@wix/himalaya-cli 0.1042.0 → 0.1044.0

package/dist/cli.mjs

@@ -1357,7 +1357,18 @@ function idSegOf(name) {
 function substituteIdentity(body, name, slug = name) {
   const idSeg = idSegOf(slug);
   const cmsPrefix = slug.replace(/[^a-z0-9]+/gi, "_").replace(/^_+|_+$/g, "").toLowerCase() || "app";
-  return body.replaceAll("__HIMI_APP_NAME__", name).replaceAll("__HIMI_APP_SLUG__", slug).replaceAll("__HIMI_APP_DOTID__", `com.example.${idSeg}`).replaceAll("__HIMI_APP_CMS_PREFIX__", cmsPrefix);
+  const values = {
+    __HIMI_APP_NAME__: name,
+    __HIMI_APP_SLUG__: slug,
+    __HIMI_APP_DOTID__: `com.example.${idSeg}`,
+    __HIMI_APP_CMS_PREFIX__: cmsPrefix
+  };
+  return body.replace(sentinelPattern(), (m) => values[m] ?? m);
+}
+function sentinelPattern() {
+  SENTINEL_RE ??= new RegExp(IDENTITY_SENTINELS.map((m) => escapeRe(m)).join("|"), "g");
+  SENTINEL_RE.lastIndex = 0;
+  return SENTINEL_RE;
 }
 function sentineledFiles(files) {
   return Object.entries(files).filter(([, body]) => IDENTITY_SENTINELS.some((s) => body.includes(s))).map(([rel]) => rel).sort();
@@ -1699,7 +1710,7 @@ A per-app \`npm i @wix/himalaya\` is optional and only buys your editor local ty
   );
   return finishScaffold({ dir, files, ...kept.length ? { kept: kept.sort() } : {} });
 }
-var PLAN_FILES, PACKAGE_GITIGNORE, MODULE_SOURCE_FILE, TEMPLATES_DIR, SHOWCASE_TEMPLATES_DIR, SHOWCASE_TEMPLATE_NAMES, TEMPLATE_META_FILE, TEMPLATE_ICONS_DIR, HEX_COLOR, PALETTE_KEYS, IDENTITY_SENTINELS, escapeRe, NAME_FIELDS, IDENTITY_FILES, DOTID_RE, BINARY_EXTENSIONS, extOf;
+var PLAN_FILES, PACKAGE_GITIGNORE, MODULE_SOURCE_FILE, TEMPLATES_DIR, SHOWCASE_TEMPLATES_DIR, SHOWCASE_TEMPLATE_NAMES, TEMPLATE_META_FILE, TEMPLATE_ICONS_DIR, HEX_COLOR, PALETTE_KEYS, IDENTITY_SENTINELS, SENTINEL_RE, escapeRe, NAME_FIELDS, IDENTITY_FILES, DOTID_RE, BINARY_EXTENSIONS, extOf;
 var init_scaffold = __esm({
   "src/scaffold.ts"() {
     init_source_deny();
@@ -1728,6 +1739,181 @@ var init_scaffold = __esm({
   }
 });
 
+// ../../core/serve-storage/src/sha256.ts
+function sha256(input) {
+  const bytes2 = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  const bitLen = bytes2.length * 8;
+  const padded = new Uint8Array(((bytes2.length + 9 + 63) / 64 | 0) * 64);
+  padded.set(bytes2);
+  padded[bytes2.length] = 128;
+  const view = new DataView(padded.buffer);
+  view.setUint32(padded.length - 8, Math.floor(bitLen / 4294967296));
+  view.setUint32(padded.length - 4, bitLen >>> 0);
+  let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
+  let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
+  const w = new Uint32Array(64);
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const a0 = w[i - 15];
+      const a1 = w[i - 2];
+      const s0 = (rotr(a0, 7) ^ rotr(a0, 18) ^ a0 >>> 3) >>> 0;
+      const s1 = (rotr(a1, 17) ^ rotr(a1, 19) ^ a1 >>> 10) >>> 0;
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+    }
+    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
+    for (let i = 0; i < 64; i++) {
+      const S1 = (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) >>> 0;
+      const ch = (e & f ^ ~e & g) >>> 0;
+      const t1 = h + S1 + ch + K[i] + w[i] >>> 0;
+      const S0 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) >>> 0;
+      const maj = (a & b ^ a & c ^ b & c) >>> 0;
+      const t2 = S0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    h0 = h0 + a >>> 0;
+    h1 = h1 + b >>> 0;
+    h2 = h2 + c >>> 0;
+    h3 = h3 + d >>> 0;
+    h4 = h4 + e >>> 0;
+    h5 = h5 + f >>> 0;
+    h6 = h6 + g >>> 0;
+    h7 = h7 + h >>> 0;
+  }
+  const out = new Uint8Array(32);
+  const o = new DataView(out.buffer);
+  o.setUint32(0, h0);
+  o.setUint32(4, h1);
+  o.setUint32(8, h2);
+  o.setUint32(12, h3);
+  o.setUint32(16, h4);
+  o.setUint32(20, h5);
+  o.setUint32(24, h6);
+  o.setUint32(28, h7);
+  return out;
+}
+function sha256Hex(input) {
+  return hex(sha256(input));
+}
+async function sha256HexAsync(input) {
+  const bytes2 = typeof input === "string" ? new TextEncoder().encode(input) : input;
+  return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes2)));
+}
+function hex(bytes2) {
+  let s = "";
+  for (const b of bytes2) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+var K, rotr;
+var init_sha256 = __esm({
+  "../../core/serve-storage/src/sha256.ts"() {
+    K = new Uint32Array([
+      1116352408,
+      1899447441,
+      3049323471,
+      3921009573,
+      961987163,
+      1508970993,
+      2453635748,
+      2870763221,
+      3624381080,
+      310598401,
+      607225278,
+      1426881987,
+      1925078388,
+      2162078206,
+      2614888103,
+      3248222580,
+      3835390401,
+      4022224774,
+      264347078,
+      604807628,
+      770255983,
+      1249150122,
+      1555081692,
+      1996064986,
+      2554220882,
+      2821834349,
+      2952996808,
+      3210313671,
+      3336571891,
+      3584528711,
+      113926993,
+      338241895,
+      666307205,
+      773529912,
+      1294757372,
+      1396182291,
+      1695183700,
+      1986661051,
+      2177026350,
+      2456956037,
+      2730485921,
+      2820302411,
+      3259730800,
+      3345764771,
+      3516065817,
+      3600352804,
+      4094571909,
+      275423344,
+      430227734,
+      506948616,
+      659060556,
+      883997877,
+      958139571,
+      1322822218,
+      1537002063,
+      1747873779,
+      1955562222,
+      2024104815,
+      2227730452,
+      2361852424,
+      2428436474,
+      2756734187,
+      3204031479,
+      3329325298
+    ]);
+    rotr = (x, n) => (x >>> n | x << 32 - n) >>> 0;
+  }
+});
+
+// ../../core/serve-storage/src/contract.ts
+function strongEtag(body) {
+  return strongEtagForSha256(sha256Hex(body));
+}
+function strongEtagForSha256(hex2) {
+  return `"${hex2.slice(0, 32)}"`;
+}
+function isSafeSegment(name) {
+  return !name.includes("/") && !name.includes("..") && name.length > 0;
+}
+function isValidAppId(app) {
+  return typeof app === "string" && APP_ID_RE.test(app);
+}
+function assertAppId(app, where) {
+  if (!isValidAppId(app)) {
+    throw new Error(`invalid app id at ${where}: ${JSON.stringify(app)}`);
+  }
+  return app;
+}
+var BUNDLE_CACHE_CONTROL, DOC_CACHE_CONTROL, PINNED_CACHE_CONTROL, APP_ID_RE;
+var init_contract = __esm({
+  "../../core/serve-storage/src/contract.ts"() {
+    init_sha256();
+    BUNDLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
+    DOC_CACHE_CONTROL = "public, max-age=60, stale-while-revalidate=86400";
+    PINNED_CACHE_CONTROL = "public, max-age=31536000, immutable";
+    APP_ID_RE = /^(?=.{1,63}$)[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)?$/;
+  }
+});
+
 // ../../core/ts/src/app-link.ts
 function requirePreviewSegment(value, field) {
   if (!PLAYER_PREVIEW_SEGMENT_PATTERN.test(value)) {
@@ -1790,10 +1976,10 @@ function findingId(source, finding) {
     finding.path ?? finding.at,
     finding.ruleCode ?? finding.code ?? finding.invariant ?? finding.pass
   ].map(asText).join("\0");
-  return `${source}:${sha256Hex(identity).slice(0, 12)}`;
+  return `${source}:${sha256Hex2(identity).slice(0, 12)}`;
 }
 function gapToFinding(gap) {
-  return { ...gap, id: `gap:${gap.kind}:${sha256Hex(gap.key).slice(0, 12)}` };
+  return { ...gap, id: `gap:${gap.kind}:${sha256Hex2(gap.key).slice(0, 12)}` };
 }
 function normalizedFinding(source, finding) {
   return {
@@ -1866,7 +2052,7 @@ function stringField(value) {
 function numberField(value) {
   return typeof value === "number" ? value : void 0;
 }
-function sha256Hex(value) {
+function sha256Hex2(value) {
   const bytes2 = new TextEncoder().encode(value);
   const K2 = [
     1116352408,
@@ -12759,7 +12945,7 @@ async function fetchUpstreamBytes(url) {
   return new Uint8Array(await res.arrayBuffer());
 }
 function writeCachedFace(bytes2) {
-  const hash = sha256Hex2(bytes2);
+  const hash = sha256Hex3(bytes2);
   mkdirSync9(CACHE_DIR, { recursive: true });
   const tmp = join21(CACHE_DIR, `.${hash}.${process.pid}.${Date.now()}.tmp`);
   try {
@@ -12775,7 +12961,7 @@ async function ensureFaceBytes(face, opts = {}) {
   const local = faceSource(face.file, face.sha256);
   if (local) {
     const bytes2 = readFileSync18(local);
-    if (local !== join21(CACHE_DIR, face.sha256) || sha256Hex2(bytes2) === face.sha256) {
+    if (local !== join21(CACHE_DIR, face.sha256) || sha256Hex3(bytes2) === face.sha256) {
       return { ok: true, bytes: bytes2, from: "local" };
     }
   }
@@ -12802,7 +12988,7 @@ async function fetchVerifyAndCache(url, sha2565, fetcher) {
   } catch (err) {
     return { ok: false, reason: `fetching ${url} failed: ${err.message}` };
   }
-  const got = sha256Hex2(bytes2);
+  const got = sha256Hex3(bytes2);
   if (got !== sha2565) {
     return {
       ok: false,
@@ -12862,14 +13048,14 @@ async function catalogFaceBytes(sha2565, opts = {}) {
   }
   return void 0;
 }
-var REPO_ROOT5, VENDORED_DIR, CACHE_DIR, sha256Hex2, RAW, UPSTREAM_DIR, FETCH_TIMEOUT_MS, FAILURE_MEMO_MS, recentFetches;
+var REPO_ROOT5, VENDORED_DIR, CACHE_DIR, sha256Hex3, RAW, UPSTREAM_DIR, FETCH_TIMEOUT_MS, FAILURE_MEMO_MS, recentFetches;
 var init_face_source = __esm({
   "../font-bake/face-source.ts"() {
     init_catalog();
     REPO_ROOT5 = fileURLToPath9(new URL("../..", import.meta.url));
     VENDORED_DIR = process.env.HIMI_FONTS_VENDORED_DIR || join21(REPO_ROOT5, "stdlib", "fonts", "vendored", "wix-madefor");
     CACHE_DIR = join21(process.env.XDG_CACHE_HOME || join21(homedir3(), ".cache"), "himi", "fonts");
-    sha256Hex2 = (bytes2) => createHash6("sha256").update(bytes2).digest("hex");
+    sha256Hex3 = (bytes2) => createHash6("sha256").update(bytes2).digest("hex");
     RAW = ["https://", "raw.", "githubuser", "content.com"].join("");
     UPSTREAM_DIR = /^(ofl|apache|ufl)\/[a-z0-9_-]+$/;
     FETCH_TIMEOUT_MS = 2e4;
@@ -18383,151 +18569,6 @@ var init_wix_gateway = __esm({
   }
 });
 
-// ../../core/serve-storage/src/sha256.ts
-function sha2562(input) {
-  const bytes2 = typeof input === "string" ? new TextEncoder().encode(input) : input;
-  const bitLen = bytes2.length * 8;
-  const padded = new Uint8Array(((bytes2.length + 9 + 63) / 64 | 0) * 64);
-  padded.set(bytes2);
-  padded[bytes2.length] = 128;
-  const view = new DataView(padded.buffer);
-  view.setUint32(padded.length - 8, Math.floor(bitLen / 4294967296));
-  view.setUint32(padded.length - 4, bitLen >>> 0);
-  let h0 = 1779033703, h1 = 3144134277, h2 = 1013904242, h3 = 2773480762;
-  let h4 = 1359893119, h5 = 2600822924, h6 = 528734635, h7 = 1541459225;
-  const w = new Uint32Array(64);
-  for (let off = 0; off < padded.length; off += 64) {
-    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
-    for (let i = 16; i < 64; i++) {
-      const a0 = w[i - 15];
-      const a1 = w[i - 2];
-      const s0 = (rotr(a0, 7) ^ rotr(a0, 18) ^ a0 >>> 3) >>> 0;
-      const s1 = (rotr(a1, 17) ^ rotr(a1, 19) ^ a1 >>> 10) >>> 0;
-      w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
-    }
-    let a = h0, b = h1, c = h2, d = h3, e = h4, f = h5, g = h6, h = h7;
-    for (let i = 0; i < 64; i++) {
-      const S1 = (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) >>> 0;
-      const ch = (e & f ^ ~e & g) >>> 0;
-      const t1 = h + S1 + ch + K[i] + w[i] >>> 0;
-      const S0 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) >>> 0;
-      const maj = (a & b ^ a & c ^ b & c) >>> 0;
-      const t2 = S0 + maj >>> 0;
-      h = g;
-      g = f;
-      f = e;
-      e = d + t1 >>> 0;
-      d = c;
-      c = b;
-      b = a;
-      a = t1 + t2 >>> 0;
-    }
-    h0 = h0 + a >>> 0;
-    h1 = h1 + b >>> 0;
-    h2 = h2 + c >>> 0;
-    h3 = h3 + d >>> 0;
-    h4 = h4 + e >>> 0;
-    h5 = h5 + f >>> 0;
-    h6 = h6 + g >>> 0;
-    h7 = h7 + h >>> 0;
-  }
-  const out = new Uint8Array(32);
-  const o = new DataView(out.buffer);
-  o.setUint32(0, h0);
-  o.setUint32(4, h1);
-  o.setUint32(8, h2);
-  o.setUint32(12, h3);
-  o.setUint32(16, h4);
-  o.setUint32(20, h5);
-  o.setUint32(24, h6);
-  o.setUint32(28, h7);
-  return out;
-}
-function sha256Hex3(input) {
-  return hex(sha2562(input));
-}
-async function sha256HexAsync(input) {
-  const bytes2 = typeof input === "string" ? new TextEncoder().encode(input) : input;
-  return hex(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes2)));
-}
-function hex(bytes2) {
-  let s = "";
-  for (const b of bytes2) s += b.toString(16).padStart(2, "0");
-  return s;
-}
-var K, rotr;
-var init_sha256 = __esm({
-  "../../core/serve-storage/src/sha256.ts"() {
-    K = new Uint32Array([
-      1116352408,
-      1899447441,
-      3049323471,
-      3921009573,
-      961987163,
-      1508970993,
-      2453635748,
-      2870763221,
-      3624381080,
-      310598401,
-      607225278,
-      1426881987,
-      1925078388,
-      2162078206,
-      2614888103,
-      3248222580,
-      3835390401,
-      4022224774,
-      264347078,
-      604807628,
-      770255983,
-      1249150122,
-      1555081692,
-      1996064986,
-      2554220882,
-      2821834349,
-      2952996808,
-      3210313671,
-      3336571891,
-      3584528711,
-      113926993,
-      338241895,
-      666307205,
-      773529912,
-      1294757372,
-      1396182291,
-      1695183700,
-      1986661051,
-      2177026350,
-      2456956037,
-      2730485921,
-      2820302411,
-      3259730800,
-      3345764771,
-      3516065817,
-      3600352804,
-      4094571909,
-      275423344,
-      430227734,
-      506948616,
-      659060556,
-      883997877,
-      958139571,
-      1322822218,
-      1537002063,
-      1747873779,
-      1955562222,
-      2024104815,
-      2227730452,
-      2361852424,
-      2428436474,
-      2756734187,
-      3204031479,
-      3329325298
-    ]);
-    rotr = (x, n) => (x >>> n | x << 32 - n) >>> 0;
-  }
-});
-
 // ../../core/serve-runtime/src/wix-bridge.ts
 function absoluteUrlRejection(path2) {
   let host = "";
@@ -18670,7 +18711,7 @@ var init_wix_bridge = __esm({
        *  header with no session cookie falls back to itself — callers refuse that case before here. */
       key(msid, cookieHeader) {
         const session = /(?:^|;\s*)wixSession2=([^;]*)/.exec(cookieHeader)?.[1] ?? cookieHeader;
-        return sha256Hex3(`${msid}
+        return sha256Hex(`${msid}
 ${session}`);
       }
       async instance(msid, cookieHeader, now = Date.now()) {
@@ -18745,7 +18786,7 @@ ${session}`);
       }
       cache = /* @__PURE__ */ new Map();
       key(cookieHeader, limit) {
-        return sha256Hex3(`${limit}
+        return sha256Hex(`${limit}
 ${cookieHeader}`);
       }
       async sites(cookieHeader, limit, now = Date.now()) {
@@ -21250,7 +21291,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -24851,7 +24891,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -33288,36 +33327,6 @@ var init_errors = __esm({
   }
 });
 
-// ../../core/serve-storage/src/contract.ts
-function strongEtag(body) {
-  return strongEtagForSha256(sha256Hex3(body));
-}
-function strongEtagForSha256(hex2) {
-  return `"${hex2.slice(0, 32)}"`;
-}
-function isSafeSegment(name) {
-  return !name.includes("/") && !name.includes("..") && name.length > 0;
-}
-function isValidAppId(app) {
-  return typeof app === "string" && APP_ID_RE.test(app);
-}
-function assertAppId(app, where) {
-  if (!isValidAppId(app)) {
-    throw new Error(`invalid app id at ${where}: ${JSON.stringify(app)}`);
-  }
-  return app;
-}
-var BUNDLE_CACHE_CONTROL, DOC_CACHE_CONTROL, PINNED_CACHE_CONTROL, APP_ID_RE;
-var init_contract = __esm({
-  "../../core/serve-storage/src/contract.ts"() {
-    init_sha256();
-    BUNDLE_CACHE_CONTROL = "public, max-age=31536000, immutable";
-    DOC_CACHE_CONTROL = "public, max-age=60, stale-while-revalidate=86400";
-    PINNED_CACHE_CONTROL = "public, max-age=31536000, immutable";
-    APP_ID_RE = /^(?=.{1,63}$)[a-z0-9][a-z0-9-]*(?:\.[a-z0-9][a-z0-9-]*)?$/;
-  }
-});
-
 // ../../core/serve-control/src/config.ts
 var config_exports2 = {};
 __export(config_exports2, {
@@ -33630,11 +33639,13 @@ async function readBody2(req) {
 function makeEtag(body) {
   return `"${createHash16("sha256").update(body).digest("hex").slice(0, 32)}"`;
 }
+function servedTokensPath(app) {
+  return app.module.designTokensPath ?? resolve31(app.dir, app.module.config.designTokensPath ?? "tokens.json");
+}
 function readAppTokens(state) {
   if (!state.app) return null;
   try {
-    const tokenPath = state.app.module.designTokensPath ?? resolve31(state.app.dir, state.app.module.config.designTokensPath ?? "tokens.json");
-    const parsed = JSON.parse(readFileSync41(tokenPath, "utf8"));
+    const parsed = JSON.parse(readFileSync41(servedTokensPath(state.app), "utf8"));
     delete parsed._meta;
     return parsed;
   } catch {
@@ -34503,13 +34514,17 @@ async function reloadAppModuleNow(state, opts) {
       state.moduleStore = next.createStore(current.name);
     }
     state.serverCache.clear();
-    const screenIds = [.../* @__PURE__ */ new Set([...oldMeta.screenIds, ...state.app.meta.screenIds])];
-    publishSSE(state, "screen.invalidated", { screenIds, reason: opts.reason });
+    if (opts.invalidateScreens !== false) {
+      const screenIds = [.../* @__PURE__ */ new Set([...oldMeta.screenIds, ...state.app.meta.screenIds])];
+      publishSSE(state, "screen.invalidated", { screenIds, reason: opts.reason });
+    }
     const newNav = JSON.stringify(deriveNavigationConfig(state.app.meta) ?? null);
     if (oldNav !== newNav) {
       publishSSE(state, "config.invalidated", { reason: opts.reason, at: Date.now() });
     }
-    if (idiomOf(next) !== oldIdiom) {
+    const tokensHash = servedTokensHash(state.app);
+    if (idiomOf(next) !== oldIdiom || tokensHash !== state.announcedTokensHash) {
+      state.announcedTokensHash = tokensHash;
       publishSSE(state, "tokens.changed", { reason: opts.reason, at: Date.now() });
     }
     console.log(`[himalaya-dev] reloaded app module in-process: ${current.name} (${opts.reason})`);
@@ -34525,6 +34540,17 @@ async function reloadAppModuleNow(state, opts) {
     }
   }
 }
+function tokensAreDerived(state) {
+  if (!state.app) return false;
+  return resolve31(servedTokensPath(state.app)) !== resolve31(state.app.dir, "tokens.json");
+}
+function servedTokensHash(app) {
+  try {
+    return createHash16("sha256").update(readFileSync41(servedTokensPath(app))).digest("hex");
+  } catch {
+    return "";
+  }
+}
 function classifyAppPath(rel) {
   if (!rel || rel.startsWith("..")) return null;
   if (rel === "tokens.json") return "tokens";
@@ -34550,21 +34576,30 @@ function startAppSourceWatcher(state) {
     pending.clear();
     if (paths.length === 0) return;
     const kinds = new Set(paths.map(classifyAppPath));
-    if (kinds.has("tokens")) {
-      publishSSE(state, "tokens.changed", { reason: "file_changed", at: Date.now() });
-    }
+    const tokensNeedReload = kinds.has("tokens") && tokensAreDerived(state);
     if (kinds.has("appconfig")) {
       publishSSE(state, "config.invalidated", { reason: "file_changed", at: Date.now() });
     }
-    if (kinds.has("module")) {
+    if (kinds.has("module") || tokensNeedReload) {
       reloading = true;
       const recreateStore = paths.some((p) => p.startsWith("data/") || p.startsWith("seed/"));
       try {
-        await reloadAppModule(state, { reason: "source_changed", recreateStore });
+        await reloadAppModule(state, {
+          reason: kinds.has("module") ? "source_changed" : "tokens_changed",
+          recreateStore,
+          invalidateScreens: kinds.has("module")
+        });
       } finally {
         reloading = false;
       }
     }
+    if (kinds.has("tokens") && state.app) {
+      const tokensHash = servedTokensHash(state.app);
+      if (tokensHash !== state.announcedTokensHash) {
+        state.announcedTokensHash = tokensHash;
+        publishSSE(state, "tokens.changed", { reason: "file_changed", at: Date.now() });
+      }
+    }
   };
   try {
     const watcher2 = watch(appDir2, { persistent: false, recursive: true }, (_event, filename) => {
@@ -36003,6 +36038,7 @@ function createDevServer(opts = {}) {
   if (state.hotReloadEnabled) {
     state.bundleWatcher = startBundleArtifactWatcher(state);
     state.bundleSourceWatcher = startBundleSourceWatcher(state);
+    if (state.app) state.announcedTokensHash = servedTokensHash(state.app);
     state.appWatcher = startAppSourceWatcher(state);
   }
   const handleRequest = (req, res) => {
@@ -49475,7 +49511,7 @@ function makeServeHandler(opts) {
   }
   const PINNED_MANIFEST_CACHE_CAP = 100;
   const pinnedManifestCache = /* @__PURE__ */ new Map();
-  const sha256hex = (b) => sha256Hex3(b);
+  const sha256hex = (b) => sha256Hex(b);
   function resolvePin(request, url) {
     return request.headers.get("x-himalaya-release") || url.searchParams.get("release") || null;
   }
@@ -63187,6 +63223,7 @@ async function loadReleaseFromDir(app, dir) {
 // src/cli.ts
 init_scaffold();
 init_store();
+init_contract();
 init_app_link();
 init_himi_report();
 
@@ -63592,7 +63629,7 @@ function screenshotArtifactPath(contentDir2, hash) {
   return join6(resolve6(contentDir2), ".himi", "attestations", "artifacts", `${hash}.png`);
 }
 var GIT_HASH_MAX_BUFFER = 128 * 1024 * 1024;
-var sha256 = (bytes2) => createHash3("sha256").update(bytes2).digest("hex");
+var sha2562 = (bytes2) => createHash3("sha256").update(bytes2).digest("hex");
 function canonical(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
   if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
@@ -63600,21 +63637,21 @@ function canonical(value) {
   return `{${Object.keys(record2).filter((key2) => record2[key2] !== void 0).sort().map((key2) => `${JSON.stringify(key2)}:${canonical(record2[key2])}`).join(",")}}`;
 }
 function releasePayloadHash(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return sha256(canonical(payload));
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return sha2562(canonical(payload));
   const record2 = payload;
   const manifest = record2.manifest;
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return sha256(canonical(payload));
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return sha2562(canonical(payload));
   const manifestRecord = manifest;
   const widgets = manifestRecord.widgets;
-  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return sha256(canonical(payload));
-  return sha256(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets(widgets) } }));
+  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return sha2562(canonical(payload));
+  return sha2562(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets(widgets) } }));
 }
 function withoutSelfHash(attestation) {
   const { selfHash: _selfHash, ...body } = attestation;
   return body;
 }
 function selfHashFor(attestation) {
-  return sha256(canonical(withoutSelfHash(attestation)));
+  return sha2562(canonical(withoutSelfHash(attestation)));
 }
 function repoRoot(contentDir2) {
   try {
@@ -63728,7 +63765,7 @@ function readRetainedAttestations(contentDir2) {
       for (const expected of Object.values(run2.screenshots)) {
         const path2 = screenshotArtifactPath(contentDir2, expected);
         if (!existsSync3(path2)) errors.push(`missing screenshot for retained run ${run2.runId}: ${basename2(path2)}`);
-        else if (sha256(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match retained run ${run2.runId}: ${basename2(path2)}`);
+        else if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match retained run ${run2.runId}: ${basename2(path2)}`);
       }
     }
     const runs = [];
@@ -63787,11 +63824,11 @@ function writeAttestation(input, opts = {}) {
   const previous = readLatestAttestation(contentDir2);
   const runId = `${(opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()}-${(opts.randomSuffix ?? (() => randomBytes(3).toString("hex")))()}`;
   const descriptorHashes = Object.fromEntries(
-    Object.entries(input.descriptors).sort(([a], [b]) => a.localeCompare(b)).map(([screen, bytes2]) => [screen, sha256(bytes2)])
+    Object.entries(input.descriptors).sort(([a], [b]) => a.localeCompare(b)).map(([screen, bytes2]) => [screen, sha2562(bytes2)])
   );
   const screenshotEntries = Object.entries(input.screenshots ?? {}).sort(([a], [b]) => a.localeCompare(b)).filter(([, path2]) => existsSync3(path2)).map(([screen, path2]) => {
     const bytes2 = readFileSync5(path2);
-    return { screen, bytes: bytes2, hash: sha256(bytes2) };
+    return { screen, bytes: bytes2, hash: sha2562(bytes2) };
   });
   const screenshots = Object.fromEntries(screenshotEntries.map(({ screen, hash }) => [screen, hash]));
   for (const { bytes: bytes2, hash } of screenshotEntries) {
@@ -63914,7 +63951,7 @@ function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, r
       errors.push(`missing baked descriptor for ${screen}`);
       continue;
     }
-    if (sha256(bytes2) !== expected) errors.push(`descriptor hash does not match for ${screen}`);
+    if (sha2562(bytes2) !== expected) errors.push(`descriptor hash does not match for ${screen}`);
   }
   for (const [screen, expected] of Object.entries(attestation.screenshots)) {
     const path2 = screenshotArtifactPath(contentDir2, expected);
@@ -63922,7 +63959,7 @@ function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, r
       errors.push(`missing screenshot for ${screen}: ${basename2(path2)}`);
       continue;
     }
-    if (sha256(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match for ${screen}: ${basename2(path2)}`);
+    if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match for ${screen}: ${basename2(path2)}`);
   }
   return { ok: errors.length === 0, errors };
 }
@@ -67557,8 +67594,26 @@ function shellShaDivergenceWarnings(jobs) {
     ([release, built]) => `\u26A0 this build compiles the native shell at ${built.slice(0, 12)}, not release ${release.slice(0, 12)} \u2014 the release was pushed from a branch whose HEAD is not on the default branch, so the Mac pool checks out the nearest default-branch ancestor. A native-shell or tools/mobile-dist/** change on that branch is NOT in this binary even if the job reports SUCCESS; re-push from a checkout whose HEAD is on origin/master to validate it.`
   );
 }
+async function templatePublishName(sourceDir) {
+  const id = await appId(sourceDir);
+  return IDENTITY_SENTINELS.some((s) => id.includes(s)) ? basename14(sourceDir) : id;
+}
+function templateNameError(name, from) {
+  if (name.startsWith(TEMPLATE_APP_PREFIX)) {
+    const stripped = name.slice(TEMPLATE_APP_PREFIX.length);
+    const hint = stripped && !stripped.startsWith(TEMPLATE_APP_PREFIX) && !templateNameError(stripped, from) ? `pass --name ${stripped}` : "pass --name <kebab-id>";
+    return `template name "${name}" (${from}) already starts with "${TEMPLATE_APP_PREFIX}", which would publish to "${TEMPLATE_APP_PREFIX}${name}"; ${hint}`;
+  }
+  if (!TEMPLATE_NAME_PATTERN.test(name)) {
+    return `template name "${name}" (${from}) is not a lowercase kebab id (lowercase letters and digits, hyphens only between them); pass --name <kebab-id> (it becomes ${TEMPLATE_APP_PREFIX}<name>)`;
+  }
+  const composed = TEMPLATE_APP_PREFIX + name;
+  return isValidAppId(composed) ? null : `template name "${name}" (${from}) makes app id "${composed}", which is over the serve plane's app-id length limit; pass a shorter --name`;
+}
 function materializeForPreview(appDir2, slug, displayName) {
   if (!isTemplateSourceTree(appDir2)) return appDir2;
+  const slugError = templateNameError(slug, "preview slug");
+  if (slugError) throw Object.assign(new Error(slugError), { exitCode: 2 });
   const files = readTemplateFiles(appDir2);
   const forBuild = Object.fromEntries(
     Object.entries(files).map(([rel, body]) => [rel, rel === "himalaya.content.json" ? substituteIdentity(body, slug) : body])
@@ -67586,7 +67641,12 @@ function materializeForPreview(appDir2, slug, displayName) {
   const dest = join60(root, `${slug}-${process.pid}`);
   rmSync14(dest, { recursive: true, force: true });
   mkdirSync31(dest, { recursive: true });
-  materializeSource(forBuild, displayName, dest, slug);
+  try {
+    materializeSource(forBuild, displayName, dest, slug);
+  } catch (e) {
+    rmSync14(dest, { recursive: true, force: true });
+    throw e;
+  }
   return dest;
 }
 async function appId(dir) {
@@ -68452,253 +68512,281 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return outcome.code;
         }
         if (sub === "publish") {
-          const appDir2 = resolve47(str6(flags.dir) ?? process.cwd());
-          const sourceDir = resolve47(str6(flags["source-dir"]) ?? appDir2);
-          let meta;
-          try {
-            meta = JSON.parse(readFileSync75(join60(sourceDir, TEMPLATE_META_FILE), "utf8"));
-          } catch {
-            io.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
-            return 2;
-          }
-          if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
-            io.error(JSON.stringify({ error: `${TEMPLATE_META_FILE} must be { title: string, description: string, tags: string[], category?: string }` }));
-            return 2;
-          }
+          const publishScratch = [];
           try {
-            const appearance = extractTemplateAppearance(JSON.parse(readFileSync75(join60(sourceDir, "tokens.json"), "utf8")));
-            meta = { ...appearance, ...meta };
-          } catch {
-          }
-          const name = str6(flags.name) ?? await appId(sourceDir);
-          const templateAppId = TEMPLATE_APP_PREFIX + name;
-          const buildDir = materializeForPreview(appDir2, name, meta.title);
-          const app = await appId(buildDir);
-          const strict = flags.strict === true;
-          const force = flags.force === true;
-          const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
-          const bres = await buildContentForValidation2(buildDir, { resolution: resolutionFlag(flags) });
-          const out = mkdtempSync4(join60(tmpdir5(), "himi-template-"));
-          const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
-          const outcome = await buildReleaseFromContent2(buildDir, out, {
-            ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
-            collect: { lint: true, strict }
-          });
-          const scaffoldSourceFindings = resolve47(sourceDir) === resolve47(appDir2) ? [] : [
-            ...tokenColorIssues(sourceDir),
-            ...surfaceIssues(sourceDir, void 0, strict),
-            ...await fontIssues(sourceDir, strict),
-            ...storesV1Issues(sourceDir, strict)
-          ].map((issue2) => ({
-            ...issue2,
-            // Say WHICH tree. The same message against two trees means two different fixes,
-            // and the scaffold source is the one the author is least likely to be looking at.
-            message: `scaffold source (--source-dir ${sourceDir}): ${issue2.message}`
-          }));
-          const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
-          const { report: report2, hasErrors } = summarizeLint(app, bres, outcome, strict, [
-            ...await cmsIssues(buildDir, app, strict, { local: true }),
-            ...surfaceIssues(buildDir, outcome.surfaceNav, strict),
-            ...tokenColorIssues(buildDir),
-            ...await fontIssues(buildDir, strict),
-            ...storesV1Issues(buildDir, strict),
-            ...await navIssues2(buildDir, strict),
-            ...scaffoldSourceFindings
-          ]);
-          if (hasErrors && !force) {
-            print({ ...report2, published: false, hint: "lint found errors \u2014 fix them, or re-run with --force to publish anyway" });
-            return 1;
-          }
-          const payload = await loadReleaseFromDir(app, out);
-          const previewAuthError = templatePreviewAuthError(payload.appConfig);
-          if (previewAuthError) {
-            io.error(JSON.stringify({ error: previewAuthError, published: false }));
-            return 1;
-          }
-          const leaked = sentineledFiles({
-            ...payload.screens,
-            ...payload.appConfig ? { "app-config.json": payload.appConfig } : {},
-            ...payload.tokens ? { "tokens.json": payload.tokens } : {}
-          });
-          if (leaked.length > 0) {
-            io.error(JSON.stringify({
-              error: `built release still contains __HIMI_APP_*__ scaffold markers in: ${leaked.join(", ")}`,
-              hint: "point --dir at a concrete app (e.g. apps/himi-branded-lite), or fix the template so its identity fields are sentineled only in files himi init substitutes"
-            }));
-            return 1;
-          }
-          const iconPath = str6(flags.icon) ? resolve47(str6(flags.icon)) : templateIconPath(name);
-          let iconHash;
-          if (iconPath) {
+            for (const f of ["dir", "source-dir", "name", "icon"]) {
+              if (flags[f] === true) {
+                io.error(JSON.stringify({ error: `--${f} needs a value`, published: false }));
+                return 2;
+              }
+            }
+            const appDir2 = resolve47(str6(flags.dir) ?? process.cwd());
+            const sourceDir = resolve47(str6(flags["source-dir"]) ?? appDir2);
+            let meta;
             try {
-              const bytes2 = readFileSync75(iconPath);
-              payload.icon = bytes2.toString("base64");
-              iconHash = createHash27("sha256").update(bytes2).digest("hex");
+              meta = JSON.parse(readFileSync75(join60(sourceDir, TEMPLATE_META_FILE), "utf8"));
             } catch {
+              io.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
+              return 2;
             }
-          }
-          payload.app = templateAppId;
-          payload.manifest = { ...payload.manifest, app: templateAppId, ...iconHash ? { iconHash } : {} };
-          const files = sentinelizeArchive(readTemplateFiles(sourceDir), app);
-          if (Object.keys(files).length === 0) {
-            io.error(JSON.stringify({ error: `no source files collected from ${sourceDir}` }));
-            return 1;
-          }
-          payload.source = { files, meta };
-          const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, largestEntries: largestEntries2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
-          const templateArchive = collectAppSource2(sourceDir);
-          const templateSecrets = secretFindings2(templateArchive.entries);
-          if (templateSecrets.length > 0) {
-            io.error(JSON.stringify({
-              error: `refusing to publish: ${templateSecrets[0].path} looks like it contains ${templateSecrets[0].reason}`,
-              file: templateSecrets[0].path,
-              hint: "a template's source is served PUBLICLY \u2014 remove it from the tree before publishing"
-            }));
-            return 1;
-          }
-          const templateZip = zipAppSource2(templateArchive.entries);
-          const templateSourceB64 = templateZip.toString("base64");
-          if (templateSourceB64.length > MAX_APP_SOURCE_BYTES2) {
-            const templateLargest = largestEntries2(templateArchive.entries);
-            io.error(JSON.stringify({
-              ok: false,
-              template: name,
-              app: templateAppId,
-              published: false,
-              error: "app_source_too_large",
-              archivedBytes: templateZip.length,
-              encodedBytes: templateSourceB64.length,
-              limit: MAX_APP_SOURCE_BYTES2,
-              files: templateArchive.entries.length,
-              largest: templateLargest,
-              // No `--no-source` here, deliberately: a template's archive is not optional the way
-              // a push's is. `himi pull` restores templates through it, so a flag that dropped it
-              // would publish a template nobody can restore — the failure #2423 exists to prevent.
-              hint: `trim the template's source tree \u2014 the largest entries are ${templateLargest.map((e) => `${e.path} (${Math.round(e.compressed / 1024)} KB compressed)`).join(", ")}. Build output and dependencies are already excluded, and a template's archive is not optional, so there is no flag that publishes without it`
-            }));
-            return 1;
-          }
-          payload.appSource = templateSourceB64;
-          const tplVis = visibilityFlag(flags, io);
-          if (!tplVis) return 2;
-          const publishMeta = {
-            ...str6(flags.label) ? { label: str6(flags.label) } : {},
-            ...str6(flags.notes) ? { notes: str6(flags.notes) } : {},
-            ...tplVis.value ? { visibility: tplVis.value } : {}
-          };
-          let sendPayload = payload;
-          let templateBodyBytes = publishReleaseBodyBytes(payload, publishMeta);
-          let sourceGzChars;
-          if (templateBodyBytes > MAX_PUBLISH_BODY_BYTES) {
-            const { gzipSync: gzipSync2 } = await import("node:zlib");
-            const { source: plainSource, ...rest } = payload;
-            const sourceGz = gzipSync2(Buffer.from(JSON.stringify(plainSource), "utf8"), { level: 9 }).toString("base64");
-            sourceGzChars = sourceGz.length;
-            const gzipped = { ...rest, sourceGz };
-            const gzBytes = publishReleaseBodyBytes(gzipped, publishMeta);
-            if (gzBytes <= MAX_PUBLISH_BODY_BYTES) {
-              sendPayload = gzipped;
-              templateBodyBytes = gzBytes;
+            if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
+              io.error(JSON.stringify({ error: `${TEMPLATE_META_FILE} must be { title: string, description: string, tags: string[], category?: string }` }));
+              return 2;
             }
-          }
-          if (templateBodyBytes > MAX_PUBLISH_BODY_BYTES) {
-            io.error(JSON.stringify({
-              ok: false,
-              template: name,
-              app: templateAppId,
-              published: false,
-              error: "publish_body_too_large",
-              bodyBytes: templateBodyBytes,
-              limit: MAX_PUBLISH_BODY_BYTES,
-              // Both halves, because "the body is too big" does not say which one to cut, and the
-              // two answer to different edits: `sourceChars` shrinks by removing FILES from the
-              // tree, `appSourceBytes` by removing bytes (an image, a fixture) that may not be
-              // text at all. They overlap by design — the same tree, twice — so they are reported
-              // separately rather than summed into a figure that double-counts it.
-              sourceChars: JSON.stringify(payload.source).length,
-              appSourceBytes: templateSourceB64.length,
-              // The catalog view is reported COMPRESSED as well, because "trim the tree" was the
-              // wrong instruction and cost real time: the collector already drops binaries,
-              // symlinks and dist/node_modules/.git/.himi, so there is rarely anything to trim.
-              // What the two figures actually say is whether compression can still save you --
-              // `sourceGzChars` is what this publish already tried and what remains after it.
-              sourceGzChars,
-              hint: "the catalog view is already sent gzipped when the plain body would not fit, and it still does not: the remainder is the release itself (screens, bundles, assets) plus the private archive, which no flag omits. Cut what the app ships, not the source tree \u2014 the collector already excludes binaries, symlinks, dist/, node_modules/, .git/ and .himi/."
+            try {
+              const appearance = extractTemplateAppearance(JSON.parse(readFileSync75(join60(sourceDir, "tokens.json"), "utf8")));
+              meta = { ...appearance, ...meta };
+            } catch {
+            }
+            const nameFlag = str6(flags.name);
+            const name = nameFlag ?? await templatePublishName(sourceDir);
+            const nameError = templateNameError(
+              name,
+              nameFlag !== void 0 ? "from --name" : `from ${sourceDir}'s himalaya.content.json, or its directory name when that is a scaffold marker`
+            );
+            if (nameError) {
+              io.error(JSON.stringify({ error: nameError, published: false }));
+              return 2;
+            }
+            const templateAppId = TEMPLATE_APP_PREFIX + name;
+            const buildDir = materializeForPreview(appDir2, name, meta.title);
+            if (buildDir !== appDir2) publishScratch.push(buildDir);
+            const app = await appId(buildDir);
+            const strict = flags.strict === true;
+            const force = flags.force === true;
+            const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
+            const bres = await buildContentForValidation2(buildDir, { resolution: resolutionFlag(flags) });
+            const out = mkdtempSync4(join60(tmpdir5(), "himi-template-"));
+            publishScratch.push(out);
+            const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
+            const outcome = await buildReleaseFromContent2(buildDir, out, {
+              ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
+              collect: { lint: true, strict }
+            });
+            const scaffoldSourceFindings = resolve47(sourceDir) === resolve47(appDir2) ? [] : [
+              ...tokenColorIssues(sourceDir),
+              ...surfaceIssues(sourceDir, void 0, strict),
+              ...await fontIssues(sourceDir, strict),
+              ...storesV1Issues(sourceDir, strict)
+            ].map((issue2) => ({
+              ...issue2,
+              // Say WHICH tree. The same message against two trees means two different fixes,
+              // and the scaffold source is the one the author is least likely to be looking at.
+              message: `scaffold source (--source-dir ${sourceDir}): ${issue2.message}`
             }));
-            return 1;
-          }
-          if (sendPayload.sourceGz) {
-            const { gzipSync: gz } = await import("node:zlib");
-            const probeApp = templateAppId;
-            let probeErr;
+            const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
+            const { report: report2, hasErrors } = summarizeLint(app, bres, outcome, strict, [
+              ...await cmsIssues(buildDir, app, strict, { local: true }),
+              ...surfaceIssues(buildDir, outcome.surfaceNav, strict),
+              ...tokenColorIssues(buildDir),
+              ...await fontIssues(buildDir, strict),
+              ...storesV1Issues(buildDir, strict),
+              ...await navIssues2(buildDir, strict),
+              ...scaffoldSourceFindings
+            ]);
+            if (hasErrors && !force) {
+              print({ ...report2, published: false, hint: "lint found errors \u2014 fix them, or re-run with --force to publish anyway" });
+              return 1;
+            }
+            const payload = await loadReleaseFromDir(app, out);
+            const previewAuthError = templatePreviewAuthError(payload.appConfig);
+            if (previewAuthError) {
+              io.error(JSON.stringify({ error: previewAuthError, published: false }));
+              return 1;
+            }
+            const leaked = sentineledFiles({
+              ...payload.screens,
+              ...payload.appConfig ? { "app-config.json": payload.appConfig } : {},
+              ...payload.tokens ? { "tokens.json": payload.tokens } : {}
+            });
+            if (leaked.length > 0) {
+              io.error(JSON.stringify({
+                error: `built release still contains __HIMI_APP_*__ scaffold markers in: ${leaked.join(", ")}`,
+                hint: "point --dir at a concrete app (e.g. apps/himi-branded-lite), or fix the template so its identity fields are sentineled only in files himi init substitutes"
+              }));
+              return 1;
+            }
+            const iconPath = str6(flags.icon) ? resolve47(str6(flags.icon)) : templateIconPath(name);
+            let iconHash;
+            if (iconPath) {
+              try {
+                const bytes2 = readFileSync75(iconPath);
+                payload.icon = bytes2.toString("base64");
+                iconHash = createHash27("sha256").update(bytes2).digest("hex");
+              } catch {
+              }
+            }
+            payload.app = templateAppId;
+            payload.manifest = { ...payload.manifest, app: templateAppId, ...iconHash ? { iconHash } : {} };
+            const files = sentinelizeArchive(readTemplateFiles(sourceDir), app);
+            if (Object.keys(files).length === 0) {
+              io.error(JSON.stringify({ error: `no source files collected from ${sourceDir}` }));
+              return 1;
+            }
+            payload.source = { files, meta };
+            const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, largestEntries: largestEntries2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
+            const templateArchive = collectAppSource2(sourceDir);
+            const templateSecrets = secretFindings2(templateArchive.entries);
+            if (templateSecrets.length > 0) {
+              io.error(JSON.stringify({
+                error: `refusing to publish: ${templateSecrets[0].path} looks like it contains ${templateSecrets[0].reason}`,
+                file: templateSecrets[0].path,
+                hint: "a template's source is served PUBLICLY \u2014 remove it from the tree before publishing"
+              }));
+              return 1;
+            }
+            const templateZip = zipAppSource2(templateArchive.entries);
+            const templateSourceB64 = templateZip.toString("base64");
+            if (templateSourceB64.length > MAX_APP_SOURCE_BYTES2) {
+              const templateLargest = largestEntries2(templateArchive.entries);
+              io.error(JSON.stringify({
+                ok: false,
+                template: name,
+                app: templateAppId,
+                published: false,
+                error: "app_source_too_large",
+                archivedBytes: templateZip.length,
+                encodedBytes: templateSourceB64.length,
+                limit: MAX_APP_SOURCE_BYTES2,
+                files: templateArchive.entries.length,
+                largest: templateLargest,
+                // No `--no-source` here, deliberately: a template's archive is not optional the way
+                // a push's is. `himi pull` restores templates through it, so a flag that dropped it
+                // would publish a template nobody can restore — the failure #2423 exists to prevent.
+                hint: `trim the template's source tree \u2014 the largest entries are ${templateLargest.map((e) => `${e.path} (${Math.round(e.compressed / 1024)} KB compressed)`).join(", ")}. Build output and dependencies are already excluded, and a template's archive is not optional, so there is no flag that publishes without it`
+              }));
+              return 1;
+            }
+            payload.appSource = templateSourceB64;
+            const tplVis = visibilityFlag(flags, io);
+            if (!tplVis) return 2;
+            const publishMeta = {
+              ...str6(flags.label) ? { label: str6(flags.label) } : {},
+              ...str6(flags.notes) ? { notes: str6(flags.notes) } : {},
+              ...tplVis.value ? { visibility: tplVis.value } : {}
+            };
+            let sendPayload = payload;
+            let templateBodyBytes = publishReleaseBodyBytes(payload, publishMeta);
+            let sourceGzChars;
+            if (templateBodyBytes > MAX_PUBLISH_BODY_BYTES) {
+              const { gzipSync: gzipSync2 } = await import("node:zlib");
+              const { source: plainSource, ...rest } = payload;
+              const sourceGz = gzipSync2(Buffer.from(JSON.stringify(plainSource), "utf8"), { level: 9 }).toString("base64");
+              sourceGzChars = sourceGz.length;
+              const gzipped = { ...rest, sourceGz };
+              const gzBytes = publishReleaseBodyBytes(gzipped, publishMeta);
+              if (gzBytes <= MAX_PUBLISH_BODY_BYTES) {
+                sendPayload = gzipped;
+                templateBodyBytes = gzBytes;
+              }
+            }
+            if (templateBodyBytes > MAX_PUBLISH_BODY_BYTES) {
+              io.error(JSON.stringify({
+                ok: false,
+                template: name,
+                app: templateAppId,
+                published: false,
+                error: "publish_body_too_large",
+                bodyBytes: templateBodyBytes,
+                limit: MAX_PUBLISH_BODY_BYTES,
+                // Both halves, because "the body is too big" does not say which one to cut, and the
+                // two answer to different edits: `sourceChars` shrinks by removing FILES from the
+                // tree, `appSourceBytes` by removing bytes (an image, a fixture) that may not be
+                // text at all. They overlap by design — the same tree, twice — so they are reported
+                // separately rather than summed into a figure that double-counts it.
+                sourceChars: JSON.stringify(payload.source).length,
+                appSourceBytes: templateSourceB64.length,
+                // The catalog view is reported COMPRESSED as well, because "trim the tree" was the
+                // wrong instruction and cost real time: the collector already drops binaries,
+                // symlinks and dist/node_modules/.git/.himi, so there is rarely anything to trim.
+                // What the two figures actually say is whether compression can still save you --
+                // `sourceGzChars` is what this publish already tried and what remains after it.
+                sourceGzChars,
+                hint: "the catalog view is already sent gzipped when the plain body would not fit, and it still does not: the remainder is the release itself (screens, bundles, assets) plus the private archive, which no flag omits. Cut what the app ships, not the source tree \u2014 the collector already excludes binaries, symlinks, dist/, node_modules/, .git/ and .himi/."
+              }));
+              return 1;
+            }
+            if (sendPayload.sourceGz) {
+              const { gzipSync: gz } = await import("node:zlib");
+              const probeApp = templateAppId;
+              let probeErr;
+              try {
+                const probe = await client2().publishRelease({
+                  app: probeApp,
+                  manifest: { releaseId: "preflight", gitSha: "0".repeat(40), app: probeApp, minBinaryVersion: null, screens: {}, bundles: {} },
+                  screens: {},
+                  sourceGz: gz(Buffer.from("null")).toString("base64")
+                });
+                probeErr = probe.json?.error ?? probe.status;
+              } catch (e) {
+                const target = targetName();
+                io.error(JSON.stringify(serveUnreachableError(target, serveBase(), e.message)));
+                return 1;
+              }
+              if (probeErr !== "source_gz_not_an_object") {
+                io.error(JSON.stringify({
+                  ok: false,
+                  template: name,
+                  app: templateAppId,
+                  published: false,
+                  error: "serve_plane_lacks_source_gz",
+                  probe: probeErr,
+                  bodyBytes: templateBodyBytes,
+                  limit: MAX_PUBLISH_BODY_BYTES,
+                  hint: `this template only fits with a compressed catalog view, and this plane does not accept one \u2014 it answered ${JSON.stringify(probeErr)} to the capability probe instead of "source_gz_not_an_object". NOTHING was published. Upgrade the serve plane and run this again.`
+                }));
+                return 1;
+              }
+            }
+            let r;
             try {
-              const probe = await client2().publishRelease({
-                app: probeApp,
-                manifest: { releaseId: "preflight", gitSha: "0".repeat(40), app: probeApp, minBinaryVersion: null, screens: {}, bundles: {} },
-                screens: {},
-                sourceGz: gz(Buffer.from("null")).toString("base64")
-              });
-              probeErr = probe.json?.error ?? probe.status;
+              r = await client2().publishRelease(sendPayload, publishMeta);
             } catch (e) {
               const target = targetName();
               io.error(JSON.stringify(serveUnreachableError(target, serveBase(), e.message)));
               return 1;
             }
-            if (probeErr !== "source_gz_not_an_object") {
+            if (!r.ok) {
+              print({ ok: false, status: r.status, body: r.json ?? r.text });
+              return 1;
+            }
+            if (sendPayload.sourceGz && r.json?.template !== true) {
               io.error(JSON.stringify({
                 ok: false,
                 template: name,
                 app: templateAppId,
                 published: false,
-                error: "serve_plane_lacks_source_gz",
-                probe: probeErr,
-                bodyBytes: templateBodyBytes,
-                limit: MAX_PUBLISH_BODY_BYTES,
-                hint: `this template only fits with a compressed catalog view, and this plane does not accept one \u2014 it answered ${JSON.stringify(probeErr)} to the capability probe instead of "source_gz_not_an_object". NOTHING was published. Upgrade the serve plane and run this again.`
+                error: "serve_plane_ignored_source_gz",
+                hint: `this plane accepted the publish but did not score it as a template, which means it predates compressed catalog views (\`sourceGz\`). A release WAS created for ${templateAppId} as an ordinary app \u2014 it carries no template source and will not appear in \`himi template list --remote\`. Upgrade the serve plane, then publish again; the republish repairs it.`
               }));
               return 1;
             }
-          }
-          let r;
-          try {
-            r = await client2().publishRelease(sendPayload, publishMeta);
-          } catch (e) {
-            const target = targetName();
-            io.error(JSON.stringify(serveUnreachableError(target, serveBase(), e.message)));
-            return 1;
-          }
-          if (!r.ok) {
-            print({ ok: false, status: r.status, body: r.json ?? r.text });
-            return 1;
-          }
-          if (sendPayload.sourceGz && r.json?.template !== true) {
-            io.error(JSON.stringify({
-              ok: false,
+            const releaseId = r.json?.releaseId ?? payload.manifest.releaseId;
+            const targetFlag = str6(flags.target) ? ` --target ${str6(flags.target)}` : "";
+            print({
+              ok: true,
               template: name,
               app: templateAppId,
-              published: false,
-              error: "serve_plane_ignored_source_gz",
-              hint: `this plane accepted the publish but did not score it as a template, which means it predates compressed catalog views (\`sourceGz\`). A release WAS created for ${templateAppId} as an ordinary app \u2014 it carries no template source and will not appear in \`himi template list --remote\`. Upgrade the serve plane, then publish again; the republish repairs it.`
-            }));
-            return 1;
+              releaseId,
+              title: meta.title,
+              tags: meta.tags,
+              icon: Boolean(iconHash),
+              ...meta.accent ? { accent: meta.accent } : {},
+              ...meta.palette ? { palette: meta.palette } : {},
+              sourceFiles: Object.keys(files).length,
+              ...hasErrors && force ? { forcedPastErrors: true } : {},
+              initWith: `himi init <new-app-name> --template ${name} --remote${targetFlag}`
+            });
+            return 0;
+          } finally {
+            for (const dir of publishScratch) {
+              try {
+                rmSync14(dir, { recursive: true, force: true });
+              } catch (e) {
+                io.error(JSON.stringify({ warning: `could not remove temp dir ${dir}: ${e.message}` }));
+              }
+            }
           }
-          const releaseId = r.json?.releaseId ?? payload.manifest.releaseId;
-          const targetFlag = str6(flags.target) ? ` --target ${str6(flags.target)}` : "";
-          print({
-            ok: true,
-            template: name,
-            app: templateAppId,
-            releaseId,
-            title: meta.title,
-            tags: meta.tags,
-            icon: Boolean(iconHash),
-            ...meta.accent ? { accent: meta.accent } : {},
-            ...meta.palette ? { palette: meta.palette } : {},
-            sourceFiles: Object.keys(files).length,
-            ...hasErrors && force ? { forcedPastErrors: true } : {},
-            initWith: `himi init <new-app-name> --template ${name} --remote${targetFlag}`
-          });
-          return 0;
         }
         io.error(JSON.stringify({ error: "template needs a subcommand", usage: "himi template list [--remote] | himi template prompt <name> | himi template publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--target <t>] | himi template trim --keep <id,id,\u2026> [--content <dir>] [--links follow|drop] [--dry-run] [--force]" }));
         return 2;
@@ -73486,7 +73574,9 @@ export {
   spawnUpdateRefresh,
   staleUpdateLockFile,
   switchFlagErrors,
+  templateNameError,
   templatePreviewAuthError,
+  templatePublishName,
   tokenCoversApp,
   trustedConfiguredRegistry,
   updateCachePath,

package/guides/templates.md

@@ -116,6 +116,22 @@ himi template publish --target bo                    # from the app dir
 himi template publish --dir <app> --source-dir <dir> --name <name> --target bo
 ```
 
+A **template tree that still carries the `__HIMI_APP_NAME__` placeholder** (a generated
+template, as `himi init` receives it) publishes with `--dir` alone:
+
+```sh
+himi template publish --dir <template-dir> --target bo
+```
+
+Its `himalaya.content.json` name is the placeholder, so the template name comes from the
+**directory name**, and the preview is built from a substituted copy titled with the template's
+own `title`. Pass `--name` only to publish under a different name. Every name, given or
+derived, must be a lowercase kebab id short enough to fit once `himi-template-` is prefixed; a
+name that fails is refused before anything is built.
+
+A published template does not follow its source: after changing a template, publish it again so
+`himi template list --remote` and `himi init … --remote` serve the new version.
+
 `publish` builds a previewable release from the app and attaches the editable scaffold source,
 sentinel-izing identity so it re-parameterizes on the next `himi init`. It then appears in
 `himi template list --remote` and is scaffoldable with `himi init … --remote`. (Only the app

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1042.0",
+  "version": "0.1044.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "d80f9cca0922b2f864a60197972f9e23f2e17ddc1e40669cdf7a63a6"
+  "falconPackageHash": "7c2534e837382316a3416a0e6225572fbc86b02c8b5b35cea3d7530b"
 }