@wix/himalaya-cli 0.1102.0 → 0.1104.0

package/dist/cli.mjs

@@ -3979,7 +3979,11 @@ function isBrandable(repoRoot2, name) {
     return false;
   }
 }
-var SHELL_NAMES2, DEFAULT_BRANDABLE_SHELL, HOME_REFRESH_ACTIONS;
+function isSiteShell(name) {
+  assertKnownShell(name);
+  return SITE_SHELLS.has(name);
+}
+var SHELL_NAMES2, DEFAULT_BRANDABLE_SHELL, HOME_REFRESH_ACTIONS, SITE_SHELLS;
 var init_brandable_shells = __esm({
   "src/brandable-shells.ts"() {
     init_dist_jobs();
@@ -3988,6 +3992,7 @@ var init_brandable_shells = __esm({
     HOME_REFRESH_ACTIONS = {
       "branded-lite": "tier5.himiBrandedHome.refresh"
     };
+    SITE_SHELLS = /* @__PURE__ */ new Set(["brandy"]);
   }
 });
 
@@ -24713,6 +24718,7 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
+    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -29113,6 +29119,7 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
+    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -36813,8 +36820,86 @@ var init_app_registry_client = __esm({
 });
 
 // ../../core/ts/src/site-shell.ts
+function normalizeSiteOrigin(origin) {
+  const raw = (typeof origin === "string" ? origin : "").trim();
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    throw new Error(`site origin ${JSON.stringify(origin)} is not a URL`);
+  }
+  if (url.protocol !== "https:") {
+    throw new Error(`site origin ${JSON.stringify(origin)} must be https`);
+  }
+  if (url.username || url.password) {
+    throw new Error(`site origin ${JSON.stringify(origin)} must not carry credentials`);
+  }
+  if (url.search || url.hash) {
+    throw new Error(`site origin ${JSON.stringify(origin)} must not carry a query or fragment`);
+  }
+  const path2 = url.pathname.replace(/\/+$/, "");
+  return `https://${url.host.toLowerCase()}${path2}`;
+}
+function sitePageUrl(origin, path2) {
+  const base = normalizeSiteOrigin(origin);
+  const raw = (typeof path2 === "string" ? path2 : "").trim();
+  if (/^[a-z][a-z0-9+.-]*:/i.test(raw) || raw.startsWith("//")) {
+    throw new Error(`site page path ${JSON.stringify(path2)} must be relative to the site`);
+  }
+  if (raw.includes("\\")) {
+    throw new Error(`site page path ${JSON.stringify(path2)} must not contain a backslash`);
+  }
+  const trimmed = raw.replace(/^\/+/, "");
+  const joined = trimmed ? `${base}/${trimmed}` : base;
+  const resolved2 = new URL(joined);
+  const baseUrl = new URL(base);
+  const basePath = baseUrl.pathname.replace(/\/+$/, "");
+  const inside2 = resolved2.pathname === basePath || resolved2.pathname === `${basePath}/` || resolved2.pathname.startsWith(`${basePath}/`);
+  if (resolved2.host !== baseUrl.host || !inside2) {
+    throw new Error(`site page path ${JSON.stringify(path2)} resolves outside the site`);
+  }
+  return joined;
+}
+function siteScreenId(page) {
+  return `${SITE_SCREEN_PREFIX}${page.id}`;
+}
+function assertSitePage(page) {
+  if (!page || typeof page.id !== "string" || !PAGE_ID.test(page.id)) {
+    throw new Error(`site page id ${JSON.stringify(page?.id)} must match ${PAGE_ID}`);
+  }
+  if (siteScreenId(page) === SITE_PAGE_SCREEN_ID) {
+    throw new Error(`site page id "page" is reserved for the ${SITE_PAGE_SCREEN_ID} fallback screen`);
+  }
+  if (typeof page.title !== "string" || !page.title.trim()) {
+    throw new Error(`site page ${page.id} needs a title`);
+  }
+}
+function assertSiteShellConfig(site) {
+  normalizeSiteOrigin(site.origin);
+  if (site.kind !== "wix" && site.kind !== "base44") {
+    throw new Error(`site kind ${JSON.stringify(site.kind)} must be "wix" or "base44"`);
+  }
+  if (!Array.isArray(site.pages) || site.pages.length === 0) {
+    throw new Error("a site shell needs at least one page");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const page of site.pages) {
+    assertSitePage(page);
+    if (seen.has(page.id)) throw new Error(`site page id ${page.id} is declared twice`);
+    seen.add(page.id);
+    sitePageUrl(site.origin, page.path);
+  }
+  if (!site.pages.some((page) => (page.placement ?? "tab") === "tab")) {
+    throw new Error('a site shell needs at least one page with placement "tab"');
+  }
+}
+var SITE_SHELL_MAX_TABS, SITE_SCREEN_PREFIX, SITE_PAGE_SCREEN_ID, PAGE_ID;
 var init_site_shell = __esm({
   "../../core/ts/src/site-shell.ts"() {
+    SITE_SHELL_MAX_TABS = 4;
+    SITE_SCREEN_PREFIX = "site_";
+    SITE_PAGE_SCREEN_ID = "site_page";
+    PAGE_ID = /^[a-z0-9_]+$/;
   }
 });
 
@@ -60017,7 +60102,7 @@ function classifyPageRole(url, title, _nav = "") {
   if (/\b(blog|journal|news|posts?|ebooks?|insight)\b/.test(hay)) return "blog";
   if (/\b(about|story|our-story)\b/.test(hay)) return "about";
   if (/\b(contact|find-us)\b/.test(hay)) return "contact";
-  if (/\b(event|meetup|workshop)\b/.test(hay)) return "events";
+  if (/\b(events?|meetups?|workshops?)\b/.test(hay)) return "events";
   if (/\b(gallery|portfolio|work)\b/.test(hay)) return "gallery";
   return "other";
 }
@@ -60380,11 +60465,11 @@ function parsePublishedHtml(html) {
   PAGE_ENTRY_RE.lastIndex = 0;
   let m;
   while (m = PAGE_ENTRY_RE.exec(html)) {
-    const pageId = m[1];
-    if (seen.has(pageId) || pages.length >= 80) continue;
-    seen.add(pageId);
+    const pageId2 = m[1];
+    if (seen.has(pageId2) || pages.length >= 80) continue;
+    seen.add(pageId2);
     pages.push({
-      pageId,
+      pageId: pageId2,
       title: unescapeJsonString(m[2] ?? ""),
       slug: unescapeJsonString(m[3] ?? "")
     });
@@ -60679,7 +60764,7 @@ function veloHintFromEval(evaled, page) {
   if (!v) return void 0;
   const wixRendered = !!v.wixRendered;
   const pageModuleUrls = (v.pageModuleUrls ?? []).filter(Boolean).slice(0, 16);
-  const pageId = (v.pageId || page.pageId || "").trim() || void 0;
+  const pageId2 = (v.pageId || page.pageId || "").trim() || void 0;
   const hasCode = pageModuleUrls.length > 0 || !!v.gridAppId || (v.wixCodeFeatures ?? []).length > 0;
   return {
     wixRendered,
@@ -60688,7 +60773,7 @@ function veloHintFromEval(evaled, page) {
     wixCodeFeatures: (v.wixCodeFeatures ?? []).slice(0, 24),
     pageModuleUrls,
     httpFunctionHints: (v.httpFunctionHints ?? []).filter(Boolean).slice(0, 16),
-    pages: [{ url: page.url, title: page.title, hasCode: wixRendered && hasCode, ...pageId ? { pageId } : {} }]
+    pages: [{ url: page.url, title: page.title, hasCode: wixRendered && hasCode, ...pageId2 ? { pageId: pageId2 } : {} }]
   };
 }
 function pageIdFromVeloPath(path2) {
@@ -62811,13 +62896,15 @@ function mergeCustomerOwned(committed, overlay) {
     "locale",
     "wix",
     "copy",
-    "faq"
+    "faq",
+    "site"
   ];
   const customer = {};
   for (const key2 of CUSTOMER_OWNED) {
     const value = overlay[key2];
     if (value !== void 0) customer[key2] = value;
   }
+  if (committed.site === void 0) delete customer.site;
   const overlayBranding = { ...customer.branding ?? {} };
   delete overlayBranding.appIconPath;
   delete overlayBranding.fonts;
@@ -62969,7 +63056,7 @@ async function applyOverlays(input) {
     const committedSite = existsSync64(committedPath) ? JSON.parse(readFileSync76(committedPath, "utf8")).site : void 0;
     if (committedSite !== void 0 && overlay.site === void 0) {
       throw new Error(
-        `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), which this analysis does not produce yet. Write the site block into a contract and run \`npm run prepare:customer -- --contract <file>\` in ${shellAppDir(shell)} (or \`himi dist --shell ${shell}\`).`
+        `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), and this overlay has none. Re-run \`himi site analyze --url <site> --shell ${shell}\` to derive the site's page map (edit \`site.pages\` in provisioning.overlay.json if needed), then --apply.`
       );
     }
     const packageDir = dirname35(resolve49(input.overlayPath));
@@ -63175,6 +63262,170 @@ var init_apply2 = __esm({
   }
 });
 
+// src/site-analyze/site-shell-derive.ts
+function isSystemPage(path2, title) {
+  const last = path2.split("/").filter(Boolean).pop() ?? "";
+  return SYSTEM_SEGMENT.test(last) || SYSTEM_TITLE.test(title);
+}
+function boundedTitle(s) {
+  const t = oneLine2(s).replace(/\s*\(new\)\s*$/i, "");
+  return t.length <= SITE_PAGE_TITLE_MAX ? t : t.slice(0, SITE_PAGE_TITLE_MAX).trimEnd();
+}
+function pathOnSite(origin, url) {
+  let u;
+  let base;
+  try {
+    u = new URL(url);
+    base = new URL(origin);
+  } catch {
+    return null;
+  }
+  const host = (h) => h.toLowerCase().replace(/^www\./, "");
+  if (host(u.host) !== host(base.host)) return null;
+  const basePath = base.pathname.replace(/\/+$/, "");
+  const p = u.pathname.replace(/\/+$/, "");
+  if (p !== basePath && !p.startsWith(`${basePath}/`)) return null;
+  return p.slice(basePath.length) || "/";
+}
+function isHomePage(page, mainPageId) {
+  return mainPageId !== void 0 && page.pageId === mainPageId || !page.slug || page.slug === "home";
+}
+function pageId(c, used) {
+  const fromPath = (c.path.split("/").filter(Boolean).pop() ?? "").toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const base = c.role !== "other" && c.role !== "home" && !used.has(c.role) ? c.role : fromPath || "page_1";
+  let id = base === "page" ? "page_1" : base;
+  for (let n = 2; used.has(id); n++) id = `${base}_${n}`;
+  used.add(id);
+  return id;
+}
+function deriveSiteShell(input) {
+  const origin = normalizeSiteOrigin(input.siteUrl);
+  const notes = [];
+  const published = input.look.sitePages ?? [];
+  const mainPageId = input.look.mainPageId;
+  const candidates = [];
+  const seenPaths = /* @__PURE__ */ new Set(["/"]);
+  let systemDropped = 0;
+  const add = (title, path2, url) => {
+    if (seenPaths.has(path2) || !title) return;
+    if (isSystemPage(path2, title)) {
+      seenPaths.add(path2);
+      systemDropped++;
+      return;
+    }
+    seenPaths.add(path2);
+    candidates.push({ title: boundedTitle(title), path: path2, role: classifyPageRole(url, title) });
+  };
+  const navLinks = input.look.navLinks ?? [];
+  let homeTitle = "Home";
+  if (navLinks.length) {
+    for (const link of navLinks) {
+      const path2 = pathOnSite(origin, link.href);
+      if (path2 === null) continue;
+      if (path2 === "/" && homeTitle === "Home" && HOME_WORD.test(oneLine2(link.label))) homeTitle = boundedTitle(link.label);
+      add(link.label, path2, link.href);
+    }
+  } else if (input.look.navLabels.length && published.length) {
+    const byTitle = new Map(published.map((p) => [oneLine2(p.title).toLowerCase(), p]));
+    for (const label2 of input.look.navLabels) {
+      if (homeTitle === "Home" && HOME_WORD.test(oneLine2(label2))) homeTitle = boundedTitle(label2);
+      const page = byTitle.get(oneLine2(label2).toLowerCase());
+      const path2 = page?.url ? pathOnSite(origin, page.url) : null;
+      if (page && path2 !== null) add(label2, path2, page.url);
+    }
+  }
+  if (!candidates.length && navLinks.length) {
+    notes.push("site pages: the site's header menu links only to its home page, so the map has only Home \u2014 add the site's pages to `site.pages` before --apply.");
+  } else if (!candidates.length) {
+    for (const page of published) {
+      if (isHomePage(page, mainPageId) || !page.url) continue;
+      const path2 = pathOnSite(origin, page.url);
+      if (path2 !== null) add(page.title, path2, page.url);
+    }
+    if (published.length) {
+      notes.push("site pages: no header menu was crawled, so pages follow the published page list \u2014 reorder them in `site.pages` if the site's menu differs.");
+    }
+  }
+  if (systemDropped) notes.push(`site pages: left out ${systemDropped} flow/utility page(s) (thank-you, popups, item templates, members-area pages).`);
+  const dropped = Math.max(0, candidates.length - (DERIVED_SITE_MAX_PAGES - 1));
+  const kept = candidates.slice(0, DERIVED_SITE_MAX_PAGES - 1);
+  if (dropped) notes.push(`site pages: kept the first ${DERIVED_SITE_MAX_PAGES} pages; ${dropped} more are reachable from the site's own links but have no native row.`);
+  const used = /* @__PURE__ */ new Set(["home"]);
+  const placed = kept.map((c) => ({ c, id: pageId(c, used), placement: "drawer" }));
+  let tabs = 1;
+  for (const p of placed) {
+    if (p.c.role === "members") p.placement = "overflow";
+    else if (TAB_ROLES.has(p.c.role) && tabs < SITE_SHELL_MAX_TABS) {
+      p.placement = "tab";
+      tabs++;
+    }
+  }
+  if (tabs < 2) {
+    for (const p of placed) {
+      if (tabs >= SITE_SHELL_MAX_TABS) break;
+      if (p.placement === "drawer") {
+        p.placement = "tab";
+        tabs++;
+      }
+    }
+  }
+  const pages = [
+    { id: "home", title: homeTitle, path: "/", icon: "home" },
+    ...placed.map(({ c, id, placement }) => ({
+      id,
+      title: c.title,
+      path: c.path,
+      icon: ROLE_ICON[c.role],
+      ...placement === "tab" ? {} : { placement }
+    }))
+  ];
+  if (!published.length && !navLinks.length) {
+    notes.push("site pages: the analysis read no page list, so the map has only Home \u2014 add the site's pages to `site.pages` before --apply.");
+  }
+  const site = {
+    origin,
+    kind: "wix",
+    pages,
+    // Hidden by default — the product decision for the site shell (RFC 0062 §6); the owner can
+    // turn any of them back on here, and the flags ride the OTA descriptor.
+    chrome: { hideSiteHeader: true, hideSiteFooter: true, hideWixAds: true }
+  };
+  assertSiteShellConfig(site);
+  const tabTitles = pages.filter((p) => (p.placement ?? "tab") === "tab").map((p) => p.title);
+  notes.unshift(`site pages: ${pages.length} derived \u2014 tabs ${tabTitles.join(", ")}; edit \`site.pages\` in provisioning.overlay.json to change them.`);
+  return { site, notes };
+}
+var DERIVED_SITE_MAX_PAGES, SITE_PAGE_TITLE_MAX, ROLE_ICON, TAB_ROLES, SYSTEM_SEGMENT, SYSTEM_TITLE, HOME_WORD, oneLine2;
+var init_site_shell_derive = __esm({
+  "src/site-analyze/site-shell-derive.ts"() {
+    init_site_shell();
+    init_traits();
+    DERIVED_SITE_MAX_PAGES = 10;
+    SITE_PAGE_TITLE_MAX = 40;
+    ROLE_ICON = {
+      home: "home",
+      shop: "bag",
+      book: "calendar",
+      menu: "list",
+      blog: "newspaper",
+      about: "info",
+      contact: "mail",
+      events: "ticket",
+      gallery: "photo",
+      plans: "tag",
+      faq: "help",
+      library: "book",
+      members: "person",
+      other: "globe"
+    };
+    TAB_ROLES = /* @__PURE__ */ new Set(["shop", "book", "menu", "events", "plans", "blog", "gallery", "library"]);
+    SYSTEM_SEGMENT = /^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\d+)?|404)$/i;
+    SYSTEM_TITLE = /\b(thank you|\(popup\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\b|\b(group|service|product|project|collection|category|cart|payment request) pages?$|\b(event|experience|reservation|item) details\b/i;
+    HOME_WORD = /^(home|home ?page|main|start|accueil|inicio|início|startseite|home ?sweet ?home|בית|דף הבית|ראשי|الرئيسية|ホーム|首页|홈)$/i;
+    oneLine2 = (s) => s.replace(/[\u0000-\u001F\u007F\s]+/g, " ").trim();
+  }
+});
+
 // ../../node_modules/tldts/dist/cjs/index.js
 var require_cjs = __commonJS({
   "../../node_modules/tldts/dist/cjs/index.js"(exports) {
@@ -66298,6 +66549,7 @@ async function createPlaywrightBrowser(load = () => import("playwright"), siteFe
         const seen = /* @__PURE__ */ new Set();
         const pages = [];
         const navAll = [];
+        const navLinksAll = [];
         const veloHints = [];
         let htmlLang;
         let faviconUrl;
@@ -66321,7 +66573,7 @@ async function createPlaywrightBrowser(load = () => import("playwright"), siteFe
           } catch {
             continue;
           }
-          let pageId = evaled.velo?.pageId || void 0;
+          let pageId2 = evaled.velo?.pageId || void 0;
           let publishedTitle = "";
           try {
             const html = await page.content();
@@ -66333,7 +66585,7 @@ async function createPlaywrightBrowser(load = () => import("playwright"), siteFe
             }
             if (pub.pages.length && !sitePages.length) sitePages = pub.pages;
             const hit = matchPublishedPage(url, title, pub.pages, pub.mainPageId);
-            if (!pageId) pageId = hit?.pageId;
+            if (!pageId2) pageId2 = hit?.pageId;
             publishedTitle = hit?.title ?? "";
             if (!seededFromMap && pub.pages.length) {
               seededFromMap = true;
@@ -66365,13 +66617,17 @@ async function createPlaywrightBrowser(load = () => import("playwright"), siteFe
               ctas: ctasOf(evaled.buttons)
             },
             screenshotLocal: `evidence/pages/${filename}`,
-            ...pageId ? { pageId } : {},
+            ...pageId2 ? { pageId: pageId2 } : {},
             ...copyFromEval(evaled)
           });
-          const hint = veloHintFromEval(evaled, { url, title, pageId });
+          const hint = veloHintFromEval(evaled, { url, title, pageId: pageId2 });
           if (hint) veloHints.push(hint);
           if (!htmlLang && evaled.htmlLang) htmlLang = evaled.htmlLang;
           for (const n of evaled.nav) if (!navAll.includes(n)) navAll.push(n);
+          for (const l of evaled.navLinks ?? []) {
+            const key2 = `${l.label}\0${l.href.split("#")[0]}`;
+            if (navLinksAll.length < 24 && !navLinksAll.some((x) => `${x.label}\0${x.href.split("#")[0]}` === key2)) navLinksAll.push(l);
+          }
           if (!faviconUrl && evaled.velo?.favicon && !isGenericWixFavicon(evaled.velo.favicon)) {
             faviconUrl = evaled.velo.favicon;
           }
@@ -66393,6 +66649,7 @@ async function createPlaywrightBrowser(load = () => import("playwright"), siteFe
         return {
           pages,
           navLabels: navAll,
+          ...navLinksAll.length ? { navLinks: navLinksAll } : {},
           theme: Object.keys(wst).length ? {
             colors: Object.fromEntries(Object.entries(wst).filter(([k]) => k.includes("color"))),
             fonts: Object.fromEntries(Object.entries(wst).filter(([k]) => k.includes("font")))
@@ -66479,8 +66736,13 @@ var init_crawl_look = __esm({
     if (probe.parentNode) probe.parentNode.removeChild(probe);
   } catch (e3) {}
   const txt = (el) => String((el && el.textContent) || "").replace(/\\s+/g, " ").trim();
-  const nav = Array.from(document.querySelectorAll("nav a, header a, [role=navigation] a"))
-    .map((a) => (a.textContent || "").trim()).filter(Boolean).slice(0, 24);
+  const navAnchors = Array.from(document.querySelectorAll("nav a, header a, [role=navigation] a"));
+  const nav = navAnchors.map((a) => (a.textContent || "").trim()).filter(Boolean).slice(0, 24);
+  // WHERE each label goes \u2014 a site shell orders its tabs by these (RFC 0062). a.href is
+  // already absolute; an anchor with no text or no href is not a page link.
+  const navLinks = navAnchors
+    .map((a) => ({ label: txt(a), href: String(a.href || "") }))
+    .filter((l) => l.label && /^https?:/.test(l.href)).slice(0, 24);
   const headings = Array.from(document.querySelectorAll("h1,h2")).map((h) => (h.textContent || "").trim()).filter(Boolean).slice(0, 12);
   const hero = ((document.querySelector("h1") && document.querySelector("h1").textContent) || "").trim();
 
@@ -66605,7 +66867,7 @@ var init_crawl_look = __esm({
       if (pid) velo.pageId = pid[1];
     }
   } catch (e4) {}
-  return { wst, nav, headings, hero, imgs, hrefs, buttons, html, htmlLang, velo, sections, ctaLabels, faq, testimonials, about, meta };
+  return { wst, nav, navLinks, headings, hero, imgs, hrefs, buttons, html, htmlLang, velo, sections, ctaLabels, faq, testimonials, about, meta };
 })()`;
     CAP4 = {
       heading: 120,
@@ -67271,6 +67533,7 @@ function ownerSiteFor(opts, env = process.env) {
   return env.WIX_SITE_ID?.trim() || void 0;
 }
 async function runSiteAnalyze(opts) {
+  if (opts.shell !== void 0) assertKnownShell(opts.shell);
   if (!opts.clientId?.trim()) {
     if (opts.apply) throw Object.assign(new Error(APPLY_NEEDS_CLIENT), { exit: 2 });
     if (opts.redirectUri?.trim()) throw Object.assign(new Error(REDIRECT_NEEDS_CLIENT), { exit: 2 });
@@ -67303,6 +67566,18 @@ async function runSiteAnalyze(opts) {
     { clientId: opts.clientId, siteUrl: opts.siteUrl, msid, redirectUri: opts.redirectUri },
     ports
   );
+  if (opts.shell !== void 0 && isSiteShell(opts.shell)) {
+    try {
+      const derived = deriveSiteShell({ siteUrl: result.book.input.siteUrl, look: result.book.look });
+      result.provisioningOverlay.site = derived.site;
+      result.warnings = [...result.warnings ?? [], ...derived.notes];
+    } catch (e) {
+      result.warnings = [
+        ...result.warnings ?? [],
+        `site pages: could not derive a site block for --shell ${opts.shell} (${e instanceof Error ? e.message : String(e)}) \u2014 write \`site\` into provisioning.overlay.json by hand before --apply.`
+      ];
+    }
+  }
   const ownerCall = ownerAuth ? ownerTransportFrom(fetchImpl, ownerAuth) : void 0;
   const written = await writeBusinessBook(result, {
     outDir,
@@ -67392,6 +67667,8 @@ var init_cli = __esm({
     init_write_artifacts();
     init_net_guard();
     init_apply2();
+    init_site_shell_derive();
+    init_brandable_shells();
     init_crawl_look();
     init_rest();
     init_wix_owner();
@@ -71122,7 +71399,10 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            visitor-only pass (published pages, look, copy); --client-id
                                            adds the vertical catalog counts and the app binding, and
                                            --apply requires it. --shell takes the same
-                                           names 'himi dist --shell' does; default branded-lite. Owner token: WIX_TEST_TOKEN
+                                           names 'himi dist --shell' does; default branded-lite.
+                                           A SITE shell (brandy) also derives the site's page map
+                                           (tabs/drawer from its menu) into the overlay's \`site\`
+                                           block \u2014 edit it, then --apply. Owner token: WIX_TEST_TOKEN
                                            or 'wix token --site'. Look/screenshots need Chromium:
                                            npx playwright install chromium.
   himi site function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET]
@@ -71233,7 +71513,7 @@ var COMMANDS = [
   { name: "login", summary: "obtain a scoped serve-control token from Wix identity and store it in ~/.himalaya/serve-targets.json (so push/promote need no hand-pasted token). Three modes: --browser (your own Wix account, no VPN/BO), --wix (HEADLESS \u2014 the machine's own Wix CLI credential; the mode a CI pod or agent container can satisfy), --dpx (Wix employee, reads ~/.dpx/session/token). RFC 0026 WS3.", required: "[--browser|--wix|--dpx] [--target <t>] [--issue-url <url>]" },
   { name: "logout", summary: "remove the stored control token for a target", required: "[--target <t>]" },
   { name: "notify", summary: "`setup` optionally configures Branded/Ping from local customer key files; `status --refresh` reads live backend readiness. Setup may be deferred while building. These use serve-control and require owner plus Wix account authentication. `send`, `tokens`, `doctor`: send a REAL push notification to registered devices (RFC 0036 WS5) \u2014 APNs .p8 over HTTP/2 for iOS, FCM v1 for Android. `send` targets one device (--token / --device <registry id>) or fans out to the whole app (--all), reporting a per-device result; a token the provider says is uninstalled (APNs 410 Unregistered / FCM UNREGISTERED) is auto-disabled, while a merely wrong one (BadDeviceToken \u2014 usually a sandbox/production mismatch) is recorded and left enabled. `tokens` lists the registry. `doctor` reports which credentials resolve and which sender each platform picks. Talks to the admin-server via --admin-url/HIMALAYA_ADMIN_URL, authenticated with --admin-session/HIMALAYA_ADMIN_SESSION. NOT `himi push`, which publishes a release.", required: "setup|status [--content <dir>] [--target <t>] [--refresh] [--yes] [--no-push-setup] | send|tokens|doctor [--app <a>] [--token <t> | --device <id> | --all] [--title <s>] [--body <s>] [--link <url>] [--platform ios|android] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]" },
-  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no URL/browser and never uploads or applies anything. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell; `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
+  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no URL/browser and never uploads or applies anything. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell; `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "upgrade", summary: "install the newest published CLI (`npm i -g @wix/himalaya-cli@latest`) and report what moved. This is the explicit door: himi also updates itself when the running build is more than a week old \u2014 unattended it just does it and re-runs your command, at a terminal it asks first \u2014 and `HIMI_NO_UPDATE_CHECK=1` turns that off, leaving this command as the way to catch up. Reports `unchanged` rather than claiming success when npm exits 0 without moving the version, which is what a registry mirror serving its own pinned copy looks like.", required: "[--json]" },
   { name: "push", summary: "lint + build + publish a release (default --draft: servable via ?release= but NOT live). REFUSES to publish on any error unless --force; --strict promotes warnings. Prints preview + agent-context links. A successful draft push also rebuilds the making-of (.himi/making-of.html, local and offline) and names it as `reel` \u2014 the file to hand the owner beside the preview link. Its postcard carries the home shot only when that shot is newer than the last source edit; otherwise the postcard says why and names `himi render <home> --png`, and the envelope's `postcardPicture: {skipped, render}` leads next[] with that render (the push never renders it itself). The published slug is NAMESPACED per owner \u2014 `<ownerPrefix>.<name>`, composed offline from the control token's ownerPrefix claim, so the CLI and the server derive the identical string and himalaya.content.json is NOT rewritten (a legacy token with no ownerPrefix publishes the declared name unchanged). An app claimed BEFORE namespacing is stored under its FLAT slug, so the claim route answers `alreadyYours` naming that slug and the push adopts it \u2014 reported as `adoptedSlug`, since it is the one case where the published `app` differs from what the declared name composes to. `--no-claim` skips the route that knows this, so a pre-namespacing app pushed with it still fails 403. --visibility public|unlisted decides whether /v1/apps + the Himi Player picker LIST the app (also declarable as `visibility` in himalaya.content.json; omitted, a brand-new app defaults to unlisted \u2014 share by link \u2014 and an existing setting is kept). --account-id names which account owns the app when your Wix session resolves to several (the auto-claim of a brand-new slug cannot guess \u2014 without it a multi-account caller is told to name one). An unforced push of a release that carries SCREENS also refuses when `.himi/ux-audit.json` holds no mobile-UX drive recorded against that release id, or holds one that FAILED (#2955) \u2014 a published draft IS the owner-private preview a customer is handed; `himi ux record` clears it and `--force` overrides it, which the success envelope then says out loud. `--only <selector>` publishes ONLY the named items as a release derived from the app's live release (or `--from-release <id>`), running the identical build + lint gate and simply publishing less; it requires an explicit `--draft` or `--live` because a partial publish has no safe default, never claims a slug, and carries neither attestation nor a source archive (both named in the output). Selectors are comma-separated in ONE `--only`: `changed` (every item whose bytes differ from the base), `screen:<id|glob>`, `bundle:<name>`, `tokens`, `app-config` \u2014 a selected screen drags its logic bundle and a selected bundle drags the screens that reference it, or the bytes land under a key nothing reads.", required: "[--content <dir>] [--draft] [--live] [--force] [--strict] [--label] [--notes] [--visibility public|unlisted] [--no-claim] [--account-id <id>] [--only <selector>] [--from-release <id>] [--accept-regressions] [--accept-partial] [--app <slug>] (--control-token)" },
@@ -78437,7 +78717,7 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
           }
         }
         if (sub !== "analyze") {
-          io.error(JSON.stringify({ error: sub ? `unknown site subcommand "${sub}"` : "site needs a subcommand", usage: `himi site create <name> [--type wix|headless|branded-app|vibe] --yes  |  himi site list  |  himi site client ensure|list --site <msid>  |  himi site analyze --url <https://\u2026> [--client-id <id>] [--site <msid>] [--out <dir>] [--apply [--shell <id>]]  |  himi site function list|get|put|publish|invoke \u2026` }));
+          io.error(JSON.stringify({ error: sub ? `unknown site subcommand "${sub}"` : "site needs a subcommand", usage: `himi site create <name> [--type wix|headless|branded-app|vibe] --yes  |  himi site list  |  himi site client ensure|list --site <msid>  |  himi site analyze --url <https://\u2026> [--client-id <id>] [--site <msid>] [--out <dir>] [--shell <id>] [--apply]  |  himi site function list|get|put|publish|invoke \u2026` }));
           return 2;
         }
         const clientFlag = str8(flags["client-id"]);
@@ -78471,7 +78751,7 @@ ${report2.ok ? "OK \u2014 data + serve plane reachable." : typeof report2.hint =
           print({ ok: true, context });
           return 0;
         }
-        const analyzeUsage = "himi site analyze --url https://\u2026 [--client-id <headless-oauth-client-id>] [--site <msid>] [--out .himi/business-book] [--redirect-uri <uri>] [--apply [--shell " + SHELL_ENUM + "]]";
+        const analyzeUsage = "himi site analyze --url https://\u2026 [--client-id <headless-oauth-client-id>] [--site <msid>] [--out .himi/business-book] [--redirect-uri <uri>] [--shell " + SHELL_ENUM + "] [--apply]";
         if (!siteUrl) {
           io.error(JSON.stringify({ error: "himi site analyze needs --url", usage: analyzeUsage }));
           return 2;

package/guides/wix-business-context.md

@@ -156,6 +156,28 @@ The plane has no headless browser (`look.unavailable: no_browser_on_plane`). Own
 
 `--apply` writes `appearance.homeLayout` + `navigation.navKind` plus identity/colors. It never silently overwrites committed Amit1 `apps/himi-branded-lite/provisioning.json`.
 
+### A site shell: `--shell brandy`
+
+`himi-brandy`, the site shell, opens the customer's live website as native-framed tabs, so its contract is a `site` block: which website, and which of its pages are tabs, drawer rows or overflow rows. `--shell brandy` derives that block into `provisioning.overlay.json`:
+
+```bash
+himi site analyze --url https://owner.wixsite.com/site --client-id <id> --shell brandy   # writes site.pages
+# edit site.pages in .himi/business-book/provisioning.overlay.json if the map needs it
+himi site analyze --url https://owner.wixsite.com/site --client-id <id> --shell brandy --apply
+```
+
+The map comes from what the analysis already reads without owner credentials, because Wix has no public menu API: the published page list (`look.sitePages`), the header menu the crawl saw (`look.navLinks`, label and href), and each page's role.
+
+- **Order and labels** follow the site's own menu. Links to other hosts, and repeat links to the same page, are dropped.
+- **No menu crawled** (no browser, or the crawl failed): the published page list is used instead, and a note says so.
+- **Home** is always the first tab, with the menu's own word for it.
+- **Tabs:** the pages a visitor comes back to (shop, book, menu, events, plans, blog, gallery) take up to three more, in menu order. A small site fills its bar in menu order rather than show a single tab.
+- **Drawer and overflow:** About, Contact and other pages go to the drawer; account pages go to overflow.
+- **Size:** at most 10 pages, with titles capped at 40 characters.
+- **Chrome:** the site's own header, footer and Wix ads are hidden (the site shell's default).
+
+The block is validated with the shell's own rules before it is written. Only a site shell ever receives it: the analysis leaves it out for any other `--shell`, and the merge drops it for a shell whose committed contract has no `site`. `--apply --shell brandy` without a `site` block in the overlay is refused, because baking would ship the shell's demo site under the customer's brand.
+
 When the analysis recognized at least one vertical, `--apply` also patches the shell's baked home
 (`dev/index.ts`) to what the site actually runs. The Explore grid keeps only the site's
 destinations (adding a card the template baked none for, and leaving off a vertical the template

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1102.0",
+  "version": "0.1104.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "49e51090f4e4f0dc82b4398a9f06fb4f52e4055be047ff22734a8d41"
+  "falconPackageHash": "3b9d4a5bc87c7f44c95094ff409a54b61fb726b2c3062b7a587718be"
 }