@wix/himalaya-cli 0.1053.0 → 0.1054.0

package/dist/cli.mjs

@@ -2182,6 +2182,282 @@ var init_widget_identity = __esm({
   }
 });
 
+// ../../core/admin-web/src/utils/qr.ts
+function rawDataModules(ver) {
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7) result -= 36;
+  }
+  return result;
+}
+function byteCapacity(ver) {
+  const lenBits = ver < 10 ? 8 : 16;
+  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
+}
+function fitVersion(len) {
+  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
+  return void 0;
+}
+function rsDivisor(degree) {
+  const result = new Array(degree).fill(0);
+  result[degree - 1] = 1;
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < degree; j++) {
+      result[j] = gfMul(result[j], root);
+      if (j + 1 < degree) result[j] ^= result[j + 1];
+    }
+    root = gfMul(root, 2);
+  }
+  return result;
+}
+function rsRemainder(data, degree) {
+  const divisor = rsDivisor(degree);
+  const res = new Array(degree).fill(0);
+  for (const b of data) {
+    const factor = b ^ res.shift();
+    res.push(0);
+    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
+  }
+  return res;
+}
+function encodeData(bytes2, ver) {
+  const bits = [];
+  const push = (val, len) => {
+    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
+  };
+  push(4, 4);
+  push(bytes2.length, ver < 10 ? 8 : 16);
+  for (const b of bytes2) push(b, 8);
+  const capacityBits = dataCodewords(ver) * 8;
+  push(0, Math.min(4, capacityBits - bits.length));
+  while (bits.length % 8 !== 0) bits.push(0);
+  const out = [];
+  for (let i = 0; i < bits.length; i += 8) {
+    let byte2 = 0;
+    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
+    out.push(byte2);
+  }
+  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
+  return out;
+}
+function interleave(data, ver) {
+  const numBlocks = NUM_BLOCKS_L[ver];
+  const eccLen = ECC_PER_BLOCK_L[ver];
+  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
+  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
+  const blocks = [];
+  const eccs = [];
+  let off = 0;
+  for (let i = 0; i < numBlocks; i++) {
+    const len = shortLen + (i < numShort ? 0 : 1);
+    const blk = data.slice(off, off + len);
+    off += len;
+    blocks.push(blk);
+    eccs.push(rsRemainder(blk, eccLen));
+  }
+  const out = [];
+  for (let i = 0; i < shortLen + 1; i++) {
+    for (let b = 0; b < numBlocks; b++) {
+      const v = blocks[b][i];
+      if (v !== void 0) out.push(v);
+    }
+  }
+  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
+  return out;
+}
+function alignmentPositions(ver) {
+  if (ver === 1) return [];
+  const num3 = Math.floor(ver / 7) + 2;
+  const size = ver * 4 + 17;
+  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
+  const res = [6];
+  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
+  return res;
+}
+function bchFormat(data) {
+  let rem = data;
+  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
+  return (data << 10 | rem) ^ 21522;
+}
+function bchVersion(ver) {
+  let rem = ver;
+  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
+  return ver << 12 | rem;
+}
+function penalty(m, size) {
+  let score = 0;
+  const run2 = (get) => {
+    for (let i = 0; i < size; i++) {
+      let last = get(i, 0), len = 1;
+      for (let j = 1; j < size; j++) {
+        const cur = get(i, j);
+        if (cur === last) {
+          len++;
+          if (len === 5) score += 3;
+          else if (len > 5) score++;
+        } else {
+          last = cur;
+          len = 1;
+        }
+      }
+    }
+  };
+  run2((i, j) => m[i][j]);
+  run2((i, j) => m[j][i]);
+  for (let y = 0; y < size - 1; y++)
+    for (let x = 0; x < size - 1; x++) {
+      const c = m[y][x];
+      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
+    }
+  let dark = 0;
+  for (const row of m) for (const c of row) if (c) dark++;
+  const total = size * size;
+  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
+  return score;
+}
+function encodeQr(text5) {
+  const bytes2 = [...new TextEncoder().encode(text5)];
+  const version2 = fitVersion(bytes2.length);
+  if (!version2) {
+    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
+  }
+  const codewords = interleave(encodeData(bytes2, version2), version2);
+  const size = version2 * 4 + 17;
+  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
+  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
+  const set = (x, y, dark) => {
+    modules[y][x] = dark;
+    reserved[y][x] = true;
+  };
+  const finder = (cx, cy) => {
+    for (let dy = -4; dy <= 4; dy++)
+      for (let dx = -4; dx <= 4; dx++) {
+        const x = cx + dx, y = cy + dy;
+        if (x < 0 || y < 0 || x >= size || y >= size) continue;
+        const d = Math.max(Math.abs(dx), Math.abs(dy));
+        set(x, y, d !== 2 && d !== 4);
+      }
+  };
+  finder(3, 3);
+  finder(size - 4, 3);
+  finder(3, size - 4);
+  for (let i = 8; i < size - 8; i++) {
+    set(i, 6, i % 2 === 0);
+    set(6, i, i % 2 === 0);
+  }
+  for (const ay of alignmentPositions(version2))
+    for (const ax of alignmentPositions(version2)) {
+      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
+      for (let dy = -2; dy <= 2; dy++)
+        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
+    }
+  for (let i = 0; i < 9; i++) {
+    reserved[i][8] = true;
+    reserved[8][i] = true;
+  }
+  for (let i = 0; i < 8; i++) {
+    reserved[size - 1 - i][8] = true;
+    reserved[8][size - 1 - i] = true;
+  }
+  set(8, size - 8, true);
+  if (version2 >= 7)
+    for (let i = 0; i < 18; i++) {
+      const a = size - 11 + i % 3, b = Math.floor(i / 3);
+      reserved[a][b] = true;
+      reserved[b][a] = true;
+    }
+  let bit = 0;
+  const totalBits = codewords.length * 8;
+  for (let right = size - 1; right >= 1; right -= 2) {
+    if (right === 6) right = 5;
+    for (let vert = 0; vert < size; vert++) {
+      for (let j = 0; j < 2; j++) {
+        const x = right - j;
+        const upward = (right + 1 & 2) === 0;
+        const y = upward ? size - 1 - vert : vert;
+        if (reserved[y][x]) continue;
+        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
+        bit++;
+      }
+    }
+  }
+  let best = null, bestMask = 0, bestScore = Infinity;
+  for (let mask = 0; mask < 8; mask++) {
+    const cand = modules.map((row) => [...row]);
+    for (let y = 0; y < size; y++)
+      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
+    applyFormat(cand, size, mask);
+    if (version2 >= 7) applyVersion(cand, size, version2);
+    const s = penalty(cand, size);
+    if (s < bestScore) {
+      bestScore = s;
+      best = cand;
+      bestMask = mask;
+    }
+  }
+  return { size, version: version2, mask: bestMask, modules: best };
+}
+function applyFormat(m, size, mask) {
+  const bits = bchFormat(1 << 3 | mask);
+  const on3 = (i) => (bits >>> i & 1) === 1;
+  const put = (x, y, dark) => {
+    m[y][x] = dark;
+  };
+  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
+  put(8, 7, on3(6));
+  put(8, 8, on3(7));
+  put(7, 8, on3(8));
+  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
+  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
+  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
+  put(8, size - 8, true);
+}
+function applyVersion(m, size, version2) {
+  const bits = bchVersion(version2);
+  for (let i = 0; i < 18; i++) {
+    const on3 = (bits >>> i & 1) === 1;
+    const a = size - 11 + i % 3, b = Math.floor(i / 3);
+    m[a][b] = on3;
+    m[b][a] = on3;
+  }
+}
+var ECC_PER_BLOCK_L, NUM_BLOCKS_L, QR_MAX_VERSION, totalCodewords, dataCodewords, EXP, LOG, gfMul, MASKS;
+var init_qr = __esm({
+  "../../core/admin-web/src/utils/qr.ts"() {
+    ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
+    NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
+    QR_MAX_VERSION = 20;
+    totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
+    dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
+    EXP = new Uint8Array(512);
+    LOG = new Uint8Array(256);
+    (() => {
+      let x = 1;
+      for (let i = 0; i < 255; i++) {
+        EXP[i] = x;
+        LOG[x] = i;
+        x <<= 1;
+        if (x & 256) x ^= 285;
+      }
+      for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
+    })();
+    gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
+    MASKS = [
+      (x, y) => (x + y) % 2 === 0,
+      (_x, y) => y % 2 === 0,
+      (x) => x % 3 === 0,
+      (x, y) => (x + y) % 3 === 0,
+      (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
+      (x, y) => x * y % 2 + x * y % 3 === 0,
+      (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
+      (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
+    ];
+  }
+});
+
 // ../../core/dev-server/src/wix-placeholders.ts
 var PLACEHOLDER_CLIENT_ID;
 var init_wix_placeholders = __esm({
@@ -11363,6 +11639,7 @@ function resolveIdiom(tokens, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -21757,7 +22034,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -25358,7 +25634,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -26899,7 +27174,8 @@ function renderNodeInner(node, ctx) {
         extra.role = "button";
         if (typeof el.type !== "string") extra[SYNTHETIC_TAP_ROLE] = true;
       }
-      if (extra.tabIndex == null) {
+      const defaultedTabIndex = extra.tabIndex == null || extra.tabIndex === -1 && extra[SYNTHETIC_TABINDEX] === true;
+      if (defaultedTabIndex) {
         extra.tabIndex = 0;
         if (typeof el.type !== "string") extra[SYNTHETIC_TABINDEX] = true;
       }
@@ -41178,6 +41454,11 @@ h2{font-size:12px;font-weight:600;color:var(--muted);text-transform:uppercase;le
 .phone img,.phone iframe{width:100%;height:100%;object-fit:cover;object-position:top;border:0;display:block;cursor:zoom-in}
 .phone.vpf{position:relative}.phone iframe.vp{position:absolute;top:0;left:0;width:390px;height:844px;transform-origin:0 0;transform:scale(var(--k,.72));cursor:auto}
 .cap{text-align:center;color:var(--muted);font-size:12px;margin-top:8px}
+.lan{text-align:center;margin-top:12px;padding:12px;border:1px solid var(--line);border-radius:12px}
+.lan svg{display:block;margin:8px auto;border-radius:6px}
+.lant{font-weight:600}
+.lanu{font-size:12px;word-break:break-all}
+.lanh{color:var(--muted);font-size:12px;margin-top:4px}
 .film{display:flex;gap:6px;overflow-x:auto;margin-top:12px;padding-bottom:4px}.film img{width:48px;aspect-ratio:390/844;object-fit:cover;object-position:top;border-radius:8px;border:1px solid var(--line);cursor:zoom-in}
 .chips{display:flex;flex-wrap:wrap;gap:8px;margin-bottom:16px}.chip{font-size:12px;padding:5px 10px;border-radius:999px;background:var(--card);border:1px solid var(--line);color:var(--muted)}
 .chip.ok{background:var(--okbg);color:var(--ok);border-color:transparent}.chip.warn{background:var(--warnbg);color:var(--warn);border-color:transparent}.chip.bad{background:var(--badbg);color:var(--bad);border-color:transparent}
@@ -41246,6 +41527,14 @@ h2{font-size:12px;font-weight:600;color:var(--muted);text-transform:uppercase;le
 var cur=null, lastSeen=Date.now();
 function $(id){return document.getElementById(id)}
 function el(tag,cls,txt){var e=document.createElement(tag);if(cls)e.className=cls;if(txt!=null)e.textContent=txt;return e}
+/* #3250 \u2014 a --lan run's way onto the owner's phone. The QR arrives as rows of 1/0 modules and is drawn
+   as ONE path of unit squares: built with DOM calls, so nothing in the URL can become markup. */
+function lanCard(lan){var d=el("div","lan");d.appendChild(el("div","lant","Open on your phone"));
+  if(lan.qr){var ns="http://www.w3.org/2000/svg",n=lan.qr.length,q=4,sz=n+2*q,svg=document.createElementNS(ns,"svg");svg.setAttribute("viewBox","0 0 "+sz+" "+sz);svg.setAttribute("width","148");svg.setAttribute("height","148");svg.setAttribute("role","img");svg.setAttribute("aria-label","QR code for "+lan.url);
+    var bg=document.createElementNS(ns,"rect");bg.setAttribute("width",String(sz));bg.setAttribute("height",String(sz));bg.setAttribute("fill","#fff");svg.appendChild(bg);
+    var p="";for(var y=0;y<n;y++)for(var x=0;x<n;x++)if(lan.qr[y].charAt(x)==="1")p+="M"+(x+q)+" "+(y+q)+"h1v1h-1z";
+    var path=document.createElementNS(ns,"path");path.setAttribute("d",p);path.setAttribute("fill","#000");svg.appendChild(path);d.appendChild(svg)}
+  d.appendChild(el("div","lanu",lan.url));d.appendChild(el("div","lanh","On the same Wi-Fi as this computer. It opens as the real app, full screen."));return d}
 function clear(e){while(e.firstChild)e.removeChild(e.firstChild)}
 function nowMs(){return asOf||Date.now()}
 function ago(ts){var s=Math.max(0,Math.round((nowMs()-Date.parse(ts))/1000));if(s<60)return s+"s ago";var m=Math.round(s/60);if(m<60)return m+" min ago";return Math.round(m/60)+" h ago"}
@@ -41273,7 +41562,7 @@ function render(s){
   if(pip){paintStrip(s)}else{
   var kept=s.live?focus.querySelector("iframe"):null;if(kept&&(kept.getAttribute("src")!==s.live.url||kept.getAttribute("data-run")!==s.live.runId))kept=null;
   if(kept){while(focus.lastChild&&focus.lastChild!==kept.parentNode)focus.removeChild(focus.lastChild)}else clear(focus);
-  if(s.live){$("focuslbl").textContent="Live preview";if(!kept){var f=el("div","phone vpf");var fr=document.createElement("iframe");fr.className="vp";fr.setAttribute("width","390");fr.setAttribute("height","844");fr.setAttribute("data-run",s.live.runId);fr.src=s.live.url;fr.title="Live preview";f.appendChild(fr);focus.appendChild(f)}fit();if(s.live.buildError){var be=el("div","chip bad",null);be.style.display="block";be.style.marginTop="8px";be.textContent="Last edit did not build, still showing the last good version: "+s.live.buildError;focus.appendChild(be)}focus.appendChild(el("div","cap",(s.live.watching?"Repaints as the app is edited \xB7 ":"The build this run started with; himi run --watch repaints on every edit \xB7 ")+s.live.url))}
+  if(s.live){$("focuslbl").textContent="Live preview";if(!kept){var f=el("div","phone vpf");var fr=document.createElement("iframe");fr.className="vp";fr.setAttribute("width","390");fr.setAttribute("height","844");fr.setAttribute("data-run",s.live.runId);fr.src=s.live.url;fr.title="Live preview";f.appendChild(fr);focus.appendChild(f)}fit();if(s.live.buildError){var be=el("div","chip bad",null);be.style.display="block";be.style.marginTop="8px";be.textContent="Last edit did not build, still showing the last good version: "+s.live.buildError;focus.appendChild(be)}focus.appendChild(el("div","cap",(s.live.watching?"Repaints as the app is edited \xB7 ":"The build this run started with; himi run --watch repaints on every edit \xB7 ")+s.live.url));if(s.live.lan)focus.appendChild(lanCard(s.live.lan))}
   else if(s.focus&&s.focus.frames.length){var fl=s.focus.frames;$("focuslbl").textContent="Latest \xB7 "+s.focus.id;var p=el("div","phone");p.appendChild(img(fl[fl.length-1].img));focus.appendChild(p);focus.appendChild(el("div","cap",fl.length+(fl.length===1?" version":" versions")+" so far"))}
   else{$("focuslbl").textContent="Latest";focus.appendChild(el("div","empty","The first render appears here."))}
   if(s.focus&&s.focus.frames.length>1)s.focus.frames.forEach(function(fm){film.appendChild(img(fm.img))});}}
@@ -41784,12 +42073,30 @@ function liveRun(dir) {
         screens: (Array.isArray(build2.screens) ? build2.screens : []).filter((x) => typeof x === "string").slice(0, 20),
         tokens: build2.tokens === true,
         config: build2.config === true
-      } : null
+      } : null,
+      lan: lanOf(rec?.lanUrl)
     };
   } catch {
     return null;
   }
 }
+function lanOf(value) {
+  const raw = text(value);
+  if (!raw) return null;
+  let url;
+  try {
+    const u = new URL(raw);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    url = u.href;
+  } catch {
+    return null;
+  }
+  try {
+    return { url, qr: encodeQr(url).modules.map((row) => row.map((m) => m ? "1" : "0").join("")) };
+  } catch {
+    return { url, qr: null };
+  }
+}
 function focusScreen(memory) {
   const present = Object.entries(memory.shots).filter(([, s]) => s.present);
   if (!present.length) return null;
@@ -41916,6 +42223,7 @@ var STUDIO_DIR, STUDIO_PAGE, STATE_FILE, MEMORY_FILE, VALIDATE_RECORD, PUSH_RECO
 var init_studio = __esm({
   "src/studio.ts"() {
     init_studio_page();
+    init_qr();
     init_studio_timeline();
     init_progress();
     init_studio_page();
@@ -51325,21 +51633,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-DT6bRpY_.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1055972, sha256: "3a52c8395a6509cfe2cae8036024b987cd3361095ff5450bfd7a9efa0123850b" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1055980, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1060590, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1549174, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1640098, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1731082, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1822062, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1912934, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2003914, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2112550, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2221634, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2330682, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2438382, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2526490, length: 4947, sha256: "a9dcd2ec33b7ea5cee46b0a1f37f926678dd6939b442e3d50bff0101f0fe63ba" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2531437, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-D1gUsTY3.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1056804, sha256: "26589af001475b3ae732fdc5abd94d43c0b48f9d946b9fe6a2f27db0c7ba71a7" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1056812, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1061422, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1550006, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1640930, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1731914, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1822894, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1913766, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2004746, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2113382, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2222466, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2331514, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2439214, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2527322, length: 4947, sha256: "207153af042e0e1a166f74fcd50bd1052e9000b05e7bc7283c0514848af6bd31" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2532269, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -51348,6 +51656,8 @@ var init_preview_assets_generated = __esm({
 var run_exports = {};
 __export(run_exports, {
   NO_SPA_MESSAGE: () => NO_SPA_MESSAGE,
+  lanAddress: () => lanAddress,
+  lanFlagConflict: () => lanFlagConflict,
   loadPreviewAssets: () => loadPreviewAssets,
   makePackageRunHandler: () => makePackageRunHandler,
   packageUrl: () => packageUrl,
@@ -51356,7 +51666,7 @@ __export(run_exports, {
   withoutProdServe: () => withoutProdServe
 });
 import { cpSync as cpSync2, existsSync as existsSync55, mkdirSync as mkdirSync26, mkdtempSync as mkdtempSync3, readFileSync as readFileSync61, rmSync as rmSync12, statSync as statSync13 } from "node:fs";
-import { tmpdir as tmpdir4 } from "node:os";
+import { networkInterfaces as osNetworkInterfaces, tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname29, join as join54 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
 function makePackageRunHandler(opts) {
@@ -51460,10 +51770,37 @@ function packageUrl(origin, app, opts = {}) {
   const query = opts.surface ? `?surface=${encodeURIComponent(opts.surface)}` : "";
   return `${origin.replace(/\/$/, "")}${path2}${query}`;
 }
+function isPrivateLan(address) {
+  const [a, b] = address.split(".").map(Number);
+  return a === 10 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+}
+function lanAddress(ifaces = osNetworkInterfaces()) {
+  const found = [];
+  for (const [name, list] of Object.entries(ifaces)) {
+    if (UNREACHABLE_IFACE.test(name)) continue;
+    for (const i of list ?? []) {
+      const v4 = i.family === "IPv4" || i.family === 4;
+      if (v4 && !i.internal && isPrivateLan(i.address)) found.push({ name, address: i.address });
+    }
+  }
+  return (found.find((f) => LIKELY_LAN_IFACE.test(f.name)) ?? found[0])?.address ?? null;
+}
+function lanFlagConflict(f) {
+  if (!f.lan) return null;
+  if (f.browser) return { error: "--lan cannot be combined with --browser: that preview runs inside a desktop tab, with no server a phone could open. Drop --browser." };
+  if (f.spa) return { error: "--lan cannot be combined with --spa: the hosted page would read the preview from loopback, which on a phone is the phone itself. Drop --spa." };
+  return null;
+}
 function openBrowser(url) {
   openUrl(url);
 }
 async function runPackage(source, opts = {}) {
+  const conflict = lanFlagConflict(opts);
+  if (conflict) throw new Error(conflict.error);
+  const lanHost = opts.lan ? lanAddress((opts.networkInterfaces ?? osNetworkInterfaces)()) : null;
+  if (opts.lan && !lanHost) {
+    throw new Error("himi run --lan found no LAN address to share: connect this machine to the same Wi-Fi as the phone (a VPN tunnel does not count), or drop --lan");
+  }
   const resolved2 = await resolvePackage(source, opts.workDir);
   const assets = opts.assets ?? (opts.spa ? /* @__PURE__ */ new Map() : await loadPreviewAssets());
   if (!opts.spa && assets.size === 0) {
@@ -51481,16 +51818,38 @@ async function runPackage(source, opts = {}) {
   });
   const extra = opts.extraRoutes;
   const handler = extra ? (request) => extra(request) ?? plane(request) : plane;
-  const server = nodeAdapter(handler);
-  const host = opts.host ?? "127.0.0.1";
-  const port = await new Promise((resolvePort, reject) => {
-    server.once("error", reject);
-    server.listen(opts.port ?? 0, host, () => {
-      const addr = server.address();
-      resolvePort(typeof addr === "object" && addr ? addr.port : opts.port ?? 0);
+  const listen = (srv, port2, host2) => new Promise((resolveListen, reject) => {
+    srv.once("error", reject);
+    srv.listen(port2, host2, () => {
+      const addr = srv.address();
+      resolveListen(typeof addr === "object" && addr ? { port: addr.port, address: addr.address } : { port: port2, address: host2 });
     });
   });
+  const closeServer = (srv) => new Promise((done) => {
+    srv.closeAllConnections?.();
+    srv.close(() => done());
+  });
+  const host = opts.host ?? "127.0.0.1";
+  const server = nodeAdapter(handler);
+  const first = await listen(server, opts.port ?? 0, host);
+  const port = first.port;
+  const bound = [first.address];
+  const servers = [server];
+  if (lanHost) {
+    const lanServer = nodeAdapter(handler);
+    let lanBound;
+    try {
+      lanBound = (await listen(lanServer, port, lanHost)).address;
+    } catch (e) {
+      await closeServer(server);
+      if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
+      throw new Error(`himi run --lan could not listen on ${lanHost}:${port} (${e.message}); drop --lan, or pass --port for a free one`);
+    }
+    bound.push(lanBound);
+    servers.push(lanServer);
+  }
   const origin = `http://${host}:${port}`;
+  const lanUrl = lanHost ? packageUrl(`http://${lanHost}:${port}`, resolved2.app, opts) : void 0;
   const url = opts.spa ? `${packageUrl(opts.spa, resolved2.app, opts)}${opts.surface ? "&" : "?"}api=${encodeURIComponent(origin)}` : packageUrl(origin, resolved2.app, opts);
   if (opts.open) openBrowser(url);
   return {
@@ -51500,17 +51859,16 @@ async function runPackage(source, opts = {}) {
     url,
     releaseRoot: resolved2.releaseRoot,
     origin,
+    bound,
+    ...lanUrl ? { lanUrl } : {},
     warnings: resolved2.warnings,
-    close: () => new Promise((done) => {
-      server.closeAllConnections?.();
-      server.close(() => {
-        if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
-        done();
-      });
-    })
+    close: async () => {
+      await Promise.all(servers.map(closeServer));
+      if (resolved2.temp) rmSync12(resolved2.temp, { recursive: true, force: true });
+    }
   };
 }
-var NO_SPA_MESSAGE;
+var NO_SPA_MESSAGE, UNREACHABLE_IFACE, LIKELY_LAN_IFACE;
 var init_run = __esm({
   "src/run.ts"() {
     init_open_url();
@@ -51522,6 +51880,8 @@ var init_run = __esm({
     init_himi_package();
     init_himi_package();
     NO_SPA_MESSAGE = "the web-host SPA is not embedded in this build \u2014 run `node packages/serve/scripts/embed-preview-assets.mjs` (in a monorepo checkout), or pass --spa <url> to use a hosted preview host instead";
+    UNREACHABLE_IFACE = /^(utun|tun|tap|ppp|ipsec|wg|gif|stf|bridge|vmnet|vboxnet|virbr|docker|br-|veth|awdl|llw|anpi|tailscale|zt|zerotier|nordlynx)|vpn/i;
+    LIKELY_LAN_IFACE = /^(en|eth|wlan|wl|wifi)/i;
   }
 });
 
@@ -64427,278 +64787,8 @@ function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, r
   return { ok: errors.length === 0, errors };
 }
 
-// ../../core/admin-web/src/utils/qr.ts
-var ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
-var NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
-var QR_MAX_VERSION = 20;
-function rawDataModules(ver) {
-  let result = (16 * ver + 128) * ver + 64;
-  if (ver >= 2) {
-    const numAlign = Math.floor(ver / 7) + 2;
-    result -= (25 * numAlign - 10) * numAlign - 55;
-    if (ver >= 7) result -= 36;
-  }
-  return result;
-}
-var totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
-var dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
-function byteCapacity(ver) {
-  const lenBits = ver < 10 ? 8 : 16;
-  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
-}
-function fitVersion(len) {
-  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
-  return void 0;
-}
-var EXP = new Uint8Array(512);
-var LOG = new Uint8Array(256);
-(() => {
-  let x = 1;
-  for (let i = 0; i < 255; i++) {
-    EXP[i] = x;
-    LOG[x] = i;
-    x <<= 1;
-    if (x & 256) x ^= 285;
-  }
-  for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
-})();
-var gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
-function rsDivisor(degree) {
-  const result = new Array(degree).fill(0);
-  result[degree - 1] = 1;
-  let root = 1;
-  for (let i = 0; i < degree; i++) {
-    for (let j = 0; j < degree; j++) {
-      result[j] = gfMul(result[j], root);
-      if (j + 1 < degree) result[j] ^= result[j + 1];
-    }
-    root = gfMul(root, 2);
-  }
-  return result;
-}
-function rsRemainder(data, degree) {
-  const divisor = rsDivisor(degree);
-  const res = new Array(degree).fill(0);
-  for (const b of data) {
-    const factor = b ^ res.shift();
-    res.push(0);
-    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
-  }
-  return res;
-}
-function encodeData(bytes2, ver) {
-  const bits = [];
-  const push = (val, len) => {
-    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
-  };
-  push(4, 4);
-  push(bytes2.length, ver < 10 ? 8 : 16);
-  for (const b of bytes2) push(b, 8);
-  const capacityBits = dataCodewords(ver) * 8;
-  push(0, Math.min(4, capacityBits - bits.length));
-  while (bits.length % 8 !== 0) bits.push(0);
-  const out = [];
-  for (let i = 0; i < bits.length; i += 8) {
-    let byte2 = 0;
-    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
-    out.push(byte2);
-  }
-  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
-  return out;
-}
-function interleave(data, ver) {
-  const numBlocks = NUM_BLOCKS_L[ver];
-  const eccLen = ECC_PER_BLOCK_L[ver];
-  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
-  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
-  const blocks = [];
-  const eccs = [];
-  let off = 0;
-  for (let i = 0; i < numBlocks; i++) {
-    const len = shortLen + (i < numShort ? 0 : 1);
-    const blk = data.slice(off, off + len);
-    off += len;
-    blocks.push(blk);
-    eccs.push(rsRemainder(blk, eccLen));
-  }
-  const out = [];
-  for (let i = 0; i < shortLen + 1; i++) {
-    for (let b = 0; b < numBlocks; b++) {
-      const v = blocks[b][i];
-      if (v !== void 0) out.push(v);
-    }
-  }
-  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
-  return out;
-}
-function alignmentPositions(ver) {
-  if (ver === 1) return [];
-  const num3 = Math.floor(ver / 7) + 2;
-  const size = ver * 4 + 17;
-  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
-  const res = [6];
-  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
-  return res;
-}
-var MASKS = [
-  (x, y) => (x + y) % 2 === 0,
-  (_x, y) => y % 2 === 0,
-  (x) => x % 3 === 0,
-  (x, y) => (x + y) % 3 === 0,
-  (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
-  (x, y) => x * y % 2 + x * y % 3 === 0,
-  (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
-  (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
-];
-function bchFormat(data) {
-  let rem = data;
-  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
-  return (data << 10 | rem) ^ 21522;
-}
-function bchVersion(ver) {
-  let rem = ver;
-  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
-  return ver << 12 | rem;
-}
-function penalty(m, size) {
-  let score = 0;
-  const run2 = (get) => {
-    for (let i = 0; i < size; i++) {
-      let last = get(i, 0), len = 1;
-      for (let j = 1; j < size; j++) {
-        const cur = get(i, j);
-        if (cur === last) {
-          len++;
-          if (len === 5) score += 3;
-          else if (len > 5) score++;
-        } else {
-          last = cur;
-          len = 1;
-        }
-      }
-    }
-  };
-  run2((i, j) => m[i][j]);
-  run2((i, j) => m[j][i]);
-  for (let y = 0; y < size - 1; y++)
-    for (let x = 0; x < size - 1; x++) {
-      const c = m[y][x];
-      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
-    }
-  let dark = 0;
-  for (const row of m) for (const c of row) if (c) dark++;
-  const total = size * size;
-  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
-  return score;
-}
-function encodeQr(text5) {
-  const bytes2 = [...new TextEncoder().encode(text5)];
-  const version2 = fitVersion(bytes2.length);
-  if (!version2) {
-    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
-  }
-  const codewords = interleave(encodeData(bytes2, version2), version2);
-  const size = version2 * 4 + 17;
-  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
-  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
-  const set = (x, y, dark) => {
-    modules[y][x] = dark;
-    reserved[y][x] = true;
-  };
-  const finder = (cx, cy) => {
-    for (let dy = -4; dy <= 4; dy++)
-      for (let dx = -4; dx <= 4; dx++) {
-        const x = cx + dx, y = cy + dy;
-        if (x < 0 || y < 0 || x >= size || y >= size) continue;
-        const d = Math.max(Math.abs(dx), Math.abs(dy));
-        set(x, y, d !== 2 && d !== 4);
-      }
-  };
-  finder(3, 3);
-  finder(size - 4, 3);
-  finder(3, size - 4);
-  for (let i = 8; i < size - 8; i++) {
-    set(i, 6, i % 2 === 0);
-    set(6, i, i % 2 === 0);
-  }
-  for (const ay of alignmentPositions(version2))
-    for (const ax of alignmentPositions(version2)) {
-      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
-      for (let dy = -2; dy <= 2; dy++)
-        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
-    }
-  for (let i = 0; i < 9; i++) {
-    reserved[i][8] = true;
-    reserved[8][i] = true;
-  }
-  for (let i = 0; i < 8; i++) {
-    reserved[size - 1 - i][8] = true;
-    reserved[8][size - 1 - i] = true;
-  }
-  set(8, size - 8, true);
-  if (version2 >= 7)
-    for (let i = 0; i < 18; i++) {
-      const a = size - 11 + i % 3, b = Math.floor(i / 3);
-      reserved[a][b] = true;
-      reserved[b][a] = true;
-    }
-  let bit = 0;
-  const totalBits = codewords.length * 8;
-  for (let right = size - 1; right >= 1; right -= 2) {
-    if (right === 6) right = 5;
-    for (let vert = 0; vert < size; vert++) {
-      for (let j = 0; j < 2; j++) {
-        const x = right - j;
-        const upward = (right + 1 & 2) === 0;
-        const y = upward ? size - 1 - vert : vert;
-        if (reserved[y][x]) continue;
-        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
-        bit++;
-      }
-    }
-  }
-  let best = null, bestMask = 0, bestScore = Infinity;
-  for (let mask = 0; mask < 8; mask++) {
-    const cand = modules.map((row) => [...row]);
-    for (let y = 0; y < size; y++)
-      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
-    applyFormat(cand, size, mask);
-    if (version2 >= 7) applyVersion(cand, size, version2);
-    const s = penalty(cand, size);
-    if (s < bestScore) {
-      bestScore = s;
-      best = cand;
-      bestMask = mask;
-    }
-  }
-  return { size, version: version2, mask: bestMask, modules: best };
-}
-function applyFormat(m, size, mask) {
-  const bits = bchFormat(1 << 3 | mask);
-  const on3 = (i) => (bits >>> i & 1) === 1;
-  const put = (x, y, dark) => {
-    m[y][x] = dark;
-  };
-  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
-  put(8, 7, on3(6));
-  put(8, 8, on3(7));
-  put(7, 8, on3(8));
-  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
-  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
-  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
-  put(8, size - 8, true);
-}
-function applyVersion(m, size, version2) {
-  const bits = bchVersion(version2);
-  for (let i = 0; i < 18; i++) {
-    const on3 = (bits >>> i & 1) === 1;
-    const a = size - 11 + i % 3, b = Math.floor(i / 3);
-    m[a][b] = on3;
-    m[b][a] = on3;
-  }
-}
-
 // ../../core/admin-web/src/utils/qr-terminal.ts
+init_qr();
 function qrTerminal(text5, opts = {}) {
   const { modules, size } = encodeQr(text5);
   const quietZone = opts.quietZone ?? 4;
@@ -66085,6 +66175,7 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "force",
   "replace",
   "watch",
+  "lan",
   "no-claim",
   "new",
   "dev",
@@ -66503,7 +66594,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            file is not the plane's per-release archive.
   himi share --file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>
                                            publish a content-addressed package link for a released app
-  himi run [<package.himi|dir|url>] [--browser] [--watch] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
+  himi run [<package.himi|dir|url>] [--browser] [--watch] [--lan] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
                                            serve a package on localhost + open it in a browser. No serve
                                            plane, no dev-server. With no argument it packs the current
                                            content package first \u2014 edit, run, look at it.
@@ -66511,6 +66602,9 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            (a failed build keeps the last good preview). The build board
                                            is served beside it at /__himi/studio/ with the preview framed
                                            in it. Blocks until Ctrl-C.
+                                           --lan also serves it to the local network and prints a QR:
+                                           a phone on the same Wi-Fi opens it as the real app, full
+                                           screen. Read-only, but anyone on that network can open it.
   himi flags list|set|ramp|rm [<key>] [--app <a>]
                                            read/change operational flags (RFC 0013); writes report
                                            servedNow from the device door, never just ok
@@ -66857,7 +66951,7 @@ var COMMANDS = [
   { name: "import", summary: "turn a `himi pack --dev` package back into an EDITABLE content package \u2014 the file counterpart of `himi pull`, needing no serve plane, no account and no network. Refuses an invalid package before trusting its source (the content hash is recomputed over every entry on open, so the archive is provably the one that was packed), and refuses a RELEASE package by naming the absence \u2014 it carries built output and no source \u2014 rather than reporting a missing file. `--name` re-substitutes the app identity through the same machinery `himi init --template` and `himi pull --name` use, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A non-empty destination needs `--force` and a merge NAMES what it kept (`left: [...]`), the same contract `himi pull --force` has; a shape clash is refused whole before anything is written. There is no `--replace`: a file you were handed is not the plane's per-release archive.", required: "<package.himi> [--out <dir>] [--name <new>] [--force]" },
   { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A NON-EMPTY destination is refused unless you say which you mean: `--force` merges and reports \u2014 it writes the archive over what is there, keeps files the release does not carry, and NAMES every one of them as `left: [...]` so a tree that matches no release is never silent (#2437); `--replace` restores exactly what was archived, removing those files first (`removed: [...]`) and implying `--force`. `--replace` refuses a directory holding no `himalaya.content.json`, so a mistyped `--out` cannot clear an unrelated tree, and the only paths it can remove are the ones a push would have archived \u2014 `.git/`, `node_modules/`, `dist/`, `.env*` and key material are out of its reach by construction.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]" },
   { name: "share", summary: "publish or revoke a content-addressed `.himi` share link. The package must be a validated archive for an already-published release; the resulting https URL is safe to QR, copy, or open in Himi Player.", required: "--file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>" },
-  { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod. --watch keeps the preview LIVE: every save in the content package rebuilds it and repaints the open tab with only what changed (the dev-server's hot-reload events); a build that fails keeps the last good preview on screen and says why. Any `himi run` of a content package (plain, --watch or --browser) frames its preview on the build board (`himi studio`) while it serves, and all but --browser also serve that board at /__himi/studio/ on the preview's own origin.", required: "[<package.himi|dir|url>] [--browser] [--watch] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
+  { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod. --lan also serves it to the local network and prints a QR, so a phone on the same Wi-Fi opens it as the real app, full screen. --watch keeps the preview LIVE: every save in the content package rebuilds it and repaints the open tab with only what changed (the dev-server's hot-reload events); a build that fails keeps the last good preview on screen and says why. Any `himi run` of a content package (plain, --watch or --browser) frames its preview on the build board (`himi studio`) while it serves, and all but --browser also serve that board at /__himi/studio/ on the preview's own origin.", required: "[<package.himi|dir|url>] [--browser] [--watch] [--lan] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
   { name: "preview", summary: "print the shareable web URL + himi:// deep link + agent /v1/preview JSON URLs for an app+release; --surface frames the web preview as any catalog surface (?surface=)", required: "--app --release [--screen] [--surface]" },
   { name: "surfaces", summary: "the surface catalog vs this app's envelope (platforms.json): targeted surfaces, the opt-in key for the rest, per-surface preview links with --app --release, and which widget families the package produces with --measure-widgets (which runs its built bundles)", required: "[--content <dir>] [--app --release] [--measure-widgets]" },
   { name: "context", summary: "fetch the agent preview envelope (GET /v1/preview/a/<app>) \u2014 ok/issues/screens/links; exit 1 if ok:false", required: "--app --release [--screen] [--include telemetry]" },
@@ -71430,7 +71524,13 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
       // ---- himi run — serve a package on localhost and open it in a browser ----
       // Blocks until interrupted, like any dev server.
       case "run": {
-        const { runPackage: runPackage2 } = await Promise.resolve().then(() => (init_run(), run_exports));
+        const { runPackage: runPackage2, lanFlagConflict: lanFlagConflict2 } = await Promise.resolve().then(() => (init_run(), run_exports));
+        const spaFlag = flags.spa;
+        const lanConflict = lanFlagConflict2({ lan: flags.lan === true, browser: flags.browser === true, spa: typeof spaFlag === "string" || Array.isArray(spaFlag) ? String(spaFlag) : void 0 });
+        if (lanConflict) {
+          io.error(JSON.stringify({ ok: false, ...lanConflict }));
+          return 2;
+        }
         let source = pos[1];
         let temp = null;
         const watch2 = flags.watch === true;
@@ -71486,7 +71586,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let startedAt = "";
           const record2 = (served2, build2) => {
             try {
-              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, pid: process.pid, startedAt, watching: watch2, build: build2 })) recorded = true;
+              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, ...served2.lanUrl ? { lanUrl: served2.lanUrl } : {}, pid: process.pid, startedAt, watching: watch2, build: build2 })) recorded = true;
               return null;
             } catch (e) {
               return e.message;
@@ -71535,6 +71635,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             surface: str6(flags.surface),
             spa: str6(flags.spa),
             open: flags["no-open"] !== true,
+            lan: flags.lan === true,
             // The build board on the preview's own origin, for any run of this content package.
             ...recordKit ? { extraRoutes: (request) => recordKit.boardFile(dir, new URL(request.url).pathname) } : {},
             // `liveWix` only with --watch: that is the "click around while you work" window, and a
@@ -71607,12 +71708,23 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             await running.close();
             throw e;
           }
+          if (running.lanUrl) {
+            io.error(`himi run --lan: anyone on this network can open this preview (read-only) at ${running.lanUrl}`);
+            io.error("Scan it with your phone, on the same Wi-Fi:");
+            try {
+              const qr = qrTerminal(running.lanUrl);
+              io.error(qr.cols <= 60 ? qr.text : `  QR omitted (terminal width ${qr.cols} exceeds 60 columns)`);
+            } catch {
+              io.error("  QR omitted (link is too long)");
+            }
+          }
           print({
             ok: true,
             app: running.app,
             releaseId: running.releaseId,
             url: running.url,
             port: running.port,
+            ...running.lanUrl ? { lan: { url: running.lanUrl } } : {},
             ...watch2 ? { watching: dir } : {},
             ...recordKit && boardOpen(dir) ? { board: `${running.origin}/__himi/studio/` } : {},
             ...running.warnings.length ? { warnings: running.warnings } : {},

package/guides/headless-loop.md

@@ -101,7 +101,10 @@ fills, and a published draft or the handover is celebrated once. The tab title c
 ("(5/8) salon"), and the owner can switch on Sound and desktop notices from the board itself — both
 start off, so never promise them either. The board can also rewind the whole build — drag its timeline or
 press Replay for a thirty-second making-of, checks included — pop the live phone out into an
-always-on-top window, and show the owner their website next to their app the moment the brand lands. `himi test` writes one PNG per
+always-on-top window, and show the owner their website next to their app the moment the brand lands.
+To put the preview on the owner's phone, run `himi run --watch --lan` instead: it prints a QR (and
+the board shows one) that a phone on the same Wi-Fi opens as the real app, full screen, repainting as
+you edit. Say that anyone on that network can open it; it is read-only. `himi test` writes one PNG per
 screen to `.himi/shots/` on every run, so take the new screens from there instead of rendering each
 one again; a bare `--png` on `himi render` writes `.himi/shots/<id>.png`. `himi progress` copies each image into `.himi/history/`
 as it was when you journaled it, so a later render cannot change what the record says the owner saw;

package/guides/wix-business-context.md

@@ -145,6 +145,13 @@ Same collector, three doors:
 | `POST /v1/site/analyze` (BO-only) | JSON book + overlays + media URLs (no PNG bodies) |
 | MCP `himi_site_analyze` | Same JSON via `structuredContent` |
 
+`clientId` is optional on the HTTP and MCP doors too, as `--client-id` is on the CLI: a body of
+`{ "siteUrl": "https://…" }` alone is the URL-only pass — vertical probes `skipped`, no `wix` block
+in `provisioningOverlay`, and the response carries `urlOnly: true` plus a `note` saying the catalog
+counts and the binding need a `clientId`. `"apply": true` without a `clientId` is refused with
+`400 apply_needs_client_id`, the HTTP twin of `--apply` exiting 2. The door stays BO-only, and
+`siteUrl` is judged by the same public-host guard whether or not a client id is sent.
+
 The plane has no headless browser (`look.unavailable: no_browser_on_plane`). Owner token is a **request field**, never spawned via `wix token` on the guest. Blobs in the book are **URLs** (Media Manager / wixstatic), not S3 and not base64.
 
 `--apply` writes `appearance.homeLayout` + `navigation.navKind` plus identity/colors. It never silently overwrites committed Amit1 `apps/himi-branded-lite/provisioning.json`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1053.0",
+  "version": "0.1054.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "09a8cfb09738de91c22097314d5bb642195d40f284ccec170bb75968"
+  "falconPackageHash": "045caa3e88a506e031fb787279f23cc802f48565167f69eb533939ab"
 }