@wix/himalaya-cli 0.1055.0 → 0.1057.0

package/dist/cli.mjs

@@ -2168,462 +2168,1239 @@ var init_himi_report = __esm({
   }
 });
 
-// ../../core/serve-storage/src/widget-identity.ts
-function stableWidgets(widgets) {
-  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return widgets;
-  return Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
-    if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
-    const { contentEtag: _regenerated, ...stable } = value;
-    return [id, stable];
-  }));
-}
-var init_widget_identity = __esm({
-  "../../core/serve-storage/src/widget-identity.ts"() {
+// ../ai-review-gate/paths.mjs
+import { resolve as resolve3, dirname as dirname3 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var REPO_ROOT;
+var init_paths = __esm({
+  "../ai-review-gate/paths.mjs"() {
+    REPO_ROOT = resolve3(dirname3(fileURLToPath2(import.meta.url)), "../..");
   }
 });
 
-// ../../core/admin-web/src/utils/qr.ts
-function rawDataModules(ver) {
-  let result = (16 * ver + 128) * ver + 64;
-  if (ver >= 2) {
-    const numAlign = Math.floor(ver / 7) + 2;
-    result -= (25 * numAlign - 10) * numAlign - 55;
-    if (ver >= 7) result -= 36;
+// ../ai-review-gate/review-diff.mjs
+var init_review_diff = __esm({
+  "../ai-review-gate/review-diff.mjs"() {
+    init_paths();
   }
-  return result;
+});
+
+// ../pre-pr-review/command.mjs
+var SHELL_NAMES, SHELL_TOKEN;
+var init_command = __esm({
+  "../pre-pr-review/command.mjs"() {
+    SHELL_NAMES = "sh|bash|zsh|ksh|dash|ash|fish|csh|tcsh|pwsh|xonsh|nu";
+    SHELL_TOKEN = new RegExp(`^(?:.*/)?(?:${SHELL_NAMES})$`);
+  }
+});
+
+// ../pre-pr-review/scope.mjs
+import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import { resolve as resolve4, dirname as dirname4, isAbsolute, join as join4 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+function resolveRepoRoot(cwd = process.cwd()) {
+  let top;
+  try {
+    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).toString().trim();
+  } catch (err) {
+    throw new Error(`cannot resolve a repo root from ${cwd}: ${err?.message || err}`);
+  }
+  if (!top) throw new Error(`cannot resolve a repo root from ${cwd}: git named no toplevel`);
+  return top;
 }
-function byteCapacity(ver) {
-  const lenBits = ver < 10 ? 8 : 16;
-  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
+function git(args, opts = {}) {
+  return execFileSync("git", args, {
+    cwd: opts.cwd || REPO_ROOT2,
+    encoding: "utf8",
+    // A full PR diff can be megabytes; the default 1MB cap would truncate mid-hunk and the
+    // delta parser would then read a malformed diff as "unsupported shape".
+    maxBuffer: opts.maxBuffer ?? 256 * 1024 * 1024,
+    stdio: ["ignore", "pipe", "pipe"]
+  }).toString();
 }
-function fitVersion(len) {
-  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
-  return void 0;
+function diffHash(diff) {
+  return createHash("sha256").update(diff).digest("hex");
 }
-function rsDivisor(degree) {
-  const result = new Array(degree).fill(0);
-  result[degree - 1] = 1;
-  let root = 1;
-  for (let i = 0; i < degree; i++) {
-    for (let j = 0; j < degree; j++) {
-      result[j] = gfMul(result[j], root);
-      if (j + 1 < degree) result[j] ^= result[j + 1];
-    }
-    root = gfMul(root, 2);
+var REPO_ROOT2, BASE_REF;
+var init_scope = __esm({
+  "../pre-pr-review/scope.mjs"() {
+    init_paths();
+    init_review_diff();
+    init_command();
+    REPO_ROOT2 = resolve4(dirname4(fileURLToPath3(import.meta.url)), "../..");
+    BASE_REF = process.env.PRE_PR_REVIEW_BASE || "origin/master";
   }
-  return result;
+});
+
+// ../verify-gate/diff-hash.mjs
+import {
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync4,
+  mkdtempSync,
+  readFileSync as readFileSync4,
+  readlinkSync,
+  rmSync as rmSync2,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { createHash as createHash2 } from "node:crypto";
+import { tmpdir } from "node:os";
+import { basename, dirname as dirname5, join as join5, resolve as resolve5 } from "node:path";
+import { pathToFileURL } from "node:url";
+function isValidationMetadata(path2) {
+  return VALIDATION_METADATA.has(path2) || /(^|[\\/])\.himi([\\/]|$)/.test(path2);
 }
-function rsRemainder(data, degree) {
-  const divisor = rsDivisor(degree);
-  const res = new Array(degree).fill(0);
-  for (const b of data) {
-    const factor = b ^ res.shift();
-    res.push(0);
-    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
+function tryGit(args, root) {
+  try {
+    return git(args, { cwd: root });
+  } catch {
+    return null;
   }
-  return res;
 }
-function encodeData(bytes2, ver) {
-  const bits = [];
-  const push = (val, len) => {
-    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
-  };
-  push(4, 4);
-  push(bytes2.length, ver < 10 ? 8 : 16);
-  for (const b of bytes2) push(b, 8);
-  const capacityBits = dataCodewords(ver) * 8;
-  push(0, Math.min(4, capacityBits - bits.length));
-  while (bits.length % 8 !== 0) bits.push(0);
-  const out = [];
-  for (let i = 0; i < bits.length; i += 8) {
-    let byte2 = 0;
-    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
-    out.push(byte2);
+function committedRecords(raw) {
+  const fields = raw.split("\0");
+  if (fields.length > 0 && fields[fields.length - 1] === "") fields.pop();
+  if (fields.length % 2 !== 0) return null;
+  const records = [];
+  for (let i = 0; i < fields.length; i += 2) {
+    const metadata2 = fields[i];
+    const path2 = fields[i + 1];
+    if (!metadata2.startsWith(":") || path2 === "") return null;
+    if (isValidationMetadata(path2)) continue;
+    records.push(`${Buffer.byteLength(path2)}:${path2}\0${metadata2}\0`);
   }
-  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
-  return out;
+  return records.sort().join("");
 }
-function interleave(data, ver) {
-  const numBlocks = NUM_BLOCKS_L[ver];
-  const eccLen = ECC_PER_BLOCK_L[ver];
-  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
-  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
-  const blocks = [];
-  const eccs = [];
-  let off = 0;
-  for (let i = 0; i < numBlocks; i++) {
-    const len = shortLen + (i < numShort ? 0 : 1);
-    const blk = data.slice(off, off + len);
-    off += len;
-    blocks.push(blk);
-    eccs.push(rsRemainder(blk, eccLen));
+function committedIdentity(root) {
+  const head = tryGit(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], root)?.trim();
+  if (!head) return "unborn\0";
+  const base = tryGit(["merge-base", BASE_REF, "HEAD"], root)?.trim();
+  if (base) {
+    const raw = tryGit(["diff", "--raw", "--no-renames", "-z", "--no-abbrev", base, "HEAD"], root);
+    const records = raw === null ? null : committedRecords(raw);
+    if (records !== null) return `base\0${base}\0${records}`;
   }
-  const out = [];
-  for (let i = 0; i < shortLen + 1; i++) {
-    for (let b = 0; b < numBlocks; b++) {
-      const v = blocks[b][i];
-      if (v !== void 0) out.push(v);
-    }
+  const listing = tryGit(["ls-tree", "-rz", "--full-tree", "HEAD"], root);
+  const tree = listing === null ? null : treeRecords(listing);
+  return tree !== null ? `tree-listing\0${tree}` : `commit\0${head}\0`;
+}
+function treeRecords(listing) {
+  const records = [];
+  for (const record2 of listing.split("\0")) {
+    if (record2 === "") continue;
+    const tab = record2.indexOf("	");
+    if (tab <= 0 || tab === record2.length - 1) return null;
+    const path2 = record2.slice(tab + 1);
+    if (isValidationMetadata(path2)) continue;
+    records.push(`${Buffer.byteLength(path2)}:${path2}\0${record2.slice(0, tab)}\0`);
   }
-  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
-  return out;
+  return records.sort().join("");
 }
-function alignmentPositions(ver) {
-  if (ver === 1) return [];
-  const num3 = Math.floor(ver / 7) + 2;
-  const size = ver * 4 + 17;
-  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
-  const res = [6];
-  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
-  return res;
+function treeEntries(output, index = false) {
+  const entries = /* @__PURE__ */ new Map();
+  for (const record2 of output.split("\0").filter(Boolean)) {
+    const tab = record2.indexOf("	");
+    if (tab === -1) continue;
+    const metadata2 = record2.slice(0, tab).split(" ");
+    if (index && metadata2[2] !== "0") continue;
+    entries.set(record2.slice(tab + 1), {
+      mode: metadata2[0],
+      oid: index ? metadata2[1] : metadata2[2]
+    });
+  }
+  return entries;
 }
-function bchFormat(data) {
-  let rem = data;
-  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
-  return (data << 10 | rem) ^ 21522;
+function sameEntry(left, right) {
+  if (!left || !right) return left === right;
+  return left.mode === right.mode && left.oid === right.oid;
 }
-function bchVersion(ver) {
-  let rem = ver;
-  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
-  return ver << 12 | rem;
+function stagedIdentity(head, index, worktree) {
+  if (sameEntry(index, head) || sameEntry(index, worktree)) return "";
+  if (!index) return head ? "deleted" : "";
+  return `${index.mode}:${index.oid}`;
 }
-function penalty(m, size) {
-  let score = 0;
-  const run2 = (get) => {
-    for (let i = 0; i < size; i++) {
-      let last = get(i, 0), len = 1;
-      for (let j = 1; j < size; j++) {
-        const cur = get(i, j);
-        if (cur === last) {
-          len++;
-          if (len === 5) score += 3;
-          else if (len > 5) score++;
-        } else {
-          last = cur;
-          len = 1;
-        }
-      }
-    }
-  };
-  run2((i, j) => m[i][j]);
-  run2((i, j) => m[j][i]);
-  for (let y = 0; y < size - 1; y++)
-    for (let x = 0; x < size - 1; x++) {
-      const c = m[y][x];
-      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
-    }
-  let dark = 0;
-  for (const row of m) for (const c of row) if (c) dark++;
-  const total = size * size;
-  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
-  return score;
+function blobOid(contents, algorithm) {
+  const body = Buffer.isBuffer(contents) ? contents : Buffer.from(contents);
+  return createHash2(algorithm).update(Buffer.from(`blob ${body.byteLength}\0`)).update(body).digest("hex");
 }
-function encodeQr(text5) {
-  const bytes2 = [...new TextEncoder().encode(text5)];
-  const version2 = fitVersion(bytes2.length);
-  if (!version2) {
-    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
+function validationDiffHash(cwd = process.cwd()) {
+  const root = resolveRepoRoot(cwd);
+  const born = tryGit(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], root) !== null;
+  const staged = git(["diff", "--cached", "--name-only", "--no-renames", "-z", ...born ? ["HEAD"] : []], {
+    cwd: root
+  }).split("\0").filter(Boolean);
+  const unstaged = git(["diff", "--name-only", "--no-renames", "-z"], { cwd: root }).split("\0").filter(Boolean);
+  const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], {
+    cwd: root
+  }).split("\0").filter(Boolean);
+  const headEntries = born ? treeEntries(git(["ls-tree", "-rz", "--full-tree", "HEAD"], { cwd: root })) : /* @__PURE__ */ new Map();
+  const indexEntries = treeEntries(git(["ls-files", "--stage", "-z"], { cwd: root }), true);
+  const objectAlgorithm = git(["rev-parse", "--show-object-format"], { cwd: root }).trim();
+  let trustFilesystemMode = true;
+  try {
+    trustFilesystemMode = git(["config", "--bool", "--get", "core.fileMode"], { cwd: root }).trim() !== "false";
+  } catch {
   }
-  const codewords = interleave(encodeData(bytes2, version2), version2);
-  const size = version2 * 4 + 17;
-  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
-  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
-  const set = (x, y, dark) => {
-    modules[y][x] = dark;
-    reserved[y][x] = true;
-  };
-  const finder = (cx, cy) => {
-    for (let dy = -4; dy <= 4; dy++)
-      for (let dx = -4; dx <= 4; dx++) {
-        const x = cx + dx, y = cy + dy;
-        if (x < 0 || y < 0 || x >= size || y >= size) continue;
-        const d = Math.max(Math.abs(dx), Math.abs(dy));
-        set(x, y, d !== 2 && d !== 4);
+  const paths = [.../* @__PURE__ */ new Set([...staged, ...unstaged, ...untracked])].filter((path2) => !isValidationMetadata(path2)).sort();
+  const identity = paths.map((path2) => {
+    const absolute = resolve5(root, path2);
+    const headEntry = headEntries.get(path2);
+    const indexEntry = indexEntries.get(path2);
+    const deletedRecord = () => [`${Buffer.byteLength(path2)}:${path2}`, "deleted", stagedIdentity(headEntry, indexEntry, void 0), ""].join("\0");
+    let stat2;
+    try {
+      stat2 = lstatSync2(absolute);
+    } catch (error) {
+      if (error?.code === "ENOENT") return deletedRecord();
+      throw error;
+    }
+    try {
+      if (stat2.isSymbolicLink()) {
+        const target = readlinkSync(absolute);
+        const worktreeEntry = { mode: "120000", oid: blobOid(target, objectAlgorithm) };
+        const stagedState2 = stagedIdentity(headEntry, indexEntry, worktreeEntry);
+        return [
+          `${Buffer.byteLength(path2)}:${path2}`,
+          "symlink",
+          "120000",
+          diffHash(target),
+          stagedState2,
+          ""
+        ].join("\0");
       }
-  };
-  finder(3, 3);
-  finder(size - 4, 3);
-  finder(3, size - 4);
-  for (let i = 8; i < size - 8; i++) {
-    set(i, 6, i % 2 === 0);
-    set(6, i, i % 2 === 0);
-  }
-  for (const ay of alignmentPositions(version2))
-    for (const ax of alignmentPositions(version2)) {
-      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
-      for (let dy = -2; dy <= 2; dy++)
-        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
+      if (stat2.isFile()) {
+        const filesystemMode = stat2.mode & 73 ? "100755" : "100644";
+        const worktreeMode = trustFilesystemMode ? filesystemMode : indexEntry?.mode ?? headEntry?.mode ?? "100644";
+        const worktreeOid = git(["hash-object", `--path=${path2}`, "--", path2], { cwd: root }).trim();
+        const worktreeEntry = { mode: worktreeMode, oid: worktreeOid };
+        const stagedState2 = stagedIdentity(headEntry, indexEntry, worktreeEntry);
+        return [
+          `${Buffer.byteLength(path2)}:${path2}`,
+          "file",
+          worktreeMode,
+          diffHash(readFileSync4(absolute)),
+          stagedState2,
+          ""
+        ].join("\0");
+      }
+    } catch (error) {
+      try {
+        lstatSync2(absolute);
+      } catch (recheck) {
+        if (recheck?.code === "ENOENT") return deletedRecord();
+      }
+      throw error;
     }
-  for (let i = 0; i < 9; i++) {
-    reserved[i][8] = true;
-    reserved[8][i] = true;
-  }
-  for (let i = 0; i < 8; i++) {
-    reserved[size - 1 - i][8] = true;
-    reserved[8][size - 1 - i] = true;
-  }
-  set(8, size - 8, true);
-  if (version2 >= 7)
-    for (let i = 0; i < 18; i++) {
-      const a = size - 11 + i % 3, b = Math.floor(i / 3);
-      reserved[a][b] = true;
-      reserved[b][a] = true;
+    const type = stat2.isDirectory() ? "directory" : "other";
+    const stagedState = stagedIdentity(headEntry, indexEntry, void 0);
+    return [
+      `${Buffer.byteLength(path2)}:${path2}`,
+      type,
+      stat2.mode.toString(8),
+      stagedState,
+      ""
+    ].join("\0");
+  }).join("");
+  const committed = committedIdentity(root);
+  return diffHash(
+    `validation-change-v3\0${Buffer.byteLength(committed)}\0${committed}${identity}`
+  );
+}
+function seed(repo, commands) {
+  for (const args of commands) git(args, { cwd: repo });
+}
+function write(repo, rel, body) {
+  const absolute = resolve5(repo, rel);
+  mkdirSync4(dirname5(absolute), { recursive: true });
+  writeFileSync4(absolute, body);
+}
+function selfTestRepo({ withBase }) {
+  const repo = mkdtempSync(join5(tmpdir(), "diff-hash-self-test-"));
+  seed(repo, [
+    ["init", "-q", repo],
+    ["-C", repo, "config", "user.email", "self-test@test.invalid"],
+    ["-C", repo, "config", "user.name", "diff-hash-self-test"]
+  ]);
+  write(repo, "src/base.txt", "base\n");
+  seed(repo, [["-C", repo, "add", "-A"], ["-C", repo, "commit", "-qm", "base"]]);
+  const base = git(["-C", repo, "rev-parse", "HEAD"], { cwd: repo }).trim();
+  if (withBase) seed(repo, [["-C", repo, "update-ref", "refs/remotes/origin/master", base]]);
+  return { repo, base };
+}
+function commitChange(repo, base, branch, rel, body) {
+  seed(repo, [["-C", repo, "checkout", "-q", base], ["-C", repo, "checkout", "-q", "-b", branch]]);
+  write(repo, rel, body);
+  seed(repo, [["-C", repo, "add", rel], ["-C", repo, "commit", "-qm", `commit ${rel}`]]);
+  return validationDiffHash(repo);
+}
+function runSelfTest() {
+  let failed2 = 0;
+  for (const testCase of SELF_TEST_CASES) {
+    let ok = false;
+    let thrown = null;
+    try {
+      ok = testCase.run() === true;
+    } catch (error) {
+      thrown = error?.message || String(error);
     }
-  let bit = 0;
-  const totalBits = codewords.length * 8;
-  for (let right = size - 1; right >= 1; right -= 2) {
-    if (right === 6) right = 5;
-    for (let vert = 0; vert < size; vert++) {
-      for (let j = 0; j < 2; j++) {
-        const x = right - j;
-        const upward = (right + 1 & 2) === 0;
-        const y = upward ? size - 1 - vert : vert;
-        if (reserved[y][x]) continue;
-        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
-        bit++;
-      }
+    if (ok) {
+      process.stdout.write(`  \u2713 ${testCase.name}
+`);
+      continue;
     }
+    failed2++;
+    process.stderr.write(`  \u2717 ${testCase.name}
+      ${thrown ?? testCase.reason}
+`);
   }
-  let best = null, bestMask = 0, bestScore = Infinity;
-  for (let mask = 0; mask < 8; mask++) {
-    const cand = modules.map((row) => [...row]);
-    for (let y = 0; y < size; y++)
-      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
-    applyFormat(cand, size, mask);
-    if (version2 >= 7) applyVersion(cand, size, version2);
-    const s = penalty(cand, size);
-    if (s < bestScore) {
-      bestScore = s;
-      best = cand;
-      bestMask = mask;
+  return failed2;
+}
+var VALIDATION_METADATA, SELF_TEST_CASES;
+var init_diff_hash = __esm({
+  "../verify-gate/diff-hash.mjs"() {
+    init_scope();
+    VALIDATION_METADATA = /* @__PURE__ */ new Set([
+      ".claude/.validation-baseline.json",
+      ".claude/.validation-evidence.json"
+    ]);
+    SELF_TEST_CASES = [
+      {
+        name: "committed diffs are distinguished (the #1831 regression)",
+        reason: "two unrelated COMMITTED diffs share one identity \u2014 a record for either would satisfy the gate for the other",
+        run: () => {
+          const { repo, base } = selfTestRepo({ withBase: true });
+          try {
+            return commitChange(repo, base, "a", "src/alpha.txt", "alpha\n") !== commitChange(repo, base, "b", "src/beta.txt", "a different change\n");
+          } finally {
+            rmSync2(repo, { recursive: true, force: true });
+          }
+        }
+      },
+      {
+        name: "committed diffs are distinguished with NO base ref (fallback ladder)",
+        reason: "without origin/master the committed identity collapses to a constant",
+        run: () => {
+          const { repo, base } = selfTestRepo({ withBase: false });
+          try {
+            return commitChange(repo, base, "a", "src/alpha.txt", "alpha\n") !== commitChange(repo, base, "b", "src/beta.txt", "a different change\n");
+          } finally {
+            rmSync2(repo, { recursive: true, force: true });
+          }
+        }
+      },
+      {
+        name: "a clean tree is not the digest of an empty path list",
+        reason: 'a clean tree still hashes to sha256("validation-worktree-v2\\0"), the constant measured in #1831',
+        run: () => {
+          const { repo } = selfTestRepo({ withBase: true });
+          try {
+            return validationDiffHash(repo) !== createHash2("sha256").update("validation-worktree-v2\0").digest("hex");
+          } finally {
+            rmSync2(repo, { recursive: true, force: true });
+          }
+        }
+      },
+      {
+        name: "an uncommitted edit still changes the identity",
+        reason: "the working-tree half of the identity stopped responding to edits",
+        run: () => {
+          const { repo } = selfTestRepo({ withBase: true });
+          try {
+            const before = validationDiffHash(repo);
+            write(repo, "src/base.txt", "edited in the working tree\n");
+            return validationDiffHash(repo) !== before;
+          } finally {
+            rmSync2(repo, { recursive: true, force: true });
+          }
+        }
+      },
+      {
+        // The "can pass" half. Without it every case above is satisfied by a hash that simply
+        // changes every call, which would identify nothing and invalidate every record.
+        name: "one unchanged state hashes to one value",
+        reason: "the identity is not stable for an unchanged state \u2014 every record would read stale",
+        run: () => {
+          const { repo } = selfTestRepo({ withBase: true });
+          try {
+            write(repo, "src/base.txt", "edited in the working tree\n");
+            return validationDiffHash(repo) === validationDiffHash(repo);
+          } finally {
+            rmSync2(repo, { recursive: true, force: true });
+          }
+        }
+      }
+    ];
+    if (process.argv[1] && basename(process.argv[1]) === "diff-hash.mjs" && import.meta.url === pathToFileURL(process.argv[1]).href) {
+      if (process.argv.slice(2).includes("--self-test")) {
+        process.stdout.write("\u25B8 diff-hash --self-test: proving the identity can change, and can hold\n");
+        const failed2 = runSelfTest();
+        if (failed2) {
+          process.stderr.write(
+            `\u2717 diff-hash self-test FAILED (${failed2} case(s)) \u2014 the evidence record's diff identity cannot be trusted
+`
+          );
+          process.exit(1);
+        }
+        process.stdout.write(`\u2713 diff-hash self-test passed (${SELF_TEST_CASES.length} cases)
+`);
+      } else {
+        process.stdout.write(`${validationDiffHash()}
+`);
+      }
     }
   }
-  return { size, version: version2, mask: bestMask, modules: best };
+});
+
+// ../../core/serve-storage/src/widget-identity.ts
+function stableWidgets(widgets) {
+  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return widgets;
+  return Object.fromEntries(Object.entries(widgets).map(([id, value]) => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) return [id, value];
+    const { contentEtag: _regenerated, ...stable } = value;
+    return [id, stable];
+  }));
 }
-function applyFormat(m, size, mask) {
-  const bits = bchFormat(1 << 3 | mask);
-  const on3 = (i) => (bits >>> i & 1) === 1;
-  const put = (x, y, dark) => {
-    m[y][x] = dark;
-  };
-  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
-  put(8, 7, on3(6));
-  put(8, 8, on3(7));
-  put(7, 8, on3(8));
-  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
-  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
-  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
-  put(8, size - 8, true);
-}
-function applyVersion(m, size, version2) {
-  const bits = bchVersion(version2);
-  for (let i = 0; i < 18; i++) {
-    const on3 = (bits >>> i & 1) === 1;
-    const a = size - 11 + i % 3, b = Math.floor(i / 3);
-    m[a][b] = on3;
-    m[b][a] = on3;
-  }
-}
-var ECC_PER_BLOCK_L, NUM_BLOCKS_L, QR_MAX_VERSION, totalCodewords, dataCodewords, EXP, LOG, gfMul, MASKS;
-var init_qr = __esm({
-  "../../core/admin-web/src/utils/qr.ts"() {
-    ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
-    NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
-    QR_MAX_VERSION = 20;
-    totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
-    dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
-    EXP = new Uint8Array(512);
-    LOG = new Uint8Array(256);
-    (() => {
-      let x = 1;
-      for (let i = 0; i < 255; i++) {
-        EXP[i] = x;
-        LOG[x] = i;
-        x <<= 1;
-        if (x & 256) x ^= 285;
-      }
-      for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
-    })();
-    gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
-    MASKS = [
-      (x, y) => (x + y) % 2 === 0,
-      (_x, y) => y % 2 === 0,
-      (x) => x % 3 === 0,
-      (x, y) => (x + y) % 3 === 0,
-      (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
-      (x, y) => x * y % 2 + x * y % 3 === 0,
-      (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
-      (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
-    ];
+var init_widget_identity = __esm({
+  "../../core/serve-storage/src/widget-identity.ts"() {
   }
 });
 
-// ../../core/dev-server/src/wix-placeholders.ts
-var PLACEHOLDER_CLIENT_ID;
-var init_wix_placeholders = __esm({
-  "../../core/dev-server/src/wix-placeholders.ts"() {
-    PLACEHOLDER_CLIENT_ID = "YOUR_WIX_CLIENT_ID";
+// src/attestation.ts
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { createHash as createHash3, randomBytes } from "node:crypto";
+import {
+  existsSync as existsSync3,
+  lstatSync as lstatSync3,
+  mkdirSync as mkdirSync5,
+  realpathSync,
+  readlinkSync as readlinkSync2,
+  readFileSync as readFileSync5,
+  readdirSync as readdirSync3,
+  unlinkSync,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { basename as basename2, join as join6, relative, resolve as resolve6 } from "node:path";
+function attestationVersionOf(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const version2 = value.attestation;
+  return typeof version2 === "number" && Number.isInteger(version2) && version2 > 0 ? version2 : null;
+}
+function classifyRetainedRun(dir, name) {
+  let value;
+  try {
+    value = JSON.parse(readFileSync5(join6(dir, name), "utf8"));
+  } catch {
+    return { kind: "unreadable" };
   }
-});
-
-// ../../core/ts/src/widget-vocabulary.ts
-function isComponentAllowedForFamily(key2, family) {
-  return WIDGET_VOCABULARY[key2]?.[family] === true;
+  if (isAttestationV2(value)) return { kind: "current", run: value };
+  const version2 = attestationVersionOf(value);
+  if (version2 === null || version2 === ATTESTATION_VERSION) return { kind: "malformed" };
+  return { kind: version2 < ATTESTATION_VERSION ? "legacy" : "future" };
 }
-var WIDGET_VOCABULARY, WIDGET_COMPONENTS;
-var init_widget_vocabulary = __esm({
-  "../../core/ts/src/widget-vocabulary.ts"() {
-    WIDGET_VOCABULARY = {
-      "himalaya.VStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: true },
-      "himalaya.HStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: true },
-      "himalaya.ZStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Card": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
-      "himalaya.Text": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Image": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: true },
-      "himalaya.Icon": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Divider": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
-      "himalaya.Spacer": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Button": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: false },
-      "himalaya.ProgressBar": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Gauge": { ios_home: true, ios_lock: true, android_home: false, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      // Line/area/bar sparkline. No Glance Canvas → android_home:false (degrades), like Gauge.
-      "himalaya.Chart": { ios_home: true, ios_lock: true, android_home: false, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
-      "himalaya.Label": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
-      "himalaya.Chip": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
-      "himalaya.ListItem": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
-      "himalaya.LazyList": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
-      // ── RFC 0052 temporal vocabulary: a DECLARED divergence, not a gap ──────────
-      // A 42-cell month grid and an hour-gutter day timetable are not "too big for a
-      // widget" — they are the wrong SHAPE for one, and both are interactive (month
-      // paging, tap-to-select, drag-to-reschedule) where a widget snapshot is frozen.
-      // Shrinking either produces something illegible rather than something smaller,
-      // so they are excluded from EVERY family, deliberately.
-      "himalaya.MonthCalendar": { ios_home: false, ios_lock: false, android_home: false, web_card: false, ios_live_activity: false, watch_complication: false, car_list: false },
-      "himalaya.TimeGrid": { ios_home: false, ios_lock: false, android_home: false, web_card: false, ios_live_activity: false, watch_complication: false, car_list: false },
-      // Agenda IS admitted: it is list-shaped, so it degrades to "the next few things"
-      // exactly the way LazyList/ListItem do — and "what's next today" is the single
-      // most useful widget a calendar can produce. Its row mirrors LazyList's: the
-      // accessory surfaces (lock / Live Activity / complication) drop lists entirely.
-      "himalaya.Agenda": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true }
-    };
-    WIDGET_COMPONENTS = new Set(Object.keys(WIDGET_VOCABULARY));
+function screenshotArtifactPath(contentDir2, hash) {
+  return join6(resolve6(contentDir2), ".himi", "attestations", "artifacts", `${hash}.png`);
+}
+function canonical(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  const record2 = value;
+  return `{${Object.keys(record2).filter((key2) => record2[key2] !== void 0).sort().map((key2) => `${JSON.stringify(key2)}:${canonical(record2[key2])}`).join(",")}}`;
+}
+function releasePayloadHash(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return sha2562(canonical(payload));
+  const record2 = payload;
+  const manifest = record2.manifest;
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return sha2562(canonical(payload));
+  const manifestRecord = manifest;
+  const widgets = manifestRecord.widgets;
+  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return sha2562(canonical(payload));
+  return sha2562(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets(widgets) } }));
+}
+function withoutSelfHash(attestation) {
+  const { selfHash: _selfHash, ...body } = attestation;
+  return body;
+}
+function selfHashFor(attestation) {
+  return sha2562(canonical(withoutSelfHash(attestation)));
+}
+function repoRoot(contentDir2) {
+  try {
+    const root = execFileSync2("git", ["-C", contentDir2, "rev-parse", "--show-toplevel"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim();
+    if (!root) return null;
+    execFileSync2("git", ["-C", root, "rev-parse", "--verify", "--quiet", "HEAD^{commit}"], { stdio: "ignore" });
+    return root;
+  } catch {
+    return null;
   }
-});
-
-// ../../core/ts/src/preview-surfaces.ts
-function surfaceById(id) {
-  return PREVIEW_SURFACES.find((s) => s.id === id);
 }
-function surfaceFrozenFamily(surface) {
-  const gate = surface.gate;
-  return gate.kind === "family" || gate.kind === "projection" ? gate.family : void 0;
+function storedContentDir(contentDir2) {
+  const absolute = resolve6(contentDir2);
+  const root = repoRoot(absolute);
+  return root ? relative(root, absolute) || "." : ".";
 }
-function isWidgetFamilySurface(surface) {
-  return surface.gate.kind === "family";
+function currentGitDiffHash(contentDir2) {
+  const root = repoRoot(resolve6(contentDir2));
+  if (!root) return "unavailable";
+  return validationDiffHash(root);
 }
-function surfaceRenderMode(surface) {
-  const { kind } = surface.gate;
-  return kind === "family" || kind === "projection" ? "frozen" : "interactive";
+function currentGitUntrackedHash(contentDir2) {
+  const unresolved = resolve6(contentDir2);
+  const absolute = realpathSync.native(unresolved);
+  const root = repoRoot(absolute);
+  if (!root) return sourceTreeHash(absolute);
+  const scope = relative(root, absolute) || ".";
+  const listed = execFileSync2("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--", scope], {
+    encoding: "utf8",
+    maxBuffer: GIT_HASH_MAX_BUFFER
+  });
+  const hash = createHash3("sha256");
+  for (const path2 of listed.split("\0").filter(Boolean).sort()) {
+    const local = relative(absolute, join6(root, path2));
+    const segs = local.split(/[\\/]/);
+    if (NOT_ATTESTED_DIRS.has(segs[0])) continue;
+    if (segs.length === 1 && AGENT_TOOLING_ROOT_FILES.includes(segs[0])) continue;
+    const full = join6(root, path2);
+    const stats = lstatSync3(full, { throwIfNoEntry: false });
+    if (!stats) continue;
+    const kind = stats.isSymbolicLink() ? "link" : stats.isDirectory() ? "dir" : stats.isFile() ? "file" : null;
+    if (!kind) continue;
+    const payload = kind === "link" ? Buffer.from(readlinkSync2(full)) : kind === "file" ? readFileSync5(full) : Buffer.alloc(0);
+    const pathBytes = Buffer.from(path2);
+    hash.update(`${kind} ${pathBytes.length} ${payload.length}
+`).update(pathBytes).update(payload);
+  }
+  return hash.digest("hex");
 }
-function isViewTarget(key2) {
-  return SURFACE_GROUPS.includes(key2) || surfaceById(key2) !== void 0;
+function sourceTreeHash(root) {
+  const hash = createHash3("sha256");
+  const visit = (dir) => {
+    for (const entry of readdirSync3(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
+      if (entry.isDirectory() && (entry.name === ".git" || entry.name === "node_modules" || NOT_ATTESTED_DIRS.has(entry.name))) continue;
+      const path2 = join6(dir, entry.name);
+      const local = relative(root, path2);
+      if (dir === root && entry.isFile() && AGENT_TOOLING_ROOT_FILES.includes(entry.name)) continue;
+      if (entry.isDirectory()) visit(path2);
+      else if (entry.isFile()) hash.update(local).update("\0").update(readFileSync5(path2)).update("\0");
+      else if (entry.isSymbolicLink()) hash.update(local).update("\0link\0").update(readlinkSync2(path2)).update("\0");
+    }
+  };
+  visit(root);
+  return hash.digest("hex");
 }
-function viewTargetRenderMode(target) {
-  if (target === "frozen") return "frozen";
-  if (SURFACE_GROUPS.includes(target)) return "interactive";
-  const surface = surfaceById(target);
-  return surface ? surfaceRenderMode(surface) : void 0;
+function isAttestationV2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const a = value;
+  const coverage = a.coverage;
+  const report2 = a.report;
+  return a.attestation === 2 && typeof a.runId === "string" && ["himi-test", "himi-render", "himi-shots"].includes(a.tool) && [a.app, a.contentDir, a.gitDiffHash, a.gitUntrackedHash, a.releaseId, a.releaseHash, a.selfHash].every((item) => typeof item === "string" && item.length > 0) && stringRecord(a.descriptorHashes) && stringRecord(a.screenshots) && !!coverage && [coverage.screens, coverage.actionsDispatched, coverage.uncoveredFns, coverage.gaps].every((count) => typeof count === "number" && Number.isFinite(count) && count >= 0) && typeof report2?.ok === "boolean" && !!report2.counts && [report2.counts.errors, report2.counts.warnings, report2.counts.gaps].every((count) => typeof count === "number" && Number.isFinite(count) && count >= 0) && (a.prev === null || typeof a.prev === "string");
 }
-function resolveSurfaceViewKey(surfaceId, registered) {
-  const ladder = SURFACE_VIEW_LADDER[surfaceId];
-  if (!ladder) return void 0;
-  const keys = registered instanceof Set ? registered : new Set(registered);
-  return ladder.find((rung) => keys.has(rung));
+function readLatestAttestation(contentDir2) {
+  try {
+    const parsed = JSON.parse(readFileSync5(join6(resolve6(contentDir2), ".himi", "attestations", "latest.json"), "utf8"));
+    return isAttestationV2(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
 }
-function isTargeted(surface, platforms) {
-  if (surface.platformKey === null) return true;
-  if (surface.platformKey === "macos") return platforms.macos !== false;
-  return platforms[surface.platformKey] === true;
+function readRetainedAttestations(contentDir2) {
+  const dir = join6(resolve6(contentDir2), ".himi", "attestations");
+  if (!existsSync3(dir)) return { runs: [], errors: [] };
+  try {
+    const names = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json");
+    const parsedRuns = [];
+    const errors = [];
+    for (const name of names) {
+      const classified = classifyRetainedRun(dir, name);
+      if (classified.kind === "current") parsedRuns.push(classified.run);
+      else if (classified.kind === "legacy") {
+        errors.push(`attestation history contains retained run ${name} from an older attestation version \u2014 re-run himi test/render to start a v${ATTESTATION_VERSION} chain`);
+      } else if (classified.kind === "future") {
+        errors.push(`attestation history contains retained run ${name} from a newer attestation version \u2014 upgrade himi rather than deleting it`);
+      } else if (classified.kind === "unreadable") {
+        errors.push(`attestation history contains unreadable retained run ${name}`);
+      } else errors.push(`attestation history contains malformed retained run ${name}`);
+    }
+    const latest = readLatestAttestation(contentDir2);
+    if (existsSync3(join6(dir, "latest.json")) && !latest) errors.push("attestation history has no valid latest.json");
+    else if (names.length > 0 && !latest) errors.push("attestation history has no latest.json");
+    const byHash = new Map(parsedRuns.map((run2) => [run2.selfHash, run2]));
+    if (byHash.size !== parsedRuns.length) errors.push("attestation history contains duplicate self hashes");
+    for (const run2 of parsedRuns) {
+      if (selfHashFor(run2) !== run2.selfHash) errors.push(`selfHash does not match retained run ${run2.runId}`);
+      for (const expected of Object.values(run2.screenshots)) {
+        const path2 = screenshotArtifactPath(contentDir2, expected);
+        if (!existsSync3(path2)) errors.push(`missing screenshot for retained run ${run2.runId}: ${basename2(path2)}`);
+        else if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match retained run ${run2.runId}: ${basename2(path2)}`);
+      }
+    }
+    const runs = [];
+    const seen = /* @__PURE__ */ new Set();
+    let cursor = latest ?? void 0;
+    while (cursor && !seen.has(cursor.selfHash)) {
+      runs.push(cursor);
+      seen.add(cursor.selfHash);
+      cursor = cursor.prev ? byHash.get(cursor.prev) : void 0;
+    }
+    if (latest && !byHash.has(latest.selfHash)) errors.push("latest.json has no matching retained run");
+    if (seen.size !== parsedRuns.length) errors.push("attestation hash chain does not reach every retained run");
+    runs.push(...parsedRuns.filter((run2) => !seen.has(run2.selfHash)).sort((a, b) => a.runId < b.runId ? 1 : -1));
+    return {
+      runs,
+      errors
+    };
+  } catch {
+    return { runs: [], errors: ["attestation history could not be read"] };
+  }
 }
-function surfacesForApp(platforms, producedFamilies) {
-  const produced = producedFamilies === void 0 ? void 0 : producedFamilies instanceof Set ? producedFamilies : new Set(producedFamilies);
-  return PREVIEW_SURFACES.map((surface) => {
-    const inEnvelope = isTargeted(surface, platforms);
-    const family = isWidgetFamilySurface(surface) ? surfaceFrozenFamily(surface) : void 0;
-    if (produced && family !== void 0) {
-      const isProduced = produced.has(family);
-      return inEnvelope && isProduced ? { surface, targeted: true, produced: true } : {
-        surface,
-        targeted: false,
-        produced: isProduced,
-        // The four native families carry no platform key, so there is nothing to
-        // offer; `web_card` and `watch_complication` DO have one, and when that is
-        // the half that is missing it is still the right advice. Hence the guard —
-        // it is load-bearing for two families, not defensive padding.
-        ...inEnvelope ? {} : surface.platformKey ? { optIn: `"${surface.platformKey}": true` } : {},
-        ...isProduced ? {} : {
-          // The rebuild half is not padding: the produced set is read off BUILT
-          // bundles, so an author who has just written the registration and not
-          // rebuilt lands here too, and "write defineWidget" alone would be advice
-          // to write the code they are looking at.
-          needs: `defineWidget({ family: "${family}", \u2026 }) in a Tier-5 bundle \u2014 and a rebuild, if you just added it`
-        }
-      };
+function selectAttestationForPush(runs) {
+  const newestBehavioral = runs.find((run2) => run2.tool === "himi-test");
+  if (!newestBehavioral) return runs[0];
+  const behavioralIndex = runs.indexOf(newestBehavioral);
+  const newerFailure = runs.slice(0, behavioralIndex).find((run2) => run2.report.ok === false);
+  return newerFailure ?? newestBehavioral;
+}
+function inRepoCommit(releaseId) {
+  const m = /^([0-9a-f]{40})(?:-[0-9a-f]{12})?$/.exec(releaseId ?? "");
+  return m ? m[1] : null;
+}
+function sameReleaseCommit(a, b) {
+  if (a !== void 0 && a === b) return true;
+  const commit = inRepoCommit(a);
+  return commit !== null && commit === inRepoCommit(b);
+}
+function pushEvidence(contentDir2, releaseId, verify) {
+  const retained = readRetainedAttestations(contentDir2);
+  const sameCommit = retained.runs.filter((candidate) => sameReleaseCommit(candidate.releaseId, releaseId));
+  const verified = sameCommit.filter((candidate) => candidate.releaseId === releaseId).filter(verify);
+  const selected = selectAttestationForPush(verified);
+  return {
+    ...selected ? { selected } : {},
+    historyErrors: retained.errors,
+    staleRuns: verified.length === 0 ? sameCommit.length : 0
+  };
+}
+function summaryOf(attestation) {
+  return {
+    runId: attestation.runId,
+    selfHash: attestation.selfHash,
+    tool: attestation.tool,
+    screenIds: Object.keys(attestation.descriptorHashes).sort(),
+    coverage: attestation.coverage,
+    report: { ok: attestation.report.ok, counts: attestation.report.counts },
+    gitDiffHash: attestation.gitDiffHash,
+    releaseHash: attestation.releaseHash
+  };
+}
+function writeAttestation(input, opts = {}) {
+  const contentDir2 = resolve6(input.contentDir);
+  const dir = join6(contentDir2, ".himi", "attestations");
+  mkdirSync5(dir, { recursive: true });
+  const previous = readLatestAttestation(contentDir2);
+  const runId = `${(opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()}-${(opts.randomSuffix ?? (() => randomBytes(3).toString("hex")))()}`;
+  const descriptorHashes = Object.fromEntries(
+    Object.entries(input.descriptors).sort(([a], [b]) => a.localeCompare(b)).map(([screen, bytes2]) => [screen, sha2562(bytes2)])
+  );
+  const screenshotEntries = Object.entries(input.screenshots ?? {}).sort(([a], [b]) => a.localeCompare(b)).filter(([, path2]) => existsSync3(path2)).map(([screen, path2]) => {
+    const bytes2 = readFileSync5(path2);
+    return { screen, bytes: bytes2, hash: sha2562(bytes2) };
+  });
+  const screenshots = Object.fromEntries(screenshotEntries.map(({ screen, hash }) => [screen, hash]));
+  for (const { bytes: bytes2, hash } of screenshotEntries) {
+    const artifact = screenshotArtifactPath(contentDir2, hash);
+    mkdirSync5(join6(dir, "artifacts"), { recursive: true });
+    if (!existsSync3(artifact)) writeFileSync5(artifact, bytes2);
+  }
+  const unsigned = {
+    attestation: 2,
+    runId,
+    tool: input.tool,
+    app: input.app,
+    contentDir: storedContentDir(contentDir2),
+    gitDiffHash: input.gitDiffHash,
+    releaseId: input.releaseId,
+    releaseHash: releasePayloadHash(input.releasePayload),
+    gitUntrackedHash: currentGitUntrackedHash(contentDir2),
+    descriptorHashes,
+    screenshots,
+    coverage: input.coverage,
+    report: input.report,
+    prev: previous?.selfHash ?? null
+  };
+  const attestation = { ...unsigned, selfHash: "" };
+  attestation.selfHash = selfHashFor(attestation);
+  const json5 = JSON.stringify(attestation, null, 2) + "\n";
+  const runFile = `${runId.replace(/:/g, "-")}.json`;
+  writeFileSync5(join6(dir, runFile), json5);
+  writeFileSync5(join6(dir, "latest.json"), json5);
+  const keep = Math.max(1, opts.maxRuns ?? DEFAULT_MAX_RUNS);
+  const allPriorRuns = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json").filter((name) => name !== runFile).sort().reverse();
+  const priorRuns = allPriorRuns.filter((name) => {
+    const kind = classifyRetainedRun(dir, name).kind;
+    if (kind === "legacy") {
+      unlinkSync(join6(dir, name));
+      return false;
     }
-    if (inEnvelope) return { surface, targeted: true };
-    return surface.platformKey ? { surface, targeted: false, optIn: `"${surface.platformKey}": true` } : { surface, targeted: false };
+    return kind !== "future";
+  });
+  for (const name of priorRuns.slice(Math.max(0, keep - 1))) unlinkSync(join6(dir, name));
+  const retainedFiles = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json");
+  const retainedRuns = retainedFiles.map((name) => {
+    const classified = classifyRetainedRun(dir, name);
+    return classified.kind === "current" ? classified.run : null;
   });
+  if (retainedRuns.every((run2) => run2 !== null)) {
+    const retainedScreenshotHashes = new Set(
+      retainedRuns.flatMap((run2) => Object.values(run2.screenshots))
+    );
+    const artifactDir = join6(dir, "artifacts");
+    if (existsSync3(artifactDir)) {
+      for (const name of readdirSync3(artifactDir).filter((candidate) => candidate.endsWith(".png"))) {
+        if (!retainedScreenshotHashes.has(name.slice(0, -4))) unlinkSync(join6(artifactDir, name));
+      }
+    }
+  }
+  return attestation;
 }
-function resolveSurfaceEnvelope(platforms, requested) {
-  const envelope = PREVIEW_SURFACES.filter((s) => isTargeted(s, platforms)).map((s) => s.id);
-  if (requested == null) return { enabled: envelope, rejected: [] };
-  const inEnvelope = new Set(envelope);
-  const enabled = [];
-  const rejected = [];
-  for (const id of requested) {
-    if (inEnvelope.has(id)) {
-      if (!enabled.includes(id)) enabled.push(id);
-    } else if (!surfaceById(id)) {
-      rejected.push({ id, reason: `"${id}" is not a surface` });
+function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, releasePayload, opts = {}) {
+  const errors = [];
+  if (selfHashFor(attestation) !== attestation.selfHash) errors.push("selfHash does not match the attestation bytes");
+  try {
+    const dir = join6(resolve6(contentDir2), ".himi", "attestations");
+    const latest = readLatestAttestation(contentDir2);
+    if (!latest || opts.requireLatest !== false && latest.selfHash !== attestation.selfHash) {
+      errors.push("attestation does not match latest.json");
     } else {
-      const key2 = surfaceById(id).platformKey;
-      rejected.push({
-        id,
-        reason: `"${id}" is outside this binary's envelope \u2014 add ${key2 ? `"${key2}": true` : "the target"} to apps/<app>/platforms.json and ship a new binary`
-      });
+      const classified = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json").map((name) => classifyRetainedRun(dir, name)).filter((entry) => entry.kind !== "future");
+      const retained = classified.map((entry) => entry.kind === "current" ? entry.run : null);
+      if (retained.some((run2) => run2 === null)) {
+        errors.push("attestation history contains a malformed retained run");
+      } else {
+        const runs = retained;
+        const byHash = new Map(runs.map((run2) => [run2.selfHash, run2]));
+        if (!byHash.has(attestation.selfHash)) errors.push("attestation has no matching retained run");
+        if (!byHash.has(latest.selfHash)) {
+          errors.push("latest.json has no matching retained run");
+        } else {
+          const seen = /* @__PURE__ */ new Set();
+          let cursor = latest;
+          while (cursor && !seen.has(cursor.selfHash)) {
+            seen.add(cursor.selfHash);
+            if (selfHashFor(cursor) !== cursor.selfHash) {
+              errors.push(`selfHash does not match retained run ${cursor.runId}`);
+              break;
+            }
+            cursor = cursor.prev ? byHash.get(cursor.prev) : void 0;
+          }
+          if (seen.size !== runs.length) errors.push("attestation hash chain does not reach every retained run");
+        }
+      }
     }
+  } catch {
+    errors.push("attestation history could not be verified");
   }
-  return { enabled: envelope.filter((id) => enabled.includes(id)), rejected };
-}
-function isComponentAllowed(surface, componentType) {
-  const gate = surface.gate;
-  if (gate.kind === "none") return { allowed: true };
-  if (gate.kind === "framework") {
-    const missing = gate.unavailable[componentType];
-    return missing ? { allowed: false, reason: `${missing} is unavailable on ${gate.platform}` } : { allowed: true };
+  if (attestation.app !== expectedApp) errors.push(`attestation app does not match ${expectedApp}`);
+  if (attestation.contentDir !== storedContentDir(contentDir2)) errors.push("attestation contentDir does not match the requested content directory");
+  if (releasePayloadHash(releasePayload) !== attestation.releaseHash) {
+    errors.push("releaseHash does not match the current release payload");
   }
-  if (gate.kind === "projection") {
-    return WIDGET_VOCABULARY[componentType]?.[gate.family] ? { allowed: true } : {
-      allowed: false,
-      // Name the catalog. "No Android Auto template expresses himalaya.Gauge"
-      // tells an author it is unsupported; adding "(templates: list)" tells them
-      // WHAT the surface can express, which is the thing they can act on.
-      reason: `no ${gate.platform} template expresses ${componentType} (templates: ${gate.templates.join(", ")})`
-    };
+  try {
+    const liveDiffHash = currentGitDiffHash(contentDir2);
+    if (liveDiffHash !== "unavailable" && liveDiffHash !== attestation.gitDiffHash) {
+      errors.push("gitDiffHash does not match the live git diff");
+    }
+  } catch {
+    errors.push("gitDiffHash could not be recomputed from the live git diff");
   }
-  const row = WIDGET_VOCABULARY[componentType];
-  if (!row) return { allowed: true };
-  return row[gate.family] ? { allowed: true } : { allowed: false, reason: `not in the ${gate.family} allowlist` };
-}
-var PREVIEW_EXEMPT_PLATFORM_KEYS, WATCH_UNAVAILABLE, CAR_TEMPLATES, PROJECTION_SNAPSHOT_SIZE, widgetSurface, PREVIEW_SURFACES, SURFACE_GROUPS, SURFACE_VIEW_LADDER;
-var init_preview_surfaces = __esm({
-  "../../core/ts/src/preview-surfaces.ts"() {
-    init_widget_vocabulary();
-    PREVIEW_EXEMPT_PLATFORM_KEYS = ["astro"];
-    WATCH_UNAVAILABLE = {
-      "himalaya.WebView": "WebKit",
-      "himalaya.VideoPlayer": "AVKit",
-      "himalaya.Lottie": "Lottie",
+  try {
+    const liveUntrackedHash = currentGitUntrackedHash(contentDir2);
+    if (liveUntrackedHash !== "unavailable" && liveUntrackedHash !== attestation.gitUntrackedHash) {
+      errors.push("gitUntrackedHash does not match the live untracked source bytes");
+    }
+  } catch {
+    errors.push("gitUntrackedHash could not be recomputed from the live untracked source bytes");
+  }
+  for (const [screen, expected] of Object.entries(attestation.descriptorHashes)) {
+    const bytes2 = descriptors[screen];
+    if (bytes2 === void 0) {
+      errors.push(`missing baked descriptor for ${screen}`);
+      continue;
+    }
+    if (sha2562(bytes2) !== expected) errors.push(`descriptor hash does not match for ${screen}`);
+  }
+  for (const [screen, expected] of Object.entries(attestation.screenshots)) {
+    const path2 = screenshotArtifactPath(contentDir2, expected);
+    if (!existsSync3(path2)) {
+      errors.push(`missing screenshot for ${screen}: ${basename2(path2)}`);
+      continue;
+    }
+    if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match for ${screen}: ${basename2(path2)}`);
+  }
+  return { ok: errors.length === 0, errors };
+}
+var DEFAULT_MAX_RUNS, ATTESTATION_VERSION, GIT_HASH_MAX_BUFFER, sha2562, NOT_ATTESTED_DIRS, stringRecord;
+var init_attestation = __esm({
+  "src/attestation.ts"() {
+    init_diff_hash();
+    init_source_deny();
+    init_widget_identity();
+    DEFAULT_MAX_RUNS = 20;
+    ATTESTATION_VERSION = 2;
+    GIT_HASH_MAX_BUFFER = 128 * 1024 * 1024;
+    sha2562 = (bytes2) => createHash3("sha256").update(bytes2).digest("hex");
+    NOT_ATTESTED_DIRS = /* @__PURE__ */ new Set([".himi", ...AGENT_TOOLING_DIRS]);
+    stringRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
+  }
+});
+
+// ../../core/admin-web/src/utils/qr.ts
+function rawDataModules(ver) {
+  let result = (16 * ver + 128) * ver + 64;
+  if (ver >= 2) {
+    const numAlign = Math.floor(ver / 7) + 2;
+    result -= (25 * numAlign - 10) * numAlign - 55;
+    if (ver >= 7) result -= 36;
+  }
+  return result;
+}
+function byteCapacity(ver) {
+  const lenBits = ver < 10 ? 8 : 16;
+  return dataCodewords(ver) - Math.ceil((4 + lenBits) / 8);
+}
+function fitVersion(len) {
+  for (let v = 1; v <= QR_MAX_VERSION; v++) if (byteCapacity(v) >= len) return v;
+  return void 0;
+}
+function rsDivisor(degree) {
+  const result = new Array(degree).fill(0);
+  result[degree - 1] = 1;
+  let root = 1;
+  for (let i = 0; i < degree; i++) {
+    for (let j = 0; j < degree; j++) {
+      result[j] = gfMul(result[j], root);
+      if (j + 1 < degree) result[j] ^= result[j + 1];
+    }
+    root = gfMul(root, 2);
+  }
+  return result;
+}
+function rsRemainder(data, degree) {
+  const divisor = rsDivisor(degree);
+  const res = new Array(degree).fill(0);
+  for (const b of data) {
+    const factor = b ^ res.shift();
+    res.push(0);
+    for (let i = 0; i < degree; i++) res[i] ^= gfMul(divisor[i], factor);
+  }
+  return res;
+}
+function encodeData(bytes2, ver) {
+  const bits = [];
+  const push = (val, len) => {
+    for (let i = len - 1; i >= 0; i--) bits.push(val >>> i & 1);
+  };
+  push(4, 4);
+  push(bytes2.length, ver < 10 ? 8 : 16);
+  for (const b of bytes2) push(b, 8);
+  const capacityBits = dataCodewords(ver) * 8;
+  push(0, Math.min(4, capacityBits - bits.length));
+  while (bits.length % 8 !== 0) bits.push(0);
+  const out = [];
+  for (let i = 0; i < bits.length; i += 8) {
+    let byte2 = 0;
+    for (let j = 0; j < 8; j++) byte2 = byte2 << 1 | bits[i + j];
+    out.push(byte2);
+  }
+  for (let pad2 = 236; out.length < dataCodewords(ver); pad2 ^= 236 ^ 17) out.push(pad2);
+  return out;
+}
+function interleave(data, ver) {
+  const numBlocks = NUM_BLOCKS_L[ver];
+  const eccLen = ECC_PER_BLOCK_L[ver];
+  const shortLen = Math.floor(totalCodewords(ver) / numBlocks) - eccLen;
+  const numShort = numBlocks - totalCodewords(ver) % numBlocks;
+  const blocks = [];
+  const eccs = [];
+  let off = 0;
+  for (let i = 0; i < numBlocks; i++) {
+    const len = shortLen + (i < numShort ? 0 : 1);
+    const blk = data.slice(off, off + len);
+    off += len;
+    blocks.push(blk);
+    eccs.push(rsRemainder(blk, eccLen));
+  }
+  const out = [];
+  for (let i = 0; i < shortLen + 1; i++) {
+    for (let b = 0; b < numBlocks; b++) {
+      const v = blocks[b][i];
+      if (v !== void 0) out.push(v);
+    }
+  }
+  for (let i = 0; i < eccLen; i++) for (let b = 0; b < numBlocks; b++) out.push(eccs[b][i]);
+  return out;
+}
+function alignmentPositions(ver) {
+  if (ver === 1) return [];
+  const num3 = Math.floor(ver / 7) + 2;
+  const size = ver * 4 + 17;
+  const step = Math.ceil((ver * 4 + 4) / (num3 * 2 - 2)) * 2;
+  const res = [6];
+  for (let pos = size - 7; res.length < num3; pos -= step) res.splice(1, 0, pos);
+  return res;
+}
+function bchFormat(data) {
+  let rem = data;
+  for (let i = 0; i < 10; i++) rem = rem << 1 ^ (rem >>> 9) * 1335;
+  return (data << 10 | rem) ^ 21522;
+}
+function bchVersion(ver) {
+  let rem = ver;
+  for (let i = 0; i < 12; i++) rem = rem << 1 ^ (rem >>> 11) * 7973;
+  return ver << 12 | rem;
+}
+function penalty(m, size) {
+  let score = 0;
+  const run2 = (get) => {
+    for (let i = 0; i < size; i++) {
+      let last = get(i, 0), len = 1;
+      for (let j = 1; j < size; j++) {
+        const cur = get(i, j);
+        if (cur === last) {
+          len++;
+          if (len === 5) score += 3;
+          else if (len > 5) score++;
+        } else {
+          last = cur;
+          len = 1;
+        }
+      }
+    }
+  };
+  run2((i, j) => m[i][j]);
+  run2((i, j) => m[j][i]);
+  for (let y = 0; y < size - 1; y++)
+    for (let x = 0; x < size - 1; x++) {
+      const c = m[y][x];
+      if (c === m[y][x + 1] && c === m[y + 1][x] && c === m[y + 1][x + 1]) score += 3;
+    }
+  let dark = 0;
+  for (const row of m) for (const c of row) if (c) dark++;
+  const total = size * size;
+  score += Math.floor(Math.abs(dark * 20 - total * 10) / total) * 10;
+  return score;
+}
+function encodeQr(text5) {
+  const bytes2 = [...new TextEncoder().encode(text5)];
+  const version2 = fitVersion(bytes2.length);
+  if (!version2) {
+    throw new RangeError(`QR payload too long: ${bytes2.length} bytes exceeds version ${QR_MAX_VERSION} at EC level L`);
+  }
+  const codewords = interleave(encodeData(bytes2, version2), version2);
+  const size = version2 * 4 + 17;
+  const modules = Array.from({ length: size }, () => new Array(size).fill(false));
+  const reserved = Array.from({ length: size }, () => new Array(size).fill(false));
+  const set = (x, y, dark) => {
+    modules[y][x] = dark;
+    reserved[y][x] = true;
+  };
+  const finder = (cx, cy) => {
+    for (let dy = -4; dy <= 4; dy++)
+      for (let dx = -4; dx <= 4; dx++) {
+        const x = cx + dx, y = cy + dy;
+        if (x < 0 || y < 0 || x >= size || y >= size) continue;
+        const d = Math.max(Math.abs(dx), Math.abs(dy));
+        set(x, y, d !== 2 && d !== 4);
+      }
+  };
+  finder(3, 3);
+  finder(size - 4, 3);
+  finder(3, size - 4);
+  for (let i = 8; i < size - 8; i++) {
+    set(i, 6, i % 2 === 0);
+    set(6, i, i % 2 === 0);
+  }
+  for (const ay of alignmentPositions(version2))
+    for (const ax of alignmentPositions(version2)) {
+      if (ax === 6 && ay === 6 || ax === 6 && ay === size - 7 || ax === size - 7 && ay === 6) continue;
+      for (let dy = -2; dy <= 2; dy++)
+        for (let dx = -2; dx <= 2; dx++) set(ax + dx, ay + dy, Math.max(Math.abs(dx), Math.abs(dy)) !== 1);
+    }
+  for (let i = 0; i < 9; i++) {
+    reserved[i][8] = true;
+    reserved[8][i] = true;
+  }
+  for (let i = 0; i < 8; i++) {
+    reserved[size - 1 - i][8] = true;
+    reserved[8][size - 1 - i] = true;
+  }
+  set(8, size - 8, true);
+  if (version2 >= 7)
+    for (let i = 0; i < 18; i++) {
+      const a = size - 11 + i % 3, b = Math.floor(i / 3);
+      reserved[a][b] = true;
+      reserved[b][a] = true;
+    }
+  let bit = 0;
+  const totalBits = codewords.length * 8;
+  for (let right = size - 1; right >= 1; right -= 2) {
+    if (right === 6) right = 5;
+    for (let vert = 0; vert < size; vert++) {
+      for (let j = 0; j < 2; j++) {
+        const x = right - j;
+        const upward = (right + 1 & 2) === 0;
+        const y = upward ? size - 1 - vert : vert;
+        if (reserved[y][x]) continue;
+        modules[y][x] = bit < totalBits ? (codewords[bit >>> 3] >>> 7 - (bit & 7) & 1) === 1 : false;
+        bit++;
+      }
+    }
+  }
+  let best = null, bestMask = 0, bestScore = Infinity;
+  for (let mask = 0; mask < 8; mask++) {
+    const cand = modules.map((row) => [...row]);
+    for (let y = 0; y < size; y++)
+      for (let x = 0; x < size; x++) if (!reserved[y][x] && MASKS[mask](x, y)) cand[y][x] = !cand[y][x];
+    applyFormat(cand, size, mask);
+    if (version2 >= 7) applyVersion(cand, size, version2);
+    const s = penalty(cand, size);
+    if (s < bestScore) {
+      bestScore = s;
+      best = cand;
+      bestMask = mask;
+    }
+  }
+  return { size, version: version2, mask: bestMask, modules: best };
+}
+function applyFormat(m, size, mask) {
+  const bits = bchFormat(1 << 3 | mask);
+  const on3 = (i) => (bits >>> i & 1) === 1;
+  const put = (x, y, dark) => {
+    m[y][x] = dark;
+  };
+  for (let i = 0; i <= 5; i++) put(8, i, on3(i));
+  put(8, 7, on3(6));
+  put(8, 8, on3(7));
+  put(7, 8, on3(8));
+  for (let i = 9; i < 15; i++) put(14 - i, 8, on3(i));
+  for (let i = 0; i < 8; i++) put(size - 1 - i, 8, on3(i));
+  for (let i = 8; i < 15; i++) put(8, size - 15 + i, on3(i));
+  put(8, size - 8, true);
+}
+function applyVersion(m, size, version2) {
+  const bits = bchVersion(version2);
+  for (let i = 0; i < 18; i++) {
+    const on3 = (bits >>> i & 1) === 1;
+    const a = size - 11 + i % 3, b = Math.floor(i / 3);
+    m[a][b] = on3;
+    m[b][a] = on3;
+  }
+}
+var ECC_PER_BLOCK_L, NUM_BLOCKS_L, QR_MAX_VERSION, totalCodewords, dataCodewords, EXP, LOG, gfMul, MASKS;
+var init_qr = __esm({
+  "../../core/admin-web/src/utils/qr.ts"() {
+    ECC_PER_BLOCK_L = [0, 7, 10, 15, 20, 26, 18, 20, 24, 30, 18, 20, 24, 26, 30, 22, 24, 28, 30, 28, 28];
+    NUM_BLOCKS_L = [0, 1, 1, 1, 1, 1, 2, 2, 2, 2, 4, 4, 4, 4, 4, 6, 6, 6, 6, 7, 8];
+    QR_MAX_VERSION = 20;
+    totalCodewords = (ver) => Math.floor(rawDataModules(ver) / 8);
+    dataCodewords = (ver) => totalCodewords(ver) - ECC_PER_BLOCK_L[ver] * NUM_BLOCKS_L[ver];
+    EXP = new Uint8Array(512);
+    LOG = new Uint8Array(256);
+    (() => {
+      let x = 1;
+      for (let i = 0; i < 255; i++) {
+        EXP[i] = x;
+        LOG[x] = i;
+        x <<= 1;
+        if (x & 256) x ^= 285;
+      }
+      for (let i = 255; i < 512; i++) EXP[i] = EXP[i - 255];
+    })();
+    gfMul = (a, b) => a === 0 || b === 0 ? 0 : EXP[LOG[a] + LOG[b]];
+    MASKS = [
+      (x, y) => (x + y) % 2 === 0,
+      (_x, y) => y % 2 === 0,
+      (x) => x % 3 === 0,
+      (x, y) => (x + y) % 3 === 0,
+      (x, y) => (Math.floor(y / 2) + Math.floor(x / 3)) % 2 === 0,
+      (x, y) => x * y % 2 + x * y % 3 === 0,
+      (x, y) => (x * y % 2 + x * y % 3) % 2 === 0,
+      (x, y) => ((x + y) % 2 + x * y % 3) % 2 === 0
+    ];
+  }
+});
+
+// ../../core/dev-server/src/wix-placeholders.ts
+var PLACEHOLDER_CLIENT_ID;
+var init_wix_placeholders = __esm({
+  "../../core/dev-server/src/wix-placeholders.ts"() {
+    PLACEHOLDER_CLIENT_ID = "YOUR_WIX_CLIENT_ID";
+  }
+});
+
+// ../../core/ts/src/widget-vocabulary.ts
+function isComponentAllowedForFamily(key2, family) {
+  return WIDGET_VOCABULARY[key2]?.[family] === true;
+}
+var WIDGET_VOCABULARY, WIDGET_COMPONENTS;
+var init_widget_vocabulary = __esm({
+  "../../core/ts/src/widget-vocabulary.ts"() {
+    WIDGET_VOCABULARY = {
+      "himalaya.VStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: true },
+      "himalaya.HStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: true },
+      "himalaya.ZStack": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Card": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
+      "himalaya.Text": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Image": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: true },
+      "himalaya.Icon": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Divider": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
+      "himalaya.Spacer": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Button": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: false },
+      "himalaya.ProgressBar": { ios_home: true, ios_lock: true, android_home: true, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Gauge": { ios_home: true, ios_lock: true, android_home: false, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      // Line/area/bar sparkline. No Glance Canvas → android_home:false (degrades), like Gauge.
+      "himalaya.Chart": { ios_home: true, ios_lock: true, android_home: false, web_card: true, ios_live_activity: true, watch_complication: true, car_list: false },
+      "himalaya.Label": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
+      "himalaya.Chip": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: true, watch_complication: false, car_list: false },
+      "himalaya.ListItem": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
+      "himalaya.LazyList": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true },
+      // ── RFC 0052 temporal vocabulary: a DECLARED divergence, not a gap ──────────
+      // A 42-cell month grid and an hour-gutter day timetable are not "too big for a
+      // widget" — they are the wrong SHAPE for one, and both are interactive (month
+      // paging, tap-to-select, drag-to-reschedule) where a widget snapshot is frozen.
+      // Shrinking either produces something illegible rather than something smaller,
+      // so they are excluded from EVERY family, deliberately.
+      "himalaya.MonthCalendar": { ios_home: false, ios_lock: false, android_home: false, web_card: false, ios_live_activity: false, watch_complication: false, car_list: false },
+      "himalaya.TimeGrid": { ios_home: false, ios_lock: false, android_home: false, web_card: false, ios_live_activity: false, watch_complication: false, car_list: false },
+      // Agenda IS admitted: it is list-shaped, so it degrades to "the next few things"
+      // exactly the way LazyList/ListItem do — and "what's next today" is the single
+      // most useful widget a calendar can produce. Its row mirrors LazyList's: the
+      // accessory surfaces (lock / Live Activity / complication) drop lists entirely.
+      "himalaya.Agenda": { ios_home: true, ios_lock: false, android_home: true, web_card: true, ios_live_activity: false, watch_complication: false, car_list: true }
+    };
+    WIDGET_COMPONENTS = new Set(Object.keys(WIDGET_VOCABULARY));
+  }
+});
+
+// ../../core/ts/src/preview-surfaces.ts
+function surfaceById(id) {
+  return PREVIEW_SURFACES.find((s) => s.id === id);
+}
+function surfaceFrozenFamily(surface) {
+  const gate = surface.gate;
+  return gate.kind === "family" || gate.kind === "projection" ? gate.family : void 0;
+}
+function isWidgetFamilySurface(surface) {
+  return surface.gate.kind === "family";
+}
+function surfaceRenderMode(surface) {
+  const { kind } = surface.gate;
+  return kind === "family" || kind === "projection" ? "frozen" : "interactive";
+}
+function isViewTarget(key2) {
+  return SURFACE_GROUPS.includes(key2) || surfaceById(key2) !== void 0;
+}
+function viewTargetRenderMode(target) {
+  if (target === "frozen") return "frozen";
+  if (SURFACE_GROUPS.includes(target)) return "interactive";
+  const surface = surfaceById(target);
+  return surface ? surfaceRenderMode(surface) : void 0;
+}
+function resolveSurfaceViewKey(surfaceId, registered) {
+  const ladder = SURFACE_VIEW_LADDER[surfaceId];
+  if (!ladder) return void 0;
+  const keys = registered instanceof Set ? registered : new Set(registered);
+  return ladder.find((rung) => keys.has(rung));
+}
+function isTargeted(surface, platforms) {
+  if (surface.platformKey === null) return true;
+  if (surface.platformKey === "macos") return platforms.macos !== false;
+  return platforms[surface.platformKey] === true;
+}
+function surfacesForApp(platforms, producedFamilies) {
+  const produced = producedFamilies === void 0 ? void 0 : producedFamilies instanceof Set ? producedFamilies : new Set(producedFamilies);
+  return PREVIEW_SURFACES.map((surface) => {
+    const inEnvelope = isTargeted(surface, platforms);
+    const family = isWidgetFamilySurface(surface) ? surfaceFrozenFamily(surface) : void 0;
+    if (produced && family !== void 0) {
+      const isProduced = produced.has(family);
+      return inEnvelope && isProduced ? { surface, targeted: true, produced: true } : {
+        surface,
+        targeted: false,
+        produced: isProduced,
+        // The four native families carry no platform key, so there is nothing to
+        // offer; `web_card` and `watch_complication` DO have one, and when that is
+        // the half that is missing it is still the right advice. Hence the guard —
+        // it is load-bearing for two families, not defensive padding.
+        ...inEnvelope ? {} : surface.platformKey ? { optIn: `"${surface.platformKey}": true` } : {},
+        ...isProduced ? {} : {
+          // The rebuild half is not padding: the produced set is read off BUILT
+          // bundles, so an author who has just written the registration and not
+          // rebuilt lands here too, and "write defineWidget" alone would be advice
+          // to write the code they are looking at.
+          needs: `defineWidget({ family: "${family}", \u2026 }) in a Tier-5 bundle \u2014 and a rebuild, if you just added it`
+        }
+      };
+    }
+    if (inEnvelope) return { surface, targeted: true };
+    return surface.platformKey ? { surface, targeted: false, optIn: `"${surface.platformKey}": true` } : { surface, targeted: false };
+  });
+}
+function resolveSurfaceEnvelope(platforms, requested) {
+  const envelope = PREVIEW_SURFACES.filter((s) => isTargeted(s, platforms)).map((s) => s.id);
+  if (requested == null) return { enabled: envelope, rejected: [] };
+  const inEnvelope = new Set(envelope);
+  const enabled = [];
+  const rejected = [];
+  for (const id of requested) {
+    if (inEnvelope.has(id)) {
+      if (!enabled.includes(id)) enabled.push(id);
+    } else if (!surfaceById(id)) {
+      rejected.push({ id, reason: `"${id}" is not a surface` });
+    } else {
+      const key2 = surfaceById(id).platformKey;
+      rejected.push({
+        id,
+        reason: `"${id}" is outside this binary's envelope \u2014 add ${key2 ? `"${key2}": true` : "the target"} to apps/<app>/platforms.json and ship a new binary`
+      });
+    }
+  }
+  return { enabled: envelope.filter((id) => enabled.includes(id)), rejected };
+}
+function isComponentAllowed(surface, componentType) {
+  const gate = surface.gate;
+  if (gate.kind === "none") return { allowed: true };
+  if (gate.kind === "framework") {
+    const missing = gate.unavailable[componentType];
+    return missing ? { allowed: false, reason: `${missing} is unavailable on ${gate.platform}` } : { allowed: true };
+  }
+  if (gate.kind === "projection") {
+    return WIDGET_VOCABULARY[componentType]?.[gate.family] ? { allowed: true } : {
+      allowed: false,
+      // Name the catalog. "No Android Auto template expresses himalaya.Gauge"
+      // tells an author it is unsupported; adding "(templates: list)" tells them
+      // WHAT the surface can express, which is the thing they can act on.
+      reason: `no ${gate.platform} template expresses ${componentType} (templates: ${gate.templates.join(", ")})`
+    };
+  }
+  const row = WIDGET_VOCABULARY[componentType];
+  if (!row) return { allowed: true };
+  return row[gate.family] ? { allowed: true } : { allowed: false, reason: `not in the ${gate.family} allowlist` };
+}
+var PREVIEW_EXEMPT_PLATFORM_KEYS, WATCH_UNAVAILABLE, CAR_TEMPLATES, PROJECTION_SNAPSHOT_SIZE, widgetSurface, PREVIEW_SURFACES, SURFACE_GROUPS, SURFACE_VIEW_LADDER;
+var init_preview_surfaces = __esm({
+  "../../core/ts/src/preview-surfaces.ts"() {
+    init_widget_vocabulary();
+    PREVIEW_EXEMPT_PLATFORM_KEYS = ["astro"];
+    WATCH_UNAVAILABLE = {
+      "himalaya.WebView": "WebKit",
+      "himalaya.VideoPlayer": "AVKit",
+      "himalaya.Lottie": "Lottie",
       "himalaya.Rive": "RiveRuntime"
     };
     CAR_TEMPLATES = ["list"];
@@ -3224,7 +4001,7 @@ function appConfigTs(app) {
   return join10(appDir(app), "config.ts");
 }
 var REPO_ROOT3, withoutExt;
-var init_paths = __esm({
+var init_paths2 = __esm({
   "../store-release/paths.ts"() {
     REPO_ROOT3 = resolveRepoRoot2();
     withoutExt = (p) => p.replace(/\\/g, "/").replace(/\.(?:[mc]?ts|[mc]?js)$/, "");
@@ -3418,7 +4195,7 @@ function splashPlan(app, configTs, manifestPath, hasIosMarkers) {
 var LABEL_IOS_SPLASH, IOS_COLORSET_NAME, ANDROID_COLOR_RES, ANDROID_STYLE_NAME, ANDROID_SPLASH_FILE, ANDROID_SPLASH_PARENT, DEFAULT_BACKGROUND_TOKEN, GENERATED_XML_NOTE;
 var init_splash = __esm({
   "../native-config/splash.ts"() {
-    init_paths();
+    init_paths2();
     LABEL_IOS_SPLASH = "himalaya:splash:info";
     IOS_COLORSET_NAME = "HimalayaLaunchBackground";
     ANDROID_COLOR_RES = "himalaya_splash_background";
@@ -14629,11 +15406,12 @@ function uxEvidenceForRelease(content, release) {
     const failedPlatforms = forRelease.filter(([, entry]) => entry.status === "failed").map(([platform]) => platform);
     return failedPlatforms.length > 0 ? { ...base, state: "failed", platforms, failedPlatforms, malformed } : { ...base, state: "recorded", platforms, malformed };
   }
-  if (recorded.some(([, entry]) => entry.releaseId === releaseId)) {
+  const sameCommit = recorded.filter(([, entry]) => sameReleaseCommit(entry.releaseId, releaseId));
+  if (sameCommit.length > 0) {
     return {
       ...base,
       state: "outdated",
-      platforms: recorded.filter(([, entry]) => entry.releaseId === releaseId).map(([platform]) => platform),
+      platforms: sameCommit.map(([platform]) => platform),
       malformed
     };
   }
@@ -14650,6 +15428,7 @@ var NATIVE_PLATFORMS, NATIVE_AUDIT_STATUSES;
 var init_ux_evidence = __esm({
   "src/ux-evidence.ts"() {
     init_mobile_ux_contract();
+    init_attestation();
     NATIVE_PLATFORMS = ["ios", "android"];
     NATIVE_AUDIT_STATUSES = ["passed", "failed", "unavailable"];
   }
@@ -15947,7 +16726,7 @@ function generationAllowed(app, configTs, opts = {}) {
 var DEFAULT_ACCENT_TOKEN, DEFAULT_GLYPH_SCALE, GLYPH_SCALE_MIN, GLYPH_SCALE_MAX, LEGACY_PLACEHOLDER_SHA256;
 var init_plan2 = __esm({
   "../app-icons/plan.ts"() {
-    init_paths();
+    init_paths2();
     init_glyphs();
     DEFAULT_ACCENT_TOKEN = "accentPrimary";
     DEFAULT_GLYPH_SCALE = 0.62;
@@ -16015,7 +16794,7 @@ var ANDROID_ICON_BACKGROUND_RES, ANDROID_ADAPTIVE_FILES, ANDROID_ICON_BACKGROUND
 var init_icon2 = __esm({
   "../native-config/icon.ts"() {
     init_plan2();
-    init_paths();
+    init_paths2();
     ANDROID_ICON_BACKGROUND_RES = "ic_launcher_background";
     ANDROID_ADAPTIVE_FILES = ["ic_launcher.xml", "ic_launcher_round.xml"];
     ANDROID_ICON_BACKGROUND_FILE = "ic_launcher_background.xml";
@@ -16524,7 +17303,7 @@ var init_gen_native_config = __esm({
   "../native-config/gen-native-config.ts"() {
     init_src2();
     init_src2();
-    init_paths();
+    init_paths2();
     init_splash();
     init_icon2();
     init_live_activity();
@@ -22033,7 +22812,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -25634,7 +26412,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -26948,7 +27725,7 @@ function ensureInitialFocusRuntime() {
     initialFocusScheduled = false;
     const targets = Array.from(document.querySelectorAll("[data-himalaya-initial-focus]"));
     const active = document.activeElement;
-    const unplaced = active == null || active === document.body;
+    const unplaced = active == null || active === document.body || active.hasAttribute?.("data-himalaya-focus-landing") === true;
     const fresh = targets.filter((t) => !initialFocusSeen.has(t));
     let presented;
     let presentedScope = null;
@@ -37209,6 +37986,44 @@ var init_src6 = __esm({
   }
 });
 
+// ../../core/serve-storage/src/release-patch.ts
+import { createHash as createHash17 } from "node:crypto";
+function sha256hex(b) {
+  return createHash17("sha256").update(b).digest("hex");
+}
+function stableStringify(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(stableStringify).join(",") + "]";
+  const object = value;
+  return "{" + Object.keys(object).sort().map((key2) => JSON.stringify(key2) + ":" + stableStringify(object[key2])).join(",") + "}";
+}
+function manifestContent(m) {
+  const {
+    releaseId: _releaseId,
+    gitSha: _gitSha,
+    shellSha: _shellSha,
+    label: _label,
+    notes: _notes,
+    publishedAt: _publishedAt,
+    publishedBy: _publishedBy,
+    attestation: _attestation,
+    forcedPastErrors: _forcedPastErrors,
+    ...content
+  } = m;
+  return content;
+}
+function releaseContentId(m) {
+  const content = manifestContent(m);
+  const widgets = content.widgets;
+  if (widgets && typeof widgets === "object" && !Array.isArray(widgets)) content.widgets = stableWidgets(widgets);
+  return sha256hex(stableStringify(content));
+}
+var init_release_patch = __esm({
+  "../../core/serve-storage/src/release-patch.ts"() {
+    init_widget_identity();
+  }
+});
+
 // ../../core/dev-server/src/net-scenario.ts
 function resolveScenario(rules, req, upstream) {
   const ctx = {
@@ -39922,11 +40737,11 @@ var init_dependencies = __esm({
 });
 
 // ../../core/functions-build/src/sbom.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function createFunctionSbom(packages) {
   const components2 = [...packages].sort((a, b) => a.name.localeCompare(b.name)).map(({ name, version: version2, integrity: integrity2, license }) => ({ name, version: version2, integrity: integrity2, license }));
   const body = JSON.stringify({ format: "himalaya-sbom-v1", components: components2 });
-  return { format: "himalaya-sbom-v1", components: components2, hash: createHash17("sha256").update(body).digest("hex") };
+  return { format: "himalaya-sbom-v1", components: components2, hash: createHash18("sha256").update(body).digest("hex") };
 }
 var init_sbom = __esm({
   "../../core/functions-build/src/sbom.ts"() {
@@ -39934,12 +40749,12 @@ var init_sbom = __esm({
 });
 
 // ../../core/functions-build/src/build.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 function sha2563(value) {
-  return createHash18("sha256").update(value).digest("hex");
+  return createHash19("sha256").update(value).digest("hex");
 }
 function sri(value) {
-  return `sha256-${createHash18("sha256").update(value).digest("base64")}`;
+  return `sha256-${createHash19("sha256").update(value).digest("base64")}`;
 }
 function schemaHash(schema) {
   if (!schema) return "";
@@ -40120,6 +40935,7 @@ __export(build_exports2, {
   pinBakedServerBaseUrl: () => pinBakedServerBaseUrl,
   pinnedReleaseFromEnv: () => pinnedReleaseFromEnv,
   publishableFontFaces: () => publishableFontFaces,
+  rebindReleaseId: () => rebindReleaseId,
   releaseIdFor: () => releaseIdFor,
   servicesFromBundleJs: () => servicesFromBundleJs,
   shellSha: () => shellSha,
@@ -40129,7 +40945,7 @@ __export(build_exports2, {
   withStoreNavBundle: () => withStoreNavBundle,
   withoutDevOnlyAppConfig: () => withoutDevOnlyAppConfig
 });
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import { readFileSync as readFileSync42, readdirSync as readdirSync21, existsSync as existsSync39 } from "node:fs";
 import { dirname as dirname23, join as join37, resolve as resolve32 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
@@ -40199,10 +41015,10 @@ async function bakeCatalogs(app, locale, fetchCatalog, putDoc) {
   return out;
 }
 function sha2564(buf) {
-  return createHash19("sha256").update(buf).digest("hex");
+  return createHash20("sha256").update(buf).digest("hex");
 }
 function sri2(buf) {
-  return "sha256-" + createHash19("sha256").update(buf).digest("base64");
+  return "sha256-" + createHash20("sha256").update(buf).digest("base64");
 }
 async function widgetFailureDetail(res) {
   try {
@@ -40298,14 +41114,14 @@ function pinBakedServerBaseUrl(json5, base) {
   const boundary = /:\d+$/.test(base) ? "(?!\\d)" : "(?![\\w.-])(?!:\\d)";
   return json5.replace(new RegExp(`${escaped}${boundary}`, "g"), BAKED_SERVER_BASE_URL);
 }
-function stableStringify(v) {
+function stableStringify2(v) {
   if (v === null || typeof v !== "object") return JSON.stringify(v);
-  if (Array.isArray(v)) return "[" + v.map(stableStringify).join(",") + "]";
+  if (Array.isArray(v)) return "[" + v.map(stableStringify2).join(",") + "]";
   const o = v;
-  return "{" + Object.keys(o).sort().map((k) => JSON.stringify(k) + ":" + stableStringify(o[k])).join(",") + "}";
+  return "{" + Object.keys(o).sort().map((k) => JSON.stringify(k) + ":" + stableStringify2(o[k])).join(",") + "}";
 }
 function contentReleaseId(content) {
-  return sha2564(stableStringify(content));
+  return sha2564(stableStringify2(content));
 }
 function servicesFromBundleJs(bundleJs, input = {}) {
   try {
@@ -40320,7 +41136,13 @@ function hydrationServices(tier5Dir, bundleName, input = {}) {
   return js ? servicesFromBundleJs(js, input) : null;
 }
 function releaseIdFor(sha, content) {
-  return sha !== "dev" ? sha : contentReleaseId(content);
+  if (sha === "dev") return contentReleaseId(content);
+  const stored = JSON.parse(JSON.stringify(content));
+  return `${sha}-${releaseContentId(stored).slice(0, 12)}`;
+}
+function rebindReleaseId(manifest) {
+  const { releaseId: _releaseId, gitSha: gitSha2, shellSha: _shellSha, ...content } = manifest;
+  return { ...manifest, releaseId: releaseIdFor(gitSha2, content) };
 }
 function shellSha(root = REPO_ROOT7) {
   if (!isMonorepoCheckout(root)) return "";
@@ -41265,6 +42087,7 @@ var init_build3 = __esm({
     init_src6();
     init_check();
     init_file_store();
+    init_release_patch();
     init_validate_descriptor();
     init_wix_member_login();
     init_wix_placeholders();
@@ -41927,7 +42750,7 @@ __export(studio_exports, {
   renderStudioHtml: () => renderStudioHtml,
   writeStudioRecord: () => writeStudioRecord
 });
-import { createHash as createHash20 } from "node:crypto";
+import { createHash as createHash21 } from "node:crypto";
 import { existsSync as existsSync41, readdirSync as readdirSync22, readFileSync as readFileSync44, realpathSync as realpathSync5, statSync as statSync8 } from "node:fs";
 import { basename as basename10, extname as extname3, join as join39, relative as relative7, resolve as resolve33, sep as sep9 } from "node:path";
 import { pathToFileURL as pathToFileURL7 } from "node:url";
@@ -42165,7 +42988,7 @@ function buildView(dir, memory, now) {
     reveal: memory.reveal ?? null
   };
   const { generatedAt: _ignored, timelineFrames: _count, ...stable } = view;
-  const v = createHash20("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
+  const v = createHash21("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
   return { v, ...view };
 }
 function writeAtomic(file, content) {
@@ -42663,7 +43486,7 @@ function patchHonesty(opts) {
   return { attestation, source };
 }
 var SELECTOR_KINDS;
-var init_release_patch = __esm({
+var init_release_patch2 = __esm({
   "src/release-patch.ts"() {
     init_widget_identity();
     SELECTOR_KINDS = ["changed", "screen:<id|glob>", "bundle:<name>", "tokens", "app-config"];
@@ -45409,7 +46232,7 @@ __export(pack_exports, {
   unpackTo: () => unpackTo,
   writeZip: () => writeZip
 });
-import { createHash as createHash21 } from "node:crypto";
+import { createHash as createHash22 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
 import { existsSync as existsSync44, mkdirSync as mkdirSync21, readFileSync as readFileSync48, readdirSync as readdirSync24, rmSync as rmSync9, statSync as statSync11, writeFileSync as writeFileSync17 } from "node:fs";
 import { dirname as dirname26, join as join42, resolve as resolve37 } from "node:path";
@@ -45559,11 +46382,11 @@ function gatherReleaseEntries(appDir2) {
   return { entries, manifest, skipped };
 }
 function sha256Hex4(bytes2) {
-  return createHash21("sha256").update(bytes2).digest("hex");
+  return createHash22("sha256").update(bytes2).digest("hex");
 }
 function computeContentHash(entries) {
   const input = packageHashInput(entries.map((e) => ({ path: e.path, hash: sha256Hex4(e.bytes) })));
-  return "sha256-" + createHash21("sha256").update(input).digest("base64");
+  return "sha256-" + createHash22("sha256").update(input).digest("base64");
 }
 function buildEntries(appDir2, app, opts) {
   const { entries: released, manifest, skipped } = gatherReleaseEntries(appDir2);
@@ -47772,10 +48595,10 @@ var init_calls = __esm({
 });
 
 // ../../core/functions-runtime/src/queue.ts
-import { createHash as createHash22 } from "node:crypto";
+import { createHash as createHash23 } from "node:crypto";
 function inputSchemaHash(definition) {
   const schema = definition.input;
-  return schema ? createHash22("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
+  return schema ? createHash23("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
 }
 function createFunctionEnqueueCapability(options) {
   return {
@@ -47841,14 +48664,14 @@ var init_queue = __esm({
 });
 
 // ../../core/data-resources/src/plan.ts
-import { createHash as createHash23 } from "node:crypto";
+import { createHash as createHash24 } from "node:crypto";
 function canonical2(value) {
   if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
   if (value && typeof value === "object") return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key2, item]) => `${JSON.stringify(key2)}:${canonical2(item)}`).join(",")}}`;
   return JSON.stringify(value);
 }
 function hashResourcePlan(plan) {
-  return createHash23("sha256").update(canonical2(plan)).digest("hex");
+  return createHash24("sha256").update(canonical2(plan)).digest("hex");
 }
 function finalize(input) {
   return { ...input, hash: hashResourcePlan(input) };
@@ -48784,7 +49607,7 @@ __export(studio_reel_exports, {
   thin: () => thin,
   utcDay: () => utcDay
 });
-import { createHash as createHash24 } from "node:crypto";
+import { createHash as createHash25 } from "node:crypto";
 import { lstatSync as lstatSync9, readFileSync as readFileSync55 } from "node:fs";
 import { basename as basename12, join as join49 } from "node:path";
 function loadMemory2(dir) {
@@ -48872,7 +49695,7 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
       const st = lstatSync9(path2);
       if (!st.isFile() || st.nlink !== 1) return null;
       const bytes2 = readFileSync55(path2);
-      return createHash24("sha256").update(bytes2).digest("hex") === f.slice(0, 64) && imageExtension(bytes2) === f.slice(65) ? bytes2 : null;
+      return createHash25("sha256").update(bytes2).digest("hex") === f.slice(0, 64) && imageExtension(bytes2) === f.slice(65) ? bytes2 : null;
     } catch {
       return null;
     }
@@ -49292,7 +50115,7 @@ __export(browser_authoring_exports, {
   sdkSubpathReader: () => sdkSubpathReader
 });
 import { createServer as createServer3 } from "node:http";
-import { createHash as createHash25, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash26, randomBytes as randomBytes4 } from "node:crypto";
 import { existsSync as existsSync52, readdirSync as readdirSync26, readFileSync as readFileSync57, realpathSync as realpathSync6, statSync as statSync12 } from "node:fs";
 import { join as join51, posix as posix2, relative as relative9, sep as sep12 } from "node:path";
 function humanMs(ms) {
@@ -49391,7 +50214,7 @@ function encodeJob(job) {
   return Buffer.from(JSON.stringify(job), "utf8").toString("base64");
 }
 function mintToken2(payload, nonce = randomBytes4(16).toString("hex")) {
-  const digest2 = createHash25("sha256").update(payload, "utf8").digest("base64url");
+  const digest2 = createHash26("sha256").update(payload, "utf8").digest("base64url");
   return `${nonce}.${digest2}`;
 }
 function defaultOpenBrowser2(url) {
@@ -50314,7 +51137,7 @@ function makeServeHandler(opts) {
   }
   const PINNED_MANIFEST_CACHE_CAP = 100;
   const pinnedManifestCache = /* @__PURE__ */ new Map();
-  const sha256hex = (b) => sha256Hex(b);
+  const sha256hex2 = (b) => sha256Hex(b);
   function resolvePin(request, url) {
     return request.headers.get("x-himalaya-release") || url.searchParams.get("release") || null;
   }
@@ -50367,7 +51190,7 @@ ${releaseId}`;
     const doc = store.getDoc ? await store.getDoc(app, hash) : null;
     if (doc) return doc;
     const bytes2 = await slot();
-    return bytes2 && sha256hex(bytes2) === hash ? bytes2 : null;
+    return bytes2 && sha256hex2(bytes2) === hash ? bytes2 : null;
   }
   function callbackUrlFor(url) {
     const base = ((typeof opts.publicBaseUrl === "function" ? opts.publicBaseUrl(url) : opts.publicBaseUrl) ?? url.origin).replace(/\/$/, "");
@@ -51031,7 +51854,7 @@ ${releaseId}`;
             }
           }
         }
-        const cfgTag = ringPinned ? sha256hex(JSON.stringify(appConfig)) : mm.appConfigHash ?? "";
+        const cfgTag = ringPinned ? sha256hex2(JSON.stringify(appConfig)) : mm.appConfigHash ?? "";
         const etag = strongEtag(`${mm.releaseId}:${cfgTag}:${mm.tokensHash ?? ""}:${screenHash}:${homeBundle?.sha256 ?? ""}`);
         const cache = pin && !ringPinned ? PINNED_CACHE_CONTROL : DOC_CACHE_CONTROL;
         const vary = pin ? { vary: ringPinned ? `x-himalaya-release, ${RELEASE_SOURCE_HEADER}` : "x-himalaya-release" } : {};
@@ -51634,21 +52457,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-Bh3PhhIv.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1056814, sha256: "ca4ec59601c2b573ed7e8bf193c05412a2c1eb385afc34a5fc0fc3272e0ab4b8" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1056822, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1061432, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1550016, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1640940, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1731924, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1822904, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1913776, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2004756, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2113392, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2222476, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2331524, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2439224, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2527332, length: 4947, sha256: "f2505c929e9df4474bcfb0e0ea3d52ede073bf70f3a87d5c8a358b41599fda69" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2532279, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-BpZ7D4Bh.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1058524, sha256: "cc7f9edeb0a351f0d1fbc18d622044afaf3112c567893f04135a5cf846e2c4d2" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1058532, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1063142, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1551726, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1642650, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1733634, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1824614, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1915486, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2006466, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2115102, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2224186, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2333234, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2440934, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2529042, length: 4947, sha256: "bed413299e95d197f054aae695914a18403bef8f893a8ed89a87068cbd0cab80" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2533989, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -52778,7 +53601,7 @@ function loadStoreConfig(app) {
 }
 var init_preflight = __esm({
   "../store-release/preflight.ts"() {
-    init_paths();
+    init_paths2();
   }
 });
 
@@ -52918,7 +53741,7 @@ __export(preflight_app_exports, {
   profileAccount: () => profileAccount
 });
 import { readFileSync as readFileSync66, existsSync as existsSync60, readdirSync as readdirSync28, statSync as statSync15 } from "node:fs";
-import { createHash as createHash26 } from "node:crypto";
+import { createHash as createHash27 } from "node:crypto";
 import { join as join57 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
   const f = [];
@@ -53207,7 +54030,7 @@ function placeholderHashes2() {
     const p = join57(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync15(p).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash26("sha256").update(readFileSync66(p)).digest("hex")];
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash27("sha256").update(readFileSync66(p)).digest("hex")];
     } catch {
     }
   }
@@ -53244,7 +54067,7 @@ async function appIconState(iosDir) {
     try {
       if (!statSync15(p).isFile()) continue;
       const bytes2 = readFileSync66(p);
-      const hash = createHash26("sha256").update(bytes2).digest("hex");
+      const hash = createHash27("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
         exists: true,
@@ -53279,7 +54102,7 @@ ${app}: ${errors.length} error(s), ${warns.length} warning(s).`);
 var APP_STORE_SIZES, PNG_COLOR_TYPE_RGB, PLAY_FEATURE_GRAPHIC, LEGACY_PLACEHOLDER_SHA2562;
 var init_preflight_app = __esm({
   "../store-release/preflight-app.ts"() {
-    init_paths();
+    init_paths2();
     init_preflight();
     init_credential_profile();
     init_app_icon_rules();
@@ -53386,7 +54209,7 @@ function bumpVersion(app, opts) {
 }
 var init_version = __esm({
   "../store-release/version.ts"() {
-    init_paths();
+    init_paths2();
   }
 });
 
@@ -53445,7 +54268,7 @@ async function main2() {
 var ASC_API;
 var init_register_bundle = __esm({
   "../store-release/register-bundle.ts"() {
-    init_paths();
+    init_paths2();
     init_preflight();
     ASC_API = "https://api.appstoreconnect.apple.com";
     if (runningAsScript("store-release/register-bundle.ts")) {
@@ -53510,7 +54333,7 @@ async function main3() {
 var ASC;
 var init_asc_status = __esm({
   "../store-release/asc-status.ts"() {
-    init_paths();
+    init_paths2();
     init_register_bundle();
     init_preflight();
     ASC = "https://api.appstoreconnect.apple.com";
@@ -63450,7 +64273,7 @@ var init_context = __esm({
 // src/cli.ts
 import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync75, mkdirSync as mkdirSync31, writeFileSync as writeFileSync29, existsSync as existsSync63, rmSync as rmSync14, readdirSync as readdirSync29, statSync as statSync17, lstatSync as lstatSync11, accessSync, constants as constants2, renameSync as renameSync7, cpSync as cpSync3 } from "node:fs";
 import { execFile, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn6 } from "node:child_process";
-import { createHash as createHash27, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash28, randomUUID as randomUUID5 } from "node:crypto";
 import { tmpdir as tmpdir5, homedir as homedir7, hostname } from "node:os";
 import { join as join61, resolve as resolve47, relative as relative11, basename as basename15, dirname as dirname34 } from "node:path";
 import { fileURLToPath as fileURLToPath24 } from "node:url";
@@ -64050,743 +64873,7 @@ init_store();
 init_contract();
 init_app_link();
 init_himi_report();
-
-// src/attestation.ts
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { createHash as createHash3, randomBytes } from "node:crypto";
-import {
-  existsSync as existsSync3,
-  lstatSync as lstatSync3,
-  mkdirSync as mkdirSync5,
-  realpathSync,
-  readlinkSync as readlinkSync2,
-  readFileSync as readFileSync5,
-  readdirSync as readdirSync3,
-  unlinkSync,
-  writeFileSync as writeFileSync5
-} from "node:fs";
-import { basename as basename2, join as join6, relative, resolve as resolve6 } from "node:path";
-
-// ../verify-gate/diff-hash.mjs
-import {
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync4,
-  mkdtempSync,
-  readFileSync as readFileSync4,
-  readlinkSync,
-  rmSync as rmSync2,
-  writeFileSync as writeFileSync4
-} from "node:fs";
-import { createHash as createHash2 } from "node:crypto";
-import { tmpdir } from "node:os";
-import { basename, dirname as dirname5, join as join5, resolve as resolve5 } from "node:path";
-import { pathToFileURL } from "node:url";
-
-// ../pre-pr-review/scope.mjs
-import { execFileSync } from "node:child_process";
-import { createHash } from "node:crypto";
-import { resolve as resolve4, dirname as dirname4, isAbsolute, join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
-
-// ../ai-review-gate/paths.mjs
-import { resolve as resolve3, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-var REPO_ROOT = resolve3(dirname3(fileURLToPath2(import.meta.url)), "../..");
-
-// ../pre-pr-review/command.mjs
-var SHELL_NAMES = "sh|bash|zsh|ksh|dash|ash|fish|csh|tcsh|pwsh|xonsh|nu";
-var SHELL_TOKEN = new RegExp(`^(?:.*/)?(?:${SHELL_NAMES})$`);
-
-// ../pre-pr-review/scope.mjs
-var REPO_ROOT2 = resolve4(dirname4(fileURLToPath3(import.meta.url)), "../..");
-var BASE_REF = process.env.PRE_PR_REVIEW_BASE || "origin/master";
-function resolveRepoRoot(cwd = process.cwd()) {
-  let top;
-  try {
-    top = execFileSync("git", ["rev-parse", "--show-toplevel"], {
-      cwd,
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "pipe"]
-    }).toString().trim();
-  } catch (err) {
-    throw new Error(`cannot resolve a repo root from ${cwd}: ${err?.message || err}`);
-  }
-  if (!top) throw new Error(`cannot resolve a repo root from ${cwd}: git named no toplevel`);
-  return top;
-}
-function git(args, opts = {}) {
-  return execFileSync("git", args, {
-    cwd: opts.cwd || REPO_ROOT2,
-    encoding: "utf8",
-    // A full PR diff can be megabytes; the default 1MB cap would truncate mid-hunk and the
-    // delta parser would then read a malformed diff as "unsupported shape".
-    maxBuffer: opts.maxBuffer ?? 256 * 1024 * 1024,
-    stdio: ["ignore", "pipe", "pipe"]
-  }).toString();
-}
-function diffHash(diff) {
-  return createHash("sha256").update(diff).digest("hex");
-}
-
-// ../verify-gate/diff-hash.mjs
-var VALIDATION_METADATA = /* @__PURE__ */ new Set([
-  ".claude/.validation-baseline.json",
-  ".claude/.validation-evidence.json"
-]);
-function isValidationMetadata(path2) {
-  return VALIDATION_METADATA.has(path2) || /(^|[\\/])\.himi([\\/]|$)/.test(path2);
-}
-function tryGit(args, root) {
-  try {
-    return git(args, { cwd: root });
-  } catch {
-    return null;
-  }
-}
-function committedRecords(raw) {
-  const fields = raw.split("\0");
-  if (fields.length > 0 && fields[fields.length - 1] === "") fields.pop();
-  if (fields.length % 2 !== 0) return null;
-  const records = [];
-  for (let i = 0; i < fields.length; i += 2) {
-    const metadata2 = fields[i];
-    const path2 = fields[i + 1];
-    if (!metadata2.startsWith(":") || path2 === "") return null;
-    if (isValidationMetadata(path2)) continue;
-    records.push(`${Buffer.byteLength(path2)}:${path2}\0${metadata2}\0`);
-  }
-  return records.sort().join("");
-}
-function committedIdentity(root) {
-  const head = tryGit(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], root)?.trim();
-  if (!head) return "unborn\0";
-  const base = tryGit(["merge-base", BASE_REF, "HEAD"], root)?.trim();
-  if (base) {
-    const raw = tryGit(["diff", "--raw", "--no-renames", "-z", "--no-abbrev", base, "HEAD"], root);
-    const records = raw === null ? null : committedRecords(raw);
-    if (records !== null) return `base\0${base}\0${records}`;
-  }
-  const listing = tryGit(["ls-tree", "-rz", "--full-tree", "HEAD"], root);
-  const tree = listing === null ? null : treeRecords(listing);
-  return tree !== null ? `tree-listing\0${tree}` : `commit\0${head}\0`;
-}
-function treeRecords(listing) {
-  const records = [];
-  for (const record2 of listing.split("\0")) {
-    if (record2 === "") continue;
-    const tab = record2.indexOf("	");
-    if (tab <= 0 || tab === record2.length - 1) return null;
-    const path2 = record2.slice(tab + 1);
-    if (isValidationMetadata(path2)) continue;
-    records.push(`${Buffer.byteLength(path2)}:${path2}\0${record2.slice(0, tab)}\0`);
-  }
-  return records.sort().join("");
-}
-function treeEntries(output, index = false) {
-  const entries = /* @__PURE__ */ new Map();
-  for (const record2 of output.split("\0").filter(Boolean)) {
-    const tab = record2.indexOf("	");
-    if (tab === -1) continue;
-    const metadata2 = record2.slice(0, tab).split(" ");
-    if (index && metadata2[2] !== "0") continue;
-    entries.set(record2.slice(tab + 1), {
-      mode: metadata2[0],
-      oid: index ? metadata2[1] : metadata2[2]
-    });
-  }
-  return entries;
-}
-function sameEntry(left, right) {
-  if (!left || !right) return left === right;
-  return left.mode === right.mode && left.oid === right.oid;
-}
-function stagedIdentity(head, index, worktree) {
-  if (sameEntry(index, head) || sameEntry(index, worktree)) return "";
-  if (!index) return head ? "deleted" : "";
-  return `${index.mode}:${index.oid}`;
-}
-function blobOid(contents, algorithm) {
-  const body = Buffer.isBuffer(contents) ? contents : Buffer.from(contents);
-  return createHash2(algorithm).update(Buffer.from(`blob ${body.byteLength}\0`)).update(body).digest("hex");
-}
-function validationDiffHash(cwd = process.cwd()) {
-  const root = resolveRepoRoot(cwd);
-  const born = tryGit(["rev-parse", "--verify", "--quiet", "HEAD^{commit}"], root) !== null;
-  const staged = git(["diff", "--cached", "--name-only", "--no-renames", "-z", ...born ? ["HEAD"] : []], {
-    cwd: root
-  }).split("\0").filter(Boolean);
-  const unstaged = git(["diff", "--name-only", "--no-renames", "-z"], { cwd: root }).split("\0").filter(Boolean);
-  const untracked = git(["ls-files", "--others", "--exclude-standard", "-z"], {
-    cwd: root
-  }).split("\0").filter(Boolean);
-  const headEntries = born ? treeEntries(git(["ls-tree", "-rz", "--full-tree", "HEAD"], { cwd: root })) : /* @__PURE__ */ new Map();
-  const indexEntries = treeEntries(git(["ls-files", "--stage", "-z"], { cwd: root }), true);
-  const objectAlgorithm = git(["rev-parse", "--show-object-format"], { cwd: root }).trim();
-  let trustFilesystemMode = true;
-  try {
-    trustFilesystemMode = git(["config", "--bool", "--get", "core.fileMode"], { cwd: root }).trim() !== "false";
-  } catch {
-  }
-  const paths = [.../* @__PURE__ */ new Set([...staged, ...unstaged, ...untracked])].filter((path2) => !isValidationMetadata(path2)).sort();
-  const identity = paths.map((path2) => {
-    const absolute = resolve5(root, path2);
-    const headEntry = headEntries.get(path2);
-    const indexEntry = indexEntries.get(path2);
-    const deletedRecord = () => [`${Buffer.byteLength(path2)}:${path2}`, "deleted", stagedIdentity(headEntry, indexEntry, void 0), ""].join("\0");
-    let stat2;
-    try {
-      stat2 = lstatSync2(absolute);
-    } catch (error) {
-      if (error?.code === "ENOENT") return deletedRecord();
-      throw error;
-    }
-    try {
-      if (stat2.isSymbolicLink()) {
-        const target = readlinkSync(absolute);
-        const worktreeEntry = { mode: "120000", oid: blobOid(target, objectAlgorithm) };
-        const stagedState2 = stagedIdentity(headEntry, indexEntry, worktreeEntry);
-        return [
-          `${Buffer.byteLength(path2)}:${path2}`,
-          "symlink",
-          "120000",
-          diffHash(target),
-          stagedState2,
-          ""
-        ].join("\0");
-      }
-      if (stat2.isFile()) {
-        const filesystemMode = stat2.mode & 73 ? "100755" : "100644";
-        const worktreeMode = trustFilesystemMode ? filesystemMode : indexEntry?.mode ?? headEntry?.mode ?? "100644";
-        const worktreeOid = git(["hash-object", `--path=${path2}`, "--", path2], { cwd: root }).trim();
-        const worktreeEntry = { mode: worktreeMode, oid: worktreeOid };
-        const stagedState2 = stagedIdentity(headEntry, indexEntry, worktreeEntry);
-        return [
-          `${Buffer.byteLength(path2)}:${path2}`,
-          "file",
-          worktreeMode,
-          diffHash(readFileSync4(absolute)),
-          stagedState2,
-          ""
-        ].join("\0");
-      }
-    } catch (error) {
-      try {
-        lstatSync2(absolute);
-      } catch (recheck) {
-        if (recheck?.code === "ENOENT") return deletedRecord();
-      }
-      throw error;
-    }
-    const type = stat2.isDirectory() ? "directory" : "other";
-    const stagedState = stagedIdentity(headEntry, indexEntry, void 0);
-    return [
-      `${Buffer.byteLength(path2)}:${path2}`,
-      type,
-      stat2.mode.toString(8),
-      stagedState,
-      ""
-    ].join("\0");
-  }).join("");
-  const committed = committedIdentity(root);
-  return diffHash(
-    `validation-change-v3\0${Buffer.byteLength(committed)}\0${committed}${identity}`
-  );
-}
-function seed(repo, commands) {
-  for (const args of commands) git(args, { cwd: repo });
-}
-function write(repo, rel, body) {
-  const absolute = resolve5(repo, rel);
-  mkdirSync4(dirname5(absolute), { recursive: true });
-  writeFileSync4(absolute, body);
-}
-function selfTestRepo({ withBase }) {
-  const repo = mkdtempSync(join5(tmpdir(), "diff-hash-self-test-"));
-  seed(repo, [
-    ["init", "-q", repo],
-    ["-C", repo, "config", "user.email", "self-test@test.invalid"],
-    ["-C", repo, "config", "user.name", "diff-hash-self-test"]
-  ]);
-  write(repo, "src/base.txt", "base\n");
-  seed(repo, [["-C", repo, "add", "-A"], ["-C", repo, "commit", "-qm", "base"]]);
-  const base = git(["-C", repo, "rev-parse", "HEAD"], { cwd: repo }).trim();
-  if (withBase) seed(repo, [["-C", repo, "update-ref", "refs/remotes/origin/master", base]]);
-  return { repo, base };
-}
-function commitChange(repo, base, branch, rel, body) {
-  seed(repo, [["-C", repo, "checkout", "-q", base], ["-C", repo, "checkout", "-q", "-b", branch]]);
-  write(repo, rel, body);
-  seed(repo, [["-C", repo, "add", rel], ["-C", repo, "commit", "-qm", `commit ${rel}`]]);
-  return validationDiffHash(repo);
-}
-var SELF_TEST_CASES = [
-  {
-    name: "committed diffs are distinguished (the #1831 regression)",
-    reason: "two unrelated COMMITTED diffs share one identity \u2014 a record for either would satisfy the gate for the other",
-    run: () => {
-      const { repo, base } = selfTestRepo({ withBase: true });
-      try {
-        return commitChange(repo, base, "a", "src/alpha.txt", "alpha\n") !== commitChange(repo, base, "b", "src/beta.txt", "a different change\n");
-      } finally {
-        rmSync2(repo, { recursive: true, force: true });
-      }
-    }
-  },
-  {
-    name: "committed diffs are distinguished with NO base ref (fallback ladder)",
-    reason: "without origin/master the committed identity collapses to a constant",
-    run: () => {
-      const { repo, base } = selfTestRepo({ withBase: false });
-      try {
-        return commitChange(repo, base, "a", "src/alpha.txt", "alpha\n") !== commitChange(repo, base, "b", "src/beta.txt", "a different change\n");
-      } finally {
-        rmSync2(repo, { recursive: true, force: true });
-      }
-    }
-  },
-  {
-    name: "a clean tree is not the digest of an empty path list",
-    reason: 'a clean tree still hashes to sha256("validation-worktree-v2\\0"), the constant measured in #1831',
-    run: () => {
-      const { repo } = selfTestRepo({ withBase: true });
-      try {
-        return validationDiffHash(repo) !== createHash2("sha256").update("validation-worktree-v2\0").digest("hex");
-      } finally {
-        rmSync2(repo, { recursive: true, force: true });
-      }
-    }
-  },
-  {
-    name: "an uncommitted edit still changes the identity",
-    reason: "the working-tree half of the identity stopped responding to edits",
-    run: () => {
-      const { repo } = selfTestRepo({ withBase: true });
-      try {
-        const before = validationDiffHash(repo);
-        write(repo, "src/base.txt", "edited in the working tree\n");
-        return validationDiffHash(repo) !== before;
-      } finally {
-        rmSync2(repo, { recursive: true, force: true });
-      }
-    }
-  },
-  {
-    // The "can pass" half. Without it every case above is satisfied by a hash that simply
-    // changes every call, which would identify nothing and invalidate every record.
-    name: "one unchanged state hashes to one value",
-    reason: "the identity is not stable for an unchanged state \u2014 every record would read stale",
-    run: () => {
-      const { repo } = selfTestRepo({ withBase: true });
-      try {
-        write(repo, "src/base.txt", "edited in the working tree\n");
-        return validationDiffHash(repo) === validationDiffHash(repo);
-      } finally {
-        rmSync2(repo, { recursive: true, force: true });
-      }
-    }
-  }
-];
-function runSelfTest() {
-  let failed2 = 0;
-  for (const testCase of SELF_TEST_CASES) {
-    let ok = false;
-    let thrown = null;
-    try {
-      ok = testCase.run() === true;
-    } catch (error) {
-      thrown = error?.message || String(error);
-    }
-    if (ok) {
-      process.stdout.write(`  \u2713 ${testCase.name}
-`);
-      continue;
-    }
-    failed2++;
-    process.stderr.write(`  \u2717 ${testCase.name}
-      ${thrown ?? testCase.reason}
-`);
-  }
-  return failed2;
-}
-if (process.argv[1] && basename(process.argv[1]) === "diff-hash.mjs" && import.meta.url === pathToFileURL(process.argv[1]).href) {
-  if (process.argv.slice(2).includes("--self-test")) {
-    process.stdout.write("\u25B8 diff-hash --self-test: proving the identity can change, and can hold\n");
-    const failed2 = runSelfTest();
-    if (failed2) {
-      process.stderr.write(
-        `\u2717 diff-hash self-test FAILED (${failed2} case(s)) \u2014 the evidence record's diff identity cannot be trusted
-`
-      );
-      process.exit(1);
-    }
-    process.stdout.write(`\u2713 diff-hash self-test passed (${SELF_TEST_CASES.length} cases)
-`);
-  } else {
-    process.stdout.write(`${validationDiffHash()}
-`);
-  }
-}
-
-// src/attestation.ts
-init_source_deny();
-init_widget_identity();
-var DEFAULT_MAX_RUNS = 20;
-var ATTESTATION_VERSION = 2;
-function attestationVersionOf(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
-  const version2 = value.attestation;
-  return typeof version2 === "number" && Number.isInteger(version2) && version2 > 0 ? version2 : null;
-}
-function classifyRetainedRun(dir, name) {
-  let value;
-  try {
-    value = JSON.parse(readFileSync5(join6(dir, name), "utf8"));
-  } catch {
-    return { kind: "unreadable" };
-  }
-  if (isAttestationV2(value)) return { kind: "current", run: value };
-  const version2 = attestationVersionOf(value);
-  if (version2 === null || version2 === ATTESTATION_VERSION) return { kind: "malformed" };
-  return { kind: version2 < ATTESTATION_VERSION ? "legacy" : "future" };
-}
-function screenshotArtifactPath(contentDir2, hash) {
-  return join6(resolve6(contentDir2), ".himi", "attestations", "artifacts", `${hash}.png`);
-}
-var GIT_HASH_MAX_BUFFER = 128 * 1024 * 1024;
-var sha2562 = (bytes2) => createHash3("sha256").update(bytes2).digest("hex");
-function canonical(value) {
-  if (value === null || typeof value !== "object") return JSON.stringify(value);
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-  const record2 = value;
-  return `{${Object.keys(record2).filter((key2) => record2[key2] !== void 0).sort().map((key2) => `${JSON.stringify(key2)}:${canonical(record2[key2])}`).join(",")}}`;
-}
-function releasePayloadHash(payload) {
-  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return sha2562(canonical(payload));
-  const record2 = payload;
-  const manifest = record2.manifest;
-  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) return sha2562(canonical(payload));
-  const manifestRecord = manifest;
-  const widgets = manifestRecord.widgets;
-  if (!widgets || typeof widgets !== "object" || Array.isArray(widgets)) return sha2562(canonical(payload));
-  return sha2562(canonical({ ...record2, manifest: { ...manifestRecord, widgets: stableWidgets(widgets) } }));
-}
-function withoutSelfHash(attestation) {
-  const { selfHash: _selfHash, ...body } = attestation;
-  return body;
-}
-function selfHashFor(attestation) {
-  return sha2562(canonical(withoutSelfHash(attestation)));
-}
-function repoRoot(contentDir2) {
-  try {
-    const root = execFileSync2("git", ["-C", contentDir2, "rev-parse", "--show-toplevel"], {
-      encoding: "utf8",
-      stdio: ["ignore", "pipe", "ignore"]
-    }).trim();
-    if (!root) return null;
-    execFileSync2("git", ["-C", root, "rev-parse", "--verify", "--quiet", "HEAD^{commit}"], { stdio: "ignore" });
-    return root;
-  } catch {
-    return null;
-  }
-}
-function storedContentDir(contentDir2) {
-  const absolute = resolve6(contentDir2);
-  const root = repoRoot(absolute);
-  return root ? relative(root, absolute) || "." : ".";
-}
-function currentGitDiffHash(contentDir2) {
-  const root = repoRoot(resolve6(contentDir2));
-  if (!root) return "unavailable";
-  return validationDiffHash(root);
-}
-function currentGitUntrackedHash(contentDir2) {
-  const unresolved = resolve6(contentDir2);
-  const absolute = realpathSync.native(unresolved);
-  const root = repoRoot(absolute);
-  if (!root) return sourceTreeHash(absolute);
-  const scope = relative(root, absolute) || ".";
-  const listed = execFileSync2("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--", scope], {
-    encoding: "utf8",
-    maxBuffer: GIT_HASH_MAX_BUFFER
-  });
-  const hash = createHash3("sha256");
-  for (const path2 of listed.split("\0").filter(Boolean).sort()) {
-    const local = relative(absolute, join6(root, path2));
-    const segs = local.split(/[\\/]/);
-    if (NOT_ATTESTED_DIRS.has(segs[0])) continue;
-    if (segs.length === 1 && AGENT_TOOLING_ROOT_FILES.includes(segs[0])) continue;
-    const full = join6(root, path2);
-    const stats = lstatSync3(full, { throwIfNoEntry: false });
-    if (!stats) continue;
-    const kind = stats.isSymbolicLink() ? "link" : stats.isDirectory() ? "dir" : stats.isFile() ? "file" : null;
-    if (!kind) continue;
-    const payload = kind === "link" ? Buffer.from(readlinkSync2(full)) : kind === "file" ? readFileSync5(full) : Buffer.alloc(0);
-    const pathBytes = Buffer.from(path2);
-    hash.update(`${kind} ${pathBytes.length} ${payload.length}
-`).update(pathBytes).update(payload);
-  }
-  return hash.digest("hex");
-}
-var NOT_ATTESTED_DIRS = /* @__PURE__ */ new Set([".himi", ...AGENT_TOOLING_DIRS]);
-function sourceTreeHash(root) {
-  const hash = createHash3("sha256");
-  const visit = (dir) => {
-    for (const entry of readdirSync3(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0)) {
-      if (entry.isDirectory() && (entry.name === ".git" || entry.name === "node_modules" || NOT_ATTESTED_DIRS.has(entry.name))) continue;
-      const path2 = join6(dir, entry.name);
-      const local = relative(root, path2);
-      if (dir === root && entry.isFile() && AGENT_TOOLING_ROOT_FILES.includes(entry.name)) continue;
-      if (entry.isDirectory()) visit(path2);
-      else if (entry.isFile()) hash.update(local).update("\0").update(readFileSync5(path2)).update("\0");
-      else if (entry.isSymbolicLink()) hash.update(local).update("\0link\0").update(readlinkSync2(path2)).update("\0");
-    }
-  };
-  visit(root);
-  return hash.digest("hex");
-}
-var stringRecord = (value) => !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((item) => typeof item === "string");
-function isAttestationV2(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-  const a = value;
-  const coverage = a.coverage;
-  const report2 = a.report;
-  return a.attestation === 2 && typeof a.runId === "string" && ["himi-test", "himi-render", "himi-shots"].includes(a.tool) && [a.app, a.contentDir, a.gitDiffHash, a.gitUntrackedHash, a.releaseId, a.releaseHash, a.selfHash].every((item) => typeof item === "string" && item.length > 0) && stringRecord(a.descriptorHashes) && stringRecord(a.screenshots) && !!coverage && [coverage.screens, coverage.actionsDispatched, coverage.uncoveredFns, coverage.gaps].every((count) => typeof count === "number" && Number.isFinite(count) && count >= 0) && typeof report2?.ok === "boolean" && !!report2.counts && [report2.counts.errors, report2.counts.warnings, report2.counts.gaps].every((count) => typeof count === "number" && Number.isFinite(count) && count >= 0) && (a.prev === null || typeof a.prev === "string");
-}
-function readLatestAttestation(contentDir2) {
-  try {
-    const parsed = JSON.parse(readFileSync5(join6(resolve6(contentDir2), ".himi", "attestations", "latest.json"), "utf8"));
-    return isAttestationV2(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function readRetainedAttestations(contentDir2) {
-  const dir = join6(resolve6(contentDir2), ".himi", "attestations");
-  if (!existsSync3(dir)) return { runs: [], errors: [] };
-  try {
-    const names = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json");
-    const parsedRuns = [];
-    const errors = [];
-    for (const name of names) {
-      const classified = classifyRetainedRun(dir, name);
-      if (classified.kind === "current") parsedRuns.push(classified.run);
-      else if (classified.kind === "legacy") {
-        errors.push(`attestation history contains retained run ${name} from an older attestation version \u2014 re-run himi test/render to start a v${ATTESTATION_VERSION} chain`);
-      } else if (classified.kind === "future") {
-        errors.push(`attestation history contains retained run ${name} from a newer attestation version \u2014 upgrade himi rather than deleting it`);
-      } else if (classified.kind === "unreadable") {
-        errors.push(`attestation history contains unreadable retained run ${name}`);
-      } else errors.push(`attestation history contains malformed retained run ${name}`);
-    }
-    const latest = readLatestAttestation(contentDir2);
-    if (existsSync3(join6(dir, "latest.json")) && !latest) errors.push("attestation history has no valid latest.json");
-    else if (names.length > 0 && !latest) errors.push("attestation history has no latest.json");
-    const byHash = new Map(parsedRuns.map((run2) => [run2.selfHash, run2]));
-    if (byHash.size !== parsedRuns.length) errors.push("attestation history contains duplicate self hashes");
-    for (const run2 of parsedRuns) {
-      if (selfHashFor(run2) !== run2.selfHash) errors.push(`selfHash does not match retained run ${run2.runId}`);
-      for (const expected of Object.values(run2.screenshots)) {
-        const path2 = screenshotArtifactPath(contentDir2, expected);
-        if (!existsSync3(path2)) errors.push(`missing screenshot for retained run ${run2.runId}: ${basename2(path2)}`);
-        else if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match retained run ${run2.runId}: ${basename2(path2)}`);
-      }
-    }
-    const runs = [];
-    const seen = /* @__PURE__ */ new Set();
-    let cursor = latest ?? void 0;
-    while (cursor && !seen.has(cursor.selfHash)) {
-      runs.push(cursor);
-      seen.add(cursor.selfHash);
-      cursor = cursor.prev ? byHash.get(cursor.prev) : void 0;
-    }
-    if (latest && !byHash.has(latest.selfHash)) errors.push("latest.json has no matching retained run");
-    if (seen.size !== parsedRuns.length) errors.push("attestation hash chain does not reach every retained run");
-    runs.push(...parsedRuns.filter((run2) => !seen.has(run2.selfHash)).sort((a, b) => a.runId < b.runId ? 1 : -1));
-    return {
-      runs,
-      errors
-    };
-  } catch {
-    return { runs: [], errors: ["attestation history could not be read"] };
-  }
-}
-function selectAttestationForPush(runs) {
-  const newestBehavioral = runs.find((run2) => run2.tool === "himi-test");
-  if (!newestBehavioral) return runs[0];
-  const behavioralIndex = runs.indexOf(newestBehavioral);
-  const newerFailure = runs.slice(0, behavioralIndex).find((run2) => run2.report.ok === false);
-  return newerFailure ?? newestBehavioral;
-}
-function pushEvidence(contentDir2, releaseId, verify) {
-  const retained = readRetainedAttestations(contentDir2);
-  const forRelease = retained.runs.filter((candidate) => candidate.releaseId === releaseId);
-  const verified = forRelease.filter(verify);
-  const selected = selectAttestationForPush(verified);
-  return {
-    ...selected ? { selected } : {},
-    historyErrors: retained.errors,
-    staleRuns: verified.length === 0 ? forRelease.length : 0
-  };
-}
-function summaryOf(attestation) {
-  return {
-    runId: attestation.runId,
-    selfHash: attestation.selfHash,
-    tool: attestation.tool,
-    screenIds: Object.keys(attestation.descriptorHashes).sort(),
-    coverage: attestation.coverage,
-    report: { ok: attestation.report.ok, counts: attestation.report.counts },
-    gitDiffHash: attestation.gitDiffHash,
-    releaseHash: attestation.releaseHash
-  };
-}
-function writeAttestation(input, opts = {}) {
-  const contentDir2 = resolve6(input.contentDir);
-  const dir = join6(contentDir2, ".himi", "attestations");
-  mkdirSync5(dir, { recursive: true });
-  const previous = readLatestAttestation(contentDir2);
-  const runId = `${(opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()}-${(opts.randomSuffix ?? (() => randomBytes(3).toString("hex")))()}`;
-  const descriptorHashes = Object.fromEntries(
-    Object.entries(input.descriptors).sort(([a], [b]) => a.localeCompare(b)).map(([screen, bytes2]) => [screen, sha2562(bytes2)])
-  );
-  const screenshotEntries = Object.entries(input.screenshots ?? {}).sort(([a], [b]) => a.localeCompare(b)).filter(([, path2]) => existsSync3(path2)).map(([screen, path2]) => {
-    const bytes2 = readFileSync5(path2);
-    return { screen, bytes: bytes2, hash: sha2562(bytes2) };
-  });
-  const screenshots = Object.fromEntries(screenshotEntries.map(({ screen, hash }) => [screen, hash]));
-  for (const { bytes: bytes2, hash } of screenshotEntries) {
-    const artifact = screenshotArtifactPath(contentDir2, hash);
-    mkdirSync5(join6(dir, "artifacts"), { recursive: true });
-    if (!existsSync3(artifact)) writeFileSync5(artifact, bytes2);
-  }
-  const unsigned = {
-    attestation: 2,
-    runId,
-    tool: input.tool,
-    app: input.app,
-    contentDir: storedContentDir(contentDir2),
-    gitDiffHash: input.gitDiffHash,
-    releaseId: input.releaseId,
-    releaseHash: releasePayloadHash(input.releasePayload),
-    gitUntrackedHash: currentGitUntrackedHash(contentDir2),
-    descriptorHashes,
-    screenshots,
-    coverage: input.coverage,
-    report: input.report,
-    prev: previous?.selfHash ?? null
-  };
-  const attestation = { ...unsigned, selfHash: "" };
-  attestation.selfHash = selfHashFor(attestation);
-  const json5 = JSON.stringify(attestation, null, 2) + "\n";
-  const runFile = `${runId.replace(/:/g, "-")}.json`;
-  writeFileSync5(join6(dir, runFile), json5);
-  writeFileSync5(join6(dir, "latest.json"), json5);
-  const keep = Math.max(1, opts.maxRuns ?? DEFAULT_MAX_RUNS);
-  const allPriorRuns = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json").filter((name) => name !== runFile).sort().reverse();
-  const priorRuns = allPriorRuns.filter((name) => {
-    const kind = classifyRetainedRun(dir, name).kind;
-    if (kind === "legacy") {
-      unlinkSync(join6(dir, name));
-      return false;
-    }
-    return kind !== "future";
-  });
-  for (const name of priorRuns.slice(Math.max(0, keep - 1))) unlinkSync(join6(dir, name));
-  const retainedFiles = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json");
-  const retainedRuns = retainedFiles.map((name) => {
-    const classified = classifyRetainedRun(dir, name);
-    return classified.kind === "current" ? classified.run : null;
-  });
-  if (retainedRuns.every((run2) => run2 !== null)) {
-    const retainedScreenshotHashes = new Set(
-      retainedRuns.flatMap((run2) => Object.values(run2.screenshots))
-    );
-    const artifactDir = join6(dir, "artifacts");
-    if (existsSync3(artifactDir)) {
-      for (const name of readdirSync3(artifactDir).filter((candidate) => candidate.endsWith(".png"))) {
-        if (!retainedScreenshotHashes.has(name.slice(0, -4))) unlinkSync(join6(artifactDir, name));
-      }
-    }
-  }
-  return attestation;
-}
-function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, releasePayload, opts = {}) {
-  const errors = [];
-  if (selfHashFor(attestation) !== attestation.selfHash) errors.push("selfHash does not match the attestation bytes");
-  try {
-    const dir = join6(resolve6(contentDir2), ".himi", "attestations");
-    const latest = readLatestAttestation(contentDir2);
-    if (!latest || opts.requireLatest !== false && latest.selfHash !== attestation.selfHash) {
-      errors.push("attestation does not match latest.json");
-    } else {
-      const classified = readdirSync3(dir).filter((name) => name.endsWith(".json") && name !== "latest.json").map((name) => classifyRetainedRun(dir, name)).filter((entry) => entry.kind !== "future");
-      const retained = classified.map((entry) => entry.kind === "current" ? entry.run : null);
-      if (retained.some((run2) => run2 === null)) {
-        errors.push("attestation history contains a malformed retained run");
-      } else {
-        const runs = retained;
-        const byHash = new Map(runs.map((run2) => [run2.selfHash, run2]));
-        if (!byHash.has(attestation.selfHash)) errors.push("attestation has no matching retained run");
-        if (!byHash.has(latest.selfHash)) {
-          errors.push("latest.json has no matching retained run");
-        } else {
-          const seen = /* @__PURE__ */ new Set();
-          let cursor = latest;
-          while (cursor && !seen.has(cursor.selfHash)) {
-            seen.add(cursor.selfHash);
-            if (selfHashFor(cursor) !== cursor.selfHash) {
-              errors.push(`selfHash does not match retained run ${cursor.runId}`);
-              break;
-            }
-            cursor = cursor.prev ? byHash.get(cursor.prev) : void 0;
-          }
-          if (seen.size !== runs.length) errors.push("attestation hash chain does not reach every retained run");
-        }
-      }
-    }
-  } catch {
-    errors.push("attestation history could not be verified");
-  }
-  if (attestation.app !== expectedApp) errors.push(`attestation app does not match ${expectedApp}`);
-  if (attestation.contentDir !== storedContentDir(contentDir2)) errors.push("attestation contentDir does not match the requested content directory");
-  if (releasePayloadHash(releasePayload) !== attestation.releaseHash) {
-    errors.push("releaseHash does not match the current release payload");
-  }
-  try {
-    const liveDiffHash = currentGitDiffHash(contentDir2);
-    if (liveDiffHash !== "unavailable" && liveDiffHash !== attestation.gitDiffHash) {
-      errors.push("gitDiffHash does not match the live git diff");
-    }
-  } catch {
-    errors.push("gitDiffHash could not be recomputed from the live git diff");
-  }
-  try {
-    const liveUntrackedHash = currentGitUntrackedHash(contentDir2);
-    if (liveUntrackedHash !== "unavailable" && liveUntrackedHash !== attestation.gitUntrackedHash) {
-      errors.push("gitUntrackedHash does not match the live untracked source bytes");
-    }
-  } catch {
-    errors.push("gitUntrackedHash could not be recomputed from the live untracked source bytes");
-  }
-  for (const [screen, expected] of Object.entries(attestation.descriptorHashes)) {
-    const bytes2 = descriptors[screen];
-    if (bytes2 === void 0) {
-      errors.push(`missing baked descriptor for ${screen}`);
-      continue;
-    }
-    if (sha2562(bytes2) !== expected) errors.push(`descriptor hash does not match for ${screen}`);
-  }
-  for (const [screen, expected] of Object.entries(attestation.screenshots)) {
-    const path2 = screenshotArtifactPath(contentDir2, expected);
-    if (!existsSync3(path2)) {
-      errors.push(`missing screenshot for ${screen}: ${basename2(path2)}`);
-      continue;
-    }
-    if (sha2562(readFileSync5(path2)) !== expected) errors.push(`screenshot hash does not match for ${screen}: ${basename2(path2)}`);
-  }
-  return { ok: errors.length === 0, errors };
-}
+init_attestation();
 
 // ../../core/admin-web/src/utils/qr-terminal.ts
 init_qr();
@@ -68005,7 +68092,7 @@ function nativeConfigTokenNotice(configSource, optedIn) {
 }
 async function nativeConfigAdvisories(app, configSource) {
   try {
-    const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
+    const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths2(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
     const iosYml = existsSync63(iosYmlPath) ? readFileSync75(iosYmlPath, "utf8") : "";
@@ -68526,7 +68613,7 @@ function uxHandoverHint(uxEvidence, ctx) {
   if (uxEvidence.state === "failed") {
     return `a mobile-UX drive for ${releaseId} IS recorded, and it FAILED on ${uxEvidence.failedPlatforms.join(", ")} (see ${uxEvidence.path}). A published draft is the owner-private preview a customer is handed, so fix what the drive found and re-record it \u2014 re-running \`himi ux record\` over a failure without changing the app just writes the same failure down again. Only if you intend to hand a customer a preview whose UX you already know is broken, \`${door} --force\`.`;
   }
-  const why = uxEvidence.state === "absent" ? `nothing has recorded a mobile-UX drive for this package \u2014 ${uxEvidence.path} does not exist` : uxEvidence.state === "unrecorded" ? uxEvidence.malformed.length ? `${uxEvidence.path} has no iOS or Android drive this gate can read \u2014 ${uxEvidence.malformed.join("; ")}` : `${uxEvidence.path} exists but carries no iOS or Android drive (\`himi render\` writes its rendered widths there too, so the file alone proves nothing)` : uxEvidence.state === "unreadable" ? `${ctx.quote(`${ctx.contentDir}/${uxEvidence.path}`)} ${uxEvidence.error} \u2014 delete it and record again, because re-recording over a malformed store does not repair it` : uxEvidence.state === "outdated" && ctx.nondeterministicWorkers?.length ? `a mobile-UX drive for ${releaseId} is recorded, but it describes different content from the release this push just built \u2014 an uncommitted edit since the record would do that, and so does the worker named below` : uxEvidence.state === "outdated" ? `a mobile-UX drive for ${releaseId} is recorded, but the package has CHANGED since \u2014 in-repo a release id is the git HEAD sha, so editing a screen, a token or a worker without committing keeps the id while replacing everything it identifies (a record written before this check also lands here, carrying no content hash)` : `the recorded mobile-UX drive is about ${uxEvidence.otherReleases.length ? `release ${uxEvidence.otherReleases.join(", ")}` : "no release at all"}, not ${releaseId}${uxEvidence.unstamped ? ` (${uxEvidence.unstamped} drive(s) name no release)` : ""}`;
+  const why = uxEvidence.state === "absent" ? `nothing has recorded a mobile-UX drive for this package \u2014 ${uxEvidence.path} does not exist` : uxEvidence.state === "unrecorded" ? uxEvidence.malformed.length ? `${uxEvidence.path} has no iOS or Android drive this gate can read \u2014 ${uxEvidence.malformed.join("; ")}` : `${uxEvidence.path} exists but carries no iOS or Android drive (\`himi render\` writes its rendered widths there too, so the file alone proves nothing)` : uxEvidence.state === "unreadable" ? `${ctx.quote(`${ctx.contentDir}/${uxEvidence.path}`)} ${uxEvidence.error} \u2014 delete it and record again, because re-recording over a malformed store does not repair it` : uxEvidence.state === "outdated" && ctx.nondeterministicWorkers?.length ? `a mobile-UX drive for an earlier build of this commit is recorded, but it describes different content from the release this push just built (${releaseId}) \u2014 an uncommitted edit since the record would do that, and so does the worker named below` : uxEvidence.state === "outdated" ? `a mobile-UX drive for an earlier build of this commit is recorded, but the package has CHANGED since \u2014 editing a screen, a token or a worker without committing makes a new release, ${releaseId} (a record written before this check also lands here, carrying no content hash)` : `the recorded mobile-UX drive is about ${uxEvidence.otherReleases.length ? `release ${uxEvidence.otherReleases.join(", ")}` : "no release at all"}, not ${releaseId}${uxEvidence.unstamped ? ` (${uxEvidence.unstamped} drive(s) name no release)` : ""}`;
   const drifting = ctx.nondeterministicWorkers ?? [];
   if (drifting.length > 0) {
     return `${why}. ${releaseDriftCause(drifting, "Re-recording", "a drive")}; then record the drive: ${uxRemedy}, and re-run \`${door}\`. Only if you intend to hand over a preview WITHOUT that evidence, \`${door} --force\`.`;
@@ -68761,7 +68848,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
   };
   const runReleasePatch = async (opts) => {
     const { app, plan, draft } = opts;
-    const { regressionDiff: regressionDiff2, patchHonesty: patchHonesty2 } = await Promise.resolve().then(() => (init_release_patch(), release_patch_exports));
+    const { regressionDiff: regressionDiff2, patchHonesty: patchHonesty2 } = await Promise.resolve().then(() => (init_release_patch2(), release_patch_exports));
     const target = targetName();
     const baseFound = await fetchReleaseManifest(client2, app, opts.fromRelease);
     if ("error" in baseFound) {
@@ -69170,12 +69257,13 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
               try {
                 const bytes2 = readFileSync75(iconPath);
                 payload.icon = bytes2.toString("base64");
-                iconHash = createHash27("sha256").update(bytes2).digest("hex");
+                iconHash = createHash28("sha256").update(bytes2).digest("hex");
               } catch {
               }
             }
             payload.app = templateAppId;
-            payload.manifest = { ...payload.manifest, app: templateAppId, ...iconHash ? { iconHash } : {} };
+            const { rebindReleaseId: rebindReleaseId2 } = await Promise.resolve().then(() => (init_build3(), build_exports2));
+            payload.manifest = rebindReleaseId2({ ...payload.manifest, app: templateAppId, ...iconHash ? { iconHash } : {} });
             const files = sentinelizeArchive(readTemplateFiles(sourceDir), app);
             if (Object.keys(files).length === 0) {
               io.error(JSON.stringify({ error: `no source files collected from ${sourceDir}` }));
@@ -70801,7 +70889,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const contentArg = shellQuote2(contentRel);
         if (onlyRaw !== void 0) {
           const onlyDraft = flags.draft === true;
-          const { parseOnlySelectors: parseOnlySelectors2, planFromPayload: planFromPayload2, notCarriedDiff: notCarriedDiff2 } = await Promise.resolve().then(() => (init_release_patch(), release_patch_exports));
+          const { parseOnlySelectors: parseOnlySelectors2, planFromPayload: planFromPayload2, notCarriedDiff: notCarriedDiff2 } = await Promise.resolve().then(() => (init_release_patch2(), release_patch_exports));
           const parsed = parseOnlySelectors2(onlyRaw, {
             screens: Object.keys(manifest.screens ?? {}),
             bundles: Object.keys(manifest.bundles ?? {})
@@ -70859,7 +70947,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let localSourceHash;
           try {
             const { collectAppSource: collectAppSource2, zipAppSource: zipAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
-            localSourceHash = createHash27("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
+            localSourceHash = createHash28("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
           } catch {
           }
           return runReleasePatch({
@@ -70934,7 +71022,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         const evidence = pushEvidence(dir, manifest.releaseId, (candidate) => verifyAttestation(candidate, dir, payload.screens, declared, payload, { requireLatest: false }).ok);
         const drifting = nondeterministicWorkers(outcome.workers);
-        const staleEvidence = evidence.staleRuns > 0 ? `${evidence.staleRuns} retained attestation(s) carry this release id, but none describes the content being published` : null;
+        const staleEvidence = evidence.staleRuns > 0 ? `${evidence.staleRuns} retained attestation(s) were recorded at this commit, but none describes the content being published` : null;
         const attestationErrors = [...evidence.historyErrors, ...staleEvidence ? [staleEvidence] : []];
         if (attestationErrors.length > 0 && !force) {
           const remedy = `\`himi test --content ${contentArg}\` (or \`himi render <screenId> --content ${contentArg}\`)`;
@@ -70943,7 +71031,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             ok: false,
             pushed: false,
             errors: attestationErrors,
-            hint: corrupted ? `attestation history in .himi/attestations/ is corrupt, so the retained runs cannot be trusted \u2014 a fresh run does not remove the bad entry. Delete .himi/attestations/, re-attest with ${remedy}, then re-run \`himi push\`. Only if you intend to publish WITHOUT that evidence, \`himi push --force\`.` : `no retained attestation for this release passed live verification${drifting.length ? `. ${releaseDriftCause(drifting, "Re-attesting", "an attestation")}, then re-attest` : " \u2014 a release id is the HEAD sha, so runs recorded before your latest edits still carry it while describing a tree that no longer exists. Re-attest"} the CURRENT release with ${remedy}, then re-run \`himi push\`. Only if you intend to publish WITHOUT that evidence, \`himi push --force\`.`
+            hint: corrupted ? `attestation history in .himi/attestations/ is corrupt, so the retained runs cannot be trusted \u2014 a fresh run does not remove the bad entry. Delete .himi/attestations/, re-attest with ${remedy}, then re-run \`himi push\`. Only if you intend to publish WITHOUT that evidence, \`himi push --force\`.` : `no retained attestation for this release passed live verification${drifting.length ? `. ${releaseDriftCause(drifting, "Re-attesting", "an attestation")}, then re-attest` : " \u2014 runs recorded at this commit before your latest edits describe a tree that no longer exists. Re-attest"} the CURRENT release with ${remedy}, then re-run \`himi push\`. Only if you intend to publish WITHOUT that evidence, \`himi push --force\`.`
           });
           return 1;
         }
@@ -72408,7 +72496,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           });
         }
         const bytes2 = readFileSync75(file);
-        const sha = createHash27("sha256").update(bytes2).digest("hex");
+        const sha = createHash28("sha256").update(bytes2).digest("hex");
         const forScreens = (str6(flags["for-screen"]) ?? "").split(",").map((s) => s.trim()).filter(Boolean);
         if (flags["no-rebind"] !== void 0 && flags["no-rebind"] !== true) {
           io.error(JSON.stringify({ ok: false, error: "no_rebind_takes_no_value", message: "--no-rebind is a switch and takes no value; pass it bare.", usage: PATCH_USAGE }));
@@ -72744,7 +72832,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const { preflightApp: preflightApp2 } = await Promise.resolve().then(() => (init_preflight_app(), preflight_app_exports));
         const { resolveStoreCredentials: resolveStoreCredentials2 } = await Promise.resolve().then(() => (init_credential_profile(), credential_profile_exports));
         const { readIosVersion: readIosVersion2, bumpVersion: bumpVersion2 } = await Promise.resolve().then(() => (init_version(), version_exports));
-        const { iosProjectYml: iosYmlPath, hasRepoCheckout: hasRepoCheckout2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
+        const { iosProjectYml: iosYmlPath, hasRepoCheckout: hasRepoCheckout2 } = await Promise.resolve().then(() => (init_paths2(), paths_exports));
         const { ascStatus: ascStatus2 } = await Promise.resolve().then(() => (init_asc_status(), asc_status_exports));
         const { readFileSync: rf, readdirSync: rd, existsSync: ex, statSync: st } = await import("node:fs");
         const { execFile: execFile2 } = await import("node:child_process");