, readFileSync as readFileSync61, realpathSync as realpathSync6, renameSync as renameSync5, rmSync as rmSync13, writeFileSync as writeFileSync22, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { extname as extname4, join as join52, resolve as resolve42, sep as sep13 } from "node:path";
+import { extname as extname4, join as join53, resolve as resolve42, sep as sep13 } from "node:path";
 function diffReleases(prev, next) {
   const bundles = Object.keys(next.bundles).filter((b) => prev.bundles[b]?.sha256 !== next.bundles[b].sha256).sort();
   const changedBundles = new Set(bundles);
@@ -49847,7 +50276,7 @@ function watchContent(dir, onChange, opts = {}) {
   let timer = null;
   const pending = /* @__PURE__ */ new Set();
   const watcher2 = watch2(dir, { recursive: true }, (_event, file) => {
-    if (!file || ignoredChange(file, (rel) => isDir(join52(dir, rel)))) return;
+    if (!file || ignoredChange(file, (rel) => isDir(join53(dir, rel)))) return;
     pending.add(file);
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
@@ -49868,7 +50297,7 @@ function watchedContentDir(source) {
   if (!source || /^https?:\/\//i.test(source)) return null;
   const dir = resolve42(source);
   try {
-    return statSync14(dir).isDirectory() && existsSync54(join52(dir, "himalaya.content.json")) ? dir : null;
+    return statSync14(dir).isDirectory() && existsSync55(join53(dir, "himalaya.content.json")) ? dir : null;
   } catch {
     return null;
   }
@@ -49925,7 +50354,7 @@ function serialize(task) {
   });
 }
 function himiDir(dir) {
-  const root = join52(dir, ".himi");
+  const root = join53(dir, ".himi");
   try {
     return lstatSync8(root).isDirectory() ? root : null;
   } catch (e) {
@@ -49937,11 +50366,11 @@ function himiDir(dir) {
 function writeRunRecord(dir, record2) {
   const root = himiDir(dir);
   if (!root) return false;
-  const tmp = join52(root, `.run.json.${process.pid}.${randomUUID3()}.tmp`);
+  const tmp = join53(root, `.run.json.${process.pid}.${randomUUID3()}.tmp`);
   try {
     writeFileSync22(tmp, `${JSON.stringify(record2, null, 2)}
 `, { flag: "wx" });
-    renameSync5(tmp, join52(root, "run.json"));
+    renameSync5(tmp, join53(root, "run.json"));
   } catch (e) {
     rmSync13(tmp, { force: true });
     throw e;
@@ -49949,7 +50378,7 @@ function writeRunRecord(dir, record2) {
   return true;
 }
 function removeRunRecord(dir, owner) {
-  const root = join52(dir, ".himi");
+  const root = join53(dir, ".himi");
   try {
     if (!lstatSync8(root).isDirectory()) return;
   } catch {
@@ -49964,16 +50393,16 @@ function removeRunRecord(dir, owner) {
     }
     if (typeof pid === "number" && pid !== owner) return;
   }
-  rmSync13(join52(root, "run.json"), { force: true });
+  rmSync13(join53(root, "run.json"), { force: true });
 }
 function boardFile(dir, pathname) {
   let rel = null;
-  if (pathname === "/__himi/studio/" || pathname === "/__himi/studio/index.html") rel = join52("studio", "index.html");
-  else if (pathname === "/__himi/studio/state.js") rel = join52("studio", "state.js");
-  else if (pathname === "/__himi/studio/timeline.js") rel = join52("studio", "timeline.js");
+  if (pathname === "/__himi/studio/" || pathname === "/__himi/studio/index.html") rel = join53("studio", "index.html");
+  else if (pathname === "/__himi/studio/state.js") rel = join53("studio", "state.js");
+  else if (pathname === "/__himi/studio/timeline.js") rel = join53("studio", "timeline.js");
   else {
     const m = /^\/__himi\/history\/([0-9a-f]{64}\.(png|jpg|gif|webp))$/.exec(pathname);
-    if (m) rel = join52("history", m[1]);
+    if (m) rel = join53("history", m[1]);
   }
   if (!rel) return null;
   const bytes2 = readConfined(resolve42(dir, ".himi"), rel);
@@ -49989,7 +50418,7 @@ function readConfined(root, rel) {
     const parts = rel.split(sep13);
     let at = root;
     for (let i = 0; i < parts.length; i++) {
-      at = join52(at, parts[i]);
+      at = join53(at, parts[i]);
       const st = lstatSync8(at);
       if (st.isSymbolicLink() || !(i === parts.length - 1 ? st.isFile() : st.isDirectory())) return null;
     }
@@ -49998,7 +50427,7 @@ function readConfined(root, rel) {
     const fd = openSync2(at, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
-      return readFileSync60(fd);
+      return readFileSync61(fd);
     } finally {
       closeSync2(fd);
     }
@@ -50049,7 +50478,7 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer5 } from "node:http";
-import { existsSync as existsSync55, readFileSync as readFileSync61 } from "node:fs";
+import { existsSync as existsSync56, readFileSync as readFileSync62 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { dirname as dirname28, resolve as resolve43 } from "node:path";
 import { fileURLToPath as fileURLToPath23 } from "node:url";
@@ -50057,7 +50486,7 @@ function stagedDir() {
   return process.env.HIMI_BROWSER_PLANE_OUT ? resolve43(process.env.HIMI_BROWSER_PLANE_OUT) : resolve43(REPO, "packages", "serve", "dist", "browser-plane");
 }
 function missingStaged() {
-  return [...SERVED].filter((f) => !existsSync55(resolve43(stagedDir(), f))).sort();
+  return [...SERVED].filter((f) => !existsSync56(resolve43(stagedDir(), f))).sort();
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
@@ -50142,7 +50571,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
     }
     const name = path2 === "/" || path2 === "/index.html" ? "host.html" : path2.slice(1);
     if (SERVED.has(name)) {
-      if (!existsSync55(resolve43(stagedDir(), name))) {
+      if (!existsSync56(resolve43(stagedDir(), name))) {
         const restaged = ensureBrowserPlaneStaged();
         if (!restaged.ok) {
           res.writeHead(503, { "content-type": "application/json" });
@@ -50152,7 +50581,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
       }
       let bytes2;
       try {
-        bytes2 = readFileSync61(resolve43(stagedDir(), name));
+        bytes2 = readFileSync62(resolve43(stagedDir(), name));
       } catch (e) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "browser_plane_unstaged", file: name, detail: String(e) }));
@@ -50613,7 +51042,7 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync56, readFileSync as readFileSync62 } from "node:fs";
+import { existsSync as existsSync57, readFileSync as readFileSync63 } from "node:fs";
 import { isAbsolute as isAbsolute3, relative as relative9, resolve as resolve44 } from "node:path";
 function isInsideRepo(p) {
   const rel = relative9(REPO_ROOT3, resolve44(p));
@@ -50670,10 +51099,10 @@ function parseStoreConfig(text5) {
 }
 function loadStoreConfig(app) {
   const p = storeConfigPath(app);
-  if (!existsSync56(p)) {
+  if (!existsSync57(p)) {
     throw new Error(`No store config at ${p}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
-  return parseStoreConfig(readFileSync62(p, "utf8"));
+  return parseStoreConfig(readFileSync63(p, "utf8"));
 }
 var init_preflight = __esm({
   "../store-release/preflight.ts"() {
@@ -50692,19 +51121,19 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync57, readFileSync as readFileSync63 } from "node:fs";
+import { existsSync as existsSync58, readFileSync as readFileSync64 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join53 } from "node:path";
+import { join as join54 } from "node:path";
 function credentialsDir(home = homedir5()) {
-  return join53(home, ".himalaya", "store-credentials");
+  return join54(home, ".himalaya", "store-credentials");
 }
 function profilePath(name, home = homedir5()) {
   if (!PROFILE_NAME.test(name)) {
     throw new Error(
-      `credential profile ${JSON.stringify(name)} is not a profile name \u2014 use letters, digits, ".", "_" or "-" starting with a letter or digit. It names ${join53(credentialsDir(home), "<name>.json")}; it is never a path.`
+      `credential profile ${JSON.stringify(name)} is not a profile name \u2014 use letters, digits, ".", "_" or "-" starting with a letter or digit. It names ${join54(credentialsDir(home), "<name>.json")}; it is never a path.`
     );
   }
-  return join53(credentialsDir(home), `${name}.json`);
+  return join54(credentialsDir(home), `${name}.json`);
 }
 function parseProfile(text5, label2) {
   let doc;
@@ -50735,8 +51164,8 @@ function resolveStoreCredentials(opts) {
   const { app, cfg } = opts;
   const env = opts.env ?? process.env;
   const home = opts.home ?? homedir5();
-  const read = opts.readProfile ?? ((p) => readFileSync63(p, "utf8"));
-  const exists = opts.profileExists ?? existsSync57;
+  const read = opts.readProfile ?? ((p) => readFileSync64(p, "utf8"));
+  const exists = opts.profileExists ?? existsSync58;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
   const named = namedProfile(cfg, opts.profileFlag);
@@ -50816,9 +51245,9 @@ __export(preflight_app_exports, {
   preflightApp: () => preflightApp,
   profileAccount: () => profileAccount
 });
-import { readFileSync as readFileSync64, existsSync as existsSync58, readdirSync as readdirSync26, statSync as statSync15 } from "node:fs";
+import { readFileSync as readFileSync65, existsSync as existsSync59, readdirSync as readdirSync26, statSync as statSync15 } from "node:fs";
 import { createHash as createHash26 } from "node:crypto";
-import { join as join54 } from "node:path";
+import { join as join55 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
   const f = [];
   const has = (re, s) => re.test(s);
@@ -50882,13 +51311,13 @@ function profileAccount(app, storeConfig, opts = {}) {
   }
 }
 async function preflightApp(app, opts = {}) {
-  const projectYml = existsSync58(iosProjectYml(app)) ? readFileSync64(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync58(storeConfigPath(app)) ? readFileSync64(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync59(iosProjectYml(app)) ? readFileSync65(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync59(storeConfigPath(app)) ? readFileSync65(storeConfigPath(app), "utf8") : "";
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }];
   const findings = analyze(
     projectYml,
     storeConfig,
-    await appIconState(join54(appDir(app), "ios")),
+    await appIconState(join55(appDir(app), "ios")),
     profileAccount(app, storeConfig, opts)
   );
   findings.push(...analyzeListing(metadataFilesPresent(app), listScreenshots(app)));
@@ -50917,17 +51346,17 @@ function analyzeSubmissionRecord(appLevel, review, opts) {
   return f;
 }
 function appLevelMetadataFiles(app, locale = "en-US") {
-  const root = join54(storeDir(app), "metadata");
+  const root = join55(storeDir(app), "metadata");
   const out = /* @__PURE__ */ new Set();
-  if (existsSync58(root)) {
+  if (existsSync59(root)) {
     for (const n of readdirSync26(root)) if (n.endsWith(".txt")) out.add(n);
   }
-  if (existsSync58(join54(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
+  if (existsSync59(join55(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
   return out;
 }
 function reviewInfoFiles(app) {
-  const dir = join54(storeDir(app), "review_information");
-  if (!existsSync58(dir)) return /* @__PURE__ */ new Set();
+  const dir = join55(storeDir(app), "review_information");
+  if (!existsSync59(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync26(dir).filter((n) => n.endsWith(".txt")));
 }
 function isValidAppStoreSize(w, h) {
@@ -51037,12 +51466,12 @@ function analyzePlayListing(assets) {
   return f;
 }
 function playListingAssets(app, locale = "en-US") {
-  const dir = join54(storeDir(app), "play", locale, "images");
+  const dir = join55(storeDir(app), "play", locale, "images");
   const read = (names) => {
     for (const name of names) {
-      const p = join54(dir, name);
+      const p = join55(dir, name);
       try {
-        if (statSync15(p).isFile()) return { name, bytes: readFileSync64(p) };
+        if (statSync15(p).isFile()) return { name, bytes: readFileSync65(p) };
       } catch {
       }
     }
@@ -51073,26 +51502,26 @@ function analyzeListing(metaFiles, shots) {
   return f;
 }
 function metadataFilesPresent(app, locale = "en-US") {
-  const dir = join54(storeDir(app), "metadata", locale);
-  if (!existsSync58(dir)) return /* @__PURE__ */ new Set();
+  const dir = join55(storeDir(app), "metadata", locale);
+  if (!existsSync59(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync26(dir).filter((n) => n.endsWith(".txt")));
 }
 function listScreenshots(app, locale = "en-US") {
   const out = [];
-  const flat = join54(storeDir(app), "screenshots", locale);
-  if (existsSync58(flat)) {
+  const flat = join55(storeDir(app), "screenshots", locale);
+  if (existsSync59(flat)) {
     for (const png of readdirSync26(flat).filter((n) => n.endsWith(".png"))) {
-      const sz = pngSize(readFileSync64(join54(flat, png)));
+      const sz = pngSize(readFileSync65(join55(flat, png)));
       if (sz) out.push({ name: png, w: sz.w, h: sz.h });
     }
   }
-  const legacy = join54(storeDir(app), "metadata", locale, "screenshots");
-  if (existsSync58(legacy)) {
+  const legacy = join55(storeDir(app), "metadata", locale, "screenshots");
+  if (existsSync59(legacy)) {
     for (const deviceDir of readdirSync26(legacy)) {
-      const d = join54(legacy, deviceDir);
+      const d = join55(legacy, deviceDir);
       if (!statSync15(d).isDirectory()) continue;
       for (const png of readdirSync26(d).filter((n) => n.endsWith(".png"))) {
-        const sz = pngSize(readFileSync64(join54(d, png)));
+        const sz = pngSize(readFileSync65(join55(d, png)));
         if (sz) out.push({ name: `${deviceDir}/${png}`, w: sz.w, h: sz.h });
       }
     }
@@ -51100,13 +51529,13 @@ function listScreenshots(app, locale = "en-US") {
   return out;
 }
 function placeholderHashes2() {
-  const templateIos = join54(appDir("_template"), "ios");
-  if (!existsSync58(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
+  const templateIos = join55(appDir("_template"), "ios");
+  if (!existsSync59(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
   for (const target of readdirSync26(templateIos)) {
-    const p = join54(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join55(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync15(p).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash26("sha256").update(readFileSync64(p)).digest("hex")];
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash26("sha256").update(readFileSync65(p)).digest("hex")];
     } catch {
     }
   }
@@ -51137,12 +51566,12 @@ async function pixelIssues(bytes2) {
   }
 }
 async function appIconState(iosDir) {
-  if (!existsSync58(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
+  if (!existsSync59(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
   for (const target of readdirSync26(iosDir)) {
-    const p = join54(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join55(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync15(p).isFile()) continue;
-      const bytes2 = readFileSync64(p);
+      const bytes2 = readFileSync65(p);
       const hash = createHash26("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
@@ -51214,7 +51643,7 @@ __export(version_exports, {
   setAndroidVersion: () => setAndroidVersion,
   setIosVersion: () => setIosVersion
 });
-import { readFileSync as readFileSync65, writeFileSync as writeFileSync23 } from "node:fs";
+import { readFileSync as readFileSync66, writeFileSync as writeFileSync23 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build2 = matchScalar(projectYml, "CFBundleVersion");
@@ -51272,8 +51701,8 @@ function setAndroidVersion(gradle, v) {
 function bumpVersion(app, opts) {
   const iosPath = iosProjectYml(app);
   const gradlePath = androidGradle(app);
-  const iosYml = readFileSync65(iosPath, "utf8");
-  const gradle = readFileSync65(gradlePath, "utf8");
+  const iosYml = readFileSync66(iosPath, "utf8");
+  const gradle = readFileSync66(gradlePath, "utf8");
   const current = readIosVersion(iosYml);
   const next = {
     marketing: opts.marketing ?? current.marketing,
@@ -51290,7 +51719,7 @@ var init_version = __esm({
 });
 
 // ../store-release/register-bundle.ts
-import { readFileSync as readFileSync66 } from "node:fs";
+import { readFileSync as readFileSync67 } from "node:fs";
 import { createPrivateKey as createPrivateKey2, sign } from "node:crypto";
 function b64url2(b) {
   return Buffer.from(b).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -51308,7 +51737,7 @@ function bundleIdBody(identifier, name, platform = "IOS") {
 async function registerBundleId(opts) {
   const env = requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync66(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync67(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   const res = await fetch(`${ASC_API}/v1/bundleIds`, {
     method: "POST",
     headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
@@ -51362,7 +51791,7 @@ __export(asc_status_exports, {
   ascStatus: () => ascStatus,
   buildVerdict: () => buildVerdict
 });
-import { readFileSync as readFileSync67 } from "node:fs";
+import { readFileSync as readFileSync68 } from "node:fs";
 function buildVerdict(builds) {
   if (!builds.length) {
     return "NO builds registered \u2014 if you uploaded recently and it's been >15 min, the binary was REJECTED IN PROCESSING (reason is email-only; run validate-binary.ts / scan-purpose-strings.ts to reproduce it).";
@@ -51376,7 +51805,7 @@ function buildVerdict(builds) {
 function client(creds) {
   const env = creds ?? requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync67(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync68(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   return async (path2) => {
     const r = await fetch(`${ASC}${path2}`, { headers: { Authorization: `Bearer ${jwt}` } });
     return { status: r.status, json: await r.json().catch(() => ({})) };
@@ -51536,7 +51965,7 @@ __export(secrets_exports, {
   runRemoteSecretsCommand: () => runRemoteSecretsCommand,
   runSecretsCommand: () => runSecretsCommand
 });
-import { readFileSync as readFileSync68 } from "node:fs";
+import { readFileSync as readFileSync69 } from "node:fs";
 function environment(value) {
   if (value === "preview" || value === "production") return value;
   throw new Error("--environment must be preview or production");
@@ -51567,7 +51996,7 @@ async function runSecretsCommand(operation, flags, io, options = {}) {
       io.log(JSON.stringify(await vault.list({ app, environment: env })));
       return 0;
     }
-    const value = options.readValue ? options.readValue() : readFileSync68(0, "utf8").replace(/\r?\n$/, "");
+    const value = options.readValue ? options.readValue() : readFileSync69(0, "utf8").replace(/\r?\n$/, "");
     if (operation === "set") await vault.set({ app, environment: env, name, value });
     else if (operation === "rotate") await vault.rotate({ app, environment: env, name, value });
     else throw new Error(`unknown secrets operation ${operation}`);
@@ -51596,7 +52025,7 @@ async function runRemoteSecretsCommand(operation, flags, io, options) {
     }
     let body;
     if (operation !== "list") {
-      const value = options.readValue ? options.readValue() : readFileSync68(0, "utf8").replace(/\r?\n$/, "");
+      const value = options.readValue ? options.readValue() : readFileSync69(0, "utf8").replace(/\r?\n$/, "");
       body = JSON.stringify({ value });
     }
     const response = await (options.fetchImpl ?? fetch)(url, { method: operation === "list" ? "GET" : operation === "set" ? "PUT" : "POST", headers: headers2, body });
@@ -51632,15 +52061,15 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync27, readFileSync as readFileSync69, writeFileSync as writeFileSync24 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync27, readFileSync as readFileSync70, writeFileSync as writeFileSync24 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { dirname as dirname30, join as join55 } from "node:path";
+import { dirname as dirname30, join as join56 } from "node:path";
 function defaultSessionsPath() {
-  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join55(homedir6(), ".himalaya", "admin-sessions.json");
+  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join56(homedir6(), ".himalaya", "admin-sessions.json");
 }
 function loadSessionsFile(path2 = defaultSessionsPath()) {
   try {
-    return JSON.parse(readFileSync69(path2, "utf8"));
+    return JSON.parse(readFileSync70(path2, "utf8"));
   } catch {
     return {};
   }
@@ -53018,7 +53447,7 @@ var init_traits = __esm({
 });
 
 // src/site-analyze/tokens.ts
-function channels(css) {
+function channels2(css) {
   const canonical3 = canonicalHex(css);
   if (!canonical3) return null;
   return [
@@ -53028,11 +53457,11 @@ function channels(css) {
   ];
 }
 function isNearWhite(css) {
-  const c = channels(css);
+  const c = channels2(css);
   return !!c && c[0] >= 240 && c[1] >= 240 && c[2] >= 240;
 }
 function isNearBlack(css) {
-  const c = channels(css);
+  const c = channels2(css);
   return !!c && c[0] <= 80 && c[1] <= 80 && c[2] <= 80;
 }
 function usableCssColor(v) {
@@ -53171,12 +53600,12 @@ var init_tokens3 = __esm({
 function channel2(hex2, offset) {
   return Number.parseInt(hex2.slice(offset, offset + 2), 16);
 }
-function toHex(r, g, b) {
+function toHex2(r, g, b) {
   return `#${[r, g, b].map((value) => Math.round(value).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
 }
 function mix2(color, background, colorWeight) {
   const values = [1, 3, 5].map((offset) => channel2(color, offset) * colorWeight + channel2(background, offset) * (1 - colorWeight));
-  return toHex(values[0], values[1], values[2]);
+  return toHex2(values[0], values[1], values[2]);
 }
 function relativeLuminance2(color) {
   const linear = [1, 3, 5].map((offset) => {
@@ -55516,7 +55945,7 @@ var init_brand_font = __esm({
 
 // src/site-analyze/write-artifacts.ts
 import { mkdirSync as mkdirSync28, writeFileSync as writeFileSync25 } from "node:fs";
-import { join as join56 } from "node:path";
+import { join as join57 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
   for (const f of book.velo.files) {
@@ -55671,12 +56100,12 @@ async function downloadMedia(book, fetchImpl, put) {
 }
 async function writeBusinessBook(result, opts) {
   const out = opts.outDir;
-  mkdirSync28(join56(out, "evidence/pages"), { recursive: true });
-  mkdirSync28(join56(out, "media/catalog"), { recursive: true });
+  mkdirSync28(join57(out, "evidence/pages"), { recursive: true });
+  mkdirSync28(join57(out, "media/catalog"), { recursive: true });
   const files = [];
   const put = (rel, body) => {
-    const p = join56(out, rel);
-    mkdirSync28(join56(p, ".."), { recursive: true });
+    const p = join57(out, rel);
+    mkdirSync28(join57(p, ".."), { recursive: true });
     writeFileSync25(p, body);
     files.push(rel);
   };
@@ -55770,8 +56199,8 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync59, readFileSync as readFileSync70, writeFileSync as writeFileSync26, copyFileSync as copyFileSync3, mkdirSync as mkdirSync29, realpathSync as realpathSync7, statSync as statSync16 } from "node:fs";
-import { dirname as dirname31, isAbsolute as isAbsolute4, join as join57, resolve as resolve45, sep as sep14 } from "node:path";
+import { existsSync as existsSync60, readFileSync as readFileSync71, writeFileSync as writeFileSync26, copyFileSync as copyFileSync3, mkdirSync as mkdirSync29, realpathSync as realpathSync7, statSync as statSync16 } from "node:fs";
+import { dirname as dirname31, isAbsolute as isAbsolute4, join as join58, resolve as resolve45, sep as sep14 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
@@ -55786,7 +56215,7 @@ function committedShellProvisioning(path2) {
 function findRepoRoot(cwd) {
   let dir = cwd;
   for (let i = 0; i < 8; i++) {
-    if (SHELL_NAMES2.some((name) => existsSync59(join57(dir, shellAppDir(name), "package.json")))) return dir;
+    if (SHELL_NAMES2.some((name) => existsSync60(join58(dir, shellAppDir(name), "package.json")))) return dir;
     const next = dirname31(dir);
     if (next === dir) break;
     dir = next;
@@ -55854,11 +56283,11 @@ function mergeCustomerOwned(committed, overlay) {
 }
 function buildMergedContract(options) {
   const { appDir: appDir2, packageDir, overlay } = options;
-  const committedPath = join57(appDir2, "provisioning.json");
-  if (!existsSync59(committedPath)) {
+  const committedPath = join58(appDir2, "provisioning.json");
+  if (!existsSync60(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
-  const committed = JSON.parse(readFileSync70(committedPath, "utf8"));
+  const committed = JSON.parse(readFileSync71(committedPath, "utf8"));
   const merged = mergeCustomerOwned(committed, overlay);
   const overlayFontFamily = (overlay.branding ?? {}).fontFamily;
   const branding = merged.branding ?? {};
@@ -55870,8 +56299,8 @@ function buildMergedContract(options) {
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
-    const to = contained(join57(appDir2, STAGED), toRel.slice(STAGED.length + 1));
-    if (!from || !to || !existsSync59(from)) return void 0;
+    const to = contained(join58(appDir2, STAGED), toRel.slice(STAGED.length + 1));
+    if (!from || !to || !existsSync60(from)) return void 0;
     let real;
     let realRoot;
     try {
@@ -55893,11 +56322,11 @@ function buildMergedContract(options) {
   };
   const icon = stage("media/icon.png", `${STAGED}/icon.png`);
   if (icon) branding.appIconPath = icon;
-  const facesPath = join57(packageDir, "media/fonts/faces.json");
-  if (existsSync59(facesPath)) {
+  const facesPath = join58(packageDir, "media/fonts/faces.json");
+  if (existsSync60(facesPath)) {
     let faces = [];
     try {
-      const parsed = JSON.parse(readFileSync70(facesPath, "utf8"));
+      const parsed = JSON.parse(readFileSync71(facesPath, "utf8"));
       faces = Array.isArray(parsed) ? parsed : [];
     } catch {
       faces = [];
@@ -55918,9 +56347,9 @@ function buildMergedContract(options) {
   merged.branding = branding;
   const body = `${JSON.stringify(merged, null, 2)}
 `;
-  const path2 = join57(packageDir, "provisioning.contract.json");
+  const path2 = join58(packageDir, "provisioning.contract.json");
   writeFileSync26(path2, body);
-  const localPath = join57(appDir2, LOCAL_CONTRACT_REL);
+  const localPath = join58(appDir2, LOCAL_CONTRACT_REL);
   mkdirSync29(dirname31(localPath), { recursive: true });
   writeFileSync26(localPath, body);
   staged.push(localPath);
@@ -55930,8 +56359,8 @@ async function applyOverlays(input) {
   const cwd = resolve45(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
-  const overlay = JSON.parse(readFileSync70(input.overlayPath, "utf8"));
-  const tokens = JSON.parse(readFileSync70(input.tokensPath, "utf8"));
+  const overlay = JSON.parse(readFileSync71(input.overlayPath, "utf8"));
+  const tokens = JSON.parse(readFileSync71(input.tokensPath, "utf8"));
   const wrote = [];
   const notes = [];
   const repoRoot2 = findRepoRoot(cwd);
@@ -55941,7 +56370,7 @@ async function applyOverlays(input) {
         `shell "${shell}" cannot bake a customer brand \u2014 it ships no prepare:customer script`
       );
     }
-    const appDir2 = join57(repoRoot2, shellAppDir(shell));
+    const appDir2 = join58(repoRoot2, shellAppDir(shell));
     const packageDir = dirname31(resolve45(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir2, packageDir, overlay });
     wrote.push(...staged);
@@ -55963,10 +56392,10 @@ async function applyOverlays(input) {
       note: `prepare:customer --contract with a merged contract (committed provisioning.json untouched)${unpairedInRepo ? ` \xB7 ${unpairedInRepo}` : ""}`
     };
   }
-  const pkgProv = join57(cwd, "provisioning.json");
+  const pkgProv = join58(cwd, "provisioning.json");
   assertNotCommitted(pkgProv, input.forbiddenProvisioning);
-  if (existsSync59(pkgProv)) {
-    const cur = JSON.parse(readFileSync70(pkgProv, "utf8"));
+  if (existsSync60(pkgProv)) {
+    const cur = JSON.parse(readFileSync71(pkgProv, "utf8"));
     const merged = deepMerge4(cur, overlay);
     writeFileSync26(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
@@ -55974,9 +56403,9 @@ async function applyOverlays(input) {
     writeFileSync26(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
-  const pkgTokens = join57(cwd, "tokens.json");
-  if (existsSync59(pkgTokens) && (tokens.colors || tokens.typography)) {
-    const cur = JSON.parse(readFileSync70(pkgTokens, "utf8"));
+  const pkgTokens = join58(cwd, "tokens.json");
+  if (existsSync60(pkgTokens) && (tokens.colors || tokens.typography)) {
+    const cur = JSON.parse(readFileSync71(pkgTokens, "utf8"));
     const merged = deepMerge4(cur, tokens);
     const mergedColors = merged.colors;
     if (mergedColors && typeof mergedColors === "object" && !Array.isArray(mergedColors)) {
@@ -55995,9 +56424,9 @@ async function applyOverlays(input) {
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
-  const homeSrc = join57(cwd, "dev/index.ts");
-  if (homeAction && existsSync59(homeSrc)) {
-    const prev = readFileSync70(homeSrc, "utf8");
+  const homeSrc = join58(cwd, "dev/index.ts");
+  if (homeAction && existsSync60(homeSrc)) {
+    const prev = readFileSync71(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
     if (!patched.foreign && overlay.installedVerticals?.length) {
@@ -56020,13 +56449,13 @@ async function applyOverlays(input) {
       notes.push(`${patched.unparsed} onAppear params block(s) in ${homeSrc} could not be read \u2014 any brand values inside them were not applied`);
     }
   }
-  if (!input.iconPath || !existsSync59(input.iconPath)) {
+  if (!input.iconPath || !existsSync60(input.iconPath)) {
     const book = input.iconPath ? dirname31(dirname31(resolve45(input.iconPath))) : void 0;
     notes.push(
       book ? `no icon installed \u2014 ${siteLogoAbsence(book).hint}` : "no icon installed and no business book to say why \u2014 `himi icon generate` draws one from the accent, or `himi icon set <file.png>` installs the customer's own mark"
     );
   }
-  if (input.iconPath && existsSync59(input.iconPath)) {
+  if (input.iconPath && existsSync60(input.iconPath)) {
     try {
       const installed = await installIcon(cwd, input.iconPath, { derivePlay: true });
       wrote.push(...installed.wrote);
@@ -60201,7 +60630,7 @@ __export(cli_exports, {
   runSiteAnalyze: () => runSiteAnalyze,
   runSiteFunctionCli: () => runSiteFunctionCli
 });
-import { readFileSync as readFileSync71 } from "node:fs";
+import { readFileSync as readFileSync72 } from "node:fs";
 import { resolve as resolve46 } from "node:path";
 function assetFetchFor(_opts) {
   return pinnedFetch2;
@@ -60300,7 +60729,7 @@ async function runSiteFunctionCli(opts) {
   let source;
   if (opts.sourcePath) {
     const p = resolve46(opts.cwd ?? process.cwd(), opts.sourcePath);
-    source = readFileSync71(p, "utf8");
+    source = readFileSync72(p, "utf8");
   }
   let body;
   if (opts.bodyRaw != null) {
@@ -60559,7 +60988,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync60, readFileSync as readFileSync72, writeFileSync as writeFileSync27 } from "node:fs";
+import { existsSync as existsSync61, readFileSync as readFileSync73, writeFileSync as writeFileSync27 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -60708,7 +61137,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync60, readFileSync: readFileSync72, writeFileSync: writeFileSync27 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync61, readFileSync: readFileSync73, writeFileSync: writeFileSync27 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -61381,11 +61810,11 @@ var init_context = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync73, mkdirSync as mkdirSync30, writeFileSync as writeFileSync28, existsSync as existsSync61, rmSync as rmSync14, readdirSync as readdirSync27, statSync as statSync17, lstatSync as lstatSync9, accessSync, constants as constants2, renameSync as renameSync6, cpSync as cpSync3 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync74, mkdirSync as mkdirSync30, writeFileSync as writeFileSync28, existsSync as existsSync62, rmSync as rmSync14, readdirSync as readdirSync27, statSync as statSync17, lstatSync as lstatSync9, accessSync, constants as constants2, renameSync as renameSync6, cpSync as cpSync3 } from "node:fs";
 import { execFile, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn6 } from "node:child_process";
 import { createHash as createHash27, randomUUID as randomUUID5 } from "node:crypto";
 import { tmpdir as tmpdir5, homedir as homedir7, hostname } from "node:os";
-import { join as join58, resolve as resolve47, relative as relative10, basename as basename14, dirname as dirname32 } from "node:path";
+import { join as join59, resolve as resolve47, relative as relative10, basename as basename14, dirname as dirname32 } from "node:path";
 import { fileURLToPath as fileURLToPath24 } from "node:url";
 
 // ../serve-cli/src/client.ts
@@ -64678,8 +65107,8 @@ var str6 = (v) => typeof v === "string" ? v : void 0;
 var num2 = (v) => typeof v === "string" && v !== "" && Number.isFinite(Number(v)) ? Number(v) : void 0;
 function embeddedTemplateCatalog() {
   return availableTemplates().map((name) => {
-    const path2 = join58(templateSourceDir(name), TEMPLATE_META_FILE);
-    const meta = JSON.parse(readFileSync73(path2, "utf8"));
+    const path2 = join59(templateSourceDir(name), TEMPLATE_META_FILE);
+    const meta = JSON.parse(readFileSync74(path2, "utf8"));
     if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
       throw new Error(`${path2} must be { title: string, description: string, tags: string[], category?: string }`);
     }
@@ -65351,7 +65780,7 @@ var COMMANDS = [
 ];
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync73(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync74(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -65469,7 +65898,7 @@ function ageInDays(publishedAt, now = Date.now()) {
 }
 function packageVersion(path2) {
   try {
-    const version2 = JSON.parse(readFileSync73(path2, "utf8")).version;
+    const version2 = JSON.parse(readFileSync74(path2, "utf8")).version;
     return typeof version2 === "string" && version2 ? version2 : void 0;
   } catch {
     return void 0;
@@ -65478,7 +65907,7 @@ function packageVersion(path2) {
 function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("./authoring-runtime/node_modules/@wix/himalaya/package.json", import.meta.url)) {
   let dir = resolve47(fromDir);
   for (; ; ) {
-    const version2 = packageVersion(join58(dir, "node_modules", "@wix", "himalaya", "package.json"));
+    const version2 = packageVersion(join59(dir, "node_modules", "@wix", "himalaya", "package.json"));
     if (version2) return { version: version2, source: "local" };
     const parent = dirname32(dir);
     if (parent === dir) break;
@@ -65488,7 +65917,7 @@ function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("
   if (bundled) return { version: bundled, source: "bundled" };
   try {
     const root = execFileSync7("npm", ["root", "-g"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-    const version2 = root ? packageVersion(join58(root, "@wix", "himalaya", "package.json")) : void 0;
+    const version2 = root ? packageVersion(join59(root, "@wix", "himalaya", "package.json")) : void 0;
     return version2 ? { version: version2, source: "global" } : {};
   } catch {
     return {};
@@ -65535,11 +65964,11 @@ var UPDATE_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1e3;
 var UPDATE_SNOOZE_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_REEXEC_ENV = "HIMI_UPDATED_ONCE";
 function updateCachePath(env = process.env) {
-  return env.HIMI_UPDATE_CACHE_FILE ?? join58(homedir7(), ".himalaya", "update-check.json");
+  return env.HIMI_UPDATE_CACHE_FILE ?? join59(homedir7(), ".himalaya", "update-check.json");
 }
 function readUpdateCache(path2) {
   try {
-    const parsed = JSON.parse(readFileSync73(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync74(path2, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -65607,12 +66036,12 @@ function createUpdateRunner(spawn7 = spawnSync5) {
     },
     installedVersion: () => {
       const root = globalNodeModulesRoot();
-      return root ? packageVersion(join58(root, "@wix", "himalaya-cli", "package.json")) : void 0;
+      return root ? packageVersion(join59(root, "@wix", "himalaya-cli", "package.json")) : void 0;
     },
     reexec: (argv) => {
       const root = globalNodeModulesRoot();
-      const entry = root ? join58(root, "@wix", "himalaya-cli", "dist", "cli.mjs") : void 0;
-      if (!entry || !existsSync61(entry)) return void 0;
+      const entry = root ? join59(root, "@wix", "himalaya-cli", "dist", "cli.mjs") : void 0;
+      if (!entry || !existsSync62(entry)) return void 0;
       const result = spawnSync5(process.execPath, [entry, ...argv], {
         // inherit keeps PIPED STDIN working — commands that read stdin must survive a re-exec.
         stdio: "inherit",
@@ -65659,7 +66088,7 @@ function staleUpdateLockFile(cachePath, now) {
   for (const path2 of [`${cachePath}.lock.break`, `${cachePath}.lock`]) {
     let content;
     try {
-      content = readFileSync73(path2, "utf8");
+      content = readFileSync74(path2, "utf8");
     } catch {
       continue;
     }
@@ -65682,7 +66111,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   const mine = lockStamp(now);
   const readLock = (path2) => {
     try {
-      return readFileSync73(path2, "utf8");
+      return readFileSync74(path2, "utf8");
     } catch {
       return void 0;
     }
@@ -65793,6 +66222,52 @@ function loaderArgs(execArgv) {
   return out;
 }
 var spawnUpdateRefresh = createUpdateRefreshSpawner();
+function createTrimValidator(deps = {}, spawnFn = spawn6) {
+  const outcome = (code, report2, said) => {
+    let counts;
+    let errors;
+    try {
+      const parsed = JSON.parse(report2);
+      counts = parsed.counts;
+      if (Array.isArray(parsed.findings)) {
+        const text5 = (v) => typeof v === "string" && v ? v : void 0;
+        errors = parsed.findings.filter((f) => f && f.severity === "error" && typeof f.id === "string").map((f) => ({
+          id: f.id,
+          message: text5(f.message) ?? "",
+          ...text5(f.pass) ? { pass: text5(f.pass) } : {},
+          ...text5(f.screen) ? { screen: text5(f.screen) } : {},
+          ...text5(f.path) ? { path: text5(f.path) } : {},
+          ...text5(f.ruleCode) ? { ruleCode: text5(f.ruleCode) } : {}
+        }));
+      }
+    } catch {
+    }
+    return { code, counts, ...errors ? { errors } : {}, ...code !== 0 ? { tail: said.slice(-4e3) } : {} };
+  };
+  return async (dir, opts = {}) => {
+    const argv = ["validate", "--content", resolve47(dir), "--strict", "--skip-version-check"];
+    if (!opts.fresh) {
+      const out = [];
+      const err = [];
+      const code2 = await run(argv, { log: (l) => out.push(l), error: (l) => err.push(l) }, deps);
+      return outcome(code2, out[out.length - 1] ?? "", [...out, ...err].join("\n"));
+    }
+    const { code, stdout, stderr } = await new Promise((done) => {
+      const chunks = { out: [], err: [] };
+      const child = spawnFn(process.execPath, [...loaderArgs(process.execArgv), fileURLToPath24(import.meta.url), ...argv], {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: ["ignore", "pipe", "pipe"]
+      });
+      child.stdout?.on("data", (b) => chunks.out.push(b));
+      child.stderr?.on("data", (b) => chunks.err.push(b));
+      child.on("error", (e) => done({ code: 2, stdout: "", stderr: String(e) }));
+      child.on("close", (c) => done({ code: c ?? 1, stdout: Buffer.concat(chunks.out).toString("utf8"), stderr: Buffer.concat(chunks.err).toString("utf8") }));
+    });
+    return outcome(code, stdout.trim(), `${stdout}
+${stderr}`);
+  };
+}
 async function maybeSelfUpdate(argv, io, opts = {}) {
   const env = opts.env ?? process.env;
   const running = opts.running ?? cliVersion();
@@ -66220,7 +66695,7 @@ function executableOnPath(name, env = process.env) {
   const suffixes = process.platform === "win32" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
   for (const dir of entries) {
     for (const suffix of suffixes) {
-      const candidate = join58(dir, `${name}${suffix}`);
+      const candidate = join59(dir, `${name}${suffix}`);
       try {
         if (!statSync17(candidate).isFile()) continue;
         if (process.platform !== "win32") accessSync(candidate, constants2.X_OK);
@@ -66329,7 +66804,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync61(iosYmlPath) ? readFileSync73(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync62(iosYmlPath) ? readFileSync74(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -66343,7 +66818,7 @@ async function nativeConfigAdvisories(app, configSource) {
 }
 function readConfigSource(dir) {
   try {
-    return readFileSync73(join58(dir, "config.ts"), "utf8");
+    return readFileSync74(join59(dir, "config.ts"), "utf8");
   } catch {
     return null;
   }
@@ -66359,7 +66834,7 @@ function keptPlan(kept) {
 }
 async function initFromRemoteTemplate(name, parentDir, template, c) {
   const dir = resolve47(parentDir, name);
-  if (existsSync61(join58(dir, "himalaya.content.json"))) {
+  if (existsSync62(join59(dir, "himalaya.content.json"))) {
     throw new Error(`content package already exists at ${dir}`);
   }
   const r = await c.fetchTemplateSource(TEMPLATE_APP_PREFIX + template);
@@ -66402,7 +66877,7 @@ function symlinkDestinationIssue(dest) {
 function restoreDestinationIssue(dest, force) {
   const link = symlinkDestinationIssue(dest);
   if (link) return link;
-  if (!existsSync61(dest)) return null;
+  if (!existsSync62(dest)) return null;
   if (!statSync17(dest).isDirectory()) {
     return { error: `${dest} exists and is not a directory`, hint: "pass --out/--name to land somewhere else, or remove the file" };
   }
@@ -66417,7 +66892,7 @@ function restoreDestinationIssue(dest, force) {
 function isHimalayaMonorepoCheckout(start) {
   let dir = resolve47(start);
   for (; ; ) {
-    if (existsSync61(join58(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync61(join58(dir, "core", "serve", "src", "server.ts"))) return true;
+    if (existsSync62(join59(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync62(join59(dir, "core", "serve", "src", "server.ts"))) return true;
     const parent = dirname32(dir);
     if (parent === dir) return false;
     dir = parent;
@@ -66460,7 +66935,7 @@ function materializeForPreview(appDir2, slug, displayName) {
     Object.entries(files).map(([rel, body]) => [rel, rel === "himalaya.content.json" ? substituteIdentity(body, slug) : body])
   );
   const repoRoot2 = resolve47(fileURLToPath24(new URL("../../..", import.meta.url)));
-  const root = join58(repoRoot2, "node_modules", ".cache", "himi-template-preview");
+  const root = join59(repoRoot2, "node_modules", ".cache", "himi-template-preview");
   const stillRunning = (pid) => {
     try {
       process.kill(pid, 0);
@@ -66474,12 +66949,12 @@ function materializeForPreview(appDir2, slug, displayName) {
       if (!entry.isDirectory()) continue;
       const pid = Number(entry.name.startsWith(`${slug}-`) ? entry.name.slice(slug.length + 1) : NaN);
       if (Number.isInteger(pid) && pid > 0 && pid !== process.pid && !stillRunning(pid)) {
-        rmSync14(join58(root, entry.name), { recursive: true, force: true });
+        rmSync14(join59(root, entry.name), { recursive: true, force: true });
       }
     }
   } catch {
   }
-  const dest = join58(root, `${slug}-${process.pid}`);
+  const dest = join59(root, `${slug}-${process.pid}`);
   rmSync14(dest, { recursive: true, force: true });
   mkdirSync30(dest, { recursive: true });
   materializeSource(forBuild, displayName, dest, slug);
@@ -66487,8 +66962,8 @@ function materializeForPreview(appDir2, slug, displayName) {
 }
 async function appId(dir) {
   try {
-    const { readFileSync: readFileSync74 } = await import("node:fs");
-    const m = JSON.parse(readFileSync74(join58(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync75 } = await import("node:fs");
+    const m = JSON.parse(readFileSync75(join59(dir, "himalaya.content.json"), "utf8"));
     if (m.name) return m.name;
   } catch {
   }
@@ -66496,8 +66971,8 @@ async function appId(dir) {
 }
 async function contentVisibility(dir) {
   try {
-    const { readFileSync: readFileSync74 } = await import("node:fs");
-    const m = JSON.parse(readFileSync74(join58(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync75 } = await import("node:fs");
+    const m = JSON.parse(readFileSync75(join59(dir, "himalaya.content.json"), "utf8"));
     if (m.visibility === "public" || m.visibility === "unlisted") return m.visibility;
   } catch {
   }
@@ -66721,7 +67196,7 @@ async function recordedReleaseForContentQuietly(dir, resolution, onDrift) {
   try {
     const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
     const bres = await buildContentForValidation2(dir, { resolution });
-    out = mkdtempSync4(join58(tmpdir5(), "himi-ux-record-"));
+    out = mkdtempSync4(join59(tmpdir5(), "himi-ux-record-"));
     const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
     const outcome = await buildReleaseFromContent2(dir, out, { ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {}, collect: { lint: true } });
     const releaseId = outcome.manifest.releaseId;
@@ -66899,7 +67374,7 @@ async function producedWidgetFamilies(dir) {
     let js;
     for (const candidate of [`${name}.bundle.js`, `${name}.js`, name]) {
       try {
-        js = readFileSync73(join58(outDir, candidate), "utf8");
+        js = readFileSync74(join59(outDir, candidate), "utf8");
         break;
       } catch {
       }
@@ -66930,7 +67405,7 @@ async function producedWidgetFamilies(dir) {
   }
   return { families, source: "dist/bundles" };
 }
-var boardOpen = (dir) => existsSync61(join58(dir, ".himi", "studio", "index.html"));
+var boardOpen = (dir) => existsSync62(join59(dir, ".himi", "studio", "index.html"));
 var BOARD_REFRESHERS = /* @__PURE__ */ new Set(["render", "test", "validate", "build", "push", "icon", "site", "ux", "progress"]);
 async function leaveForBoard(dir, record2, value) {
   if (!boardOpen(dir)) return;
@@ -67295,19 +67770,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const { runTemplateTrim: runTemplateTrim2 } = await Promise.resolve().then(() => (init_template_trim(), template_trim_exports));
           const outcome = await runTemplateTrim2(
             { dir: contentDir(flags), keep: flags.keep, links: flags.links, dryRun: flags["dry-run"] === true, force: flags.force === true },
-            {
-              validate: async (dir) => {
-                const out = [];
-                const err = [];
-                const code = await run(["validate", "--content", dir, "--strict"], { log: (l) => out.push(l), error: (l) => err.push(l) }, deps);
-                let counts;
-                try {
-                  counts = JSON.parse(out[out.length - 1] ?? "").counts;
-                } catch {
-                }
-                return { code, counts, ...code !== 0 ? { tail: [...out, ...err].join("\n").slice(-4e3) } : {} };
-              }
-            }
+            { validate: createTrimValidator(deps) }
           );
           if (outcome.code === 2) io.error(JSON.stringify(outcome.result));
           else print(outcome.result);
@@ -67318,7 +67781,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const sourceDir = resolve47(str6(flags["source-dir"]) ?? appDir2);
           let meta;
           try {
-            meta = JSON.parse(readFileSync73(join58(sourceDir, TEMPLATE_META_FILE), "utf8"));
+            meta = JSON.parse(readFileSync74(join59(sourceDir, TEMPLATE_META_FILE), "utf8"));
           } catch {
             io.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
             return 2;
@@ -67328,7 +67791,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const appearance = extractTemplateAppearance(JSON.parse(readFileSync73(join58(sourceDir, "tokens.json"), "utf8")));
+            const appearance = extractTemplateAppearance(JSON.parse(readFileSync74(join59(sourceDir, "tokens.json"), "utf8")));
             meta = { ...appearance, ...meta };
           } catch {
           }
@@ -67340,7 +67803,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const force = flags.force === true;
           const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
           const bres = await buildContentForValidation2(buildDir, { resolution: resolutionFlag(flags) });
-          const out = mkdtempSync4(join58(tmpdir5(), "himi-template-"));
+          const out = mkdtempSync4(join59(tmpdir5(), "himi-template-"));
           const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
           const outcome = await buildReleaseFromContent2(buildDir, out, {
             ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
@@ -67393,7 +67856,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           let iconHash;
           if (iconPath) {
             try {
-              const bytes2 = readFileSync73(iconPath);
+              const bytes2 = readFileSync74(iconPath);
               payload.icon = bytes2.toString("base64");
               iconHash = createHash27("sha256").update(bytes2).digest("hex");
             } catch {
@@ -67626,7 +68089,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join58(tmpdir5(), "himi-validate-"));
+        const out = mkdtempSync4(join59(tmpdir5(), "himi-validate-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -67669,7 +68132,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const path2 = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync73(path2, "utf8");
+            raw = readFileSync74(path2, "utf8");
           } catch {
             throw new Error(`no DPX BO session at ${path2}; run dpx auth login, write dpx auth token to that path, then himi login --dpx --target bo`);
           }
@@ -67789,13 +68252,13 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       case "studio": {
         const { openStudio: openStudio2 } = await Promise.resolve().then(() => (init_studio(), studio_exports));
         const dir = contentDir(flags);
-        if (!existsSync61(join58(dir, "himalaya.content.json"))) {
+        if (!existsSync62(join59(dir, "himalaya.content.json"))) {
           io.error(JSON.stringify({ ok: false, error: "not_a_content_package", dir, hint: "run from the app directory (or pass --content <dir>) \u2014 the board reads that package's .himi/" }));
           return 2;
         }
         if (pos[1] === "reel") {
           const { buildReel: buildReel2 } = await Promise.resolve().then(() => (init_studio_reel(), studio_reel_exports));
-          const out = resolve47(str6(flags.out) ?? join58(dir, ".himi", "making-of.html"));
+          const out = resolve47(str6(flags.out) ?? join59(dir, ".himi", "making-of.html"));
           const { html, plan } = buildReel2(dir);
           mkdirSync30(dirname32(out), { recursive: true });
           writeFileSync28(out, html);
@@ -67845,7 +68308,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         const { appendProgress: appendProgress2, readProgress: readProgress2, summarizeProgress: summarizeProgress2, parseStep: parseStep2, notifyDesktop: notifyDesktop2, appLabel: appLabel2, journalPath: journalPath2, ProgressError: ProgressError2, JOURNEY_STEPS: JOURNEY_STEPS2 } = await Promise.resolve().then(() => (init_progress(), progress_exports));
         const dir = contentDir(flags);
         const journal = journalPath2(dir);
-        const hint = existsSync61(join58(dir, "himalaya.content.json")) ? {} : { hint: "no himalaya.content.json here \u2014 run from the app directory (or pass --content <dir>) so the build board finds this journal" };
+        const hint = existsSync62(join59(dir, "himalaya.content.json")) ? {} : { hint: "no himalaya.content.json here \u2014 run from the app directory (or pass --content <dir>) so the build board finds this journal" };
         const message = pos.slice(1).join(" ").trim();
         if (!message) {
           if (flags.step !== void 0 || flags.image !== void 0 || flags.notify === true) {
@@ -67937,7 +68400,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       case "test": {
         const dir = contentDir(flags);
         const structuredOutput = flags.json === true || io.isTTY !== true;
-        if (existsSync61(join58(dir, "functions"))) {
+        if (existsSync62(join59(dir, "functions"))) {
           const { invokeLocalFunction: invokeLocalFunction2, loadFunctionsApp: loadFunctionsApp2 } = await Promise.resolve().then(() => (init_functions(), functions_exports));
           const loaded = await loadFunctionsApp2(dir);
           const results = [];
@@ -68024,7 +68487,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           }
         }
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join58(tmpdir5(), "himi-test-"));
+        const out = mkdtempSync4(join59(tmpdir5(), "himi-test-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -68069,7 +68532,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             io.error(JSON.stringify({ error: `screen "${screen.screenId}" has no Tier-5 worker, so there is nothing for the browser loop to build` }));
             return 2;
           }
-          const sources = collectWorkerSources2(join58(dir, "tier5-src"), screen.bundleName);
+          const sources = collectWorkerSources2(join59(dir, "tier5-src"), screen.bundleName);
           if (!sources) {
             io.error(JSON.stringify({ error: `no worker source found at tier5-src/${screen.bundleName} \u2014 the browser loop compiles SOURCE, not the built bundle` }));
             return 2;
@@ -68230,7 +68693,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             const sp = await runShotsPass2({
               descriptors: scopeDescriptors2(outcome.descriptors ?? [], pos.slice(1), invalidScreens),
               tokens: outcome.tokens,
-              outDir: join58(dir, ".himi", "shots"),
+              outDir: join59(dir, ".himi", "shots"),
               width: 390,
               layers: { rules: shotRules, ...cmsSeed ? { cmsSeed } : {}, ...canned ? { canned: canned.byKey } : {} },
               ...budgetMs ? { budgetMs } : {},
@@ -68268,7 +68731,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           releaseId: result.releaseId,
           releasePayload: release,
           descriptors: attestedDescriptors,
-          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join58(dir, ".himi", "shots", name)])),
+          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join59(dir, ".himi", "shots", name)])),
           coverage: {
             screens: crawledScreens.size,
             actionsDispatched: result.actions.exercised,
@@ -68358,7 +68821,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync73(stateArg.replace(/^@/, ""), "utf8");
+            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync74(stateArg.replace(/^@/, ""), "utf8");
             injectedState = JSON.parse(raw);
           } catch (e) {
             io.error(JSON.stringify({ error: `--state must be inline JSON or a path to a .json file \u2014 ${e.message}` }));
@@ -68373,7 +68836,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync73(inputArg.replace(/^@/, ""), "utf8");
+            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync74(inputArg.replace(/^@/, ""), "utf8");
             const parsed = JSON.parse(raw);
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("must be a JSON object");
             injectedInput = parsed;
@@ -68422,7 +68885,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         }
         const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join58(tmpdir5(), "himi-render-"));
+        const out = mkdtempSync4(join59(tmpdir5(), "himi-render-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -68436,7 +68899,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         const diagnostics = (outcome.lint ?? []).find((s) => s.screenId === screenId)?.issues ?? [];
         let pngFile;
         let attestationPngFile;
-        const shotPath = join58(dir, ".himi", "shots", `${screenId}.png`);
+        const shotPath = join59(dir, ".himi", "shots", `${screenId}.png`);
         const pngTarget = typeof flags.png === "string" ? str6(flags.png) : flags.png === true ? shotPath : void 0;
         if (pngTarget && r.pngBase64) {
           pngFile = writePngFile(pngTarget, r.pngBase64);
@@ -68566,7 +69029,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           installIcon: installIcon2,
           siteBookIcon: siteBookIcon2,
           siteLogoAbsence: siteLogoAbsence2,
-          summarize: summarize3
+          summarize: summarize4
         } = await Promise.resolve().then(() => (init_icon(), icon_exports));
         const requireVerified = sub === "check";
         const report2 = async (status, extra = {}) => {
@@ -68591,11 +69054,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             }))
           ];
           if (flags.json === true) {
-            print({ ok: !blocksRelease2(status, { requireVerified }), ...extra, ...status, findings, summary: summarize3(status) });
+            print({ ok: !blocksRelease2(status, { requireVerified }), ...extra, ...status, findings, summary: summarize4(status) });
             return blocksRelease2(status, { requireVerified }) ? 1 : 0;
           }
           for (const [k, v] of Object.entries(extra)) io.log(`${k}: ${Array.isArray(v) ? v.join(", ") : String(v)}`);
-          io.log(`launcher icon: ${summarize3(status)}`);
+          io.log(`launcher icon: ${summarize4(status)}`);
           if (status.path) io.log(`  file: ${status.path}${status.header ? ` (${status.header.width}x${status.header.height})` : ""}`);
           for (const f of findings) io.log(`  ${f.level === "error" ? "\u2717" : "\u26A0"} ${f.message}`);
           if (status.verdict === "ok" || status.verdict === "unverified") {
@@ -68772,7 +69235,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify(linked));
           return 1;
         }
-        if (existsSync61(dest)) {
+        if (existsSync62(dest)) {
           if (!statSync17(dest).isDirectory()) {
             io.error(JSON.stringify({
               error: `${dest} exists and is not a directory`,
@@ -68785,7 +69248,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway (merging, and naming what it keeps), --replace to restore exactly what was archived, or --out/--name to land somewhere else" }));
             return 1;
           }
-          if (replace && occupied && !existsSync61(join58(dest, "himalaya.content.json"))) {
+          if (replace && occupied && !existsSync62(join59(dest, "himalaya.content.json"))) {
             io.error(JSON.stringify({
               error: `${dest} is not a content package \u2014 refusing to --replace it`,
               hint: "--replace only clears a directory that holds himalaya.content.json. Check --out/--name, or pass --force to merge into it instead."
@@ -68924,7 +69387,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const force = flags.force === true;
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join58(tmpdir5(), "himi-push-"));
+        const out = mkdtempSync4(join59(tmpdir5(), "himi-push-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -69445,7 +69908,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const built = mkdtempSync4(join58(tmpdir5(), "himi-pack-"));
+        const built = mkdtempSync4(join59(tmpdir5(), "himi-pack-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, built, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -69648,7 +70111,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             }));
             return 1;
           }
-          const archive = readFileSync73(resolve47(file));
+          const archive = readFileSync74(resolve47(file));
           const result = await client2().createPackageShare({
             app: opened.header.app,
             releaseId: opened.header.releaseId,
@@ -69702,11 +70165,11 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             const app = await appId(dir2);
             const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
             const bres = await buildContentBundles2(dir2, { resolution: resolutionFlag(flags) });
-            temp = mkdtempSync4(join58(tmpdir5(), "himi-run-build-"));
+            temp = mkdtempSync4(join59(tmpdir5(), "himi-run-build-"));
             const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
             const initial = await buildReleaseFromContent2(dir2, temp, { ...hasWorkers ? { tier5Dir: bundleOutDir2(dir2) } : {} });
             servedMissing = initial.missingBundles;
-            source = join58(temp, app);
+            source = join59(temp, app);
           }
           const chromeArg = str6(flags.chrome) ?? "preview";
           if (chromeArg !== "preview" && chromeArg !== "app") {
@@ -69742,7 +70205,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             if (!recordKit) return;
             startedAt = (/* @__PURE__ */ new Date()).toISOString();
             const failure = record2(served2, { ok: true, at: startedAt });
-            if (!recorded) io.error(JSON.stringify({ run: "run_record_skipped", message: `${failure ?? `${join58(dir, ".himi")} is not a real directory`}, so the build board will not frame this preview.` }));
+            if (!recorded) io.error(JSON.stringify({ run: "run_record_skipped", message: `${failure ?? `${join59(dir, ".himi")} is not a real directory`}, so the build board will not frame this preview.` }));
             await refreshBoard();
           };
           const retract = async () => {
@@ -69773,7 +70236,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           }
           const watchKit = watch2 ? await Promise.resolve().then(() => (init_run_watch(), run_watch_exports)) : null;
           const bus = watchKit ? new watchKit.ReloadBus() : void 0;
-          if (watch2) served = mkdtempSync4(join58(tmpdir5(), "himi-run-served-"));
+          if (watch2) served = mkdtempSync4(join59(tmpdir5(), "himi-run-served-"));
           const running = await runPackage2(source, {
             port,
             chrome: chromeArg,
@@ -69794,8 +70257,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             await announce(running);
             if (watchKit && bus) {
               const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
-              const live2 = join58(running.releaseRoot, running.app);
-              const manifestOf = (tree) => JSON.parse(readFileSync73(join58(tree, "release-manifest.json"), "utf8"));
+              const live2 = join59(running.releaseRoot, running.app);
+              const manifestOf = (tree) => JSON.parse(readFileSync74(join59(tree, "release-manifest.json"), "utf8"));
               let current = manifestOf(live2);
               const failed2 = async (message) => {
                 if (stopping) return;
@@ -69806,7 +70269,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               };
               rebuild = watchKit.serialize(async () => {
                 const t0 = Date.now();
-                const next = mkdtempSync4(join58(tmpdir5(), "himi-run-build-"));
+                const next = mkdtempSync4(join59(tmpdir5(), "himi-run-build-"));
                 try {
                   const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
                   if (bres.compileErrors.length) {
@@ -69823,14 +70286,14 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
                     return;
                   }
                   if (stopping) return;
-                  const fresh = manifestOf(join58(next, running.app));
+                  const fresh = manifestOf(join59(next, running.app));
                   const diff = watchKit.diffReleases(current, fresh);
                   const retired = `${live2}.retired-${Date.now()}`;
                   renameSync6(live2, retired);
                   try {
-                    renameSync6(join58(next, running.app), live2);
+                    renameSync6(join59(next, running.app), live2);
                   } catch {
-                    cpSync3(join58(next, running.app), live2, { recursive: true });
+                    cpSync3(join59(next, running.app), live2, { recursive: true });
                   }
                   rmSync14(retired, { recursive: true, force: true });
                   current = fresh;
@@ -70428,7 +70891,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: `patch ${kind} needs --file`, usage: PATCH_USAGE }));
           return 2;
         }
-        if (!existsSync61(file)) {
+        if (!existsSync62(file)) {
           io.error(JSON.stringify({ error: `no such file: ${file}` }));
           return 2;
         }
@@ -70484,7 +70947,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           lintNote: "`himi patch` sends a raw file. Nothing here built or linted your app \u2014 `himi push --only <selector>` is the same edit with the full lint gate in front of it."
         };
         if (kind === "tokens" || kind === "app-config") {
-          const body = readFileSync73(file, "utf8");
+          const body = readFileSync74(file, "utf8");
           const patch2 = kind === "tokens" ? { tokens: body } : { appConfig: body };
           return runReleasePatch({
             ...common,
@@ -70499,7 +70962,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io.error(JSON.stringify({ error: "patch screen needs a <screenId>", usage: PATCH_USAGE }));
             return 2;
           }
-          const descriptor = readFileSync73(file, "utf8");
+          const descriptor = readFileSync74(file, "utf8");
           try {
             JSON.parse(descriptor);
           } catch (e) {
@@ -70539,7 +71002,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             extra: { kind, screen: id, file: { path: file, bytes: Buffer.byteLength(descriptor, "utf8") } }
           });
         }
-        const bytes2 = readFileSync73(file);
+        const bytes2 = readFileSync74(file);
         const sha = createHash27("sha256").update(bytes2).digest("hex");
         const forScreens = (str6(flags["for-screen"]) ?? "").split(",").map((s) => s.trim()).filter(Boolean);
         if (flags["no-rebind"] !== void 0 && flags["no-rebind"] !== true) {
@@ -70683,7 +71146,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           }
           let def;
           try {
-            const parsed = JSON.parse(arg.startsWith("@") ? readFileSync73(arg.slice(1), "utf8") : arg);
+            const parsed = JSON.parse(arg.startsWith("@") ? readFileSync74(arg.slice(1), "utf8") : arg);
             if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
               io.error(JSON.stringify({ error: "invalid_definition", problems: [`--definition must be a JSON object, got ${Array.isArray(parsed) ? "an array" : parsed === null ? "null" : typeof parsed}`] }));
               return 2;
@@ -71147,7 +71610,7 @@ ${label2}`);
         const platform = str6(flags.platform)?.split(",").map((p) => p.trim()).filter(Boolean);
         {
           const distDir = contentDir(flags);
-          if (existsSync61(join58(distDir, "himalaya.content.json"))) {
+          if (existsSync62(join59(distDir, "himalaya.content.json"))) {
             const issues = await iconIssues(distDir, flags.strict === true, { requireDeclared: true, requireVerified: true });
             const errors = issues.filter((i) => i.severity === "error");
             for (const i of issues.filter((i2) => i2.severity === "warning")) {
@@ -71416,7 +71879,7 @@ ${label2}`);
           const dpxPath = dpxSessionTokenPath();
           let dpx;
           try {
-            dpx = readFileSync73(dpxPath, "utf8").trim();
+            dpx = readFileSync74(dpxPath, "utf8").trim();
           } catch {
             io.error(JSON.stringify({ error: `no dpx session at ${dpxPath} \u2014 run \`dpx auth login\` then \`dpx auth token > ${dpxPath}\` (dpx 2.x keeps its own state in ~/.dpx/auth.json and does NOT write the legacy session file), or omit --dpx` }));
             return 1;
@@ -71818,7 +72281,7 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
           const path2 = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync73(path2, "utf8");
+            raw = readFileSync74(path2, "utf8");
           } catch {
             io.error(JSON.stringify({ error: `no DPX BO session at ${path2}` }));
             return 1;
@@ -72207,6 +72670,7 @@ export {
   buildDoctorReport,
   compareVersions2 as compareVersions,
   createScopedRegistryResolver,
+  createTrimValidator,
   createUpdateRefreshSpawner,
   createUpdateRunner,
   credentialKind,