@wix/himalaya-cli 0.1052.0 → 0.1054.0

package/dist/cli.mjs

@@ -2182,6 +2182,282 @@ var init_widget_identity = __esm({
   }
 });
 
+// ../../core/admin-web/src/utils/qr.ts
+function rawDataModules(ver) {
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7) result -= 36;
+  }
+  return result;
+}
+function byteCapacity(ver) {
+  const lenBits = ver < 10 ? 8 : 16;
+  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
+}
+function fitVersion(len) {
+  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
+  return void 0;
+}
+function rsDivisor(degree) {
+  const result = new Array(degree).fill(0);
+  result[degree - 1] = 1;
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < degree; j++) {
+      result[j] = gfMul(result[j], root);
+      if (j + 1 < degree) result[j] ^= result[j + 1];
+    }
+    root = gfMul(root, 2);
+  }
+  return result;
+}
+function rsRemainder(data, degree) {
+  const divisor = rsDivisor(degree);
+  const res = new Array(degree).fill(0);
+  for (const b of data) {
+    const factor = b ^ res.shift();
+    res.push(0);
+    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
+  }
+  return res;
+}
+function encodeData(bytes2, ver) {
+  const bits = [];
+  const push = (val, len) => {
+    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
+  };
+  push(4, 4);
+  push(bytes2.length, ver < 10 ? 8 : 16);
+  for (const b of bytes2) push(b, 8);
+  const capacityBits = dataCodewords(ver) * 8;
+  push(0, Math.min(4, capacityBits - bits.length));
+  while (bits.length % 8 !== 0) bits.push(0);
+  const out = [];
+  for (let i = 0; i < bits.length; i += 8) {
+    let byte2 = 0;
+    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
+    out.push(byte2);
+  }
+  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
+  return out;
+}
+function interleave(data, ver) {
+  const numBlocks = NUM_BLOCKS_L[ver];
+  const eccLen = ECC_PER_BLOCK_L[ver];
+  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
+  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
+  const blocks = [];
+  const eccs = [];
+  let off = 0;
+  for (let i = 0; i < numBlocks; i++) {
+    const len = shortLen + (i < numShort ? 0 : 1);
+    const blk = data.slice(off, off + len);
+    off += len;
+    blocks.push(blk);
+    eccs.push(rsRemainder(blk, eccLen));
+  }
+  const out = [];
+  for (let i = 0; i < shortLen + 1; i++) {
+    for (let b = 0; b < numBlocks; b++) {
+      const v = blocks[b][i];
+      if (v !== void 0) out.push(v);
+    }
+  }
+  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
+  return out;
+}
+function alignmentPositions(ver) {
+  if (ver === 1) return [];
+  const num3 = Math.floor(ver / 7) + 2;
+  const size = ver * 4 + 17;
+  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
+  const res = [6];
+  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
+  return res;
+}
+function bchFormat(data) {
+  let rem = data;
+  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
+  return (data << 10 | rem) ^ 21522;
+}
+function bchVersion(ver) {
+  let rem = ver;
+  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
+  return ver << 12 | rem;
+}
+function penalty(m, size) {
+  let score = 0;
+  const run2 = (get) => {
+    for (let i = 0; i < size; i++) {
+      let last = get(i, 0), len = 1;
+      for (let j = 1; j < size; j++) {
+        const cur = get(i, j);
+        if (cur === last) {
+          len++;
+          if (len === 5) score += 3;
+          else if (len > 5) score++;
+        } else {
+          last = cur;
+          len = 1;
+        }
+      }
+    }
+  };
+  run2((i, j) => m[i][j]);
+  run2((i, j) => m[j][i]);
+  for (let y = 0; y < size - 1; y++)
+    for (let x = 0; x < size - 1; x++) {
+      const c = m[y][x];
+      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
+    }
+  let dark = 0;
+  for (const row of m) for (const c of row) if (c) dark++;
+  const total = size * size;
+  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
+  return score;
+}
+function encodeQr(text5) {
+  const bytes2 = [...new TextEncoder().encode(text5)];
+  const version2 = fitVersion(bytes2.length);
+  if (!version2) {
+    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
+  }
+  const codewords = interleave(encodeData(bytes2, version2), version2);
+  const size = version2 * 4 + 17;
+  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
+  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
+  const set = (x, y, dark) => {
+    modules[y][x] = dark;
+    reserved[y][x] = true;
+  };
+  const finder = (cx, cy) => {
+    for (let dy = -4; dy <= 4; dy++)
+      for (let dx = -4; dx <= 4; dx++) {
+        const x = cx + dx, y = cy + dy;
+        if (x < 0 || y < 0 || x >= size || y >= size) continue;
+        const d = Math.max(Math.abs(dx), Math.abs(dy));
+        set(x, y, d !== 2 && d !== 4);
+      }
+  };
+  finder(3, 3);
+  finder(size - 4, 3);
+  finder(3, size - 4);
+  for (let i = 8; i < size - 8; i++) {
+    set(i, 6, i % 2 === 0);
+    set(6, i, i % 2 === 0);
+  }
+  for (const ay of alignmentPositions(version2))
+    for (const ax of alignmentPositions(version2)) {
+      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
+      for (let dy = -2; dy <= 2; dy++)
+        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
+    }
+  for (let i = 0; i < 9; i++) {
+    reserved[i][8] = true;
+    reserved[8][i] = true;
+  }
+  for (let i = 0; i < 8; i++) {
+    reserved[size - 1 - i][8] = true;
+    reserved[8][size - 1 - i] = true;
+  }
+  set(8, size - 8, true);
+  if (version2 >= 7)
+    for (let i = 0; i < 18; i++) {
+      const a = size - 11 + i % 3, b = Math.floor(i / 3);
+      reserved[a][b] = true;
+      reserved[b][a] = true;
+    }
+  let bit = 0;
+  const totalBits = codewords.length * 8;
+  for (let right = size - 1; right >= 1; right -= 2) {
+    if (right === 6) right = 5;
+    for (let vert = 0; vert < size; vert++) {
+      for (let j = 0; j < 2; j++) {
+        const x = right - j;
+        const upward = (right + 1 & 2) === 0;
+        const y = upward ? size - 1 - vert : vert;
+        if (reserved[y][x]) continue;
+        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
+        bit++;
+      }
+    }
+  }
+  let best = null, bestMask = 0, bestScore = Infinity;
+  for (let mask = 0; mask < 8; mask++) {
+    const cand = modules.map((row) => [...row]);
+    for (let y = 0; y < size; y++)
+      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
+    applyFormat(cand, size, mask);
+    if (version2 >= 7) applyVersion(cand, size, version2);
+    const s = penalty(cand, size);
+    if (s < bestScore) {
+      bestScore = s;
+      best = cand;
+      bestMask = mask;
+    }
+  }
+  return { size, version: version2, mask: bestMask, modules: best };
+}
+function applyFormat(m, size, mask) {
+  const bits = bchFormat(1 << 3 | mask);
+  const on3 = (i) => (bits >>> i & 1) === 1;
+  const put = (x, y, dark) => {
+    m[y][x] = dark;
+  };
+  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
+  put(8, 7, on3(6));
+  put(8, 8, on3(7));
+  put(7, 8, on3(8));
+  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
+  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
+  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
+  put(8, size - 8, true);
+}
+function applyVersion(m, size, version2) {
+  const bits = bchVersion(version2);
+  for (let i = 0; i < 18; i++) {
+    const on3 = (bits >>> i & 1) === 1;
+    const a = size - 11 + i % 3, b = Math.floor(i / 3);
+    m[a][b] = on3;
+    m[b][a] = on3;
+  }
+}
+var ECC_PER_BLOCK_L, NUM_BLOCKS_L, QR_MAX_VERSION, totalCodewords, dataCodewords, EXP, LOG, gfMul, MASKS;
+var init_qr = __esm({
+  "../../core/admin-web/src/utils/qr.ts"() {
+    ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
+    NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
+    QR_MAX_VERSION = 20;
+    totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
+    dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
+    EXP = new Uint8Array(512);
+    LOG = new Uint8Array(256);
+    (() => {
+      let x = 1;
+      for (let i = 0; i < 255; i++) {
+        EXP[i] = x;
+        LOG[x] = i;
+        x <<= 1;
+        if (x & 256) x ^= 285;
+      }
+      for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
+    })();
+    gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
+    MASKS = [
+      (x, y) => (x + y) % 2 === 0,
+      (_x, y) => y % 2 === 0,
+      (x) => x % 3 === 0,
+      (x, y) => (x + y) % 3 === 0,
+      (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
+      (x, y) => x * y % 2 + x * y % 3 === 0,
+      (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
+      (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
+    ];
+  }
+});
+
 // ../../core/dev-server/src/wix-placeholders.ts
 var PLACEHOLDER_CLIENT_ID;
 var init_wix_placeholders = __esm({
@@ -4274,8 +4550,9 @@ function confinedHost(ts2, contentDir2, options) {
   host.writeFile = (fileName) => {
     throw new Error(`Tier-5 typecheck attempted to write ${fileName} under noEmit \u2014 refusing`);
   };
-  if (host.createDirectory) {
-    host.createDirectory = (dir) => {
+  const writable = host;
+  if (writable.createDirectory) {
+    writable.createDirectory = (dir) => {
       throw new Error(`Tier-5 typecheck attempted to create ${dir} under noEmit \u2014 refusing`);
     };
   }
@@ -5603,6 +5880,7 @@ function walk(node, registry, path2, out) {
 var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
+    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
   }
@@ -5629,6 +5907,7 @@ function resolveTranslation(value, catalog, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
+    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s) => s !== "t").join("|")})\\b|^\\$t:`
@@ -11360,6 +11639,7 @@ function resolveIdiom(tokens, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -13865,7 +14145,7 @@ function listReport(opts = {}) {
   for (const [name, sys] of Object.entries(catalog.system)) {
     families.push({ family: name, category: sys.category ?? "serif", variable: false, weights: "platform", kb: 0, license: "system" });
   }
-  return { ok: true, count: families.length, totalBytes, families };
+  return { ok: true, count: families.length, totalBytes, problems: [], families };
 }
 async function fontFindings(appDir2, opts = {}) {
   const tokensPath = join22(appDir2, configuredTokensPath(appDir2).path ?? "tokens.json");
@@ -16991,6 +17271,12 @@ var init_agent_context = __esm({
 });
 
 // ../../core/dev-server/src/app-module.ts
+function isFunctionsOnlyConfig(config) {
+  return config.kind === "functions";
+}
+function uiConfig(config) {
+  return config ?? {};
+}
 function deriveAppMeta(name, m, platforms = {}) {
   const config = m.config;
   return {
@@ -17272,7 +17558,10 @@ async function loadContainedDevModule(name, entry, dir) {
       "the contained dev-module realm is not installed, so the upload's dev/index.ts would have been imported into the host realm (which is not a security boundary)"
     );
   }
-  const { buildContainedDevModule: buildContainedDevModule2, CONTAINED_DEV_MODULE_SERVICE: CONTAINED_DEV_MODULE_SERVICE2, CONTAINED_DEV_MODULE_ACTION: CONTAINED_DEV_MODULE_ACTION2 } = await Promise.resolve().then(() => (init_build_lib(), build_lib_exports));
+  const { buildContainedDevModule: buildContainedDevModule2, CONTAINED_DEV_MODULE_SERVICE: CONTAINED_DEV_MODULE_SERVICE2, CONTAINED_DEV_MODULE_ACTION: CONTAINED_DEV_MODULE_ACTION2 } = (
+    // @ts-expect-error — .mjs sibling without types; the cast below states what this uses.
+    await Promise.resolve().then(() => (init_build_lib(), build_lib_exports))
+  );
   let js;
   try {
     js = await buildContainedDevModule2(entry, { absWorkingDir: dir, confineTo: dir });
@@ -18212,6 +18501,7 @@ __export(wix_member_login_exports, {
   memberDirectLogin: () => memberDirectLogin,
   memberDirectRegister: () => memberDirectRegister,
   mintVisitor: () => mintVisitor,
+  readMemberId: () => readMemberId,
   webWixCall: () => webWixCall
 });
 import { createHash as createHash10, randomBytes as randomBytes3 } from "node:crypto";
@@ -18345,6 +18635,16 @@ async function webWixCall(method, path2, body, token, cookie, forwardedHeaders =
   });
   return { status: res.status, body: await res.text() };
 }
+async function readMemberId(memberToken) {
+  try {
+    const identity = await webWixCall("GET", "/members/v1/members/my", void 0, memberToken);
+    if (identity.status < 200 || identity.status >= 300) return null;
+    const parsed = JSON.parse(identity.body);
+    return parsed.member?.id ?? parsed.id ?? null;
+  } catch {
+    return null;
+  }
+}
 var API;
 var init_wix_member_login = __esm({
   "../../core/dev-server/src/wix-member-login.ts"() {
@@ -26874,7 +27174,8 @@ function renderNodeInner(node, ctx) {
         extra.role = "button";
         if (typeof el.type !== "string") extra[SYNTHETIC_TAP_ROLE] = true;
       }
-      if (extra.tabIndex == null) {
+      const defaultedTabIndex = extra.tabIndex == null || extra.tabIndex === -1 && extra[SYNTHETIC_TABINDEX] === true;
+      if (defaultedTabIndex) {
         extra.tabIndex = 0;
         if (typeof el.type !== "string") extra[SYNTHETIC_TABINDEX] = true;
       }
@@ -33950,7 +34251,7 @@ function makeEtag(body) {
   return `"${createHash16("sha256").update(body).digest("hex").slice(0, 32)}"`;
 }
 function servedTokensPath(app) {
-  return app.module.designTokensPath ?? resolve31(app.dir, app.module.config.designTokensPath ?? "tokens.json");
+  return app.module.designTokensPath ?? resolve31(app.dir, uiConfig(app.module.config).designTokensPath ?? "tokens.json");
 }
 function readAppTokens(state) {
   if (!state.app) return null;
@@ -34032,7 +34333,7 @@ function handleL10nRequest(req, res, state) {
     res.end();
     return;
   }
-  const sourceLocale = state.app.module.config.locale?.default ?? "en";
+  const sourceLocale = uiConfig(state.app.module.config).locale?.default ?? "en";
   let messages;
   try {
     messages = Object.fromEntries(
@@ -34070,9 +34371,9 @@ async function runScreenDiagnostics(state, screenId, descriptor) {
     nativeActions,
     appWorkerActions,
     strict: false,
-    workerSubtreeScreens: new Set(state.app?.module.config.workerSubtreeScreens ?? []),
+    workerSubtreeScreens: new Set(uiConfig(state.app?.module.config).workerSubtreeScreens ?? []),
     // Same a11y rung the build lint applies (RFC 0058 §5) — diagnostics must not disagree.
-    a11y: state.app?.module.config.a11y
+    a11y: uiConfig(state.app?.module.config).a11y
   });
   const telemetry = state.telemetryEvents.filter((e) => e.screenId === screenId && (/^worker_/.test(e.type) || e.type === "bundle_load_revoked")).slice(-20);
   const lastError = [...telemetry].reverse().find((e) => /crash|revoked|error|fail/i.test(e.type)) ?? null;
@@ -34423,7 +34724,7 @@ async function buildDescriptorForScreenId(state, screenId, query = new URLSearch
       }
       return null;
     })();
-    return built ? ensureTransportCapability(applyTopBarDefault(attachAssignments(built, state, evalCtx, cfg?.overrides), state.app.module.config), state.tier5Dir ?? TIER5_ROOT2) : null;
+    return built ? ensureTransportCapability(applyTopBarDefault(attachAssignments(built, state, evalCtx, cfg?.overrides), uiConfig(state.app.module.config)), state.tier5Dir ?? TIER5_ROOT2) : null;
   }
   return null;
 }
@@ -35261,15 +35562,7 @@ async function handleWebWix(req, res, state) {
   }
   if (path2 === "/v1/__webwix/identity" && (req.method === "GET" || req.method === "POST")) {
     if (!session.memberToken) return reply(200, { authenticated: false, userId: null, email: "" });
-    let userId = null;
-    try {
-      const identity = await webWixCall("GET", "/members/v1/members/my", session.memberToken);
-      if (identity.status >= 200 && identity.status < 300) {
-        const parsed = JSON.parse(identity.body);
-        userId = parsed.member?.id ?? parsed.id ?? null;
-      }
-    } catch {
-    }
+    const userId = await readMemberId(session.memberToken);
     const preferenceIdentity = session.email?.trim().toLowerCase() || userId;
     return reply(200, {
       authenticated: true,
@@ -35844,8 +36137,8 @@ async function handleAdminPlayground(req, res, state) {
       nativeActions,
       appWorkerActions,
       strict,
-      workerSubtreeScreens: new Set(state.app?.module.config.workerSubtreeScreens ?? []),
-      a11y: state.app?.module.config.a11y
+      workerSubtreeScreens: new Set(uiConfig(state.app?.module.config).workerSubtreeScreens ?? []),
+      a11y: uiConfig(state.app?.module.config).a11y
     });
     return sendJson(res, report2.ok ? 200 : 422, report2);
   }
@@ -40192,7 +40485,7 @@ async function buildReleaseFromContent(contentDir2, dest, opts = {}) {
 }
 function readTokensForLint(preloaded) {
   try {
-    const tokenPath = preloaded.module.designTokensPath ?? resolve32(preloaded.dir, preloaded.module.config.designTokensPath ?? "tokens.json");
+    const tokenPath = preloaded.module.designTokensPath ?? resolve32(preloaded.dir, uiConfig(preloaded.module.config).designTokensPath ?? "tokens.json");
     const parsed = JSON.parse(readFileSync42(tokenPath, "utf8"));
     delete parsed._meta;
     return parsed;
@@ -40204,7 +40497,8 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const app = preloaded.name;
   const tier5Dir = opts.tier5Dir ?? TIER5_DIR;
   const collect2 = opts.collect;
-  if (preloaded.module.config.kind === "functions") {
+  const config = preloaded.module.config;
+  if (isFunctionsOnlyConfig(config)) {
     return buildFunctionsOnlyRelease(preloaded, dest);
   }
   const store = typeof dest === "string" ? new FileReleaseStore(dest) : dest;
@@ -40230,14 +40524,14 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   const LIVE_LOAD_BUDGET_MS = 3e4;
   const appLocalDbSchema = (() => {
-    const entities = preloaded.module.config.dataSchema?.entities ?? [];
+    const entities = config.dataSchema?.entities ?? [];
     const names = entities.map((e) => e?.name).filter((n) => typeof n === "string" && n.length > 0);
     return names.length ? names.map((name) => ({ name })) : null;
   })();
   let liveWixCall = null;
   const ensureLiveWixCall = async () => {
     if (liveWixCall) return liveWixCall;
-    const auth = preloaded.module.config.auth;
+    const auth = config.auth;
     const clientId = auth?.config?.clientId;
     if (auth?.providerId !== "wix-consumer" || typeof clientId !== "string" || !clientId) {
       throw new Error(
@@ -40322,7 +40616,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   let handlers;
   let minBinaryVersion = null;
-  const requiredCapabilities = new Set(preloaded.module.config.capabilities ?? []);
+  const requiredCapabilities = new Set(config.capabilities ?? []);
   const requiredNativeComponents = /* @__PURE__ */ new Set();
   const tierScreens = [];
   const tierBundles = /* @__PURE__ */ new Map();
@@ -40568,11 +40862,11 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
           nativeActions,
           appWorkerActions,
           strict: collect2.strict,
-          workerSubtreeScreens: new Set(preloaded.module.config.workerSubtreeScreens ?? []),
-          l10n: l10nLintOptions(preloaded.module.config.locale, preloaded.dir),
+          workerSubtreeScreens: new Set(config.workerSubtreeScreens ?? []),
+          l10n: l10nLintOptions(config.locale, preloaded.dir),
           // RFC 0058 §5 — the app's own rung of the a11y ladder. Omitted ⇒ the validator's
           // default, "error"; an in-repo app with ratcheted debt declares "warn".
-          a11y: preloaded.module.config.a11y
+          a11y: config.a11y
         });
         lint.push({ screenId, ok: report2.ok, issues: report2.issues });
       }
@@ -40600,8 +40894,8 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             nativeActions,
             appWorkerActions,
             strict: collect2.strict,
-            workerSubtreeScreens: new Set(preloaded.module.config.workerSubtreeScreens ?? []),
-            a11y: preloaded.module.config.a11y
+            workerSubtreeScreens: new Set(config.workerSubtreeScreens ?? []),
+            a11y: config.a11y
           });
           lint.push({ screenId: wantedRender, ok: report2.ok, issues: report2.issues });
         }
@@ -40635,6 +40929,10 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         store: preloaded.module.createStore(app),
         toggles: {},
         query: new URLSearchParams(),
+        // A bake has no requesting member: the anonymous caller the dev-server also defaults to.
+        // `ScreenBuildContext.caller` is documented never-absent, so a `seedIds` may read
+        // `ctx.caller.entitled` unguarded, and would have thrown here without it.
+        caller: { entitled: false },
         serverBaseUrl: base,
         bundleIntegrity: () => null,
         // Resolve for real: a baked templated route whose descriptor references an asset must
@@ -40744,7 +41042,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     }
     Object.assign(catalogs, await bakeCatalogs(
       app,
-      preloaded.module.config.locale,
+      config.locale,
       async (tag) => {
         const res = await devFetch(
           `${base}/v1/l10n?app=${encodeURIComponent(app)}&tag=${encodeURIComponent(tag)}`,
@@ -40759,7 +41057,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       const served = await cfgRes.text();
       const prodText = withProdServeAppConfig(
         opts.keepDevOnlyAppConfig ? served : withoutDevOnlyAppConfig(served),
-        preloaded.module.config.environments?.prod
+        config.environments?.prod
       );
       const streamPolicyErrors = validateReleaseStreamPolicyConfig(prodText);
       if (streamPolicyErrors.length) {
@@ -40831,7 +41129,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     playerRequirements: {
       capabilities: [...requiredCapabilities].sort(),
       nativeComponents: [...requiredNativeComponents].sort(),
-      authProviders: [preloaded.module.config.auth.providerId].filter(Boolean).sort()
+      authProviders: [config.auth.providerId].filter(Boolean).sort()
     },
     iconHash,
     ...brandFonts.length ? { brandFonts } : {},
@@ -40887,7 +41185,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     // core identifies an oversized bundle by SRI, which is unactionable on its own, so the
     // name is resolved back in here (most-specific match: `integrity` is a full SRI, but a
     // descriptor carrying none would fall back to a bare name, and names nest).
-    tierCapViolations: checkTierCaps(preloaded.module.config, tierScreens, [...tierBundles.values()]).map((v) => {
+    tierCapViolations: checkTierCaps(config, tierScreens, [...tierBundles.values()]).map((v) => {
       const named = [...tierBundles.values()].filter((b) => v.message.includes(b.integrity)).sort((a, b) => b.integrity.length - a.integrity.length)[0];
       return named ? { ...v, message: `${v.message} \u2014 bundle "${named.name}"` } : v;
     }),
@@ -40900,7 +41198,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     ...renderTokens !== void 0 ? { tokens: renderTokens } : {},
     ...preloaded.meta.surfaces ? { surfaceNav: preloaded.meta.surfaces } : {},
     auth: (() => {
-      const a = preloaded.module.config.auth;
+      const a = config.auth;
       const cid = a?.config?.clientId;
       return { ...a?.providerId ? { providerId: a.providerId } : {}, ...typeof cid === "string" && cid ? { clientId: cid } : {} };
     })()
@@ -40944,7 +41242,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   const sha = gitSha();
   const manifest = { releaseId: contentReleaseId(content), gitSha: sha, ...content };
   await store.putManifest(app, manifest);
-  return { manifest, failedToBuild: [], missingBundles: [], auth: {} };
+  return { manifest, failedToBuild: [], missingBundles: [], auth: {}, tierCapViolations: [] };
 }
 function listBuildableApps() {
   const appsDir = join37(REPO_ROOT7, "apps");
@@ -40957,6 +41255,7 @@ var init_build3 = __esm({
     init_contained_dev_module();
     init_tier5_dir();
     init_build_sha();
+    init_app_module();
     init_app_icon();
     init_app_assets();
     init_plan_fonts();
@@ -41155,6 +41454,11 @@ h2{font-size:12px;font-weight:600;color:var(--muted);text-transform:uppercase;le
 .phone img,.phone iframe{width:100%;height:100%;object-fit:cover;object-position:top;border:0;display:block;cursor:zoom-in}
 .phone.vpf{position:relative}.phone iframe.vp{position:absolute;top:0;left:0;width:390px;height:844px;transform-origin:0 0;transform:scale(var(--k,.72));cursor:auto}
 .cap{text-align:center;color:var(--muted);font-size:12px;margin-top:8px}
+.lan{text-align:center;margin-top:12px;padding:12px;border:1px solid var(--line);border-radius:12px}
+.lan svg{display:block;margin:8px auto;border-radius:6px}
+.lant{font-weight:600}
+.lanu{font-size:12px;word-break:break-all}
+.lanh{color:var(--muted);font-size:12px;margin-top:4px}
 .film{display:flex;gap:6px;overflow-x:auto;margin-top:12px;padding-bottom:4px}.film img{width:48px;aspect-ratio:390/844;object-fit:cover;object-position:top;border-radius:8px;border:1px solid var(--line);cursor:zoom-in}
 .chips{display:flex;flex-wrap:wrap;gap:8px;margin-bottom:16px}.chip{font-size:12px;padding:5px 10px;border-radius:999px;background:var(--card);border:1px solid var(--line);color:var(--muted)}
 .chip.ok{background:var(--okbg);color:var(--ok);border-color:transparent}.chip.warn{background:var(--warnbg);color:var(--warn);border-color:transparent}.chip.bad{background:var(--badbg);color:var(--bad);border-color:transparent}
@@ -41223,6 +41527,14 @@ h2{font-size:12px;font-weight:600;color:var(--muted);text-transform:uppercase;le
 var cur=null, lastSeen=Date.now();
 function $(id){return document.getElementById(id)}
 function el(tag,cls,txt){var e=document.createElement(tag);if(cls)e.className=cls;if(txt!=null)e.textContent=txt;return e}
+/* #3250 \u2014 a --lan run's way onto the owner's phone. The QR arrives as rows of 1/0 modules and is drawn
+   as ONE path of unit squares: built with DOM calls, so nothing in the URL can become markup. */
+function lanCard(lan){var d=el("div","lan");d.appendChild(el("div","lant","Open on your phone"));
+  if(lan.qr){var ns="http://www.w3.org/2000/svg",n=lan.qr.length,q=4,sz=n+2*q,svg=document.createElementNS(ns,"svg");svg.setAttribute("viewBox","0 0 "+sz+" "+sz);svg.setAttribute("width","148");svg.setAttribute("height","148");svg.setAttribute("role","img");svg.setAttribute("aria-label","QR code for "+lan.url);
+    var bg=document.createElementNS(ns,"rect");bg.setAttribute("width",String(sz));bg.setAttribute("height",String(sz));bg.setAttribute("fill","#fff");svg.appendChild(bg);
+    var p="";for(var y=0;y<n;y++)for(var x=0;x<n;x++)if(lan.qr[y].charAt(x)==="1")p+="M"+(x+q)+" "+(y+q)+"h1v1h-1z";
+    var path=document.createElementNS(ns,"path");path.setAttribute("d",p);path.setAttribute("fill","#000");svg.appendChild(path);d.appendChild(svg)}
+  d.appendChild(el("div","lanu",lan.url));d.appendChild(el("div","lanh","On the same Wi-Fi as this computer. It opens as the real app, full screen."));return d}
 function clear(e){while(e.firstChild)e.removeChild(e.firstChild)}
 function nowMs(){return asOf||Date.now()}
 function ago(ts){var s=Math.max(0,Math.round((nowMs()-Date.parse(ts))/1000));if(s<60)return s+"s ago";var m=Math.round(s/60);if(m<60)return m+" min ago";return Math.round(m/60)+" h ago"}
@@ -41250,7 +41562,7 @@ function render(s){
   if(pip){paintStrip(s)}else{
   var kept=s.live?focus.querySelector("iframe"):null;if(kept&&(kept.getAttribute("src")!==s.live.url||kept.getAttribute("data-run")!==s.live.runId))kept=null;
   if(kept){while(focus.lastChild&&focus.lastChild!==kept.parentNode)focus.removeChild(focus.lastChild)}else clear(focus);
-  if(s.live){$("focuslbl").textContent="Live preview";if(!kept){var f=el("div","phone vpf");var fr=document.createElement("iframe");fr.className="vp";fr.setAttribute("width","390");fr.setAttribute("height","844");fr.setAttribute("data-run",s.live.runId);fr.src=s.live.url;fr.title="Live preview";f.appendChild(fr);focus.appendChild(f)}fit();if(s.live.buildError){var be=el("div","chip bad",null);be.style.display="block";be.style.marginTop="8px";be.textContent="Last edit did not build, still showing the last good version: "+s.live.buildError;focus.appendChild(be)}focus.appendChild(el("div","cap",(s.live.watching?"Repaints as the app is edited \xB7 ":"The build this run started with; himi run --watch repaints on every edit \xB7 ")+s.live.url))}
+  if(s.live){$("focuslbl").textContent="Live preview";if(!kept){var f=el("div","phone vpf");var fr=document.createElement("iframe");fr.className="vp";fr.setAttribute("width","390");fr.setAttribute("height","844");fr.setAttribute("data-run",s.live.runId);fr.src=s.live.url;fr.title="Live preview";f.appendChild(fr);focus.appendChild(f)}fit();if(s.live.buildError){var be=el("div","chip bad",null);be.style.display="block";be.style.marginTop="8px";be.textContent="Last edit did not build, still showing the last good version: "+s.live.buildError;focus.appendChild(be)}focus.appendChild(el("div","cap",(s.live.watching?"Repaints as the app is edited \xB7 ":"The build this run started with; himi run --watch repaints on every edit \xB7 ")+s.live.url));if(s.live.lan)focus.appendChild(lanCard(s.live.lan))}
   else if(s.focus&&s.focus.frames.length){var fl=s.focus.frames;$("focuslbl").textContent="Latest \xB7 "+s.focus.id;var p=el("div","phone");p.appendChild(img(fl[fl.length-1].img));focus.appendChild(p);focus.appendChild(el("div","cap",fl.length+(fl.length===1?" version":" versions")+" so far"))}
   else{$("focuslbl").textContent="Latest";focus.appendChild(el("div","empty","The first render appears here."))}
   if(s.focus&&s.focus.frames.length>1)s.focus.frames.forEach(function(fm){film.appendChild(img(fm.img))});}}
@@ -41761,12 +42073,30 @@ function liveRun(dir) {
         screens: (Array.isArray(build2.screens) ? build2.screens : []).filter((x) => typeof x === "string").slice(0, 20),
         tokens: build2.tokens === true,
         config: build2.config === true
-      } : null
+      } : null,
+      lan: lanOf(rec?.lanUrl)
     };
   } catch {
     return null;
   }
 }
+function lanOf(value) {
+  const raw = text(value);
+  if (!raw) return null;
+  let url;
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    url = u.href;
+  } catch {
+    return null;
+  }
+  try {
+    return { url, qr: encodeQr(url).modules.map((row) => row.map((m) => m ? "1" : "0").join("")) };
+  } catch {
+    return { url, qr: null };
+  }
+}
 function focusScreen(memory) {
   const present = Object.entries(memory.shots).filter(([, s]) => s.present);
   if (!present.length) return null;
@@ -41893,6 +42223,7 @@ var STUDIO_DIR, STUDIO_PAGE, STATE_FILE, MEMORY_FILE, VALIDATE_RECORD, PUSH_RECO
 var init_studio = __esm({
   "src/studio.ts"() {
     init_studio_page();
+    init_qr();
     init_studio_timeline();
     init_progress();
     init_studio_page();
@@ -48346,6 +48677,14 @@ function memoryStore(manifest, built) {
     },
     async getAppConfig() {
       return null;
+    },
+    // The two members the cast used to paper over. Serve-relative, as FileReleaseStore's is; and
+    // nothing to prune, since this store only ever holds the one release it was built with.
+    bundleUrl(_app, sha2565) {
+      return `/v1/bundles/${sha2565}.bundle.js`;
+    },
+    async prune() {
+      return 0;
     }
   };
 }
@@ -51294,21 +51633,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-DT6bRpY_.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1055972, sha256: "3a52c8395a6509cfe2cae8036024b987cd3361095ff5450bfd7a9efa0123850b" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1055980, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1060590, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1549174, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1640098, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1731082, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1822062, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1912934, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2003914, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2112550, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2221634, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2330682, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2438382, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2526490, length: 4947, sha256: "a9dcd2ec33b7ea5cee46b0a1f37f926678dd6939b442e3d50bff0101f0fe63ba" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2531437, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-D1gUsTY3.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1056804, sha256: "26589af001475b3ae732fdc5abd94d43c0b48f9d946b9fe6a2f27db0c7ba71a7" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1056812, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1061422, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1550006, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1640930, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1731914, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1822894, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1913766, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2004746, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2113382, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2222466, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2331514, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2439214, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2527322, length: 4947, sha256: "207153af042e0e1a166f74fcd50bd1052e9000b05e7bc7283c0514848af6bd31" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2532269, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -51317,6 +51656,8 @@ var init_preview_assets_generated = __esm({
 var run_exports = {};
 __export(run_exports, {
   NO_SPA_MESSAGE: () => NO_SPA_MESSAGE,
+  lanAddress: () => lanAddress,
+  lanFlagConflict: () => lanFlagConflict,
   loadPreviewAssets: () => loadPreviewAssets,
   makePackageRunHandler: () => makePackageRunHandler,
   packageUrl: () => packageUrl,
@@ -51325,7 +51666,7 @@ __export(run_exports, {
   withoutProdServe: () => withoutProdServe
 });
 import { cpSync as cpSync2, existsSync as existsSync55, mkdirSync as mkdirSync26, mkdtempSync as mkdtempSync3, readFileSync as readFileSync61, rmSync as rmSync12, statSync as statSync13 } from "node:fs";
-import { tmpdir as tmpdir4 } from "node:os";
+import { networkInterfaces as osNetworkInterfaces, tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname29, join as join54 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
 function makePackageRunHandler(opts) {
@@ -51429,10 +51770,37 @@ function packageUrl(origin, app, opts = {}) {
   const query = opts.surface ? `?surface=${encodeURIComponent(opts.surface)}` : "";
   return `${origin.replace(/\/$/, "")}${path2}${query}`;
 }
+function isPrivateLan(address) {
+  const [a, b] = address.split(".").map(Number);
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function lanAddress(ifaces = osNetworkInterfaces()) {
+  const found = [];
+  for (const [name, list] of Object.entries(ifaces)) {
+    if (UNREACHABLE_IFACE.test(name)) continue;
+    for (const i of list ?? []) {
+      const v4 = i.family === "IPv4" || i.family === 4;
+      if (v4 && !i.internal && isPrivateLan(i.address)) found.push({ name, address: i.address });
+    }
+  }
+  return (found.find((f) => LIKELY_LAN_IFACE.test(f.name)) ?? found[0])?.address ?? null;
+}
+function lanFlagConflict(f) {
+  if (!f.lan) return null;
+  if (f.browser) return { error: "--lan cannot be combined with --browser: that preview runs inside a desktop tab, with no server a phone could open. Drop --browser." };
+  if (f.spa) return { error: "--lan cannot be combined with --spa: the hosted page would read the preview from loopback, which on a phone is the phone itself. Drop --spa." };
+  return null;
+}
 function openBrowser(url) {
   openUrl(url);
 }
 async function runPackage(source, opts = {}) {
+  const conflict = lanFlagConflict(opts);
+  if (conflict) throw new Error(conflict.error);
+  const lanHost = opts.lan ? lanAddress((opts.networkInterfaces ?? osNetworkInterfaces)()) : null;
+  if (opts.lan && !lanHost) {
+    throw new Error("himi run --lan found no LAN address to share: connect this machine to the same Wi-Fi as the phone (a VPN tunnel does not count), or drop --lan");
+  }
   const resolved2 = await resolvePackage(source, opts.workDir);
   const assets = opts.assets ?? (opts.spa ? /* @__PURE__ */ new Map() : await loadPreviewAssets());
   if (!opts.spa && assets.size === 0) {
@@ -51450,16 +51818,38 @@ async function runPackage(source, opts = {}) {
   });
   const extra = opts.extraRoutes;
   const handler = extra ? (request) => extra(request) ?? plane(request) : plane;
-  const server = nodeAdapter(handler);
-  const host = opts.host ?? "127.0.0.1";
-  const port = await new Promise((resolvePort, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port ?? 0, host, () => {
-      const addr = server.address();
-      resolvePort(typeof addr === "object" && addr ? addr.port : opts.port ?? 0);
+  const listen = (srv, port2, host2) => new Promise((resolveListen, reject) => {
+    srv.once("error", reject);
+    srv.listen(port2, host2, () => {
+      const addr = srv.address();
+      resolveListen(typeof addr === "object" && addr ? { port: addr.port, address: addr.address } : { port: port2, address: host2 });
     });
   });
+  const closeServer = (srv) => new Promise((done) => {
+    srv.closeAllConnections?.();
+    srv.close(() => done());
+  });
+  const host = opts.host ?? "127.0.0.1";
+  const server = nodeAdapter(handler);
+  const first = await listen(server, opts.port ?? 0, host);
+  const port = first.port;
+  const bound = [first.address];
+  const servers = [server];
+  if (lanHost) {
+    const lanServer = nodeAdapter(handler);
+    let lanBound;
+    try {
+      lanBound = (await listen(lanServer, port, lanHost)).address;
+    } catch (e) {
+      await closeServer(server);
+      if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
+      throw new Error(`himi run --lan could not listen on ${lanHost}:${port} (${e.message}); drop --lan, or pass --port for a free one`);
+    }
+    bound.push(lanBound);
+    servers.push(lanServer);
+  }
   const origin = `http://${host}:${port}`;
+  const lanUrl = lanHost ? packageUrl(`http://${lanHost}:${port}`, resolved2.app, opts) : void 0;
   const url = opts.spa ? `${packageUrl(opts.spa, resolved2.app, opts)}${opts.surface ? "&" : "?"}api=${encodeURIComponent(origin)}` : packageUrl(origin, resolved2.app, opts);
   if (opts.open) openBrowser(url);
   return {
@@ -51469,17 +51859,16 @@ async function runPackage(source, opts = {}) {
     url,
     releaseRoot: resolved2.releaseRoot,
     origin,
+    bound,
+    ...lanUrl ? { lanUrl } : {},
     warnings: resolved2.warnings,
-    close: () => new Promise((done) => {
-      server.closeAllConnections?.();
-      server.close(() => {
-        if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
-        done();
-      });
-    })
+    close: async () => {
+      await Promise.all(servers.map(closeServer));
+      if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
+    }
   };
 }
-var NO_SPA_MESSAGE;
+var NO_SPA_MESSAGE, UNREACHABLE_IFACE, LIKELY_LAN_IFACE;
 var init_run = __esm({
   "src/run.ts"() {
     init_open_url();
@@ -51491,6 +51880,8 @@ var init_run = __esm({
     init_himi_package();
     init_himi_package();
     NO_SPA_MESSAGE = "the web-host SPA is not embedded in this build \u2014 run `node packages/serve/scripts/embed-preview-assets.mjs` (in a monorepo checkout), or pass --spa <url> to use a hosted preview host instead";
+    UNREACHABLE_IFACE = /^(utun|tun|tap|ppp|ipsec|wg|gif|stf|bridge|vmnet|vboxnet|virbr|docker|br-|veth|awdl|llw|anpi|tailscale|zt|zerotier|nordlynx)|vpn/i;
+    LIKELY_LAN_IFACE = /^(en|eth|wlan|wl|wifi)/i;
   }
 });
 
@@ -64396,278 +64787,8 @@ function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, r
   return { ok: errors.length === 0, errors };
 }
 
-// ../../core/admin-web/src/utils/qr.ts
-var ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
-var NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
-var QR_MAX_VERSION = 20;
-function rawDataModules(ver) {
-  let result = (16 * ver + 128) * ver + 64;
-  if (ver >= 2) {
-    const numAlign = Math.floor(ver / 7) + 2;
-    result -= (25 * numAlign - 10) * numAlign - 55;
-    if (ver >= 7) result -= 36;
-  }
-  return result;
-}
-var totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
-var dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
-function byteCapacity(ver) {
-  const lenBits = ver < 10 ? 8 : 16;
-  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
-}
-function fitVersion(len) {
-  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
-  return void 0;
-}
-var EXP = new Uint8Array(512);
-var LOG = new Uint8Array(256);
-(() => {
-  let x = 1;
-  for (let i = 0; i < 255; i++) {
-    EXP[i] = x;
-    LOG[x] = i;
-    x <<= 1;
-    if (x & 256) x ^= 285;
-  }
-  for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
-})();
-var gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
-function rsDivisor(degree) {
-  const result = new Array(degree).fill(0);
-  result[degree - 1] = 1;
-  let root = 1;
-  for (let i = 0; i < degree; i++) {
-    for (let j = 0; j < degree; j++) {
-      result[j] = gfMul(result[j], root);
-      if (j + 1 < degree) result[j] ^= result[j + 1];
-    }
-    root = gfMul(root, 2);
-  }
-  return result;
-}
-function rsRemainder(data, degree) {
-  const divisor = rsDivisor(degree);
-  const res = new Array(degree).fill(0);
-  for (const b of data) {
-    const factor = b ^ res.shift();
-    res.push(0);
-    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
-  }
-  return res;
-}
-function encodeData(bytes2, ver) {
-  const bits = [];
-  const push = (val, len) => {
-    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
-  };
-  push(4, 4);
-  push(bytes2.length, ver < 10 ? 8 : 16);
-  for (const b of bytes2) push(b, 8);
-  const capacityBits = dataCodewords(ver) * 8;
-  push(0, Math.min(4, capacityBits - bits.length));
-  while (bits.length % 8 !== 0) bits.push(0);
-  const out = [];
-  for (let i = 0; i < bits.length; i += 8) {
-    let byte2 = 0;
-    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
-    out.push(byte2);
-  }
-  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
-  return out;
-}
-function interleave(data, ver) {
-  const numBlocks = NUM_BLOCKS_L[ver];
-  const eccLen = ECC_PER_BLOCK_L[ver];
-  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
-  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
-  const blocks = [];
-  const eccs = [];
-  let off = 0;
-  for (let i = 0; i < numBlocks; i++) {
-    const len = shortLen + (i < numShort ? 0 : 1);
-    const blk = data.slice(off, off + len);
-    off += len;
-    blocks.push(blk);
-    eccs.push(rsRemainder(blk, eccLen));
-  }
-  const out = [];
-  for (let i = 0; i < shortLen + 1; i++) {
-    for (let b = 0; b < numBlocks; b++) {
-      const v = blocks[b][i];
-      if (v !== void 0) out.push(v);
-    }
-  }
-  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
-  return out;
-}
-function alignmentPositions(ver) {
-  if (ver === 1) return [];
-  const num3 = Math.floor(ver / 7) + 2;
-  const size = ver * 4 + 17;
-  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
-  const res = [6];
-  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
-  return res;
-}
-var MASKS = [
-  (x, y) => (x + y) % 2 === 0,
-  (_x, y) => y % 2 === 0,
-  (x) => x % 3 === 0,
-  (x, y) => (x + y) % 3 === 0,
-  (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
-  (x, y) => x * y % 2 + x * y % 3 === 0,
-  (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
-  (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
-];
-function bchFormat(data) {
-  let rem = data;
-  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
-  return (data << 10 | rem) ^ 21522;
-}
-function bchVersion(ver) {
-  let rem = ver;
-  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
-  return ver << 12 | rem;
-}
-function penalty(m, size) {
-  let score = 0;
-  const run2 = (get) => {
-    for (let i = 0; i < size; i++) {
-      let last = get(i, 0), len = 1;
-      for (let j = 1; j < size; j++) {
-        const cur = get(i, j);
-        if (cur === last) {
-          len++;
-          if (len === 5) score += 3;
-          else if (len > 5) score++;
-        } else {
-          last = cur;
-          len = 1;
-        }
-      }
-    }
-  };
-  run2((i, j) => m[i][j]);
-  run2((i, j) => m[j][i]);
-  for (let y = 0; y < size - 1; y++)
-    for (let x = 0; x < size - 1; x++) {
-      const c = m[y][x];
-      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
-    }
-  let dark = 0;
-  for (const row of m) for (const c of row) if (c) dark++;
-  const total = size * size;
-  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
-  return score;
-}
-function encodeQr(text5) {
-  const bytes2 = [...new TextEncoder().encode(text5)];
-  const version2 = fitVersion(bytes2.length);
-  if (!version2) {
-    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
-  }
-  const codewords = interleave(encodeData(bytes2, version2), version2);
-  const size = version2 * 4 + 17;
-  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
-  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
-  const set = (x, y, dark) => {
-    modules[y][x] = dark;
-    reserved[y][x] = true;
-  };
-  const finder = (cx, cy) => {
-    for (let dy = -4; dy <= 4; dy++)
-      for (let dx = -4; dx <= 4; dx++) {
-        const x = cx + dx, y = cy + dy;
-        if (x < 0 || y < 0 || x >= size || y >= size) continue;
-        const d = Math.max(Math.abs(dx), Math.abs(dy));
-        set(x, y, d !== 2 && d !== 4);
-      }
-  };
-  finder(3, 3);
-  finder(size - 4, 3);
-  finder(3, size - 4);
-  for (let i = 8; i < size - 8; i++) {
-    set(i, 6, i % 2 === 0);
-    set(6, i, i % 2 === 0);
-  }
-  for (const ay of alignmentPositions(version2))
-    for (const ax of alignmentPositions(version2)) {
-      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
-      for (let dy = -2; dy <= 2; dy++)
-        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
-    }
-  for (let i = 0; i < 9; i++) {
-    reserved[i][8] = true;
-    reserved[8][i] = true;
-  }
-  for (let i = 0; i < 8; i++) {
-    reserved[size - 1 - i][8] = true;
-    reserved[8][size - 1 - i] = true;
-  }
-  set(8, size - 8, true);
-  if (version2 >= 7)
-    for (let i = 0; i < 18; i++) {
-      const a = size - 11 + i % 3, b = Math.floor(i / 3);
-      reserved[a][b] = true;
-      reserved[b][a] = true;
-    }
-  let bit = 0;
-  const totalBits = codewords.length * 8;
-  for (let right = size - 1; right >= 1; right -= 2) {
-    if (right === 6) right = 5;
-    for (let vert = 0; vert < size; vert++) {
-      for (let j = 0; j < 2; j++) {
-        const x = right - j;
-        const upward = (right + 1 & 2) === 0;
-        const y = upward ? size - 1 - vert : vert;
-        if (reserved[y][x]) continue;
-        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
-        bit++;
-      }
-    }
-  }
-  let best = null, bestMask = 0, bestScore = Infinity;
-  for (let mask = 0; mask < 8; mask++) {
-    const cand = modules.map((row) => [...row]);
-    for (let y = 0; y < size; y++)
-      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
-    applyFormat(cand, size, mask);
-    if (version2 >= 7) applyVersion(cand, size, version2);
-    const s = penalty(cand, size);
-    if (s < bestScore) {
-      bestScore = s;
-      best = cand;
-      bestMask = mask;
-    }
-  }
-  return { size, version: version2, mask: bestMask, modules: best };
-}
-function applyFormat(m, size, mask) {
-  const bits = bchFormat(1 << 3 | mask);
-  const on3 = (i) => (bits >>> i & 1) === 1;
-  const put = (x, y, dark) => {
-    m[y][x] = dark;
-  };
-  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
-  put(8, 7, on3(6));
-  put(8, 8, on3(7));
-  put(7, 8, on3(8));
-  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
-  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
-  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
-  put(8, size - 8, true);
-}
-function applyVersion(m, size, version2) {
-  const bits = bchVersion(version2);
-  for (let i = 0; i < 18; i++) {
-    const on3 = (bits >>> i & 1) === 1;
-    const a = size - 11 + i % 3, b = Math.floor(i / 3);
-    m[a][b] = on3;
-    m[b][a] = on3;
-  }
-}
-
 // ../../core/admin-web/src/utils/qr-terminal.ts
+init_qr();
 function qrTerminal(text5, opts = {}) {
   const { modules, size } = encodeQr(text5);
   const quietZone = opts.quietZone ?? 4;
@@ -66054,6 +66175,7 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "force",
   "replace",
   "watch",
+  "lan",
   "no-claim",
   "new",
   "dev",
@@ -66472,7 +66594,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            file is not the plane's per-release archive.
   himi share --file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>
                                            publish a content-addressed package link for a released app
-  himi run [<package.himi|dir|url>] [--browser] [--watch] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
+  himi run [<package.himi|dir|url>] [--browser] [--watch] [--lan] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
                                            serve a package on localhost + open it in a browser. No serve
                                            plane, no dev-server. With no argument it packs the current
                                            content package first \u2014 edit, run, look at it.
@@ -66480,6 +66602,9 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            (a failed build keeps the last good preview). The build board
                                            is served beside it at /__himi/studio/ with the preview framed
                                            in it. Blocks until Ctrl-C.
+                                           --lan also serves it to the local network and prints a QR:
+                                           a phone on the same Wi-Fi opens it as the real app, full
+                                           screen. Read-only, but anyone on that network can open it.
   himi flags list|set|ramp|rm [<key>] [--app <a>]
                                            read/change operational flags (RFC 0013); writes report
                                            servedNow from the device door, never just ok
@@ -66826,7 +66951,7 @@ var COMMANDS = [
   { name: "import", summary: "turn a `himi pack --dev` package back into an EDITABLE content package \u2014 the file counterpart of `himi pull`, needing no serve plane, no account and no network. Refuses an invalid package before trusting its source (the content hash is recomputed over every entry on open, so the archive is provably the one that was packed), and refuses a RELEASE package by naming the absence \u2014 it carries built output and no source \u2014 rather than reporting a missing file. `--name` re-substitutes the app identity through the same machinery `himi init --template` and `himi pull --name` use, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A non-empty destination needs `--force` and a merge NAMES what it kept (`left: [...]`), the same contract `himi pull --force` has; a shape clash is refused whole before anything is written. There is no `--replace`: a file you were handed is not the plane's per-release archive.", required: "<package.himi> [--out <dir>] [--name <new>] [--force]" },
   { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A NON-EMPTY destination is refused unless you say which you mean: `--force` merges and reports \u2014 it writes the archive over what is there, keeps files the release does not carry, and NAMES every one of them as `left: [...]` so a tree that matches no release is never silent (#2437); `--replace` restores exactly what was archived, removing those files first (`removed: [...]`) and implying `--force`. `--replace` refuses a directory holding no `himalaya.content.json`, so a mistyped `--out` cannot clear an unrelated tree, and the only paths it can remove are the ones a push would have archived \u2014 `.git/`, `node_modules/`, `dist/`, `.env*` and key material are out of its reach by construction.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]" },
   { name: "share", summary: "publish or revoke a content-addressed `.himi` share link. The package must be a validated archive for an already-published release; the resulting https URL is safe to QR, copy, or open in Himi Player.", required: "--file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>" },
-  { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod. --watch keeps the preview LIVE: every save in the content package rebuilds it and repaints the open tab with only what changed (the dev-server's hot-reload events); a build that fails keeps the last good preview on screen and says why. Any `himi run` of a content package (plain, --watch or --browser) frames its preview on the build board (`himi studio`) while it serves, and all but --browser also serve that board at /__himi/studio/ on the preview's own origin.", required: "[<package.himi|dir|url>] [--browser] [--watch] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
+  { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod. --lan also serves it to the local network and prints a QR, so a phone on the same Wi-Fi opens it as the real app, full screen. --watch keeps the preview LIVE: every save in the content package rebuilds it and repaints the open tab with only what changed (the dev-server's hot-reload events); a build that fails keeps the last good preview on screen and says why. Any `himi run` of a content package (plain, --watch or --browser) frames its preview on the build board (`himi studio`) while it serves, and all but --browser also serve that board at /__himi/studio/ on the preview's own origin.", required: "[<package.himi|dir|url>] [--browser] [--watch] [--lan] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
   { name: "preview", summary: "print the shareable web URL + himi:// deep link + agent /v1/preview JSON URLs for an app+release; --surface frames the web preview as any catalog surface (?surface=)", required: "--app --release [--screen] [--surface]" },
   { name: "surfaces", summary: "the surface catalog vs this app's envelope (platforms.json): targeted surfaces, the opt-in key for the rest, per-surface preview links with --app --release, and which widget families the package produces with --measure-widgets (which runs its built bundles)", required: "[--content <dir>] [--app --release] [--measure-widgets]" },
   { name: "context", summary: "fetch the agent preview envelope (GET /v1/preview/a/<app>) \u2014 ok/issues/screens/links; exit 1 if ok:false", required: "--app --release [--screen] [--include telemetry]" },
@@ -69726,7 +69851,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const { detectAndroidNativeDecode: detectAndroidNativeDecode2, detectNativeDecode: detectNativeDecode2, nativeDecodePlatforms: nativeDecodePlatforms2 } = await Promise.resolve().then(() => (init_native_decode(), native_decode_exports));
           let platforms;
           try {
-            platforms = nativeDecodePlatforms2(flags.native === true ? true : str6(flags.native));
+            platforms = nativeDecodePlatforms2(flags.native === true ? true : str6(flags.native) ?? String(flags.native));
           } catch (error) {
             io.error(JSON.stringify({ error: error.message }));
             return 2;
@@ -71399,7 +71524,13 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
       // ---- himi run — serve a package on localhost and open it in a browser ----
       // Blocks until interrupted, like any dev server.
       case "run": {
-        const { runPackage: runPackage2 } = await Promise.resolve().then(() => (init_run(), run_exports));
+        const { runPackage: runPackage2, lanFlagConflict: lanFlagConflict2 } = await Promise.resolve().then(() => (init_run(), run_exports));
+        const spaFlag = flags.spa;
+        const lanConflict = lanFlagConflict2({ lan: flags.lan === true, browser: flags.browser === true, spa: typeof spaFlag === "string" || Array.isArray(spaFlag) ? String(spaFlag) : void 0 });
+        if (lanConflict) {
+          io.error(JSON.stringify({ ok: false, ...lanConflict }));
+          return 2;
+        }
         let source = pos[1];
         let temp = null;
         const watch2 = flags.watch === true;
@@ -71455,7 +71586,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let startedAt = "";
           const record2 = (served2, build2) => {
             try {
-              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, pid: process.pid, startedAt, watching: watch2, build: build2 })) recorded = true;
+              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, ...served2.lanUrl ? { lanUrl: served2.lanUrl } : {}, pid: process.pid, startedAt, watching: watch2, build: build2 })) recorded = true;
               return null;
             } catch (e) {
               return e.message;
@@ -71504,6 +71635,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             surface: str6(flags.surface),
             spa: str6(flags.spa),
             open: flags["no-open"] !== true,
+            lan: flags.lan === true,
             // The build board on the preview's own origin, for any run of this content package.
             ...recordKit ? { extraRoutes: (request) => recordKit.boardFile(dir, new URL(request.url).pathname) } : {},
             // `liveWix` only with --watch: that is the "click around while you work" window, and a
@@ -71576,12 +71708,23 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             await running.close();
             throw e;
           }
+          if (running.lanUrl) {
+            io.error(`himi run --lan: anyone on this network can open this preview (read-only) at ${running.lanUrl}`);
+            io.error("Scan it with your phone, on the same Wi-Fi:");
+            try {
+              const qr = qrTerminal(running.lanUrl);
+              io.error(qr.cols <= 60 ? qr.text : `  QR omitted (terminal width ${qr.cols} exceeds 60 columns)`);
+            } catch {
+              io.error("  QR omitted (link is too long)");
+            }
+          }
           print({
             ok: true,
             app: running.app,
             releaseId: running.releaseId,
             url: running.url,
             port: running.port,
+            ...running.lanUrl ? { lan: { url: running.lanUrl } } : {},
             ...watch2 ? { watching: dir } : {},
             ...recordKit && boardOpen(dir) ? { board: `${running.origin}/__himi/studio/` } : {},
             ...running.warnings.length ? { warnings: running.warnings } : {},
@@ -71726,10 +71869,11 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           // right below says how (or whether) the narrowing was measured.
           enabled: (() => {
             const envelope = resolveSurfaceEnvelope(platforms).enabled;
-            if (!produced.families) return envelope;
+            const families = produced.families;
+            if (!families) return envelope;
             return envelope.filter((id) => {
               const surface = surfaceById(id);
-              return !surface || !isWidgetFamilySurface(surface) || produced.families.has(surfaceFrozenFamily(surface));
+              return !surface || !isWidgetFamilySurface(surface) || families.has(surfaceFrozenFamily(surface));
             });
           })(),
           // Says which question the `produced` column answered, and — when it could not
@@ -73598,7 +73742,8 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
           return 2;
         }
         const environment2 = str6(flags.environment) ?? "preview";
-        if (environment2 !== "preview" && environment2 !== "production") {
+        const isResourceEnvironment = (v) => v === "preview" || v === "production";
+        if (!isResourceEnvironment(environment2)) {
           io.error(JSON.stringify({ error: "--environment must be preview or production" }));
           return 2;
         }
@@ -73881,7 +74026,7 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
             redirectUri: redirectFlag,
             cwd: str6(flags.content) ?? process.cwd()
           });
-          print({ ok: true, ...r });
+          print(r);
           return 0;
         } catch (e) {
           io.error(JSON.stringify({ error: e.message }));