@wix/himalaya-cli 0.1115.0 → 0.1117.0

package/dist/cli.mjs

@@ -13140,7 +13140,6 @@ function resolveIdiom(tokens, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -24719,7 +24718,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -29120,7 +29118,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -36092,10 +36089,10 @@ var init_render_fonts = __esm({
 
 // ../../core/dev-server/src/wix-cache-policy.ts
 function clampRule(rule, denyPrefixes, maxTTL) {
-  const denied = denyPrefixes.some((p) => rule.pathPrefix.startsWith(p));
+  const denied2 = denyPrefixes.some((p) => rule.pathPrefix.startsWith(p));
   return {
     ...rule,
-    cacheable: rule.cacheable && !denied,
+    cacheable: rule.cacheable && !denied2,
     ttl: Math.min(rule.ttl, maxTTL)
   };
 }
@@ -53857,7 +53854,8 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { lstatSync as lstatSync12, mkdirSync as mkdirSync26, readdirSync as readdirSync27, readFileSync as readFileSync59, realpathSync as realpathSync7, rmSync as rmSync12, statSync as statSync13, writeFileSync as writeFileSync21, existsSync as existsSync54 } from "node:fs";
+import { closeSync as closeSync4, constants, lstatSync as lstatSync12, mkdirSync as mkdirSync26, openSync as openSync3, readdirSync as readdirSync27, readFileSync as readFileSync59, realpathSync as realpathSync7, renameSync as renameSync6, rmSync as rmSync12, statSync as statSync13, writeSync, existsSync as existsSync54 } from "node:fs";
+import { randomBytes as randomBytes4 } from "node:crypto";
 import { dirname as dirname30, isAbsolute as isAbsolute5, join as join53, relative as relative11, resolve as resolve45, sep as sep14 } from "node:path";
 import * as z from "zod";
 function within(root, p) {
@@ -53874,37 +53872,99 @@ function realish(p) {
   }
   return join53(realpathSync7(cur), ...tail);
 }
+function symlinkComponent(base, abs) {
+  let cur = base;
+  for (const part of relative11(base, abs).split(sep14).filter(Boolean)) {
+    cur = join53(cur, part);
+    try {
+      if (lstatSync12(cur).isSymbolicLink()) return relative11(base, cur);
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
 async function confinedAppDir(args, deps) {
   const root = resolve45(await deps.defaultDir());
   const dir = typeof args.dir === "string" && args.dir ? resolve45(root, args.dir) : root;
   if (!existsSync54(root)) return refuse4("no_workspace", `the workspace folder ${root} does not exist`);
-  if (!within(realpathSync7(root), realish(dir))) return refuse4("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
+  if (!within(root, dir) || !within(realpathSync7(root), realish(dir))) return refuse4("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
+  const link = symlinkComponent(root, dir);
+  if (link) return refuse4("outside_workspace", `"${link}" is a symlink \u2014 the app folder must be a real folder in the workspace`);
+  const rel = relative11(root, dir);
+  if (rel && (isDeniedSourcePath(`${rel}/x`) || isDeniedSourcePath(`${rel.toLowerCase()}/x`))) return refuse4("denied", `"${rel}" is a folder this tool does not touch`);
+  if (!existsSync54(join53(dir, CONTENT_MARKER))) {
+    return refuse4("not_an_app", `"${rel || "."}" is not an app folder (no ${CONTENT_MARKER}) \u2014 see himi_list_apps, or create one with himi_init`);
+  }
   return dir;
 }
+function onDiskSpelling(abs) {
+  let cur = abs;
+  const tail = [];
+  while (!existsSync54(cur)) {
+    const up = dirname30(cur);
+    if (up === cur) break;
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep14) ? 0 : 1)));
+    cur = up;
+  }
+  return join53(realpathSync7.native(cur), ...tail);
+}
+function denied(appDir3, abs) {
+  const rel = relative11(appDir3, abs);
+  if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) return true;
+  try {
+    return isDeniedSourcePath(relative11(realpathSync7.native(appDir3), onDiskSpelling(abs)));
+  } catch {
+    return true;
+  }
+}
 function confinedPath(appDir3, rel) {
   if (typeof rel !== "string" || !rel.trim()) return { error: "a path is required" };
   if (rel.includes("\0")) return { error: "a path may not contain NUL" };
   if (isAbsolute5(rel)) return { error: `"${rel}" is absolute \u2014 give a path inside the app folder` };
   const abs = resolve45(appDir3, rel);
+  if (!within(appDir3, abs) || abs === appDir3) return { error: `"${rel}" is outside the app folder` };
   const real = realish(abs);
   const base = existsSync54(appDir3) ? realpathSync7(appDir3) : realish(appDir3);
   if (!within(base, real) || real === base) return { error: `"${rel}" is outside the app folder` };
-  const first = relative11(base, real).split(sep14)[0];
-  if (RESERVED.has(first)) return { error: `"${rel}" is inside ${first}/, which this tool does not touch` };
+  const link = symlinkComponent(appDir3, abs);
+  if (link) return { error: `"${link}" is a symlink, which this tool does not follow` };
+  if (denied(appDir3, abs)) return { error: `"${rel}" is on the deny-list (secrets, credentials, build output), which this tool does not touch` };
   return abs;
 }
+function writeNoFollow(appDir3, abs, content) {
+  mkdirSync26(dirname30(abs), { recursive: true });
+  const before = symlinkComponent(appDir3, abs);
+  if (before) throw new Error(`"${before}" became a symlink`);
+  const tmp = join53(dirname30(abs), `.himi-write-${process.pid}-${randomBytes4(6).toString("hex")}.tmp`);
+  const fd = openSync3(tmp, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | (constants.O_NOFOLLOW ?? 0), 420);
+  try {
+    writeSync(fd, content);
+  } finally {
+    closeSync4(fd);
+  }
+  const link = symlinkComponent(appDir3, abs);
+  if (link || !within(realpathSync7(appDir3), realpathSync7(dirname30(abs)))) {
+    rmSync12(tmp, { force: true });
+    throw new Error(`"${link ?? relative11(appDir3, dirname30(abs))}" changed into a link while writing`);
+  }
+  renameSync6(tmp, abs);
+}
 function listFiles(appDir3) {
   const files = [];
   const walk2 = (d) => {
+    const parentRel = relative11(appDir3, d);
     for (const e of readdirSync27(d, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-      if (RESERVED.has(e.name)) continue;
       if (e.isSymbolicLink()) continue;
       const p = join53(d, e.name);
       if (e.isDirectory()) {
+        if (isDeniedSourceDir(e.name, parentRel) || isDeniedSourceDir(e.name.toLowerCase(), parentRel)) continue;
         if (!walk2(p)) return false;
       } else if (e.isFile()) {
+        const rel = relative11(appDir3, p);
+        if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) continue;
         if (files.length >= MAX_LISTED) return false;
-        files.push({ path: relative11(appDir3, p).split(sep14).join("/"), bytes: statSync13(p).size });
+        files.push({ path: rel.split(sep14).join("/"), bytes: statSync13(p).size });
       }
     }
     return true;
@@ -53934,7 +53994,7 @@ function fileTools() {
     {
       name: "himi_list_files",
       title: "List app files",
-      description: `Every file in an app folder with its size (skips ${[...RESERVED].join(", ")}; at most ${MAX_LISTED}).`,
+      description: `Every file in an app folder with its size \u2014 at most ${MAX_LISTED}, skipping symlinks and what the source deny-list keeps off the machine (secrets, credentials, build output).`,
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
       inputSchema: z.object({ dir: DIR }),
       handler: async (a, d) => {
@@ -53983,14 +54043,20 @@ function fileTools() {
           else if (typeof f.content !== "string") refused2.push({ path: f.path, error: "content must be text" });
           else if (Buffer.byteLength(f.content) > MAX_FILE_BYTES) refused2.push({ path: f.path, error: `over the ${MAX_FILE_BYTES}-byte limit` });
           else if (existsSync54(p) && !lstatSync12(p).isFile()) refused2.push({ path: f.path, error: "not a regular file" });
+          else if (planned.some((q) => q.abs === p)) refused2.push({ path: f.path, error: "the same file twice in one call" });
           else planned.push({ abs: p, rel: String(f.path), content: f.content });
         }
         if (refused2.length) return { ...ok({ ok: false, error: "refused", written: [], refused: refused2 }), isError: true };
+        const written = [];
         for (const f of planned) {
-          mkdirSync26(dirname30(f.abs), { recursive: true });
-          writeFileSync21(f.abs, f.content);
+          try {
+            writeNoFollow(app, f.abs, f.content);
+            written.push(f.rel);
+          } catch (e) {
+            return { ...ok({ ok: false, error: "write_failed", message: e.message, written }), isError: true };
+          }
         }
-        return ok({ ok: true, dir: app, written: planned.map((f) => f.rel) });
+        return ok({ ok: true, dir: app, written });
       }
     },
     {
@@ -54004,28 +54070,32 @@ function fileTools() {
         if (typeof app !== "string") return app;
         const paths = Array.isArray(a.paths) ? a.paths : [];
         const planned = [];
+        const deleted = [];
         const refused2 = [];
         for (const rel of paths) {
           const p = confinedPath(app, rel);
           if (typeof p !== "string") refused2.push({ path: rel, error: p.error });
           else if (!existsSync54(p)) refused2.push({ path: rel, error: "no such file" });
           else if (!lstatSync12(p).isFile()) refused2.push({ path: rel, error: "not a regular file" });
-          else planned.push(p);
+          else if (!planned.includes(p)) {
+            planned.push(p);
+            deleted.push(rel);
+          }
         }
         if (refused2.length) return { ...ok({ ok: false, error: "refused", deleted: [], refused: refused2 }), isError: true };
         for (const p of planned) rmSync12(p);
-        return ok({ ok: true, dir: app, deleted: paths });
+        return ok({ ok: true, dir: app, deleted });
       }
     }
   ];
 }
-var MAX_FILE_BYTES, MAX_FILES_PER_WRITE, MAX_LISTED, RESERVED, CONTENT_MARKER, ok, refuse4, DIR, WRITE_ANN;
+var MAX_FILE_BYTES, MAX_FILES_PER_WRITE, MAX_LISTED, CONTENT_MARKER, ok, refuse4, DIR, WRITE_ANN;
 var init_file_tools = __esm({
   "src/mcp/file-tools.ts"() {
+    init_source_deny();
     MAX_FILE_BYTES = 1024 * 1024;
     MAX_FILES_PER_WRITE = 100;
     MAX_LISTED = 2e3;
-    RESERVED = /* @__PURE__ */ new Set([".git", "node_modules", "dist"]);
     CONTENT_MARKER = "himalaya.content.json";
     ok = (o) => ({ content: [{ type: "text", text: JSON.stringify(o, null, 2) }] });
     refuse4 = (error, message) => ({ content: [{ type: "text", text: JSON.stringify({ ok: false, error, message }, null, 2) }], isError: true });
@@ -54536,7 +54606,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync55, mkdtempSync as mkdtempSync2, readFileSync as readFileSync61, rmSync as rmSync13, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync55, mkdtempSync as mkdtempSync2, readFileSync as readFileSync61, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join54 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
@@ -54670,7 +54740,7 @@ function runNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync22(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync21(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -54708,7 +54778,7 @@ function runAndroidNativeDecode(options) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync22(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync21(join54(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -54792,7 +54862,7 @@ __export(browser_authoring_exports, {
   sdkSubpathReader: () => sdkSubpathReader
 });
 import { createServer as createServer5 } from "node:http";
-import { createHash as createHash29, randomBytes as randomBytes4 } from "node:crypto";
+import { createHash as createHash29, randomBytes as randomBytes5 } from "node:crypto";
 import { existsSync as existsSync56, readdirSync as readdirSync28, readFileSync as readFileSync62, realpathSync as realpathSync8, statSync as statSync14 } from "node:fs";
 import { join as join55, posix as posix2, relative as relative12, sep as sep15 } from "node:path";
 function humanMs(ms) {
@@ -54890,7 +54960,7 @@ function sdkSubpathReader(resolve54) {
 function encodeJob(job) {
   return Buffer.from(JSON.stringify(job), "utf8").toString("base64");
 }
-function mintToken2(payload, nonce = randomBytes4(16).toString("hex")) {
+function mintToken2(payload, nonce = randomBytes5(16).toString("hex")) {
   const digest2 = createHash29("sha256").update(payload, "utf8").digest("base64url");
   return `${nonce}.${digest2}`;
 }
@@ -55053,7 +55123,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync57, mkdirSync as mkdirSync27, readFileSync as readFileSync63, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync57, mkdirSync as mkdirSync27, readFileSync as readFileSync63, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname31, join as join56 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -55247,7 +55317,7 @@ function trendAndStore(dir, entries, suppressed) {
   const stored = [.../* @__PURE__ */ new Set([...current, ...(previous ?? []).filter((key2) => (suppressed ?? []).includes(key2))])];
   try {
     mkdirSync27(dirname31(p), { recursive: true });
-    writeFileSync23(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    writeFileSync22(p, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -55292,7 +55362,7 @@ function diffAndStoreObservations(dir, current) {
   }
   try {
     mkdirSync27(dirname31(p), { recursive: true });
-    writeFileSync23(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
+    writeFileSync22(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
   }
@@ -55903,8 +55973,8 @@ ${releaseId}`;
     const pin = resolvePin(request, url);
     let bytes2 = null;
     if (pin) {
-      const denied = await authorizePinnedRead(request, url, app, pin);
-      if (denied) return { ok: false, response: denied };
+      const denied2 = await authorizePinnedRead(request, url, app, pin);
+      if (denied2) return { ok: false, response: denied2 };
       const m = await pinnedManifest(app, pin);
       if (!m) return { ok: false, response: json4(404, { error: "release_not_found", app, releaseId: pin }) };
       bytes2 = m.appConfigHash ? await pinnedBody(app, m.appConfigHash, () => store.getAppConfig(app)) : null;
@@ -55927,7 +55997,7 @@ ${releaseId}`;
     return new Response(body, { status: 200, headers: { "content-type": JSON_CT2, etag, "cache-control": cache, ...vary } });
   }
   async function authorizePinnedRead(request, url, app, releaseId, screenId) {
-    const denied = await checkPinnedRead({
+    const denied2 = await checkPinnedRead({
       secret: opts.previewTokenSecret,
       token: resolvePreviewToken(request, url),
       app,
@@ -55937,7 +56007,7 @@ ${releaseId}`;
       authorizePreview: opts.authorizePreview,
       authorizeFollow: opts.authorizeFollow
     });
-    return denied && json4(denied.status, denied.body);
+    return denied2 && json4(denied2.status, denied2.body);
   }
   async function honourRingPin(request) {
     const kept = { request, dropped: false };
@@ -56388,8 +56458,8 @@ ${releaseId}`;
       const app = cfgMatch?.[1] ?? resolveApp(request, url);
       const pin = resolvePin(request, url);
       if (app && pin) {
-        const denied = await authorizePinnedRead(request, url, app, pin);
-        if (denied) return denied;
+        const denied2 = await authorizePinnedRead(request, url, app, pin);
+        if (denied2) return denied2;
       }
       if (path2 === "/v1/template-source") {
         if (!app) return json4(400, { error: "missing_app" });
@@ -56472,8 +56542,8 @@ ${releaseId}`;
         if (!app) return json4(400, { error: "missing_app" });
         let m;
         if (pin) {
-          const denied = await authorizePinnedRead(request, url, app, pin);
-          if (denied) return denied;
+          const denied2 = await authorizePinnedRead(request, url, app, pin);
+          if (denied2) return denied2;
           m = await pinnedManifest(app, pin);
           if (!m) return json4(404, { error: "release_not_found", app, releaseId: pin });
         } else {
@@ -56659,8 +56729,8 @@ ${releaseId}`;
         const screenId = screenMatch[1];
         if (!app || !isSafeSegment(screenId)) return json4(404, { error: "screen_not_found", screenId });
         if (pin) {
-          const denied = await authorizePinnedRead(request, url, app, pin, screenId);
-          if (denied) return denied;
+          const denied2 = await authorizePinnedRead(request, url, app, pin, screenId);
+          if (denied2) return denied2;
           const m2 = await pinnedManifest(app, pin);
           if (!m2) return json4(404, { error: "release_not_found", app, releaseId: pin });
           const meta2 = m2.screens[screenId];
@@ -57453,7 +57523,7 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync4, constants, existsSync as existsSync60, fstatSync, lstatSync as lstatSync13, statSync as statSync16, mkdirSync as mkdirSync29, openSync as openSync3, readFileSync as readFileSync67, realpathSync as realpathSync9, renameSync as renameSync6, rmSync as rmSync15, writeFileSync as writeFileSync24, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync5, constants as constants2, existsSync as existsSync60, fstatSync, lstatSync as lstatSync13, statSync as statSync16, mkdirSync as mkdirSync29, openSync as openSync4, readFileSync as readFileSync67, realpathSync as realpathSync9, renameSync as renameSync7, rmSync as rmSync15, writeFileSync as writeFileSync23, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID4 } from "node:crypto";
 import { extname as extname4, join as join59, resolve as resolve47, sep as sep16 } from "node:path";
 function diffReleases(prev, next) {
@@ -57588,9 +57658,9 @@ function writeRunRecord(dir, record2) {
   if (!root) return false;
   const tmp = join59(root, `.run.json.${process.pid}.${randomUUID4()}.tmp`);
   try {
-    writeFileSync24(tmp, `${JSON.stringify(record2, null, 2)}
+    writeFileSync23(tmp, `${JSON.stringify(record2, null, 2)}
 `, { flag: "wx" });
-    renameSync6(tmp, join59(root, "run.json"));
+    renameSync7(tmp, join59(root, "run.json"));
   } catch (e) {
     rmSync15(tmp, { force: true });
     throw e;
@@ -57647,12 +57717,12 @@ function readConfined(root, rel) {
     }
     const canonicalRoot = realpathSync9(root);
     if (!realpathSync9(at2).startsWith(canonicalRoot + sep16)) return null;
-    const fd = openSync3(at2, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    const fd = openSync4(at2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
       return readFileSync67(fd);
     } finally {
-      closeSync4(fd);
+      closeSync5(fd);
     }
   } catch {
     return null;
@@ -58874,7 +58944,7 @@ __export(version_exports, {
   setAndroidVersion: () => setAndroidVersion,
   setIosVersion: () => setIosVersion
 });
-import { readFileSync as readFileSync72, writeFileSync as writeFileSync25 } from "node:fs";
+import { readFileSync as readFileSync72, writeFileSync as writeFileSync24 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build2 = matchScalar(projectYml, "CFBundleVersion");
@@ -58939,8 +59009,8 @@ function bumpVersion(app, opts) {
     marketing: opts.marketing ?? current.marketing,
     build: opts.build === "increment" || opts.build === void 0 ? current.build + (opts.build === "increment" ? 1 : 0) : opts.build
   };
-  writeFileSync25(iosPath, setIosVersion(iosYml, next));
-  writeFileSync25(gradlePath, setAndroidVersion(gradle, next));
+  writeFileSync24(iosPath, setIosVersion(iosYml, next));
+  writeFileSync24(gradlePath, setAndroidVersion(gradle, next));
   return next;
 }
 var init_version = __esm({
@@ -59083,7 +59153,7 @@ var init_asc_status = __esm({
 });
 
 // ../../core/functions-secrets/src/vault.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes5 } from "node:crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes6 } from "node:crypto";
 import { mkdir, readFile as readFile2, rename, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname34 } from "node:path";
 function createJsonSecretStore(filePath) {
@@ -59141,7 +59211,7 @@ function createSecretVault(options) {
       environment: input.environment,
       name: input.name,
       version: input.version,
-      iv: randomBytes5(12).toString("base64url"),
+      iv: randomBytes6(12).toString("base64url"),
       ciphertext: "",
       authTag: ""
     };
@@ -59503,7 +59573,7 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync30, readFileSync as readFileSync76, writeFileSync as writeFileSync26 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync30, readFileSync as readFileSync76, writeFileSync as writeFileSync25 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { dirname as dirname35, join as join62 } from "node:path";
 function defaultSessionsPath() {
@@ -59520,7 +59590,7 @@ function saveAdminSession(adminUrl, session, path2 = defaultSessionsPath()) {
   const file = loadSessionsFile(path2);
   file.sessions = { ...file.sessions, [adminUrl]: session };
   mkdirSync30(dirname35(path2), { recursive: true, mode: 448 });
-  writeFileSync26(path2, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
+  writeFileSync25(path2, JSON.stringify(file, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync3(dirname35(path2), 448);
     chmodSync3(path2, 384);
@@ -63279,7 +63349,7 @@ var init_brand_font = __esm({
 });
 
 // src/site-analyze/write-artifacts.ts
-import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync27 } from "node:fs";
+import { mkdirSync as mkdirSync31, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join63 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
@@ -63441,7 +63511,7 @@ async function writeBusinessBook(result, opts) {
   const put = (rel, body) => {
     const p = join63(out2, rel);
     mkdirSync31(join63(p, ".."), { recursive: true });
-    writeFileSync27(p, body);
+    writeFileSync26(p, body);
     files.push(rel);
   };
   const book = result.book;
@@ -63534,7 +63604,7 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync65, readFileSync as readFileSync77, writeFileSync as writeFileSync28, copyFileSync as copyFileSync3, mkdirSync as mkdirSync32, realpathSync as realpathSync10, statSync as statSync18 } from "node:fs";
+import { existsSync as existsSync65, readFileSync as readFileSync77, writeFileSync as writeFileSync27, copyFileSync as copyFileSync3, mkdirSync as mkdirSync32, realpathSync as realpathSync10, statSync as statSync18 } from "node:fs";
 import { dirname as dirname36, isAbsolute as isAbsolute7, join as join64, resolve as resolve51, sep as sep17 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
@@ -63686,10 +63756,10 @@ function buildMergedContract(options) {
   const body = `${JSON.stringify(merged, null, 2)}
 `;
   const path2 = join64(packageDir, "provisioning.contract.json");
-  writeFileSync28(path2, body);
+  writeFileSync27(path2, body);
   const localPath = join64(appDir3, LOCAL_CONTRACT_REL);
   mkdirSync32(dirname36(localPath), { recursive: true });
-  writeFileSync28(localPath, body);
+  writeFileSync27(localPath, body);
   staged.push(localPath);
   return { path: path2, staged };
 }
@@ -63788,10 +63858,10 @@ async function applyOverlays(input) {
     const cur = JSON.parse(readFileSync77(pkgProv, "utf8"));
     const merged = deepMerge4(cur, overlay);
     packageFaq = merged.faq;
-    writeFileSync28(pkgProv, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync27(pkgProv, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgProv);
   } else {
-    writeFileSync28(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
+    writeFileSync27(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
   const pkgTokens = join64(cwd, "tokens.json");
@@ -63817,7 +63887,7 @@ async function applyOverlays(input) {
       if (primary && glow && typeof glow.color === "string") glow.color = primary;
       stripBrandFromIdiom(merged);
     }
-    writeFileSync28(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
+    writeFileSync27(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
@@ -63847,7 +63917,7 @@ async function applyOverlays(input) {
       }
     }
     if (next !== prev) {
-      writeFileSync28(homeSrc, next);
+      writeFileSync27(homeSrc, next);
       wrote.push(homeSrc);
     }
     if (patched.unparsed) {
@@ -68216,6 +68286,7 @@ __export(cli_exports, {
   APPLY_NEEDS_CLIENT: () => APPLY_NEEDS_CLIENT,
   REDIRECT_NEEDS_CLIENT: () => REDIRECT_NEEDS_CLIENT,
   SITE_FUNCTION_USAGE: () => SITE_FUNCTION_USAGE,
+  applyNeedsClient: () => applyNeedsClient,
   assetFetchFor: () => assetFetchFor,
   noteWithWarnings: () => noteWithWarnings,
   ownerSiteFor: () => ownerSiteFor,
@@ -68224,6 +68295,10 @@ __export(cli_exports, {
 });
 import { readFileSync as readFileSync78 } from "node:fs";
 import { resolve as resolve52 } from "node:path";
+function applyNeedsClient(shell) {
+  if (shell === void 0 || !SHELL_NAMES2.includes(shell)) return true;
+  return !isSiteShell(shell);
+}
 function assetFetchFor(_opts) {
   return pinnedFetch2;
 }
@@ -68236,7 +68311,7 @@ function ownerSiteFor(opts, env = process.env) {
 async function runSiteAnalyze(opts) {
   if (opts.shell !== void 0) assertKnownShell(opts.shell);
   if (!opts.clientId?.trim()) {
-    if (opts.apply) throw Object.assign(new Error(APPLY_NEEDS_CLIENT), { exit: 2 });
+    if (opts.apply && applyNeedsClient(opts.shell)) throw Object.assign(new Error(APPLY_NEEDS_CLIENT), { exit: 2 });
     if (opts.redirectUri?.trim()) throw Object.assign(new Error(REDIRECT_NEEDS_CLIENT), { exit: 2 });
   }
   const fetchImpl = opts.fetchImpl ?? fetch;
@@ -68271,7 +68346,10 @@ async function runSiteAnalyze(opts) {
     try {
       const derived = deriveSiteShell({ siteUrl: result.book.input.siteUrl, look: result.book.look });
       result.provisioningOverlay.site = derived.site;
-      result.warnings = [...result.warnings ?? [], ...derived.notes];
+      const warnings2 = (result.warnings ?? []).map(
+        (w) => !opts.clientId?.trim() && w.startsWith("no --client-id:") ? `no --client-id: fine for --shell ${opts.shell} \u2014 a site shell binds no client, so --apply works without one. Only the vertical probes were skipped, so the catalog has no counts.` : w
+      );
+      result.warnings = [...warnings2, ...derived.notes];
     } catch (e) {
       result.warnings = [
         ...result.warnings ?? [],
@@ -68595,7 +68673,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync66, readFileSync as readFileSync79, writeFileSync as writeFileSync29 } from "node:fs";
+import { existsSync as existsSync66, readFileSync as readFileSync79, writeFileSync as writeFileSync28 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -68744,7 +68822,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync66, readFileSync: readFileSync79, writeFileSync: writeFileSync29 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync66, readFileSync: readFileSync79, writeFileSync: writeFileSync28 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -69417,7 +69495,7 @@ var init_context = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync80, mkdirSync as mkdirSync33, writeFileSync as writeFileSync30, existsSync as existsSync67, rmSync as rmSync16, readdirSync as readdirSync31, statSync as statSync19, lstatSync as lstatSync14, accessSync, constants as constants2, renameSync as renameSync7, cpSync as cpSync3 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync80, mkdirSync as mkdirSync33, writeFileSync as writeFileSync29, existsSync as existsSync67, rmSync as rmSync16, readdirSync as readdirSync31, statSync as statSync19, lstatSync as lstatSync14, accessSync, constants as constants3, renameSync as renameSync8, cpSync as cpSync3 } from "node:fs";
 import { execFile, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash as createHash31, randomUUID as randomUUID7 } from "node:crypto";
@@ -71867,9 +71945,12 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            file is not the plane's per-release archive.
   himi share --file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>
                                            publish a content-addressed package link for a released app
-  himi mcp [plugin --out <dir>]            the himi tools as a local MCP server over stdio, for coding
+  himi mcp [plugin --out <dir>] [--with-files]
+                                           the himi tools as a local MCP server over stdio, for coding
                                            agents (Claude Code, Cursor, Codex, VS Code). \`himi init\`
-                                           configures each; see \`himi docs himi-mcp\`.
+                                           configures each; see \`himi docs himi-mcp\`. --with-files
+                                           adds file tools confined to the workspace, for a host that
+                                           cannot edit files (Claude Desktop chat).
   himi run [<package.himi|dir|url>] [--browser] [--watch [--idle-exit <min>]] [--lan] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open]
                                            serve a package on localhost + open it in a browser. No serve
                                            plane, no dev-server. With no argument it packs the current
@@ -72116,7 +72197,8 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            a brandable shell's content package. --url alone is the
                                            visitor-only pass (published pages, look, copy); --client-id
                                            adds the vertical catalog counts and the app binding, and
-                                           --apply requires it. --shell takes the same
+                                           --apply requires it (not for a site shell, which binds no
+                                           client). --shell takes the same
                                            names 'himi dist --shell' does; default branded-lite.
                                            A SITE shell (brandy) also derives the site's page map
                                            (tabs/drawer from its menu) into the overlay's \`site\`
@@ -72231,7 +72313,7 @@ var COMMANDS = [
   { name: "login", summary: "obtain a scoped serve-control token from Wix identity and store it in ~/.himalaya/serve-targets.json (so push/promote need no hand-pasted token). Three modes: --browser (your own Wix account, no VPN/BO), --wix (HEADLESS \u2014 the machine's own Wix CLI credential; the mode a CI pod or agent container can satisfy), --dpx (Wix employee, reads ~/.dpx/session/token). RFC 0026 WS3.", required: "[--browser|--wix|--dpx] [--target <t>] [--issue-url <url>]" },
   { name: "logout", summary: "remove the stored control token for a target", required: "[--target <t>]" },
   { name: "notify", summary: "`setup` optionally configures Branded/Ping from local customer key files; `status --refresh` reads live backend readiness. Setup may be deferred while building. These use serve-control and require owner plus Wix account authentication. `send`, `tokens`, `doctor`: send a REAL push notification to registered devices (RFC 0036 WS5) \u2014 APNs .p8 over HTTP/2 for iOS, FCM v1 for Android. `send` targets one device (--token / --device <registry id>) or fans out to the whole app (--all), reporting a per-device result; a token the provider says is uninstalled (APNs 410 Unregistered / FCM UNREGISTERED) is auto-disabled, while a merely wrong one (BadDeviceToken \u2014 usually a sandbox/production mismatch) is recorded and left enabled. `tokens` lists the registry. `doctor` reports which credentials resolve and which sender each platform picks. Talks to the admin-server via --admin-url/HIMALAYA_ADMIN_URL, authenticated with --admin-session/HIMALAYA_ADMIN_SESSION. `send --provider ping` is the hosted alternative: the serve plane sends one test notification to one site member through Ping as Himalaya, with owner login instead of provider keys, and reports acceptance, never delivery. NOT `himi push`, which publishes a release.", required: "setup|status [--content <dir>] [--target <t>] [--refresh] [--yes] [--no-push-setup] | send --provider ping [--content <dir>] [--app <a>] [--site <msid>] --member-email <email> --title <s> [--body <s>] --link <url> [--request-id <uuid>] [--dry-run] [--json] | send|tokens|doctor [--app <a>] [--token <t> | --device <id> | --all] [--title <s>] [--body <s>] [--link <url>] [--platform ios|android] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]" },
-  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no URL/browser and never uploads or applies anything. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell; `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
+  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no URL/browser and never uploads or applies anything. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "upgrade", summary: "install the newest published CLI (`npm i -g @wix/himalaya-cli@latest`) and report what moved. This is the explicit door: himi also updates itself when the running build is more than a week old \u2014 unattended it just does it and re-runs your command, at a terminal it asks first \u2014 and `HIMI_NO_UPDATE_CHECK=1` turns that off, leaving this command as the way to catch up. Reports `unchanged` rather than claiming success when npm exits 0 without moving the version, which is what a registry mirror serving its own pinned copy looks like.", required: "[--json]" },
   { name: "push", summary: "lint + build + publish a release (default --draft: servable via ?release= but NOT live). REFUSES to publish on any error unless --force; --strict promotes warnings. Prints preview + agent-context links. A successful draft push also rebuilds the making-of (.himi/making-of.html, local and offline) and names it as `reel` \u2014 the file to hand the owner beside the preview link. Its postcard carries the home shot only when that shot is newer than the last source edit; otherwise the postcard says why and names `himi render <home> --png`, and the envelope's `postcardPicture: {skipped, render}` leads next[] with that render (the push never renders it itself). The published slug is NAMESPACED per owner \u2014 `<ownerPrefix>.<name>`, composed offline from the control token's ownerPrefix claim, so the CLI and the server derive the identical string and himalaya.content.json is NOT rewritten (a legacy token with no ownerPrefix publishes the declared name unchanged). An app claimed BEFORE namespacing is stored under its FLAT slug, so the claim route answers `alreadyYours` naming that slug and the push adopts it \u2014 reported as `adoptedSlug`, since it is the one case where the published `app` differs from what the declared name composes to. `--no-claim` skips the route that knows this, so a pre-namespacing app pushed with it still fails 403. --visibility public|unlisted decides whether /v1/apps + the Himi Player picker LIST the app (also declarable as `visibility` in himalaya.content.json; omitted, a brand-new app defaults to unlisted \u2014 share by link \u2014 and an existing setting is kept). --account-id names which account owns the app when your Wix session resolves to several (the auto-claim of a brand-new slug cannot guess \u2014 without it a multi-account caller is told to name one). An unforced push of a release that carries SCREENS also refuses when `.himi/ux-audit.json` holds no mobile-UX drive recorded against that release id, or holds one that FAILED (#2955) \u2014 a published draft IS the owner-private preview a customer is handed; `himi ux record` clears it and `--force` overrides it, which the success envelope then says out loud. `--only <selector>` publishes ONLY the named items as a release derived from the app's live release (or `--from-release <id>`), running the identical build + lint gate and simply publishing less; it requires an explicit `--draft` or `--live` because a partial publish has no safe default, never claims a slug, and carries neither attestation nor a source archive (both named in the output). Selectors are comma-separated in ONE `--only`: `changed` (every item whose bytes differ from the base), `screen:<id|glob>`, `bundle:<name>`, `tokens`, `app-config` \u2014 a selected screen drags its logic bundle and a selected bundle drags the screens that reference it, or the bytes land under a key nothing reads.", required: "[--content <dir>] [--draft] [--live] [--force] [--strict] [--label] [--notes] [--visibility public|unlisted] [--no-claim] [--account-id <id>] [--only <selector>] [--from-release <id>] [--accept-regressions] [--accept-partial] [--app <slug>] (--control-token)" },
@@ -72469,7 +72551,7 @@ function readUpdateCache(path2) {
 function writeUpdateCache(path2, cache) {
   try {
     mkdirSync33(dirname37(path2), { recursive: true, mode: 448 });
-    writeFileSync30(path2, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
+    writeFileSync29(path2, JSON.stringify(cache, null, 2) + "\n", { mode: 384 });
   } catch {
   }
 }
@@ -72500,7 +72582,7 @@ function globalPrefixWritable() {
   const root = globalNodeModulesRoot();
   if (!root) return false;
   try {
-    accessSync(root, constants2.W_OK);
+    accessSync(root, constants3.W_OK);
     return true;
   } catch {
     return false;
@@ -72611,7 +72693,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   };
   const tryCreate = (path2) => {
     try {
-      writeFileSync30(path2, mine, { flag: "wx", mode: 384 });
+      writeFileSync29(path2, mine, { flag: "wx", mode: 384 });
       return true;
     } catch {
       return false;
@@ -73199,7 +73281,7 @@ function executableOnPath(name, env = process.env) {
       const candidate = join65(dir, `${name}${suffix}`);
       try {
         if (!statSync19(candidate).isFile()) continue;
-        if (process.platform !== "win32") accessSync(candidate, constants2.X_OK);
+        if (process.platform !== "win32") accessSync(candidate, constants3.X_OK);
         return true;
       } catch {
       }
@@ -73326,7 +73408,7 @@ function readConfigSource(dir) {
 }
 function writePngFile(path2, base64) {
   mkdirSync33(dirname37(path2), { recursive: true });
-  writeFileSync30(path2, Buffer.from(base64, "base64"));
+  writeFileSync29(path2, Buffer.from(base64, "base64"));
   return path2;
 }
 async function seedAgentFilesFor(dir, flags, mode = "init") {
@@ -74949,7 +75031,7 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
           const files = himiPluginFiles2(skills.skillMd);
           for (const f of files) {
             mkdirSync33(dirname37(join65(dir, f.path)), { recursive: true });
-            writeFileSync30(join65(dir, f.path), f.text);
+            writeFileSync29(join65(dir, f.path), f.text);
           }
           print({ ok: true, dir, files: files.map((f) => f.path), next: [`claude plugin validate ${dir}`, `claude --plugin-dir ${dir}`] });
           return 0;
@@ -74975,7 +75057,7 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
           const out2 = resolve53(str8(flags.out) ?? join65(dir, ".himi", "making-of.html"));
           const { html, plan } = buildReel2(dir);
           mkdirSync33(dirname37(out2), { recursive: true });
-          writeFileSync30(out2, html);
+          writeFileSync29(out2, html);
           const { pathToFileURL: pathToFileURL9 } = await import("node:url");
           const url2 = pathToFileURL9(out2).href;
           const open2 = flags["no-open"] !== true;
@@ -77195,9 +77277,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
                   const { describeChanges: describeChanges2, headline: headline2 } = await Promise.resolve().then(() => (init_build_changes(), build_changes_exports));
                   const changes = describeChanges2(live2, join65(next, running.app), diff);
                   const retired = `${live2}.retired-${Date.now()}`;
-                  renameSync7(live2, retired);
+                  renameSync8(live2, retired);
                   try {
-                    renameSync7(join65(next, running.app), live2);
+                    renameSync8(join65(next, running.app), live2);
                   } catch {
                     cpSync3(join65(next, running.app), live2, { recursive: true });
                   }
@@ -79552,10 +79634,11 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
           return 2;
         }
         const redirectFlag = str8(flags["redirect-uri"]);
-        if (!clientId && (flags.apply === true || redirectFlag)) {
-          const { APPLY_NEEDS_CLIENT: APPLY_NEEDS_CLIENT2, REDIRECT_NEEDS_CLIENT: REDIRECT_NEEDS_CLIENT2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+        const { APPLY_NEEDS_CLIENT: APPLY_NEEDS_CLIENT2, REDIRECT_NEEDS_CLIENT: REDIRECT_NEEDS_CLIENT2, applyNeedsClient: applyNeedsClient2 } = await Promise.resolve().then(() => (init_cli(), cli_exports));
+        const applyWantsClient = flags.apply === true && applyNeedsClient2(str8(flags.shell));
+        if (!clientId && (applyWantsClient || redirectFlag)) {
           io.error(JSON.stringify({
-            error: flags.apply === true ? APPLY_NEEDS_CLIENT2 : REDIRECT_NEEDS_CLIENT2,
+            error: applyWantsClient ? APPLY_NEEDS_CLIENT2 : REDIRECT_NEEDS_CLIENT2,
             usage: analyzeUsage
           }));
           return 2;

package/guides/himi-mcp.md

@@ -83,8 +83,13 @@ Each tool acts on the agent's workspace folder unless it is given a `dir`.
 **File tools, for hosts that cannot edit files.** `himi mcp --with-files` adds `himi_list_apps`,
 `himi_list_files`, `himi_read_file`, `himi_write_files` and `himi_delete_files`. The Claude Desktop
 Extension uses them, because Claude Desktop chat has no file editing of its own. They follow the
-hosted connector's shapes, act only inside the workspace folder (checked on the real path, so a
-symlink cannot lead out of it), and never touch `.git`, `node_modules` or `dist`. When the host names
+hosted connector's shapes and act only inside the workspace folder, on an app root (a folder with
+`himalaya.content.json`). They refuse any path through a symlink, dangling ones included, and write
+without following links. They judge the deny-list in every spelling, because macOS and Windows open
+`.ENV` as `.env`. They never list, read,
+write or delete anything the source deny-list keeps off the machine: `.env` files, the `.himi/`
+secret store, MCP host configs with their keys, key files, and `node_modules`, `dist` and `.git`
+at any depth. When the host names
 no workspace, `HIMI_WORKSPACE` sets the folder. Coding agents edit files themselves, so the flag is
 off by default.
 

package/guides/wix-business-context.md

@@ -161,11 +161,13 @@ The plane has no headless browser (`look.unavailable: no_browser_on_plane`). Own
 `himi-brandy`, the site shell, opens the customer's live website as native-framed tabs, so its contract is a `site` block: which website, and which of its pages are tabs, drawer rows or overflow rows. `--shell brandy` derives that block into `provisioning.overlay.json`:
 
 ```bash
-himi site analyze --url https://owner.wixsite.com/site --client-id <id> --shell brandy   # writes site.pages
+himi site analyze --url https://owner.wixsite.com/site --shell brandy   # writes site.pages
 # edit site.pages in .himi/business-book/provisioning.overlay.json if the map needs it
-himi site analyze --url https://owner.wixsite.com/site --client-id <id> --shell brandy --apply
+himi site analyze --url https://owner.wixsite.com/site --shell brandy --apply
 ```
 
+No `--client-id` is needed here: a site shell is visitor-only, its pages are the site itself, and its contract binds no Headless client. For an off-repo brandy app (`himi init --template brandy`), run the `--apply` inside the app folder: it writes the derived `site` block into the package's own `provisioning.json`, which the template's `config.ts` builds every tab and screen from.
+
 The map comes from what the analysis already reads without owner credentials, because Wix has no public menu API: the published page list (`look.sitePages`), the header menu the crawl saw (`look.navLinks`, label and href), and each page's role.
 
 - **Order and labels** follow the site's own menu. Links to other hosts, and repeat links to the same page, are dropped.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1115.0",
+  "version": "0.1117.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "19c38309340f59147c2cb6f97746d920feacc058a4c256331d9f4422"
+  "falconPackageHash": "fc5b0cacba000b4c6e6a4a5002e19ab4d37d0560e6bd98aed8b49b13"
 }

package/templates/brandy/README.md

@@ -0,0 +1,60 @@
+# __HIMI_APP_NAME__ — your website as an app
+
+A **site shell**: your live Wix website, framed as a native app. Every tab and drawer row is one of
+your site's own pages, shown in a WebView under a native tab bar, drawer and splash in your brand
+colours. The site's own header, footer and Wix ads are hidden. It is the fastest way to ship an
+existing website as an app, and each tab can later be replaced by a native screen.
+
+## Point it at your site
+
+The whole app is the `site` block in `provisioning.json`:
+
+```json
+{
+  "site": {
+    "origin": "https://your-account.wixsite.com/your-site",
+    "kind": "wix",
+    "pages": [
+      { "id": "home", "title": "Home", "path": "/", "icon": "home" },
+      { "id": "blog", "title": "Blog", "path": "/blog", "icon": "newspaper" },
+      { "id": "contact", "title": "Contact", "path": "/contact", "icon": "mail", "placement": "drawer" }
+    ],
+    "chrome": { "hideSiteHeader": true, "hideSiteFooter": true, "hideWixAds": true }
+  }
+}
+```
+
+The placeholder origin above is not a real site. Replace it by deriving the block from your site's
+own menu, from inside this folder:
+
+```bash
+himi site analyze --url https://your-account.wixsite.com/your-site --shell brandy --apply
+```
+
+That writes the derived `site` block into this `provisioning.json` and your site's colours into
+`tokens.json`. No `--client-id` is needed, because a site shell reads nothing through a Wix client.
+To review the map first, leave out `--apply`: the block is then only written to
+`.himi/business-book/provisioning.overlay.json`. You can always edit the block by hand.
+
+- **`origin`** is your published site, `https` only. A free site's path (`/your-site`) is part of it.
+- **`pages`** are paths relative to the origin. Each needs a unique `id` (`a-z`, `0-9`, `_`) and must
+  not use `page`, which is reserved.
+- **`placement`** is `tab` (the default), `drawer` or `overflow`. At most four tabs are shown, and
+  `home` must be the first of them: the app opens on its first tab.
+- **`icon`** is a design-system icon name (`home`, `bag`, `calendar`, `ticket`, `newspaper`, `mail`,
+  `info`, `tag`, `photo`, `person`, `globe`, …).
+- **`chrome`** hides the site's own header (on inner pages), its footer and the Wix ads banner.
+  Every flag defaults to hidden.
+
+`config.ts` validates the block whenever the app loads, so an `http` origin, a duplicate id or a map
+with no tab fails `himi validate`, `himi render` and `himi push` rather than shipping.
+
+## Loop
+
+```bash
+himi build && himi validate --strict   # derive the screens and check them
+himi render site_home                  # the home tab (a WebView: headless render reports it, it does not paint it)
+himi push --draft                      # publish a draft release and open the web preview
+```
+
+Your colours live in `tokens.json` and your name in `config.ts`.

package/templates/brandy/config.ts

@@ -0,0 +1,76 @@
+// Your app's configuration — a SITE SHELL. Your live website is the app: every tab and drawer
+// row is one of its pages, shown in a native-framed WebView under a native tab bar and drawer.
+//
+// Nothing here names a page. The pages come from the `site` block of ./provisioning.json, so you
+// change the app by changing that block — by hand, or with
+//   himi site analyze --url https://<your-site> --shell brandy
+// which derives it from your site's own menu. Inspect the live values any time with
+// `himi context`; see `himi docs app-config`.
+import {
+  assertSiteShellConfig,
+  defineApp,
+  siteLinkableScreens,
+  siteNav,
+  siteNavConfig,
+  type SiteShellConfig,
+} from "@himalaya/core";
+import { ConsoleTelemetrySink } from "@himalaya/telemetry-console";
+import provisioning from "./provisioning.json" with { type: "json" };
+
+/** Your website and its page map. Validated here, so a mistake in provisioning.json (an http
+ *  origin, a duplicate page id, no tab) fails `himi validate`, `render` and `push` instead of
+ *  shipping a broken app. */
+export const site = provisioning.site as SiteShellConfig;
+assertSiteShellConfig(site);
+const nav = siteNav(site);
+// The app opens on its first tab, and everything that names the home screen (`himi init`,
+// `himi render`, agent tooling) names `site_home` — so the `home` page must BE the first tab.
+if (nav.tabs[0]?.screenId !== "site_home") {
+  throw new Error('provisioning.json: the "home" page must be the first tab — list it first in site.pages');
+}
+
+export default defineApp({
+  id: "__HIMI_APP_DOTID__",
+  name: "__HIMI_APP_NAME__",
+  bundleId: "__HIMI_APP_DOTID__",
+  applicationId: "__HIMI_APP_DOTID__",
+  // Placeholders — an over-the-air app never consumes these. Leave as-is.
+  schemaPackage: "@example/__HIMI_APP_SLUG__-schema",
+  schemaPackageRange: { min: 9900, max: 9909 },
+  // Placeholders — only a local server would read these. Leave as-is.
+  ports: { devServer: 8190, web: 5390 },
+  // Visitor-only: your site's own pages handle anything a visitor does.
+  auth: { providerId: "none", config: {} },
+  telemetry: ConsoleTelemetrySink(),
+  serverUrls: {
+    screen: "http://localhost:8190/v1",
+    actions: "http://localhost:8190/v1/actions",
+    sync: "http://localhost:8190/v1/sync",
+  },
+  capabilities: [],
+  // Your brand colours paint the NATIVE chrome (tabs, drawer, splash); the site paints its pages.
+  designTokensPath: "./tokens.json",
+  // "Ready" means the first page has painted, not just the app shell — otherwise the splash
+  // fades into a blank WebView. It still dismisses after 5s on a slow link.
+  splash: {
+    enabled: true,
+    backgroundColor: "accentPrimary",
+    caption: "__HIMI_APP_NAME__",
+    minVisibleMs: 400,
+    maxHoldMs: 5000,
+    readySignal: "first_content",
+  },
+  navigation: {
+    // Bottom tabs on a phone, a sidebar on a larger screen; the drawer lists every page that is
+    // not `overflow`. At most four tabs — each keeps its page loaded while you switch.
+    navKind: "responsive",
+    scheme: "himalaya-__HIMI_APP_SLUG__",
+    deepLinkPatterns: [],
+    linkableScreens: siteLinkableScreens(site),
+    // A notification or app link carrying one of your site's URLs opens that page's tab.
+    site: siteNavConfig(site),
+    tabBar: { items: nav.tabs },
+    drawer: { items: nav.drawer },
+  },
+  entities: {},
+});

package/templates/brandy/dev/index.ts

@@ -0,0 +1,25 @@
+// Your app's screens. Each one is a page of your website — a WebView screen built from the
+// `site` block of ../provisioning.json — so this file holds no screen of its own. Change the
+// pages by changing that block, never this file.
+import { siteScreens } from "@himalaya/core";
+import config, { site } from "../config.js";
+
+const SCREENS = siteScreens(site);
+// The home screen is always the `home` page's: `site_home`. A literal on purpose — `himi init`
+// and the agent tooling read `homeScreenId` from this file as written; config.ts refuses a map
+// whose first tab is anything else, so the literal and the tab bar cannot disagree.
+
+export default {
+  config,
+  homeScreenId: "site_home",
+  screens: {
+    // A fresh copy per build: descriptors are pure functions of the site block.
+    exact: Object.fromEntries(Object.keys(SCREENS).map((id) => [id, () => structuredClone(SCREENS[id])])),
+    templated: [],
+  },
+  actions: [],
+  createStore: () => ({}),
+  // Every page is seeded, so the whole tab bar and drawer work on a cold offline start (each
+  // WebView then shows its own offline state until the network returns).
+  seed: { screens: SCREENS, data: {} },
+};

package/templates/brandy/himalaya.content.json

@@ -0,0 +1,5 @@
+{
+  "name": "__HIMI_APP_NAME__",
+  "icon": "icon.png",
+  "target": "prod"
+}

package/templates/brandy/himalaya.template.json

@@ -0,0 +1,6 @@
+{
+  "title": "Brandy — your website as an app",
+  "description": "A site shell: the customer's live Wix website as a native app. Every tab and drawer row is one of the site's own pages in a native-framed WebView, with a native tab bar, drawer, splash and brand colours; the site's header, footer and Wix ads are hidden. The page map lives in provisioning.json (`site`), and `himi site analyze --url <site> --shell brandy` derives it from the site's own menu. Start here to ship an existing website as an app today and move tabs to native screens later.",
+  "tags": ["wix", "website", "site-shell", "webview", "tabs", "drawer", "no-code", "day-zero", "consumer"],
+  "category": "consumer"
+}

package/templates/brandy/platforms.json

@@ -0,0 +1 @@
+{"macos":false}

package/templates/brandy/provisioning.json

@@ -0,0 +1,12 @@
+{
+  "site": {
+    "origin": "https://your-account.wixsite.com/your-site",
+    "kind": "wix",
+    "pages": [
+      { "id": "home", "title": "Home", "path": "/", "icon": "home" },
+      { "id": "blog", "title": "Blog", "path": "/blog", "icon": "newspaper" },
+      { "id": "contact", "title": "Contact", "path": "/contact", "icon": "mail", "placement": "drawer" }
+    ],
+    "chrome": { "hideSiteHeader": true, "hideSiteFooter": true, "hideWixAds": true }
+  }
+}

package/templates/brandy/tokens.json

@@ -0,0 +1,128 @@
+{
+  "colors": {
+    "surfacePrimary": {
+      "light": "#FFFFFF",
+      "dark": "#0D1117",
+      "highContrast": "#000000"
+    },
+    "surfaceSecondary": {
+      "light": "#F4F7F8",
+      "dark": "#161B22",
+      "highContrast": "#111111"
+    },
+    "surfaceElevated": {
+      "light": "#FFFFFF",
+      "dark": "#1D2228",
+      "highContrast": "#111111"
+    },
+    "surfaceSubtle": {
+      "light": "#F8FAF9",
+      "dark": "#121821",
+      "highContrast": "#111111"
+    },
+    "surfaceTertiary": {
+      "light": "#E9EEF0",
+      "dark": "#232A32",
+      "highContrast": "#1A1A1A"
+    },
+    "textPrimary": {
+      "light": "#1F2328",
+      "dark": "#E6EDF3",
+      "highContrast": "#FFFFFF"
+    },
+    "textSecondary": {
+      "light": "#59636E",
+      "dark": "#848D98",
+      "highContrast": "#CCCCCC"
+    },
+    "textTertiary": {
+      "light": "#7D8791",
+      "dark": "#6E7681",
+      "highContrast": "#CCCCCC"
+    },
+    "textOnAccent": {
+      "light": "#FFFFFF",
+      "dark": "#FFFFFF",
+      "highContrast": "#000000"
+    },
+    "accentPrimary": {
+      "light": "#0969DA",
+      "dark": "#1E72C7",
+      "highContrast": "#58A6FF"
+    },
+    "accentSecondary": {
+      "light": "#087F5B",
+      "dark": "#1C8968",
+      "highContrast": "#FFFFFF"
+    },
+    "accentSurface": {
+      "light": "#E2EDF8",
+      "dark": "#0C2540",
+      "highContrast": "#FFFFFF"
+    },
+    "success": {
+      "light": "#1A7F37",
+      "dark": "#3FB950",
+      "highContrast": "#3FB950"
+    },
+    "successSurface": {
+      "light": "#E9F8EC",
+      "dark": "#12331B",
+      "highContrast": "#FFFFFF"
+    },
+    "warning": {
+      "light": "#9A6700",
+      "dark": "#D29922",
+      "highContrast": "#D29922"
+    },
+    "warningSurface": {
+      "light": "#FFF5D8",
+      "dark": "#3A2C0A",
+      "highContrast": "#FFFFFF"
+    },
+    "danger": {
+      "light": "#CF222E",
+      "dark": "#F85149",
+      "highContrast": "#FF5555"
+    },
+    "dangerSurface": {
+      "light": "#FFEDEA",
+      "dark": "#3A1513",
+      "highContrast": "#FFFFFF"
+    },
+    "border": {
+      "light": "#D8DEE4",
+      "dark": "#30363D",
+      "highContrast": "#FFFFFF"
+    }
+  },
+  "spacing": {
+    "xs": 4,
+    "sm": 8,
+    "md": 12,
+    "lg": 16,
+    "xl": 24
+  },
+  "typography": {
+    "title1": {
+      "size": 28,
+      "weight": 700,
+      "line": 1.2
+    },
+    "body": {
+      "size": 16,
+      "weight": 400,
+      "line": 1.5
+    },
+    "caption": {
+      "size": 13,
+      "weight": 400,
+      "line": 1.4
+    }
+  },
+  "radius": {
+    "sm": 4,
+    "md": 8,
+    "lg": 12
+  }
+}