@wix/himalaya-cli 0.1067.0 → 0.1069.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/index.d.ts

@@ -20,3 +20,4 @@ export * from "./icon-catalog.generated.js";
 export * from "./app-link.js";
 export * from "./app-identity.js";
 export * from "./app-registry-client.js";
+export * from "./site-shell.js";

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/site-shell.d.ts

@@ -0,0 +1,125 @@
+import type { IconName } from "./icon-catalog.generated.js";
+import type { DrawerItem, NavTabItem, ScreenDescriptor, WebViewConfig } from "./schema.js";
+/** Which hosting platform the site runs on. Selects origin allow-lists (and, once
+ *  RFC 0062 phase 2 lands, the binary-shipped page adapter). */
+export type SiteKind = "wix" | "base44";
+/** Where a page lives in the native chrome. `overflow` pages are routable (deep links,
+ *  in-site links) but get no tab and no drawer row. */
+export type SitePagePlacement = "tab" | "drawer" | "overflow";
+/** One page of the customer's site, as the app presents it. */
+export interface SitePage {
+    /** Stable id — becomes the tab id and the `site_<id>` screen id. `[a-z0-9_]+`. */
+    id: string;
+    /** Native label (tab / drawer row / screen title). Copy, never a hard-coded string
+     *  in a descriptor — it comes from the provisioning file. */
+    title: string;
+    /** Path relative to the site's base URL: `"/"`, `"/shop"`, `"shop"`. Never a full
+     *  URL — an off-site page would carry the native chrome over someone else's site. */
+    path: string;
+    /** Design-system icon. Absent ⇒ `"globe"`. */
+    icon?: IconName;
+    /** Absent ⇒ `"tab"`. */
+    placement?: SitePagePlacement;
+    /** Per-page overrides, merged OVER the shell preset. */
+    webView?: Partial<WebViewConfig>;
+}
+/** What the shell hides from the hosted site so the native chrome is the only chrome.
+ *  Every flag defaults to `true` (hidden). */
+export interface SiteChrome {
+    /** The site's own header on inner pages (the home page keeps it — its menu is the
+     *  site's primary nav). */
+    hideSiteHeader?: boolean;
+    /** The site's footer. */
+    hideSiteFooter?: boolean;
+    /** The Wix ads banner shown on non-premium Wix sites. Configurable on purpose: the
+     *  default is hidden, and an owner (or a policy decision) can turn it back on
+     *  without a new binary, because the flag rides the OTA descriptor. */
+    hideWixAds?: boolean;
+}
+/** The whole site as a shell sees it. Mirrors the `site` block of a site-shell app's
+ *  `provisioning.json`. */
+export interface SiteShellConfig {
+    /** Base URL of the published site, `https` only. May carry a path — free Wix sites
+     *  live at `https://<user>.wixsite.com/<site>`. */
+    origin: string;
+    kind: SiteKind;
+    pages: readonly SitePage[];
+    chrome?: SiteChrome;
+}
+/** At most four site tabs; the rest belong in the drawer. Four, not the usual phone-bar five,
+ *  because every tab keeps its WebView warm (`keepAlive`) and the native keep-alive stores
+ *  hold four views on BOTH platforms (`WebViewKeepAliveStore`, cap 4) — a fifth tab would
+ *  evict and destroy the least-recent tab's WebView, losing its scroll and form state. */
+export declare const SITE_SHELL_MAX_TABS = 4;
+/** Screen-id prefix for every site page (`site_<page.id>`). */
+export declare const SITE_SCREEN_PREFIX = "site_";
+/** Identity-provider origins a hosted site's OAuth hops need to stay in-WebView.
+ *  Moved here from `apps/demo-app/dev/live.ts` so every shell shares one list. */
+export declare const OAUTH_IDP_ORIGINS: readonly string[];
+/** Every Base44 app's origins (`*.base44.app`) plus `base44.com`, the OAuth consent + redirect
+ *  target. The demo app's Base44 cover uses these; a SITE SHELL deliberately does not — see
+ *  {@link siteAllowedOrigins}. */
+export declare const BASE44_ORIGINS: readonly string[];
+/**
+ * Normalize a site base URL: `https` only, lower-cased host, no query/fragment, no
+ * trailing slash. Throws on anything else — a base URL that is not a loadable https
+ * site would be baked into a binary and break every launch.
+ */
+export declare function normalizeSiteOrigin(origin: string): string;
+/** The host a site's pages load from (`user.wixsite.com`, `www.example.com`). */
+export declare function siteHost(origin: string): string;
+/**
+ * What a site's WebViews may navigate to without leaving the app — scheme-qualified PATH
+ * BOUNDARIES (`https://owner.wixsite.com/my-shop/`), which the native allow-list matchers
+ * (`WebViewOriginPolicy.matches` / `allowedOriginMatches`) read as "this path, with or without
+ * the trailing slash, and everything under it". So, for the bridge-enabled WebView:
+ *  • https only — an `http` link or redirect to the same host leaves the app;
+ *  • a free site stays inside its own path — `/other-site` on the same `<user>.wixsite.com`
+ *    host is a different site, and leaves the app;
+ *  • never a prefix of another host — `https://site.com/` does not admit `site.com.evil.io`.
+ * A custom Wix domain also admits its apex / `www.` twin, because Wix redirects between them.
+ * Nothing else is admitted for any kind: a Base44 tenant gets its own host only, never every
+ * `*.base44.app` tenant — Base44 sign-in runs in the system auth session (RFC 0062 phase 5),
+ * not in this WebView.
+ */
+export declare function siteAllowedOrigins(origin: string, kind: SiteKind): string[];
+/** Join a page path onto the site's base URL. Rejects absolute URLs and `..`. */
+export declare function sitePageUrl(origin: string, path: string): string;
+/** `site_<page.id>`. */
+export declare function siteScreenId(page: Pick<SitePage, "id">): string;
+/**
+ * Hide the hosted site's footer and/or the Wix ads banner, and keep them hidden as the
+ * page mutates. Ported from `generateElementHidingScript` in the Wix RN app
+ * (`@wix/hybrid-mobile-platform`), minus the header branch — header hiding is the
+ * native `hideHostedSiteHeader` path, which keeps the home page's header.
+ *
+ * Interim delivery: this rides `injectJsDocumentEnd`. RFC 0062 phase 2 replaces it
+ * with a binary-shipped adapter selected by id (`hostedSiteAdapter` + `hideWixAds`),
+ * so no raw page script travels over the air.
+ */
+export declare function siteChromeHidingScript(options: {
+    hideFooter: boolean;
+    hideWixAds: boolean;
+}): string;
+/** Resolved chrome flags — every absent flag is `true`. */
+export declare function resolveSiteChrome(chrome: SiteChrome | undefined): Required<SiteChrome>;
+/**
+ * The WebView behaviour every site tab shares. Derived from the demo app's Site tab
+ * (`buildWebViewSiteApp`), which runs a real Wix site this way on both platforms:
+ * immersive (the site fills the tab; the native tab bar is the chrome), inset so an
+ * uncooperative site never renders under the status bar, off-site links leave the app
+ * through a prompt, and in-site history gets a floating back button.
+ */
+export declare function siteWebViewPreset(site: Pick<SiteShellConfig, "origin" | "kind" | "chrome">): WebViewConfig;
+/** The Tier-3 descriptor for one site page. */
+export declare function defineSiteTab(site: SiteShellConfig, page: SitePage): ScreenDescriptor;
+/** Every site page's descriptor, keyed by screen id. */
+export declare function siteScreens(site: SiteShellConfig): Record<string, ScreenDescriptor>;
+/** Tab-bar and drawer items for a site. Pages beyond {@link SITE_SHELL_MAX_TABS} that
+ *  asked for a tab fall into the drawer rather than disappearing. */
+export declare function siteNav(site: SiteShellConfig): {
+    tabs: NavTabItem[];
+    drawer: DrawerItem[];
+};
+/** Throws with a legible message on a site description no shell can build from. */
+export declare function assertSiteShellConfig(site: SiteShellConfig): void;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -12964,10 +12964,213 @@ var AppRegistryClient = class {
     return apps.some((a) => a.id === appId) ? "provisioned" : "unprovisioned";
   }
 };
+
+// ../../core/ts/src/site-shell.ts
+var SITE_SHELL_MAX_TABS = 4;
+var SITE_SCREEN_PREFIX = "site_";
+var OAUTH_IDP_ORIGINS = [
+  "accounts.google.com",
+  "*.google.com",
+  "*.googleusercontent.com",
+  "*.gstatic.com"
+];
+var BASE44_ORIGINS = ["*.base44.app", "*.base44.com"];
+var PAGE_ID = /^[a-z0-9_]+$/;
+function normalizeSiteOrigin(origin) {
+  const raw = (typeof origin === "string" ? origin : "").trim();
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`site origin ${JSON.stringify(origin)} is not a URL`);
+  }
+  if (url.protocol !== "https:") {
+    throw new Error(`site origin ${JSON.stringify(origin)} must be https`);
+  }
+  if (url.username || url.password) {
+    throw new Error(`site origin ${JSON.stringify(origin)} must not carry credentials`);
+  }
+  if (url.search || url.hash) {
+    throw new Error(`site origin ${JSON.stringify(origin)} must not carry a query or fragment`);
+  }
+  const path = url.pathname.replace(/\/+$/, "");
+  return `https://${url.host.toLowerCase()}${path}`;
+}
+function siteHost(origin) {
+  return new URL(normalizeSiteOrigin(origin)).host;
+}
+function siteAllowedOrigins(origin, kind) {
+  const base = new URL(normalizeSiteOrigin(origin));
+  const host = base.host;
+  const path = base.pathname.replace(/\/+$/, "");
+  const hosts = [host];
+  const isWixFreeHost = host.endsWith(".wixsite.com") || host.endsWith(".wixstudio.com");
+  if (!isWixFreeHost && kind === "wix") hosts.push(host.startsWith("www.") ? host.slice(4) : `www.${host}`);
+  return hosts.map((h) => `https://${h}${path}/`);
+}
+function sitePageUrl(origin, path) {
+  const base = normalizeSiteOrigin(origin);
+  const raw = (typeof path === "string" ? path : "").trim();
+  if (/^[a-z][a-z0-9+.-]*:/i.test(raw) || raw.startsWith("//")) {
+    throw new Error(`site page path ${JSON.stringify(path)} must be relative to the site`);
+  }
+  if (raw.includes("\\")) {
+    throw new Error(`site page path ${JSON.stringify(path)} must not contain a backslash`);
+  }
+  const trimmed = raw.replace(/^\/+/, "");
+  const joined = trimmed ? `${base}/${trimmed}` : base;
+  const resolved = new URL(joined);
+  const baseUrl = new URL(base);
+  const basePath = baseUrl.pathname.replace(/\/+$/, "");
+  const inside = resolved.pathname === basePath || resolved.pathname === `${basePath}/` || resolved.pathname.startsWith(`${basePath}/`);
+  if (resolved.host !== baseUrl.host || !inside) {
+    throw new Error(`site page path ${JSON.stringify(path)} resolves outside the site`);
+  }
+  return joined;
+}
+function siteScreenId(page) {
+  return `${SITE_SCREEN_PREFIX}${page.id}`;
+}
+function siteChromeHidingScript(options) {
+  if (!options.hideFooter && !options.hideWixAds) return "";
+  return `(function(){
+  if (window.__himiSiteChromeHider) return;
+  window.__himiSiteChromeHider = true;
+  var HIDE_FOOTER = ${options.hideFooter ? "true" : "false"};
+  var HIDE_ADS = ${options.hideWixAds ? "true" : "false"};
+  function hide(el, collapse) {
+    if (!el) return;
+    el.style.display = 'none';
+    el.style.visibility = 'hidden';
+    if (collapse) { el.style.height = '0px'; el.style.overflow = 'hidden'; }
+  }
+  function pass() {
+    if (HIDE_FOOTER) {
+      hide(document.getElementsByTagName('footer')[0] ||
+        document.querySelector('footer[id^="comp-"]') ||
+        document.querySelector('[class*="wixui-footer"]') ||
+        document.querySelector('[data-mesh-id*="SITE_FOOTER"]') ||
+        document.querySelector('[id*="SITE_FOOTER"]'), false);
+    }
+    if (HIDE_ADS) {
+      hide(document.getElementById('WIX_ADS') ||
+        document.querySelector('.WIX_ADS') ||
+        document.querySelector('[class*="WIX_ADS"]'), true);
+    }
+  }
+  var scheduled = false;
+  function schedule() {
+    if (scheduled) return;
+    scheduled = true;
+    requestAnimationFrame(function(){ scheduled = false; pass(); });
+  }
+  function start() {
+    pass();
+    new MutationObserver(schedule).observe(document.documentElement, { childList: true, subtree: true });
+  }
+  if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', start);
+  else start();
+})();`;
+}
+function resolveSiteChrome(chrome) {
+  return {
+    hideSiteHeader: chrome?.hideSiteHeader ?? true,
+    hideSiteFooter: chrome?.hideSiteFooter ?? true,
+    hideWixAds: chrome?.hideWixAds ?? true
+  };
+}
+function siteWebViewPreset(site) {
+  const chrome = resolveSiteChrome(site.chrome);
+  const hidingScript = site.kind === "wix" ? siteChromeHidingScript({ hideFooter: chrome.hideSiteFooter, hideWixAds: chrome.hideWixAds }) : siteChromeHidingScript({ hideFooter: chrome.hideSiteFooter, hideWixAds: false });
+  const config = {
+    layout: "inset",
+    immersive: true,
+    hideHostedSiteHeader: chrome.hideSiteHeader,
+    pullToRefresh: true,
+    showProgressBar: true,
+    syncStatusBarAppearance: true,
+    allowedOrigins: siteAllowedOrigins(site.origin, site.kind),
+    externalLinks: "system_browser",
+    promptBeforeExternalLink: true,
+    // A real external site, not Himalaya screens — its links stay in its WebView.
+    interceptInternalLinks: false,
+    floatingBackButton: { enabled: true },
+    autoReloadOnCrash: true,
+    domStorageEnabled: true,
+    // Each tab keeps its own warm WebView across tab switches (keyed by screen id on both
+    // platforms; see SITE_SHELL_MAX_TABS for why the tab count stays within the store's cap).
+    keepAlive: true
+  };
+  if (hidingScript) config.injectJsDocumentEnd = hidingScript;
+  return config;
+}
+function defineSiteTab(site, page) {
+  assertSitePage(page);
+  const preset = siteWebViewPreset(site);
+  return {
+    screenId: siteScreenId(page),
+    renderer: "webview_native_bridge",
+    title: page.title,
+    url: sitePageUrl(site.origin, page.path),
+    capabilitiesRequired: [],
+    schemaVersion: 1,
+    // Wix serves page HTML `no-cache`; the descriptor itself is cheap to revalidate.
+    cacheControl: { maxAge: 600, staleWhileRevalidate: 86400 },
+    webViewConfig: { ...preset, ...page.webView ?? {} }
+  };
+}
+function siteScreens(site) {
+  assertSiteShellConfig(site);
+  return Object.fromEntries(site.pages.map((page) => [siteScreenId(page), defineSiteTab(site, page)]));
+}
+function siteNav(site) {
+  assertSiteShellConfig(site);
+  const tabs = [];
+  const drawer = [];
+  for (const page of site.pages) {
+    const placement = page.placement ?? "tab";
+    const icon = page.icon ?? "globe";
+    if (placement === "tab" && tabs.length < SITE_SHELL_MAX_TABS) {
+      tabs.push({ id: page.id, screenId: siteScreenId(page), label: page.title, icon });
+    }
+    if (placement !== "overflow") {
+      drawer.push({ id: `drawer_${page.id}`, screenId: siteScreenId(page), label: page.title, icon });
+    }
+  }
+  return { tabs, drawer };
+}
+function assertSitePage(page) {
+  if (!page || typeof page.id !== "string" || !PAGE_ID.test(page.id)) {
+    throw new Error(`site page id ${JSON.stringify(page?.id)} must match ${PAGE_ID}`);
+  }
+  if (typeof page.title !== "string" || !page.title.trim()) {
+    throw new Error(`site page ${page.id} needs a title`);
+  }
+}
+function assertSiteShellConfig(site) {
+  normalizeSiteOrigin(site.origin);
+  if (site.kind !== "wix" && site.kind !== "base44") {
+    throw new Error(`site kind ${JSON.stringify(site.kind)} must be "wix" or "base44"`);
+  }
+  if (!Array.isArray(site.pages) || site.pages.length === 0) {
+    throw new Error("a site shell needs at least one page");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const page of site.pages) {
+    assertSitePage(page);
+    if (seen.has(page.id)) throw new Error(`site page id ${page.id} is declared twice`);
+    seen.add(page.id);
+    sitePageUrl(site.origin, page.path);
+  }
+  if (!site.pages.some((page) => (page.placement ?? "tab") === "tab")) {
+    throw new Error('a site shell needs at least one page with placement "tab"');
+  }
+}
 export {
   ALL_ORIENTATIONS,
   APP_ID_PATTERN,
   AppRegistryClient,
+  BASE44_ORIGINS,
   CHASSIS_GEOMETRY,
   CORE_COMPONENTS,
   DEFAULT_DISTRIBUTION,
@@ -12988,6 +13191,7 @@ export {
   LAUNCH_MANIFEST_SCHEMA,
   LAUNCH_NAMESPACE,
   LINK_MOUNT_PATHS,
+  OAUTH_IDP_ORIGINS,
   ORIGIN_PARAM_KEYS,
   PACKAGE_SHARE_ID_PATTERN,
   PLAYER_PREVIEW_SEGMENT_PATTERN,
@@ -12995,6 +13199,8 @@ export {
   PREVIEW_SURFACES,
   PROJECTION_SNAPSHOT_SIZE,
   RTL_LOCALES,
+  SITE_SCREEN_PREFIX,
+  SITE_SHELL_MAX_TABS,
   SIZE_CLASS_BREAKPOINTS,
   SPLASH_MAX_HOLD_MS_MAX,
   SPLASH_MIN_VISIBLE_MS_MAX,
@@ -13013,6 +13219,7 @@ export {
   WORKER_SUBTREE_COMMON_ACTION_PATHS,
   WORKER_SUBTREE_SAFE_TYPE_RULES,
   activeMediaItem,
+  assertSiteShellConfig,
   baselineMediaCapabilities,
   bucket,
   buildHimiPreviewUrl,
@@ -13029,6 +13236,7 @@ export {
   decodeLaunchParams,
   defaultMessage,
   defineApp,
+  defineSiteTab,
   effectiveFieldRule,
   errorMessageFor,
   evaluate,
@@ -13052,6 +13260,7 @@ export {
   isWidgetFamilySurface,
   layoutDirection,
   mergeIdiomOverlay,
+  normalizeSiteOrigin,
   parseNumeric,
   primarySubtag,
   resolveAppIdentity,
@@ -13063,6 +13272,7 @@ export {
   resolveMode,
   resolveOrientationEnvelope,
   resolveResponsiveSize,
+  resolveSiteChrome,
   resolveSizeClass,
   resolveSurfaceEnvelope,
   resolveSurfaceNav,
@@ -13071,6 +13281,14 @@ export {
   screenDescriptorSchema,
   selectIdiomOverlay,
   shouldRevealError,
+  siteAllowedOrigins,
+  siteChromeHidingScript,
+  siteHost,
+  siteNav,
+  sitePageUrl,
+  siteScreenId,
+  siteScreens,
+  siteWebViewPreset,
   stripOriginParams,
   summarize,
   surfaceById,

package/dist/cli.mjs

@@ -484,6 +484,36 @@ var init_ownership = __esm({
   }
 });
 
+// ../../core/serve-storage/src/wip-pointer.ts
+function wipSupported(store) {
+  if (!store.getWipRecord || !store.updateWipRecord) return false;
+  return store.supportsWip ? store.supportsWip() : true;
+}
+function normalizeWipRecord(value) {
+  if (!value || typeof value !== "object") return { wip: null, promoted: [], evictedBefore: null };
+  const v = value;
+  const wip = v.wip && typeof v.wip.releaseId === "string" ? v.wip : null;
+  const promoted = (Array.isArray(v.promoted) ? v.promoted : []).flatMap((entry) => {
+    if (typeof entry === "string") return [{ id: entry, at: null }];
+    const e = entry;
+    return e && typeof e.id === "string" ? [{ id: e.id, at: storedTime(e.at) }] : [];
+  });
+  return { wip, promoted, evictedBefore: storedTime(v.evictedBefore) };
+}
+async function readWip(store, app) {
+  if (!wipSupported(store)) return "unsupported";
+  const { wip, promoted } = normalizeWipRecord(await store.getWipRecord(app));
+  if (!wip || promoted.some((p) => p.id === wip.releaseId)) return null;
+  const live2 = await store.getManifest(app);
+  return live2?.releaseId === wip.releaseId ? null : wip;
+}
+var storedTime;
+var init_wip_pointer = __esm({
+  "../../core/serve-storage/src/wip-pointer.ts"() {
+    storedTime = (value) => typeof value === "string" && !Number.isNaN(Date.parse(value)) ? value : null;
+  }
+});
+
 // ../../core/serve-storage/src/store.ts
 function validateFunctionManifest(manifest) {
   const dataErrors = validateDataResources(manifest.functionDataResources, manifest.app).filter((issue2) => issue2.severity === "error");
@@ -526,6 +556,14 @@ async function retainedReleaseRefs(store, app, keepRecent = 20, keepReleaseIds =
       }
     }
   }
+  const offered = await readWip(store, app);
+  if (offered && offered !== "unsupported" && !loaded.has(offered.releaseId) && store.getManifestById) {
+    const m = await store.getManifestById(app, offered.releaseId);
+    if (m) {
+      manifests.push(m);
+      loaded.add(m.releaseId);
+    }
+  }
   for (const releaseId of new Set(keepReleaseIds)) {
     if (loaded.has(releaseId)) continue;
     if (!store.getManifestById) throw new Error(`cannot retain function job release ${releaseId}: versioned manifest lookup is unsupported`);
@@ -554,6 +592,7 @@ var TEMPLATE_APP_PREFIX;
 var init_store = __esm({
   "../../core/serve-storage/src/store.ts"() {
     init_ownership();
+    init_wip_pointer();
     TEMPLATE_APP_PREFIX = "himi-template-";
   }
 });
@@ -764,34 +803,28 @@ var init_file_store = __esm({
         else ledger.push(entry);
         writeFileSync2(this.ledgerPath(app), JSON.stringify(ledger, null, 2));
       }
-      // ---- RFC 0061 §3.1 owner-follow `wip` pointer ----
-      // Inside the app directory, so `remove` and `reset` take it with the app. `clearWipIf` is a CAS
-      // for the way this backend is deployed — ONE writer process (serve-control; serve only reads):
-      // the read, compare and delete below are synchronous with no await between them, so no other
+      // ---- RFC 0061 §3.1 owner-follow `wip` record ----
+      // Inside the app directory, so `remove` and `reset` take it with the app. `updateWipRecord` is a
+      // CAS for the way this backend is deployed — ONE writer process (serve-control; serve only
+      // reads): the read, `fn` and write below are synchronous with no await between them, so no other
       // request in that process can land in the middle. It is not a cross-process lock.
-      wipPath(app) {
-        return join2(this.appDir(app), "_wip.json");
-      }
       readWipSync(app) {
         const b = this.read(app, "_wip.json");
         if (!b) return null;
         try {
-          const wip = JSON.parse(b.toString("utf8"));
-          return wip && typeof wip.releaseId === "string" ? wip : null;
+          return JSON.parse(b.toString("utf8"));
         } catch {
           return null;
         }
       }
-      async putWip(app, wip) {
-        mkdirSync2(this.appDir(app), { recursive: true });
-        writeFileSync2(this.wipPath(app), JSON.stringify(wip, null, 2));
-      }
-      async getWip(app) {
+      async getWipRecord(app) {
         return this.readWipSync(app);
       }
-      async clearWipIf(app, releaseId) {
-        if (this.readWipSync(app)?.releaseId !== releaseId) return false;
-        rmSync(this.wipPath(app), { force: true });
+      async updateWipRecord(app, fn) {
+        const next = fn(this.readWipSync(app));
+        if (next === void 0) return false;
+        mkdirSync2(this.appDir(app), { recursive: true });
+        writeFileSync2(join2(this.appDir(app), "_wip.json"), JSON.stringify(next, null, 2));
         return true;
       }
       bundleUrl(_app, sha2565) {
@@ -3870,6 +3903,14 @@ var init_dist_jobs = __esm({
         bundleId: { ios: "ent.wix.ownerlite.dev", android: "com.wix.himi.ownerlite.dev" },
         provisioningEnv: "HIMI_OWNER_LITE_PROVISIONING_JSON"
       },
+      // RFC 0062 — the site shell: the customer's own website as native-framed Tier-3 tabs.
+      // Brandable (its package.json declares prepare:customer), so dist bakes the fetched
+      // contract's identity, icon, brand colour and `site` block into the binary.
+      brandy: {
+        appDir: "apps/himi-brandy",
+        bundleId: { ios: "ent.wix.brandy.dev", android: "com.wix.himi.brandy.dev" },
+        provisioningEnv: "HIMI_BRANDY_PROVISIONING_JSON"
+      },
       player: {
         appDir: "apps/himi-player",
         bundleId: { ios: "dev.himalaya.player.dev", android: "dev.himalaya.player.dev" },
@@ -22305,7 +22346,7 @@ function bindingPlaceholder(v, ctx) {
   if (ctx.runtimeDegraded) return null;
   return /* @__PURE__ */ jsx("span", { style: { color: ctx.color("textSecondary", "#9aa2ad"), fontStyle: "italic", overflowWrap: "anywhere", wordBreak: "break-word" }, children: v.replace(/^\$/, "") });
 }
-function mdScan(src) {
+function mdScan(src, linkStyle = "") {
   const re = new RegExp(MD_INLINE.source, "g");
   let out = "";
   let last = 0;
@@ -22317,21 +22358,22 @@ function mdScan(src) {
     } else if (label2 !== void 0) {
       if (/^https?:\/\//i.test(url)) {
         const href = mdEsc(url).replace(/"/g, """);
-        out += `<a href="${href}" target="_blank" rel="noopener noreferrer">${mdScan(label2)}</a>`;
+        out += `<a href="${href}" target="_blank" rel="noopener noreferrer"${linkStyle}>${mdScan(label2, linkStyle)}</a>`;
       } else {
         out += mdEsc(whole);
       }
     } else if (bold !== void 0) {
-      out += `<b>${mdScan(bold)}</b>`;
+      out += `<b>${mdScan(bold, linkStyle)}</b>`;
     } else {
-      out += `<i>${mdScan(italic)}</i>`;
+      out += `<i>${mdScan(italic, linkStyle)}</i>`;
     }
     last = m.index + whole.length;
   }
   return out + mdEsc(src.slice(last));
 }
-function mdInline(text5) {
-  return { __html: mdScan(text5) };
+function mdInline(text5, linkColor) {
+  const safe = typeof linkColor === "string" && /^[#a-zA-Z0-9(),.%\s-]+$/.test(linkColor) ? linkColor : "";
+  return { __html: mdScan(text5, safe ? ` style="color:${safe}"` : "") };
 }
 function sevColor(ctx, sev) {
   switch (sev) {
@@ -22346,6 +22388,20 @@ function sevColor(ctx, sev) {
       return ctx.color("accentPrimary", "#116DFF");
   }
 }
+function accentTextColor(ctx) {
+  return ctx.color("accentText", ctx.color("accentPrimary", "#116DFF"));
+}
+function sevTextColor(ctx, sev) {
+  switch (sev) {
+    case "success":
+    case "warning":
+    case "danger":
+    case "error":
+      return sevColor(ctx, sev);
+    default:
+      return accentTextColor(ctx);
+  }
+}
 function iconGlyph(name) {
   if (typeof name !== "string" || !name) return "\xB7";
   const key2 = name.toLowerCase().replace(/[_.\s-]/g, "");
@@ -25730,7 +25786,7 @@ var init_controls = __esm({
             "aria-selected": on3,
             tabIndex: on3 ? 0 : -1,
             onClick: () => select(i),
-            style: { all: "unset", display: "flex", gap: 6, alignItems: "center", minWidth: 44, minHeight: 44, padding: "10px 0", fontFamily: FONT(ctx), fontWeight: 600, fontSize: 14, cursor: "pointer", color: on3 ? C("accentPrimary", "#116DFF") : C("textSecondary", "#777"), borderBottom: on3 ? `2px solid ${C("accentPrimary", "#116DFF")}` : "2px solid transparent", marginBottom: -1 },
+            style: { all: "unset", display: "flex", gap: 6, alignItems: "center", minWidth: 44, minHeight: 44, padding: "10px 0", fontFamily: FONT(ctx), fontWeight: 600, fontSize: 14, cursor: "pointer", color: on3 ? accentTextColor(ctx) : C("textSecondary", "#777"), borderBottom: on3 ? `2px solid ${C("accentPrimary", "#116DFF")}` : "2px solid transparent", marginBottom: -1 },
             children: [
               asText2(t.label),
               t.badge && /* @__PURE__ */ jsx4("span", { "aria-hidden": true, style: { fontSize: 10, fontWeight: 700, background: C("surfaceTertiary", "#eee"), color: C("textSecondary", "#666"), padding: "1px 6px", borderRadius: 999 }, children: t.badge })
@@ -27803,9 +27859,6 @@ function actionClick(ctx, action) {
     ctx.onAction(resolveItemDeep2(action, ctx));
   };
 }
-function accentTextColor(ctx) {
-  return ctx.color("accentText", ctx.color("accentPrimary", "#116DFF"));
-}
 function actionTextButton(ctx, action, label2, color, extra) {
   if (action == null) return null;
   const onClick = actionClick(ctx, action);
@@ -28486,7 +28539,7 @@ function renderInner(node, ctx) {
         /* @__PURE__ */ jsx6("div", { style: { width: 46, height: 46, borderRadius: 13, background: C("surfaceTertiary", "#eee"), display: "grid", placeItems: "center", margin: "0 auto 12px", color: C("textSecondary", "#9aa2ad") }, children: iconSvg(props.icon, { size: 24 }) }),
         /* @__PURE__ */ jsx6("div", { style: { fontFamily: bodyFont(ctx), fontWeight: 600, fontSize: 16, color: C("textPrimary", "#111") }, children: asBoundText(props.title, ctx) || "Empty" }),
         props.subtitle && /* @__PURE__ */ jsx6("div", { style: { fontFamily: bodyFont(ctx), fontSize: 13, color: C("textSecondary", "#888"), marginTop: 3 }, children: txt(props.subtitle, ctx) }),
-        actionTextButton(ctx, props.action, asBoundText(props.actionLabel, ctx) || "Take action", C("accentPrimary", "#116DFF"), { margin: "12px auto 0", textAlign: "center" })
+        actionTextButton(ctx, props.action, asBoundText(props.actionLabel, ctx) || "Take action", accentTextColor(ctx), { margin: "12px auto 0", textAlign: "center" })
       ] });
     // ───────────── atoms ─────────────
     case "Text":
@@ -28496,7 +28549,7 @@ function renderInner(node, ctx) {
       return /* @__PURE__ */ jsx6("div", { style: { fontFamily: bodyFont(ctx), lineHeight: 1.5, overflowWrap: "break-word", color: C(resolveScalarStatic(props.color, ctx) ?? "textPrimary", "#13171e"), ...wrap }, children: runs.map((r, i) => {
         const marks = Array.isArray(r.marks) ? r.marks : [];
         const f = ctx.font(r.style);
-        return /* @__PURE__ */ jsx6("span", { style: { fontSize: f.remSize, fontWeight: marks.includes("bold") ? 700 : f.weight, fontStyle: marks.includes("italic") ? "italic" : void 0, textDecoration: marks.includes("underline") ? "underline" : void 0, ...f.family ? { fontFamily: fontStack(f.family, ctx.idiom) } : {}, ...r.color ? { color: C(r.color) } : {}, ...marks.includes("code") ? { fontFamily: "ui-monospace, monospace", background: C("surfaceTertiary", "#eee"), padding: "1px 5px", borderRadius: 4 } : {} }, children: txt(r.text, ctx) }, i);
+        return /* @__PURE__ */ jsx6("span", { style: { fontSize: f.remSize, fontWeight: marks.includes("bold") ? 700 : f.weight, fontStyle: marks.includes("italic") ? "italic" : void 0, textDecoration: marks.includes("underline") || marks.includes("link") ? "underline" : void 0, ...f.family ? { fontFamily: fontStack(f.family, ctx.idiom) } : {}, ...r.color ? { color: C(r.color) } : marks.includes("link") ? { color: accentTextColor(ctx) } : {}, ...marks.includes("code") ? { fontFamily: "ui-monospace, monospace", background: C("surfaceTertiary", "#eee"), padding: "1px 5px", borderRadius: 4 } : {} }, children: txt(r.text, ctx) }, i);
       }) });
     }
     case "Image":
@@ -28525,11 +28578,14 @@ function renderInner(node, ctx) {
       const liveCount = typeof props.text === "string" && /^\$(?:service|flag)\b/.test(props.text);
       const badgeLabel = m?.accessibilityLabel ?? m?.accessibility_label;
       const badgeRole = roleDeclared ? void 0 : liveCount ? "status" : typeof badgeLabel === "string" && badgeLabel.trim() !== "" ? "img" : void 0;
-      return /* @__PURE__ */ jsx6("span", { role: badgeRole, style: { display: "inline-flex", alignItems: "center", padding: "3px 9px", borderRadius: 999, fontSize: 12, fontWeight: 700, fontFamily: bodyFont(ctx), background: `color-mix(in srgb, ${c} 16%, ${C("surfacePrimary", "#fff")})`, color: c, ...wrap }, children: ctx.empty ? "" : txt(props.text, ctx) || "Badge" });
+      const fg = _bt ? c : sevTextColor(ctx, props.style ?? "info");
+      return /* @__PURE__ */ jsx6("span", { role: badgeRole, style: { display: "inline-flex", alignItems: "center", padding: "3px 9px", borderRadius: 999, fontSize: 12, fontWeight: 700, fontFamily: bodyFont(ctx), background: `color-mix(in srgb, ${c} 16%, ${C("surfacePrimary", "#fff")})`, color: fg, ...wrap }, children: ctx.empty ? "" : txt(props.text, ctx) || "Badge" });
     }
     case "Tag": {
-      const c = C(boundTokenName(props.tokenPath, props.token, ctx) ?? "accentPrimary", "#116DFF");
-      return /* @__PURE__ */ jsx6("span", { style: { display: "inline-flex", alignItems: "center", padding: "5px 11px", borderRadius: 999, fontSize: 13, fontWeight: 600, fontFamily: bodyFont(ctx), background: `color-mix(in srgb, ${c} 14%, ${C("surfacePrimary", "#fff")})`, border: `1px solid color-mix(in srgb, ${c} 30%, transparent)`, color: c, ...wrap }, children: ctx.empty ? "" : txt(props.text, ctx) || "Tag" });
+      const tagToken = boundTokenName(props.tokenPath, props.token, ctx);
+      const c = C(tagToken ?? "accentPrimary", "#116DFF");
+      const tagFg = tagToken ? c : accentTextColor(ctx);
+      return /* @__PURE__ */ jsx6("span", { style: { display: "inline-flex", alignItems: "center", padding: "5px 11px", borderRadius: 999, fontSize: 13, fontWeight: 600, fontFamily: bodyFont(ctx), background: `color-mix(in srgb, ${c} 14%, ${C("surfacePrimary", "#fff")})`, border: `1px solid color-mix(in srgb, ${c} 30%, transparent)`, color: tagFg, ...wrap }, children: ctx.empty ? "" : txt(props.text, ctx) || "Tag" });
     }
     case "ProgressBar":
       return /* @__PURE__ */ jsx6(ProgressBarNode, { props, ctx, wrap });
@@ -28780,7 +28836,7 @@ function renderInner(node, ctx) {
       return /* @__PURE__ */ jsx6("div", { style: { display: "flex", flexDirection: "column", gap: 6, width: "100%", ...wrap }, children: branch ? renderNode(props[branch], ctx) : cfg && typeof cfg === "object" ? /* @__PURE__ */ jsxs3("div", { style: { textAlign: "center", padding: "24px 12px", color: C("textSecondary", "#9aa2ad") }, children: [
         cfg.title && /* @__PURE__ */ jsx6("div", { style: { fontSize: 15, fontWeight: 600, color: C("textPrimary", "#111") }, children: asText2(cfg.title) }),
         (cfg.subtitle ?? cfg.message) && /* @__PURE__ */ jsx6("div", { style: { fontSize: 13, marginTop: 4 }, children: asText2(cfg.subtitle ?? cfg.message) }),
-        actionTextButton(ctx, cfg.retry ?? cfg.action, asText2(cfg.retryLabel) || asText2(cfg.actionLabel) || (cfg.retry != null ? "Retry" : "Take action"), C("accentPrimary", "#116DFF"), { margin: "12px auto 0", textAlign: "center" })
+        actionTextButton(ctx, cfg.retry ?? cfg.action, asText2(cfg.retryLabel) || asText2(cfg.actionLabel) || (cfg.retry != null ? "Retry" : "Take action"), accentTextColor(ctx), { margin: "12px auto 0", textAlign: "center" })
       ] }) : null });
     }
     case "FragmentSlot":
@@ -30411,7 +30467,8 @@ var init_renderNode = __esm({
         display: "grid",
         placeItems: "center",
         fontSize: 18,
-        color: C("accentPrimary", "#116DFF"),
+        color: accentTextColor(ctx),
+        // #3275 — a glyph on a neutral key
         border: `1px solid ${C("border", "#e3e3e3")}`,
         cursor: ctx.onAction && !disabled(at) ? "pointer" : "default",
         opacity: disabled(at) ? 0.4 : 1,
@@ -30596,7 +30653,7 @@ var init_renderNode = __esm({
         const resolved2 = resolveScalarStatic(props.text, ctx);
         return resolved2 == null ? null : String(resolved2);
       })();
-      const content = countContent != null ? countContent : icuPattern != null ? /* @__PURE__ */ jsx6(InterpolatedTextView, { pattern: icuPattern, params: props.template?.params ?? {}, ctx }) : mdSource != null ? /* @__PURE__ */ jsx6("span", { dangerouslySetInnerHTML: mdInline(mdSource) }) : txt(props.text, ctx);
+      const content = countContent != null ? countContent : icuPattern != null ? /* @__PURE__ */ jsx6(InterpolatedTextView, { pattern: icuPattern, params: props.template?.params ?? {}, ctx }) : mdSource != null ? /* @__PURE__ */ jsx6("span", { dangerouslySetInnerHTML: mdInline(mdSource, accentTextColor(ctx)) }) : txt(props.text, ctx);
       const tAlign = props.textAlign === "center" ? "center" : props.textAlign === "trailing" ? "right" : props.textAlign === "justify" ? "justify" : props.textAlign === "leading" ? "left" : void 0;
       const tDecor = props.decoration === "strikethrough" ? "line-through" : props.decoration === "underline" ? "underline" : void 0;
       const ln = typeof props.lineSpacing === "number" ? pxToRem((f.line ?? 1.4) * f.size + props.lineSpacing) : f.line;
@@ -30642,7 +30699,7 @@ var init_renderNode = __esm({
       }
       if (props.icon != null && props.url == null && props.asset == null && imgInitials == null) {
         const side2 = typeof w === "number" ? w : 40;
-        return /* @__PURE__ */ jsx6("div", { style: { width: side2, height: side2, borderRadius: "50%", background: ph ?? C("surfaceTertiary", "#e6e6e6"), display: "grid", placeItems: "center", flex: "none", ...wrap }, children: iconSvg(props.icon, { size: Math.max(14, Math.round(side2 * 0.5)), color: C("accentPrimary", "#116DFF") }) });
+        return /* @__PURE__ */ jsx6("div", { style: { width: side2, height: side2, borderRadius: "50%", background: ph ?? C("surfaceTertiary", "#e6e6e6"), display: "grid", placeItems: "center", flex: "none", ...wrap }, children: iconSvg(props.icon, { size: Math.max(14, Math.round(side2 * 0.5)), color: accentTextColor(ctx) }) });
       }
       return /* @__PURE__ */ jsx6("div", { style: { width: w, height: boxHeight, aspectRatio: ar, borderRadius: r, background: ph ?? (hasSource ? `linear-gradient(135deg, ${C("surfaceTertiary", "#e6e6e6")}, ${C("surfaceSecondary", "#f2f2f2")})` : "transparent"), color: C("textSecondary", "#999"), display: "flex", alignItems: "center", justifyContent: "center", fontFamily: "ui-monospace, monospace", fontSize: 11, flex: "none", ...wrap }, children: banner || !hasSource ? "" : "\u2022" });
     });
@@ -31319,11 +31376,13 @@ var init_renderNode = __esm({
       const effectivePositionMs = seeked ?? positionMs;
       const progress = scrub ?? (durationMs > 0 ? Math.min(Math.max(effectivePositionMs / durationMs, 0), 1) : 0);
       const clockMs = scrub != null || effectivePositionMs > 0 || isPlaying || isLoading ? Math.min(Math.round(progress * durationMs), durationMs) : durationMs;
-      const tint = C(resolveScalarStatic(props.tint, ctx) ?? "accentPrimary", "#116DFF");
+      const tintToken = resolveScalarStatic(props.tint, ctx);
+      const tint = C(tintToken ?? "accentPrimary", "#116DFF");
       const danger = C("danger", "#E62214");
       const secondary = C("textSecondary", "#636B78");
       const onAccent = C("textOnAccent", "#FFFFFF");
       const accent = isFailed ? danger : tint;
+      const accentLabel = isFailed ? danger : tintToken ? tint : accentTextColor(ctx);
       const emit = (action, extra) => {
         if (!ctx.onAction || !action) return;
         const a = resolveItemDeep2(action, ctx);
@@ -31491,7 +31550,7 @@ var init_renderNode = __esm({
                   fontSize: 11,
                   fontWeight: 600,
                   fontFamily: "inherit",
-                  color: accent,
+                  color: accentLabel,
                   background: C("surfaceSecondary", "#F5F7FA"),
                   borderRadius: 999,
                   padding: "3px 7px"
@@ -32156,7 +32215,7 @@ var init_renderNode = __esm({
             }
           )
         ] }),
-        /* @__PURE__ */ jsx6("div", { style: { display: "flex", marginLeft: 44, minWidth: days.length * 90 }, children: laneMode ? laneCols.map((lane) => /* @__PURE__ */ jsx6("div", { "data-lane": lane.id, style: { flex: "1 1 0", minWidth: 0, textAlign: "center", fontFamily: bodyFont(ctx), fontSize: 12, fontWeight: 600, color: C("textSecondary", "#888"), padding: "4px 2px", overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: laneTitle(lane.id) }, lane.id)) : days.map((d, i) => /* @__PURE__ */ jsx6("div", { style: { flex: "1 1 0", minWidth: 0, textAlign: "center", fontFamily: bodyFont(ctx), fontSize: 11, fontWeight: 600, color: dayKeys[i] === nowKey ? C("accentPrimary", "#116DFF") : C("textSecondary", "#888") }, children: d.toLocaleDateString(void 0, { weekday: "short", day: "numeric" }) }, i)) }),
+        /* @__PURE__ */ jsx6("div", { style: { display: "flex", marginLeft: 44, minWidth: days.length * 90 }, children: laneMode ? laneCols.map((lane) => /* @__PURE__ */ jsx6("div", { "data-lane": lane.id, style: { flex: "1 1 0", minWidth: 0, textAlign: "center", fontFamily: bodyFont(ctx), fontSize: 12, fontWeight: 600, color: C("textSecondary", "#888"), padding: "4px 2px", overflow: "hidden", textOverflow: "ellipsis", whiteSpace: "nowrap" }, children: laneTitle(lane.id) }, lane.id)) : days.map((d, i) => /* @__PURE__ */ jsx6("div", { style: { flex: "1 1 0", minWidth: 0, textAlign: "center", fontFamily: bodyFont(ctx), fontSize: 11, fontWeight: 600, color: dayKeys[i] === nowKey ? accentTextColor(ctx) : C("textSecondary", "#888") }, children: d.toLocaleDateString(void 0, { weekday: "short", day: "numeric" }) }, i)) }),
         days.some((_, i) => (byDay.get(dayKeys[i])?.allDay.length ?? 0) > 0) && /* @__PURE__ */ jsx6("div", { style: { display: "flex", marginLeft: 44, gap: 2, marginBottom: 4, minWidth: days.length * 90 }, children: days.map((d, i) => /* @__PURE__ */ jsx6("div", { style: { flex: "1 1 0", minWidth: 0, display: "flex", flexDirection: "column", gap: 2, padding: "0 1px" }, children: (byDay.get(dayKeys[i])?.allDay ?? []).map((ev, j) => {
           const tappable = !!(ev?.onTap || props.onSelectEvent);
           return /* @__PURE__ */ jsx6(
@@ -33832,6 +33891,12 @@ var init_app_registry_client = __esm({
   }
 });
 
+// ../../core/ts/src/site-shell.ts
+var init_site_shell = __esm({
+  "../../core/ts/src/site-shell.ts"() {
+  }
+});
+
 // ../../core/ts/src/index.ts
 var init_src5 = __esm({
   "../../core/ts/src/index.ts"() {
@@ -33858,6 +33923,7 @@ var init_src5 = __esm({
     init_app_link();
     init_app_identity();
     init_app_registry_client();
+    init_site_shell();
   }
 });
 
@@ -38191,12 +38257,6 @@ var init_src6 = __esm({
   }
 });
 
-// ../../core/serve-storage/src/wip-pointer.ts
-var init_wip_pointer = __esm({
-  "../../core/serve-storage/src/wip-pointer.ts"() {
-  }
-});
-
 // ../../core/serve-storage/src/release-patch.ts
 import { createHash as createHash17 } from "node:crypto";
 function sha256hex(b) {
@@ -53071,21 +53131,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-RMW-OZ7N.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1062852, sha256: "5ceea282c8f188d80853097ec1e56e9f363fcd19e5b7d0882134f326db513d89" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1062860, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1067470, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1556054, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1646978, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1737962, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1828942, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1919814, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2010794, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2119430, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2228514, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2337562, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2445262, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2533370, length: 4947, sha256: "f7717e4d819fee4e0719a369ca061f514e02ff24f7f0dacaa6469a4a2fca8dcf" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2538317, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
+      { key: "assets/index-DlDXdHId.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1063092, sha256: "758c655ba88cbb54101f690281513fcff56aaa8b4a31dd49545d0f30f45e05f8" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1063100, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1067710, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1556294, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1647218, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1738202, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1829182, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1920054, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2011034, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2119670, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2228754, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2337802, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2445502, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2533610, length: 4947, sha256: "7a5bedfb0fdf0c376ce40bba70539332bca4b2fad4e4112465fb1875e03aa29b" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2538557, length: 17209, sha256: "dffc9718e2faa63ae2cc919e0a842f585ed565aaaa7c53778e90379442c731b6" }
     ];
   }
 });
@@ -59418,6 +59478,13 @@ async function applyOverlays(input) {
       );
     }
     const appDir2 = join61(repoRoot2, shellAppDir(shell));
+    const committedPath = join61(appDir2, "provisioning.json");
+    const committedSite = existsSync62(committedPath) ? JSON.parse(readFileSync73(committedPath, "utf8")).site : void 0;
+    if (committedSite !== void 0 && overlay.site === void 0) {
+      throw new Error(
+        `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), which this analysis does not produce yet. Write the site block into a contract and run \`npm run prepare:customer -- --contract <file>\` in ${shellAppDir(shell)} (or \`himi dist --shell ${shell}\`).`
+      );
+    }
     const packageDir = dirname33(resolve45(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir2, packageDir, overlay });
     wrote.push(...staged);
@@ -67367,7 +67434,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                              carries no attestation, source archive, assets, icon or
                                              minBinaryVersion \u2014 all named in the output.
   himi dist [--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>]
-            [--shell branded-lite|owner-lite|player|demo-app] [--signing wix-managed|byo]
+            [--shell branded-lite|owner-lite|brandy|player|demo-app] [--signing wix-managed|byo]
             [--android-signing qa-keystore|wix-keystore|debug]
             [--borrow-ios-id <bundleId>] [--no-wait] [--force]
                                            build an INSTALLABLE QA binary (signed IPA / APK) on
@@ -67379,7 +67446,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            the in-repo default is a local dev plane that isn't
                                            reachable off-repo.
                                            --shell picks the native host to sign into (branded-lite |
-                                           owner-lite | player | demo-app). --signing defaults to
+                                           owner-lite | brandy | player | demo-app). --signing defaults to
                                            wix-managed: the Wix Apple account mints a per-app
                                            identity for the build, so you provision nothing.
                                            --signing byo (your own Apple account) is reserved and
@@ -67667,7 +67734,7 @@ var COMMANDS = [
   { name: "patch", summary: 'change ONE item of a published app \u2014 a screen descriptor, a Tier-5 bundle, tokens, or the app-config baseline \u2014 from a RAW FILE, with no content package and no build. The low-level door: it does not lint your package, because there is no package here; `himi push --only <selector>` is the same edit with the full build + lint gate and is what to reach for when the package is in hand. Derives a new release from the app\'s current LIVE release, or from `--from-release <id>`. An explicit `--draft` or `--live` is REQUIRED \u2014 a patch has no default blast radius \u2014 and `--notes` is required with `--live` on a screen or app-config patch, because off-repo `gitSha` is "dev" and the ledger notes are then the only durable record of bytes that correspond to no commit. A branch does not merge: activating one derived from an older release reverts every item the patch does not move, so that case is refused until `--accept-regressions`. A bundle patch must repoint a screen (`--for-screen`) or the bytes land under a manifest key nothing reads. It cannot ADD a screen (screens are git-only, RFC 0012), never claims a slug \u2014 the app must already be published \u2014 and carries no attestation, source archive, assets, icon or minBinaryVersion, each named in the output.', required: "screen <id> --file <descriptor.json> [--bundle <sha256|none>] | bundle --file <bundle.js> (--for-screen <id>[,<id>] | --no-rebind) | tokens --file <tokens.json> | app-config --file <app-config.json> ; (--draft|--live) --app <a> [--from-release <id>] [--accept-regressions] [--label <n>] [--notes <t>] [--force] [--target <t>] (--control-token)" },
   { name: "flags", summary: "read and change the app's OPERATIONAL flags (RFC 0013) \u2014 `list` prints what the DEVICE door serves, `set <key> --definition` creates or replaces one, `ramp <key>` moves its rollout share or kills it, `rm <key>` deletes it and echoes the definition back so the removal is reversible. Every write is followed by a read of the same door the device uses, and the answer is reported as `servedNow`: flags are stored in the app's git-committed flags.json, so a control plane with no checkout accepts a write it will never serve.", required: "list|set|ramp|rm [<key>] [--definition <json|@file>] [--percent 0-100] [--enabled true|false] [--app <a>] (--control-token)" },
   { name: "visibility", summary: "read (no value) or set whether the public registry (/v1/apps + the Himi Player picker) LISTS the app. `public` lists it for everyone; `unlisted` hides it from listings while direct reads by app id \u2014 deep links, previews \u2014 keep working. App from --app or the content dir. Setting it needs no republish.", required: "[public|unlisted] [--app <a>] [--content <dir>] (--control-token)" },
-  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | player | demo-app). `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo` (sign with your own Apple account) is reserved and 501s. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|player|demo-app] [--signing wix-managed|byo] [--android-signing qa-keystore|wix-keystore|debug] [--borrow-ios-id <bundleId>] [--no-wait] [--force] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
+  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | player | demo-app); `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo` (sign with your own Apple account) is reserved and 501s. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|player|demo-app] [--signing wix-managed|byo] [--android-signing qa-keystore|wix-keystore|debug] [--borrow-ios-id <bundleId>] [--no-wait] [--force] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
   { name: "testflight", summary: 'build, sign and upload an app to TestFlight (internal testers \u2014 no Beta App Review), then WAIT until App Store Connect finishes processing it. Sugar for `store upload --track testflight`. Prompts first: a build number is consumed permanently on a real Apple account and cannot be reused \u2014 `--yes` for CI, `--dry-run` to see the plan without touching anything. The wait is the real check, not a nicety: fastlane prints "Successfully uploaded" for a binary App Store Connect then rejects in processing, and a rejected binary leaves NO build record at all (the reason is emailed). Public App Store review is deliberately NOT automatable here \u2014 `--track appstore` is refused; use /submit-ios-app when you mean to go public', required: "<app> [--track testflight|internal] [--profile <name>] [--yes] [--dry-run] [--skip-build] [--no-wait] [--json]" },
   { name: "store", summary: "the App Store Connect group behind `testflight`. `preflight <app>` checks readiness offline (icon, entitlements, encryption flag, version, store.config ids, listing + review record); `upload <app>` is what `testflight` runs; `status <app>` reads live build + processing state. `--profile` selects WHICH App Store Connect account: an app built for a Wix customer ships under the CUSTOMER's Apple team (Apple guideline 4.2.6 forbids an app-generation service submitting on a client's behalf), declared per-app as ios.credentialProfile in store.config.yaml and resolved from ~/.himalaya/store-credentials/<name>.json \u2014 the .p8 itself never enters the repo", required: "preflight <app> [--profile <n>] | upload <app> [--track <t>] [--profile <n>] [--yes] [--dry-run] | status <app> [--profile <n>]" },
   { name: "guide", summary: "print the Himalaya overview + headless dev loop + available topics (offline)", required: "[--json]" },

package/guides/wix-site-to-himi-app.md

@@ -6,6 +6,11 @@ app that is **another client of that site** — same catalog, CMS, members, form
 IA and UX rewritten for a phone. Not a WebView. Not a shrunk desktop. Not
 `--apply` onto Branded Lite and stop.
 
+> **Not this page: "my website, as an app, today."** That is the *site shell*
+> (`himi dist --shell brandy`) — the customer's live site in native-framed WebView tabs. It is a separate, day-0 path that
+> graduates to this page's native app one tab at a time; it never replaces it. Everything
+> below is the native app.
+
 This page is the body of `himi docs wix-site-to-himi-app`. The hosted CLI skill
 ([skill.md](https://apps.wix.com/_api/himi-serve/skill.md)) should send you here
 when the user gave a site URL / client id. Analyze is collect+judge
@@ -248,7 +253,7 @@ state), and pass `himi test`. Then run
 - Never invoke Velo HTTP functions **from analyze** (or as a substitute for rewriting Velo *pages*). To create/update/publish the site's HTTP API use `himi site function` (`himi docs wix-site-http-functions`).
 - Never log contact PII; never paste `secrets-backend`.
 - Never invent CMS schemas when the book’s CMS chapter is empty but the site has forms.
-- Never pixel-clone the website; never wrap it in a WebView.
+- Never pixel-clone the website; never wrap it in a WebView (the WebView product is the separate site shell, `--shell brandy` — not this guide's output).
 - Never edit the Himalaya monorepo’s committed `apps/himi-branded-lite/provisioning.json`.
 
 ## See also

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1067.0",
+  "version": "0.1069.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -65,5 +65,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "0c8d3503f5ca13101d4857f4aea03d5974e1c26ac88f40e350b6d4de"
+  "falconPackageHash": "d66a8a95769c3eb84b52d4da2233db6689f1f833a2b254304aff2bc0"
 }