@wix/himalaya-cli 0.1154.0 → 0.1155.0

package/dist/cli.mjs

@@ -850,7 +850,7 @@ var init_file_store = __esm({
           }
           return removed;
         };
-        return sweep("bundles", new Set([...refs.bundles].map((sha) => `${sha}.bundle.js`))) + sweep("docs", new Set([...refs.docs].map((hash) => `${hash}.json`))) + sweep("assets", refs.assets);
+        return sweep("bundles", new Set([...refs.bundles].map((sha2) => `${sha2}.bundle.js`))) + sweep("docs", new Set([...refs.docs].map((hash) => `${hash}.json`))) + sweep("assets", refs.assets);
       }
     };
   }
@@ -6758,16 +6758,58 @@ function walk(node, registry, path2, out2) {
       });
     }
   }
+  const type = typeof obj3.type === "string" ? obj3.type : "";
+  const colorProps = Object.prototype.hasOwnProperty.call(COLOR_TOKEN_PROPS, type) ? COLOR_TOKEN_PROPS[type] : void 0;
+  const typoProps = Object.prototype.hasOwnProperty.call(TYPOGRAPHY_TOKEN_PROPS, type) ? TYPOGRAPHY_TOKEN_PROPS[type] : void 0;
+  if ((colorProps || typoProps) && obj3.props && typeof obj3.props === "object") {
+    const props = obj3.props;
+    const check = (spec, kind) => {
+      const [arrayKey, leaf] = spec.includes("[].") ? spec.split("[].") : [void 0, spec];
+      const sites = arrayKey ? (Array.isArray(props[arrayKey]) ? props[arrayKey] : []).map((el, i) => [`${path2}.props.${arrayKey}[${i}].${leaf}`, el && typeof el === "object" ? el[leaf] : void 0]) : [[`${path2}.props.${leaf}`, props[leaf]]];
+      for (const [at2, v] of sites) {
+        if (typeof v !== "string" || v === "") continue;
+        if (kind === "color" ? !v.startsWith("#") && !registry.colors.has(v) : !registry.typography.has(v)) {
+          out2.push({ path: at2, kind, name: v });
+        }
+      }
+    };
+    for (const spec of colorProps ?? []) check(spec, "color");
+    for (const spec of typoProps ?? []) check(spec, "typography");
+  }
   for (const [key2, value] of Object.entries(obj3)) {
     walk(value, registry, `${path2}.${key2}`, out2);
   }
 }
-var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA;
+var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA, COLOR_TOKEN_PROPS, TYPOGRAPHY_TOKEN_PROPS;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
     "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
+    COLOR_TOKEN_PROPS = {
+      Badge: ["token"],
+      Card: ["background"],
+      Image: ["tint", "placeholder"],
+      Tag: ["token"],
+      Icon: ["tint"],
+      Toggle: ["trackOn", "trackOff", "thumb"],
+      ProgressBar: ["tint", "trackColor"],
+      ListItem: ["titleColor", "subtitleColor", "overlineColor"],
+      Slider: ["tint"],
+      ActivityIndicator: ["tint"],
+      Label: ["color"],
+      Gauge: ["tint", "rings[].tint"],
+      Rating: ["color"],
+      VoiceNote: ["tint"],
+      Marquee: ["color"],
+      Fab: ["tint"]
+    };
+    TYPOGRAPHY_TOKEN_PROPS = {
+      ListItem: ["titleStyle", "subtitleStyle"],
+      RichText: ["runs[].style"],
+      Label: ["style"],
+      Marquee: ["style"]
+    };
   }
 });
 
@@ -7861,6 +7903,47 @@ var init_validator = __esm({
   }
 });
 
+// ../../core/dev-server/src/token-suggest.ts
+function suggestTokenNames(name, known, max = 3) {
+  if (name.length > MAX_SUGGEST_LEN) return [];
+  const n = name.toLowerCase();
+  const scored = [];
+  for (const k of known) {
+    if (k.length > MAX_SUGGEST_LEN) continue;
+    const l = k.toLowerCase();
+    const d = editDistance(n, l);
+    let score;
+    if (d <= 2) score = d;
+    else if (l.startsWith(n) || n.startsWith(l)) score = 3;
+    else if (l.includes(n) || n.includes(l)) score = 4;
+    else if (d <= Math.floor(Math.max(n.length, l.length) / 3)) score = 5 + d;
+    else continue;
+    scored.push([k, score]);
+  }
+  scored.sort((a, b) => a[1] - b[1] || a[0].localeCompare(b[0]));
+  const best = scored.length && scored[0][1] <= 2 ? scored.filter(([, sc]) => sc <= 2) : scored;
+  return best.slice(0, max).map(([k]) => k);
+}
+function editDistance(a, b) {
+  const prev = Array.from({ length: b.length + 1 }, (_, i) => i);
+  for (let i = 1; i <= a.length; i++) {
+    let diag = prev[0];
+    prev[0] = i;
+    for (let j = 1; j <= b.length; j++) {
+      const up = prev[j];
+      prev[j] = Math.min(prev[j] + 1, prev[j - 1] + 1, diag + (a[i - 1] === b[j - 1] ? 0 : 1));
+      diag = up;
+    }
+  }
+  return prev[b.length];
+}
+var MAX_SUGGEST_LEN;
+var init_token_suggest = __esm({
+  "../../core/dev-server/src/token-suggest.ts"() {
+    MAX_SUGGEST_LEN = 64;
+  }
+});
+
 // ../../core/dev-server/src/l10n-strings.ts
 function isUserVisibleCopy(s) {
   if (typeof s !== "string" || s.length === 0 || s.length > 200) return false;
@@ -10245,6 +10328,15 @@ function renderedWixMediaReferences(descriptor) {
   regions.forEach((region) => collectWixMediaReferences(region.value, region.path, found, false, false, "", region.atRoot));
   return found;
 }
+function unknownTokenMessage(kind, name, registry) {
+  const base = `unknown ${kind} token "${name}" (not in tokens.json)`;
+  const group = registry ? { color: registry.colors, typography: registry.typography, spacing: registry.spacing, radius: registry.radius }[kind] : void 0;
+  if (!group || group.size === 0) return base;
+  const near = suggestTokenNames(name, group);
+  const all = [...group].sort();
+  const list = all.length > 14 ? `${all.slice(0, 14).join(", ")}, \u2026 (${all.length})` : all.join(", ");
+  return `${base}${near.length ? ` \u2014 did you mean ${near.map((n) => `"${n}"`).join(" or ")}?` : ""} Defined ${kind} tokens: ${list}`;
+}
 function validateScreenDescriptor(screenId, descriptor, opts = {}) {
   const issues = [];
   const strict = opts.strict ?? false;
@@ -10288,10 +10380,11 @@ function validateScreenDescriptor(screenId, descriptor, opts = {}) {
       indexIssue(at2, issue2);
     }
   }
+  const tokenRegistry = opts.tokens ? buildTokenRegistry(opts.tokens) : void 0;
   for (const t of v.tokenViolations) {
     if (t.name.startsWith("$")) continue;
     if (pathCrossesOpaqueAuthorJson(t.path)) continue;
-    issues.push({ severity: hygiene, pass: "tokens", path: t.path, message: `unknown ${t.kind} token "${t.name}" (not in tokens.json)` });
+    issues.push({ severity: hygiene, pass: "tokens", path: t.path, message: unknownTokenMessage(t.kind, t.name, tokenRegistry) });
   }
   for (const u of v.unknownComponents) {
     if (pathCrossesOpaqueAuthorJson(u.path)) continue;
@@ -10835,6 +10928,8 @@ var init_validate_descriptor_core = __esm({
   "../../core/dev-server/src/validate-descriptor.core.ts"() {
     init_validator();
     init_validator();
+    init_tokens();
+    init_token_suggest();
     init_l10n_strings();
     init_a11y_contract();
     init_bindings();
@@ -14387,8 +14482,8 @@ function rgbToHex([r, g, b]) {
 async function normalizeSourceIcon(input, opts) {
   const sharp = await sharpOrThrow();
   const size = opts.size ?? 1024;
-  const fit = opts.fit ?? NORMALIZE_FIT_FRACTION;
-  const inner = Math.max(1, Math.round(size * fit));
+  const fit2 = opts.fit ?? NORMALIZE_FIT_FRACTION;
+  const inner = Math.max(1, Math.round(size * fit2));
   const pad3 = Math.round((size - inner) / 2);
   let trimmed;
   try {
@@ -18282,7 +18377,7 @@ function agentCovers(agent, cli) {
   const gap = Math.abs(Date.parse(agent.ts) - Date.parse(cli.ts));
   if (!(gap <= AGENT_WINS_WITHIN_MS)) return false;
   if (cli.step && agent.step === cli.step) return true;
-  return [...shasOf(cli.images)].some((sha) => agentShas.has(sha));
+  return [...shasOf(cli.images)].some((sha2) => agentShas.has(sha2));
 }
 function visibleEntries(entries) {
   return entries.filter((e) => !isCliEntry(e) || !entries.some((a) => agentCovers(a, e)));
@@ -34589,7 +34684,8 @@ var init_renderNode = __esm({
       if (v.startsWith("$item")) {
         const key2 = v.replace(/^\$item\.?/, "");
         const resolved2 = ctx.itemScope ? key2 ? ctx.itemScope[key2] : ctx.itemScope : void 0;
-        return resolved2 != null ? asTextL10n(resolved2, ctx) : bindingPlaceholder(v, ctx);
+        if (resolved2 != null) return asTextL10n(resolved2, ctx);
+        return ctx.itemScope ? null : bindingPlaceholder(v, ctx);
       }
       if (ctx.provider) return /* @__PURE__ */ jsx8(Bound, { ctx, binding: v, render: (val) => asTextL10n(val, ctx) });
       return bindingPlaceholder(v, ctx);
@@ -40514,9 +40610,9 @@ async function runScreenDiagnostics(state, screenId, descriptor) {
     evidence: { runId: `dev:${state.startedAt}:${screenId}`, ts: (/* @__PURE__ */ new Date()).toISOString() }
   });
 }
-async function fontFaceBytesBySha(_appDir, sha) {
+async function fontFaceBytesBySha(_appDir, sha2) {
   try {
-    return await catalogFaceBytes(sha);
+    return await catalogFaceBytes(sha2);
   } catch {
   }
   return void 0;
@@ -42877,13 +42973,13 @@ function createDevServer(opts = {}) {
           return handleAppIcon(req, res, state);
         }
         if (url.split("?")[0].startsWith("/v1/asset/") && req.method === "GET") {
-          const sha = url.split("?")[0].slice("/v1/asset/".length);
+          const sha2 = url.split("?")[0].slice("/v1/asset/".length);
           const q = new URLSearchParams(url.split("?")[1] ?? "");
           const assetApp = q.get("app") ?? state.appName;
           const assetDir = state.app && assetApp === state.app.name ? state.app.dir : resolveAppDir(assetApp);
-          const hit = assetDir ? collectAssets(assetDir).find((a) => assetSha256(readFileSync44(a.path)) === sha) : void 0;
+          const hit = assetDir ? collectAssets(assetDir).find((a) => assetSha256(readFileSync44(a.path)) === sha2) : void 0;
           if (!hit && assetDir) {
-            const fontBytes = await fontFaceBytesBySha(assetDir, sha);
+            const fontBytes = await fontFaceBytesBySha(assetDir, sha2);
             if (fontBytes) {
               res.writeHead(200, {
                 "content-type": "font/ttf",
@@ -42901,7 +42997,7 @@ function createDevServer(opts = {}) {
               if (serve) return await proxyToServe(serve, req, res);
             }
             res.writeHead(404, { "content-type": "application/json" });
-            res.end(JSON.stringify({ error: "asset_not_found", app: assetApp, sha }));
+            res.end(JSON.stringify({ error: "asset_not_found", app: assetApp, sha: sha2 }));
             return;
           }
           const bytes2 = readFileSync44(hit.path);
@@ -43998,6 +44094,7 @@ __export(screen_crawl_exports, {
   isUnservedRequest: () => isUnservedRequest,
   layeredTransport: () => layeredTransport,
   mapBundleFrame: () => mapBundleFrame,
+  missingItemFields: () => missingItemFields,
   netTransport: () => netTransport,
   parseWorkerAction: () => parseWorkerAction,
   recordScreenTraffic: () => recordScreenTraffic,
@@ -44614,6 +44711,96 @@ function renderedNameGaps(descriptor, state) {
   }
   return [...found.values()];
 }
+function gateTrue(v) {
+  if (typeof v === "boolean") return v;
+  if (typeof v === "number") return v !== 0;
+  if (typeof v === "string") {
+    const l = v.trim().toLowerCase();
+    return l === "true" || l === "1";
+  }
+  return false;
+}
+function rowScopeOf(el, i) {
+  return el && typeof el === "object" && !Array.isArray(el) ? { ...el, __index: i } : { value: el, __index: i };
+}
+function missingItemFields(descriptor, state) {
+  const provider = new FakeServiceProvider(state);
+  const out2 = /* @__PURE__ */ new Map();
+  const report3 = (m) => {
+    if (!out2.has(`${m.at}|${m.binding}`)) out2.set(`${m.at}|${m.binding}`, m);
+  };
+  const judgeList = (template, templateAt, rawRows, depth) => {
+    if (!rawRows.length) return;
+    const rows = rawRows.map(rowScopeOf);
+    const seen = new Set(rows.flatMap((r) => Object.keys(r)).filter((k) => k !== "__index"));
+    const walk2 = (v, rel, collapse) => {
+      if (typeof v === "string") {
+        for (const m of v.matchAll(ITEM_PATH_RE)) {
+          const path2 = m[1];
+          const at2 = joinPath(templateAt, rel);
+          if (path2.includes(".")) {
+            report3({ at: at2, binding: m[0], field: path2, rowFields: [...seen].sort(), rows: rows.length, collapseWhenEmpty: collapse, dotted: true });
+            continue;
+          }
+          if (path2 === "__index" || seen.has(path2)) continue;
+          report3({ at: at2, binding: m[0], field: path2, rowFields: [...seen].sort(), rows: rows.length, collapseWhenEmpty: collapse });
+        }
+        return;
+      }
+      if (Array.isArray(v)) return v.forEach((x, i) => walk2(x, `${rel}[${i}]`, collapse));
+      if (!v || typeof v !== "object") return;
+      const o = v;
+      const hp = o.modifiers?.hiddenPath;
+      if (typeof hp === "string" && hp.startsWith("$item.")) {
+        const gate = hp.slice("$item.".length);
+        if (rows.every((r) => gateTrue(pathValue(r, gate)))) return;
+      }
+      const c = collapse || o.collapseWhenEmpty === true;
+      const nested = repeaterOf(o);
+      for (const [k, x] of Object.entries(o)) {
+        const at2 = rel ? `${rel}.${k}` : k;
+        if (k === "id" && typeof x === "string") continue;
+        if (nested && k === "props") {
+          for (const [pk, px] of Object.entries(x)) if (pk !== "items") walk2(px, `${at2}.${pk}`, c);
+          continue;
+        }
+        walk2(x, at2, c);
+      }
+      if (nested && depth < A11Y_LIST_DEPTH) {
+        const innerAt = joinPath(templateAt, rel ? `${rel}.props.items[0]` : "props.items[0]");
+        rows.forEach((r) => {
+          const innerRows = nested.itemsPath.startsWith("$item.") ? pathValue(r, nested.itemsPath.slice("$item.".length)) : void 0;
+          if (Array.isArray(innerRows)) judgeList(nested.template, innerAt, innerRows, depth + 1);
+        });
+      }
+    };
+    walk2(template, "", false);
+  };
+  const scan = (v, at2) => {
+    if (Array.isArray(v)) return v.forEach((x, i) => scan(x, `${at2}[${i}]`));
+    if (!v || typeof v !== "object" || isActionEnvelope(v)) return;
+    const o = v;
+    const list = repeaterOf(o);
+    if (list) {
+      const rows = list.itemsPath.startsWith("$service:") ? provider.value(list.itemsPath) : void 0;
+      if (Array.isArray(rows)) judgeList(list.template, joinPath(at2, "props.items[0]"), rows, 1);
+      return;
+    }
+    for (const [k, x] of Object.entries(o)) {
+      if (!at2 && k === "input") continue;
+      scan(x, at2 ? `${at2}.${k}` : k);
+    }
+  };
+  scan(descriptor, "");
+  return [...out2.values()];
+}
+function repeaterOf(o) {
+  if (typeof o.type !== "string" || !o.props || typeof o.props !== "object") return null;
+  const p = o.props;
+  const itemsPath = typeof p.itemsPath === "string" ? p.itemsPath : typeof p.items_path === "string" ? p.items_path : null;
+  const template = Array.isArray(p.items) ? p.items[0] : void 0;
+  return itemsPath && template !== void 0 ? { itemsPath, template } : null;
+}
 function collectObservations(descriptorOrPayload, state) {
   const out2 = [];
   const walk2 = (node) => {
@@ -45112,6 +45299,17 @@ async function crawlScreenInner(opts) {
         });
       }
     }
+    for (const m of missingItemFields(descriptor, state)) {
+      findings.push({
+        screen: screenId,
+        trigger,
+        invariant: "item-field-missing",
+        severity: m.collapseWhenEmpty ? "warning" : "error",
+        message: m.dotted ? `row binding "${m.binding}" is a dotted path \u2014 row templates bind FLAT row fields only, so it does not resolve on any renderer` : `row binding "${m.binding}" reads "${m.field}", which none of the list's ${m.rows} row(s) carries \u2014 it renders blank on every renderer`,
+        at: m.at,
+        hint: m.dotted ? `have the worker flatten it onto the row (e.g. emit "${m.field.replace(/\./g, "_")}") and bind that. Row fields: ${m.rowFields.join(", ") || "none"}` : `row fields: ${m.rowFields.join(", ") || "none"} \u2014 rename the binding or have the worker emit "${m.field}"`
+      });
+    }
     for (const site of sites) {
       if (parseWorkerAction(site.actionId)) continue;
       const before = { ...site.params ?? {}, ...site.args ?? {} };
@@ -45735,7 +45933,7 @@ async function crawlScreenRelations(opts) {
     const sites = actionSitesForDescriptor(descriptor).filter(
       (s) => parseWorkerAction(s.actionId) && !opts.skipAction?.(s.actionId, s.componentId)
     );
-    const nameOf = (s) => parseWorkerAction(s.actionId).action;
+    const nameOf2 = (s) => parseWorkerAction(s.actionId).action;
     const serviceOf = (s) => parseWorkerAction(s.actionId).service;
     const boot = () => bootScreenWorker({
       bundleJs,
@@ -45793,7 +45991,7 @@ async function crawlScreenRelations(opts) {
       )
     ];
     const trig = (s) => ({ tap: s.componentId, key: s.key, action: s.actionId });
-    for (const s of sites.filter((s2) => REFRESH_ACTION.test(nameOf(s2)) || s2.key === "onPullToRefresh")) {
+    for (const s of sites.filter((s2) => REFRESH_ACTION.test(nameOf2(s2)) || s2.key === "onPullToRefresh")) {
       const after = await replay([s]);
       if (!after) continue;
       checked++;
@@ -45806,12 +46004,12 @@ async function crawlScreenRelations(opts) {
           invariant: "refresh-not-idempotent",
           severity: "warning",
           axis: "relation",
-          message: `${nameOf(s)} from a fresh boot settles on a different state than the boot itself, under identical data: ${summarizeDiff(baseSig, sig)}`,
+          message: `${nameOf2(s)} from a fresh boot settles on a different state than the boot itself, under identical data: ${summarizeDiff(baseSig, sig)}`,
           hint: "a refresh that appends instead of replacing, or clears a flag the loader set \u2014 REPLACE collections on refresh; ids, *At and _counters are already ignored by this comparison"
         });
       }
     }
-    for (const s of sites.filter((s2) => LOAD_MORE_ACTION.test(nameOf(s2)) || s2.key === "onLoadMore")) {
+    for (const s of sites.filter((s2) => LOAD_MORE_ACTION.test(nameOf2(s2)) || s2.key === "onLoadMore")) {
       const target = listPathOf(s.itemsPath);
       const after = target ? await replay([s]) : null;
       if (!after) continue;
@@ -45827,13 +46025,13 @@ async function crawlScreenRelations(opts) {
             axis: "relation",
             at: p,
             actual: `${baseLens[p]} \u2192 ${n}`,
-            message: `${nameOf(s)} shrank ${p} from ${baseLens[p]} to ${n} rows \u2014 a "load more" that replaces the page instead of appending it`,
+            message: `${nameOf2(s)} shrank ${p} from ${baseLens[p]} to ${n} rows \u2014 a "load more" that replaces the page instead of appending it`,
             hint: "append the new page to the existing rows (and de-duplicate by id); the user scrolled to see MORE"
           });
         }
       }
     }
-    for (const s of sites.filter((s2) => FILTER_ACTION.test(nameOf(s2)) && !isOptionSelection({ ...s2.params, ...s2.args }))) {
+    for (const s of sites.filter((s2) => FILTER_ACTION.test(nameOf2(s2)) && !isOptionSelection({ ...s2.params, ...s2.args }))) {
       if (screenListPaths.length !== 1) continue;
       const after = await replay([s]);
       if (!after) continue;
@@ -45849,18 +46047,18 @@ async function crawlScreenRelations(opts) {
             axis: "relation",
             at: p,
             actual: `${baseLens[p]} \u2192 ${n}`,
-            message: `${nameOf(s)} grew ${p} from ${baseLens[p]} to ${n} rows \u2014 a filter/search/sort can narrow or reorder a list, never enlarge it`,
+            message: `${nameOf2(s)} grew ${p} from ${baseLens[p]} to ${n} rows \u2014 a filter/search/sort can narrow or reorder a list, never enlarge it`,
             hint: "filter from the FULL set you keep aside, and assign the narrowed result \u2014 not a concatenation"
           });
         }
       }
     }
-    const declaredNames = sites.map(nameOf);
+    const declaredNames = sites.map(nameOf2);
     for (const a of sites) {
-      const partner = inversePartner(nameOf(a), declaredNames);
+      const partner = inversePartner(nameOf2(a), declaredNames);
       if (!partner) continue;
-      if (isUndoAction(nameOf(a))) continue;
-      const b = sites.find((s) => nameOf(s) === partner && serviceOf(s) === serviceOf(a) && s !== a);
+      if (isUndoAction(nameOf2(a))) continue;
+      const b = sites.find((s) => nameOf2(s) === partner && serviceOf(s) === serviceOf(a) && s !== a);
       if (!b) continue;
       const undoIsRowBound = isRowBound(b);
       const after = await replay([a, b], (i, bootState, prev) => {
@@ -45880,15 +46078,15 @@ async function crawlScreenRelations(opts) {
           invariant: "inverse-pair-diverges",
           severity: "warning",
           axis: "relation",
-          message: `${nameOf(a)} \u2192 ${nameOf(b)} does not return to the boot state: ${summarizeDiff(baseSig, sig)}`,
-          hint: `${nameOf(b)} should undo exactly what ${nameOf(a)} did \u2014 check which row it removes (by the id it was given) and every field ${nameOf(a)} touched; ids, *At and _counters are already ignored`
+          message: `${nameOf2(a)} \u2192 ${nameOf2(b)} does not return to the boot state: ${summarizeDiff(baseSig, sig)}`,
+          hint: `${nameOf2(b)} should undo exactly what ${nameOf2(a)} did \u2014 check which row it removes (by the id it was given) and every field ${nameOf2(a)} touched; ids, *At and _counters are already ignored`
         });
       }
     }
     return { findings: dedupe(findings), checked, byKind };
   });
 }
-var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, detached, CRAWL_CLOCK, MEMBER_IDENTITY_ACTION, BLANK_WHEN_BOUND, CONTROL_ROLES, NAME_KEYS, A11Y_ROWS_PER_LIST, A11Y_LIST_DEPTH, STALE_SNAPSHOT_HINT, UNBINDABLE_ROW;
+var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, detached, CRAWL_CLOCK, MEMBER_IDENTITY_ACTION, BLANK_WHEN_BOUND, CONTROL_ROLES, NAME_KEYS, A11Y_ROWS_PER_LIST, A11Y_LIST_DEPTH, ITEM_PATH_RE, STALE_SNAPSHOT_HINT, UNBINDABLE_ROW;
 var init_screen_crawl = __esm({
   "../../core/dev-server/src/screen-crawl.ts"() {
     init_validate_descriptor_core();
@@ -45947,6 +46145,7 @@ var init_screen_crawl = __esm({
     NAME_KEYS = new Set(ACCESSIBLE_NAME_KEYS);
     A11Y_ROWS_PER_LIST = 20;
     A11Y_LIST_DEPTH = 3;
+    ITEM_PATH_RE = /\$item\.([A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*)/g;
     STALE_SNAPSHOT_HINT = 'if every path already does, look for a stale-snapshot write-back: `return s` (or `{ ...s }`) after an await or from an early-return guard writes back the state as it was BEFORE the await, loading flag included \u2014 to change nothing, return `undefined` instead (not `null` or `{}`); see `himi docs tier-5-add-a-screen`, "Should this result be committed at all?"';
     UNBINDABLE_ROW = Symbol("unbindable-row");
   }
@@ -46497,10 +46696,10 @@ function hydrationServices(tier5Dir, bundleName, input = {}) {
   const js = readBuiltBundle(tier5Dir, bundleName);
   return js ? servicesFromBundleJs(js, input) : null;
 }
-function releaseIdFor(sha, content) {
-  if (sha === "dev") return contentReleaseId(content);
+function releaseIdFor(sha2, content) {
+  if (sha2 === "dev") return contentReleaseId(content);
   const stored = JSON.parse(JSON.stringify(content));
-  return `${sha}-${releaseContentId(stored).slice(0, 12)}`;
+  return `${sha2}-${releaseContentId(stored).slice(0, 12)}`;
 }
 function rebindReleaseId(manifest) {
   const { releaseId: _releaseId, gitSha: gitSha2, shellSha: _shellSha, ...content } = manifest;
@@ -47402,12 +47601,12 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     // never re-fetch, and the "replace an asset without a store release" claim would be false.
     ...Object.keys(assets).length ? { assets } : {}
   };
-  const sha = gitSha();
+  const sha2 = gitSha();
   const buildable = shellSha();
   const manifest = {
-    releaseId: releaseIdFor(sha, content),
-    gitSha: sha,
-    ...buildable && buildable !== sha ? { shellSha: buildable } : {},
+    releaseId: releaseIdFor(sha2, content),
+    gitSha: sha2,
+    ...buildable && buildable !== sha2 ? { shellSha: buildable } : {},
     ...content
   };
   await store.putManifest(app, manifest);
@@ -47490,8 +47689,8 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
       return { ...schedule, bundleHash: target.bundleHash };
     }) } : {}
   };
-  const sha = gitSha();
-  const manifest = { releaseId: contentReleaseId(content), gitSha: sha, ...content };
+  const sha2 = gitSha();
+  const manifest = { releaseId: contentReleaseId(content), gitSha: sha2, ...content };
   await store.putManifest(app, manifest);
   return { manifest, failedToBuild: [], missingBundles: [], auth: {}, tierCapViolations: [] };
 }
@@ -48469,14 +48668,14 @@ function observeShots(dir, memory, now) {
     const archived = archiveFile(dir, memory, join43(shotsDir, f));
     if (!archived) continue;
     seen.add(id);
-    const { sha, ext } = archived;
+    const { sha: sha2, ext } = archived;
     const prev = memory.shots[id];
     if (!prev) {
-      memory.shots[id] = { sha, ext, firstSeen: now, changedAt: now, versions: 1, present: true };
-      memory.timeline.push({ ts: now, id, sha, ext });
-    } else if (prev.sha !== sha) {
-      memory.shots[id] = { ...prev, sha, ext, changedAt: now, versions: prev.versions + 1, present: true };
-      memory.timeline.push({ ts: now, id, sha, ext });
+      memory.shots[id] = { sha: sha2, ext, firstSeen: now, changedAt: now, versions: 1, present: true };
+      memory.timeline.push({ ts: now, id, sha: sha2, ext });
+    } else if (prev.sha !== sha2) {
+      memory.shots[id] = { ...prev, sha: sha2, ext, changedAt: now, versions: prev.versions + 1, present: true };
+      memory.timeline.push({ ts: now, id, sha: sha2, ext });
     } else if (!prev.present) {
       memory.shots[id] = { ...prev, present: true };
     }
@@ -48959,12 +49158,12 @@ function planFromPayload(payload, base, selectors) {
   if (wantBundles.size) {
     patch.bundles = {};
     for (const name of wantBundles) {
-      const sha = local.bundles?.[name]?.sha256;
-      const b64 = sha ? payload.bundles?.[sha] : void 0;
-      if (!sha || !b64) {
+      const sha2 = local.bundles?.[name]?.sha256;
+      const b64 = sha2 ? payload.bundles?.[sha2] : void 0;
+      if (!sha2 || !b64) {
         return { ok: false, error: { error: "selector_matched_nothing", selector: `bundle:${name}`, message: `bundle "${name}" has no built bytes in this release \u2014 run \`himi build\` first.`, bundles: localBundles } };
       }
-      patch.bundles[sha] = b64;
+      patch.bundles[sha2] = b64;
       touched.push(`bundle:${name}`);
     }
   }
@@ -48987,13 +49186,13 @@ function planFromPayload(payload, base, selectors) {
         return { ok: false, error: { error: "selector_matched_nothing", selector: `screen:${id}`, message: `screen "${id}" has no built descriptor in this release.`, screens: localScreens } };
       }
       const localKey = local.screens?.[id]?.bundle ?? null;
-      const sha = resolveBundleSha(local, localKey);
-      const carriedHere = sha ? patch.bundles?.[sha] !== void 0 : false;
+      const sha2 = resolveBundleSha(local, localKey);
+      const carriedHere = sha2 ? patch.bundles?.[sha2] !== void 0 : false;
       const baseKeyForSha = (s) => {
         for (const [k, e] of Object.entries(base.bundles ?? {})) if (e?.sha256 === s) return k;
         return null;
       };
-      const baseKey = sha ? baseKeyForSha(sha) : null;
+      const baseKey = sha2 ? baseKeyForSha(sha2) : null;
       if (localKey !== null && !carriedHere && !baseKey) {
         return {
           ok: false,
@@ -49005,7 +49204,7 @@ function planFromPayload(payload, base, selectors) {
           }
         };
       }
-      const bundleRef = carriedHere ? sha : baseKey;
+      const bundleRef = carriedHere ? sha2 : baseKey;
       patch.screens[id] = { descriptor, bundle: bundleRef };
       if (bundleRef && bundleRef !== (base.screens?.[id]?.bundle ?? null)) rebound[id] = bundleRef;
       touched.push(`screen:${id}`);
@@ -50994,7 +51193,7 @@ function shotStateFor(dir, image) {
   }
 }
 function recordedShots(dir, screenId) {
-  return Object.entries(readRecord(dir)).filter(([sha, r]) => /^[0-9a-f]{64}$/.test(sha) && !!r && r.screen === screenId && typeof r.at === "string" && ["content", "error", "loading", "empty"].includes(r.state)).map(([sha, r]) => ({ sha256: sha, at: r.at, state: { state: r.state, ...r.initial === true ? { initial: true } : {}, ...r.offline === true ? { offline: true } : {} } })).sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0);
+  return Object.entries(readRecord(dir)).filter(([sha2, r]) => /^[0-9a-f]{64}$/.test(sha2) && !!r && r.screen === screenId && typeof r.at === "string" && ["content", "error", "loading", "empty"].includes(r.state)).map(([sha2, r]) => ({ sha256: sha2, at: r.at, state: { state: r.state, ...r.initial === true ? { initial: true } : {}, ...r.offline === true ? { offline: true } : {} } })).sort((a, b) => a.at < b.at ? 1 : a.at > b.at ? -1 : 0);
 }
 function offlineArtifact(state) {
   if (!state || state.state === "content") return false;
@@ -51268,7 +51467,7 @@ var init_studio_reel = __esm({
     };
     isObj3 = (v) => !!v && typeof v === "object" && !Array.isArray(v);
     str4 = (v) => typeof v === "string" && v ? v : null;
-    historyName = (sha, ext) => typeof sha === "string" && typeof ext === "string" && HISTORY_NAME.test(`${sha}.${ext}`) ? `${sha}.${ext}` : null;
+    historyName = (sha2, ext) => typeof sha2 === "string" && typeof ext === "string" && HISTORY_NAME.test(`${sha2}.${ext}`) ? `${sha2}.${ext}` : null;
     cited = (p) => [
       ...p.frames.map((f) => f.file),
       ...p.finals.flatMap((f) => f.file ? [f.file] : []),
@@ -51517,10 +51716,10 @@ function stillBuilding(dir, image, now) {
     if (!entries.length) return void 0;
     const times = entries.map((e) => Date.parse(e.ts)).filter(Number.isFinite);
     if (!times.length || !(now.getTime() - Math.max(...times) > STILL_BUILDING_AFTER_MS)) return void 0;
-    const sha = sha256Of2(image);
+    const sha2 = sha256Of2(image);
     const latest = entries[entries.length - 1];
-    if (Array.isArray(latest.images) && latest.images.some((i) => !!i && typeof i === "object" && i.sha256 === sha)) return void 0;
-    return journal(dir, "still-building", withHomeCaveat(STILL_BUILDING_MESSAGE, homeCaveat(dir, image)), { ref: `home-${sha.slice(0, 16)}`, image, now });
+    if (Array.isArray(latest.images) && latest.images.some((i) => !!i && typeof i === "object" && i.sha256 === sha2)) return void 0;
+    return journal(dir, "still-building", withHomeCaveat(STILL_BUILDING_MESSAGE, homeCaveat(dir, image)), { ref: `home-${sha2.slice(0, 16)}`, image, now });
   } catch {
     return void 0;
   }
@@ -51807,10 +52006,10 @@ function homeShotForPostcard(dir, opts = {}) {
   }
   if (opts.repeatOk) return pick2;
   try {
-    const sha = sha256Of2(pick2.image);
+    const sha2 = sha256Of2(pick2.image);
     const entries = readProgress(dir, { all: true }).entries;
     const latest = entries[entries.length - 1];
-    const shown2 = Array.isArray(latest?.images) && latest.images.some((i) => !!i && typeof i === "object" && i.sha256 === sha);
+    const shown2 = Array.isArray(latest?.images) && latest.images.some((i) => !!i && typeof i === "object" && i.sha256 === sha2);
     if (shown2) return { skipped: "the latest postcard already shows this home picture" };
   } catch {
     return { skipped: "the home shot could not be read" };
@@ -58603,16 +58802,16 @@ ${releaseId}`;
       if (assetMatch) {
         if (!app) return json4(400, { error: "missing_app" });
         if (!store.getAsset) return json4(501, { error: "assets_unsupported" });
-        const sha = assetMatch[1];
-        if (!isSafeSegment(sha)) return json4(400, { error: "bad_asset" });
+        const sha2 = assetMatch[1];
+        if (!isSafeSegment(sha2)) return json4(400, { error: "bad_asset" });
         const m = pin ? await pinnedManifest(app, pin) : await manifest(app);
-        const record2 = Object.values(m?.assets ?? {}).find((a) => a.sha256 === sha);
+        const record2 = Object.values(m?.assets ?? {}).find((a) => a.sha256 === sha2);
         if (!record2) return json4(404, { error: "asset_not_found", app });
-        const etag = strongEtagForSha256(sha);
+        const etag = strongEtagForSha256(sha2);
         if (request.headers.get("if-none-match") === etag) {
           return new Response(null, { status: 304, headers: { etag, "cache-control": BUNDLE_CACHE_CONTROL } });
         }
-        const bytes2 = await store.getAsset(app, sha);
+        const bytes2 = await store.getAsset(app, sha2);
         if (!bytes2) return json4(404, { error: "asset_not_found", app });
         return new Response(bytes2, {
           status: 200,
@@ -59189,21 +59388,21 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index-DHO0WElX.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1127482, sha256: "9a198f7af12c683263ba55641ec1802d4ca9addb9b8d38170e6b4f60387c61c3" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1127490, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1132100, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1620684, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1711608, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1802592, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1893572, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1984444, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2075424, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2184060, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2293144, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2402192, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2509892, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2598e3, length: 4947, sha256: "72e531f20412d0f07433cb52fac32ff7f5be87a4ef435c2d919cd5e21ec84ad3" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2602947, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
+      { key: "assets/index-CKwdlTbT.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1127499, sha256: "24d1f9f9ee47c8d4ea8f88ebfca0b78f46d3e64d26b2dd202ae97cbdcf3ede2b" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 1127507, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 1132117, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 1620701, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 1711625, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 1802609, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 1893589, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 1984461, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 2075441, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 2184077, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 2293161, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 2402209, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 2509909, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 2598017, length: 4947, sha256: "1d32807684d4cf8de017b14f9b1c6faf05c08f04a8d5d19372d4122c0c66b0bf" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 2602964, length: 17344, sha256: "d057298d75e7373e5e2c4d11b7d1bcbea88e03af555ba63d97641c78509c58e4" }
     ];
   }
 });
@@ -59826,7 +60025,7 @@ var init_iap_client = __esm({
   "../store-release/iap-client.ts"() {
     init_register_bundle();
     ASC_ORIGIN = "https://api.appstoreconnect.apple.com";
-    MAX_PAGES = 50;
+    MAX_PAGES = 100;
     MAX_READ_ATTEMPTS = 4;
     REQUEST_TIMEOUT_MS = 3e4;
     MAX_RETRY_WAIT_MS = 6e4;
@@ -59985,6 +60184,9 @@ var init_iap_client = __esm({
 });
 
 // ../store-release/iap-api.ts
+function appleProductType(type) {
+  return APPLE_PRODUCT_TYPES[type];
+}
 function single(doc) {
   return doc.data && !Array.isArray(doc.data) ? doc.data : void 0;
 }
@@ -60038,10 +60240,12 @@ async function readOptional(read) {
 function createIapApi(client2) {
   return new AppStoreConnectIapApi(client2);
 }
-var INITIAL_PRICE_REF, PAGE, linkage, related, enc, AppStoreConnectIapApi;
+var APPLE_PRODUCT_TYPES, PRICE_POINT_PAGE, INITIAL_PRICE_REF, PAGE, linkage, related, enc, AppStoreConnectIapApi;
 var init_iap_api = __esm({
   "../store-release/iap-api.ts"() {
     init_iap_client();
+    APPLE_PRODUCT_TYPES = { nonConsumable: "NON_CONSUMABLE", consumable: "CONSUMABLE" };
+    PRICE_POINT_PAGE = "limit=8000";
     INITIAL_PRICE_REF = "${initial-price}";
     PAGE = "limit=200";
     linkage = (type, id) => ({ type, id });
@@ -60078,7 +60282,7 @@ var init_iap_api = __esm({
         return (await this.client.list(`/v1/inAppPurchaseVersions/${enc(versionId)}/localizations?${PAGE}`)).map(toLocalization);
       }
       async listPricePoints(resourceId, territory) {
-        const points = await this.client.list(`/v2/inAppPurchases/${enc(resourceId)}/pricePoints?filter[territory]=${enc(territory)}&${PAGE}`);
+        const points = await this.client.list(`/v2/inAppPurchases/${enc(resourceId)}/pricePoints?filter[territory]=${enc(territory)}&${PRICE_POINT_PAGE}`);
         return points.map((p) => ({ id: p.id, customerPrice: attr(p, "customerPrice") }));
       }
       async readPriceSchedule(resourceId) {
@@ -60107,7 +60311,7 @@ var init_iap_api = __esm({
         const attributes = {
           name: product.referenceName,
           productId: product.productId,
-          inAppPurchaseType: "NON_CONSUMABLE",
+          inAppPurchaseType: appleProductType(product.type),
           familySharable: false,
           ...product.reviewNote ? { reviewNote: product.reviewNote } : {}
         };
@@ -60191,11 +60395,13 @@ function readLocalizations(reader, item, path2) {
   const localizations = reader.list(item, "localizations", path2).map((value, i) => {
     const at2 = `${path2}.localizations[${i}]`;
     const obj3 = reader.object(value, at2, LOCALIZATION_KEYS);
-    return {
-      locale: reader.text(obj3, "locale", at2, LOCALE),
-      name: reader.text(obj3, "name", at2),
-      description: reader.text(obj3, "description", at2)
-    };
+    const name = reader.text(obj3, "name", at2);
+    const length = [...name].length;
+    const { min, max } = APPLE_LIMITS.displayName;
+    if (name && (length < min || length > max)) reader.problems.push(`${at2}.name must be ${min}\u2013${max} characters (got ${length})`);
+    const description = reader.text(obj3, "description", at2);
+    reader.maxLength(description, `${at2}.description`, APPLE_LIMITS.description);
+    return { locale: reader.text(obj3, "locale", at2, LOCALE), name, description };
   });
   reader.duplicates(localizations.map((l) => l.locale), `${path2}.localizations`, "locale");
   return localizations;
@@ -60203,10 +60409,12 @@ function readLocalizations(reader, item, path2) {
 function readPrice(reader, item, path2) {
   const at2 = `${path2}.price`;
   const obj3 = reader.object(item.price, at2, PRICE_KEYS);
+  const rule = obj3.rule === void 0 ? void 0 : reader.oneOf(obj3, "rule", at2, PRICE_RULES, "exact matches Apple's price exactly; atLeast takes the next Apple price point up");
   return {
     baseTerritory: reader.text(obj3, "baseTerritory", at2, TERRITORY),
     currency: reader.text(obj3, "currency", at2, CURRENCY),
-    amount: reader.text(obj3, "amount", at2, AMOUNT)
+    amount: reader.text(obj3, "amount", at2, AMOUNT),
+    ...rule ? { rule } : {}
   };
 }
 function readTerritories(reader, item, path2, baseTerritory) {
@@ -60218,34 +60426,66 @@ function readTerritories(reader, item, path2, baseTerritory) {
   }
   return territories;
 }
+function readWixEntity(reader, value, at2) {
+  const obj3 = reader.object(value, at2, WIX_KEYS);
+  return { entityType: reader.text(obj3, "entityType", at2), entityId: reader.text(obj3, "entityId", at2) };
+}
+function readUnlocks(reader, obj3, path2) {
+  return reader.list(obj3, "unlocks", path2).map((value, i) => {
+    const at2 = `${path2}.unlocks[${i}]`;
+    const unlock = reader.object(value, at2, UNLOCK_KEYS);
+    return { entityType: reader.text(unlock, "entityType", at2), entityId: reader.text(unlock, "entityId", at2), entitlement: reader.text(unlock, "entitlement", at2) };
+  });
+}
+function readSubject(reader, obj3, path2, type) {
+  if (obj3.wix === void 0 === (obj3.unlocks === void 0)) {
+    reader.problems.push(`${path2} must name exactly one of "wix" or "unlocks"`);
+    return {};
+  }
+  if (obj3.wix !== void 0) return { wix: readWixEntity(reader, obj3.wix, `${path2}.wix`) };
+  if (type !== "consumable") reader.problems.push(`${path2}: only a consumable may carry "unlocks" \u2014 a non-consumable sells exactly one Wix item`);
+  return { unlocks: readUnlocks(reader, obj3, path2) };
+}
+function limitedText(reader, obj3, key2, path2, max, rule) {
+  const value = reader.text(obj3, key2, path2, rule);
+  reader.maxLength(value, childPath(path2, key2), max);
+  return value;
+}
 function readItem(reader, value, index) {
   const path2 = `items[${index}]`;
   const obj3 = reader.object(value, path2, ITEM_KEYS);
-  const wix = reader.object(obj3.wix, `${path2}.wix`, WIX_KEYS);
+  const type = reader.oneOf(obj3, "type", path2, PRODUCT_TYPES, "subscriptions are not supported by this version");
   const price = readPrice(reader, obj3, path2);
   const reviewNote = reader.optionalText(obj3, "reviewNote", path2);
+  if (reviewNote) reader.maxLength(reviewNote, `${path2}.reviewNote`, APPLE_LIMITS.reviewNote);
   return {
-    wix: { entityType: reader.text(wix, "entityType", `${path2}.wix`), entityId: reader.text(wix, "entityId", `${path2}.wix`) },
+    ...readSubject(reader, obj3, path2, type),
     classification: reader.literal(obj3, "classification", path2, "digital", "physical goods and unclassified products are never registered as in-app purchases"),
     entitlement: reader.text(obj3, "entitlement", path2),
-    productId: reader.text(obj3, "productId", path2, PRODUCT_ID),
-    type: reader.literal(obj3, "type", path2, "nonConsumable", "other product types are not supported by this version"),
-    referenceName: reader.text(obj3, "referenceName", path2),
+    productId: limitedText(reader, obj3, "productId", path2, APPLE_LIMITS.productId, PRODUCT_ID),
+    type,
+    referenceName: limitedText(reader, obj3, "referenceName", path2, APPLE_LIMITS.referenceName),
     ...reviewNote === void 0 ? {} : { reviewNote },
     localizations: readLocalizations(reader, obj3, path2),
     price,
     territories: readTerritories(reader, obj3, path2, price.baseTerritory)
   };
 }
+function wixEntitiesOf(item) {
+  return item.unlocks ?? (item.wix ? [item.wix] : []);
+}
 function reportDuplicateMappings(reader, items) {
   reader.duplicates(items.map((i) => i.productId), "items", "productId");
-  reader.duplicates(items.map((i) => `${i.wix.entityType}:${i.wix.entityId}`), "items", "Wix entity");
-  reader.duplicates(items.map((i) => i.entitlement), "items", "entitlement");
+  reader.duplicates(items.flatMap((i) => wixEntitiesOf(i).map((e) => `${e.entityType}:${e.entityId}`)), "items", "Wix entity");
+  reader.duplicates(items.flatMap((i) => [i.entitlement, ...(i.unlocks ?? []).map((u) => u.entitlement)]), "items", "entitlement");
   reader.duplicates(items.map((i) => i.referenceName), "items", "referenceName");
 }
+function looksLikeCredential(text8) {
+  return CREDENTIAL_SHAPES.some((shape) => shape.test(text8));
+}
 function reportCredentialMaterial(reader, value, path2) {
   if (typeof value === "string") {
-    if (CREDENTIAL_SHAPES.some((shape) => shape.test(value))) {
+    if (looksLikeCredential(value)) {
       reader.problems.push(`${path2} looks like credential material \u2014 keys and tokens never belong in a manifest`);
     }
   } else if (Array.isArray(value)) {
@@ -60288,7 +60528,7 @@ function sha256Digest(value) {
 function manifestDigest(manifest) {
   return sha256Digest(manifest);
 }
-var IapManifestError, APPLE_APP_ID, TEAM_ID, BUNDLE_ID, PRODUCT_ID, TERRITORY, CURRENCY, AMOUNT, LOCALE, CREDENTIAL_SHAPES, MANIFEST_KEYS, TARGET_KEYS, ITEM_KEYS, WIX_KEYS, LOCALIZATION_KEYS, PRICE_KEYS, childPath, ManifestReader;
+var IapManifestError, APPLE_APP_ID, TEAM_ID, BUNDLE_ID, PRODUCT_ID, TERRITORY, CURRENCY, AMOUNT, LOCALE, CREDENTIAL_SHAPES, MANIFEST_KEYS, TARGET_KEYS, ITEM_KEYS, WIX_KEYS, UNLOCK_KEYS, LOCALIZATION_KEYS, PRICE_KEYS, PRODUCT_TYPES, PRICE_RULES, APPLE_LIMITS, childPath, ManifestReader;
 var init_iap_manifest = __esm({
   "../store-release/iap-manifest.ts"() {
     IapManifestError = class extends Error {
@@ -60302,7 +60542,7 @@ var init_iap_manifest = __esm({
     APPLE_APP_ID = { pattern: /^\d+$/, hint: "the numeric App Store Connect app id" };
     TEAM_ID = { pattern: /^[A-Z0-9]{10}$/, hint: "a 10-character Apple team id" };
     BUNDLE_ID = { pattern: /^[A-Za-z0-9.-]+$/, hint: "a bundle id" };
-    PRODUCT_ID = { pattern: /^[A-Za-z0-9._]+$/, hint: "alphanumerics, underscores and periods only" };
+    PRODUCT_ID = { pattern: /^[A-Za-z0-9._-]+$/, hint: "letters, digits, hyphens, periods and underscores only" };
     TERRITORY = { pattern: /^[A-Z]{3}$/, hint: "an ISO 3166-1 alpha-3 territory code such as USA" };
     CURRENCY = { pattern: /^[A-Z]{3}$/, hint: "an ISO 4217 currency code such as USD" };
     AMOUNT = { pattern: /^\d+(\.\d+)?$/, hint: 'an exact decimal string such as "0.99"' };
@@ -60316,6 +60556,7 @@ var init_iap_manifest = __esm({
     TARGET_KEYS = ["himiApp", "wixSiteId", "appleAppId", "bundleId", "teamId", "profile"];
     ITEM_KEYS = [
       "wix",
+      "unlocks",
       "classification",
       "entitlement",
       "productId",
@@ -60327,8 +60568,12 @@ var init_iap_manifest = __esm({
       "territories"
     ];
     WIX_KEYS = ["entityType", "entityId"];
+    UNLOCK_KEYS = ["entityType", "entityId", "entitlement"];
     LOCALIZATION_KEYS = ["locale", "name", "description"];
-    PRICE_KEYS = ["baseTerritory", "currency", "amount"];
+    PRICE_KEYS = ["baseTerritory", "currency", "amount", "rule"];
+    PRODUCT_TYPES = ["nonConsumable", "consumable"];
+    PRICE_RULES = ["exact", "atLeast"];
+    APPLE_LIMITS = { displayName: { min: 2, max: 30 }, description: 45, referenceName: 64, productId: 100, reviewNote: 4e3 };
     childPath = (path2, key2) => path2 ? `${path2}.${key2}` : key2;
     ManifestReader = class {
       problems = [];
@@ -60368,6 +60613,15 @@ var init_iap_manifest = __esm({
         if (obj3[key2] !== expected) this.problems.push(`${childPath(path2, key2)} must be ${JSON.stringify(expected)} \u2014 ${why}`);
         return expected;
       }
+      oneOf(obj3, key2, path2, allowed2, why) {
+        const value = obj3[key2];
+        if (allowed2.includes(value)) return value;
+        this.problems.push(`${childPath(path2, key2)} must be ${allowed2.map((a) => JSON.stringify(a)).join(" or ")} \u2014 ${why}`);
+        return allowed2[0];
+      }
+      maxLength(value, at2, max) {
+        if ([...value].length > max) this.problems.push(`${at2} must be at most ${max} characters (got ${[...value].length})`);
+      }
       duplicates(values, path2, what) {
         const seen = /* @__PURE__ */ new Set();
         for (const value of values) {
@@ -60379,6 +60633,84 @@ var init_iap_manifest = __esm({
   }
 });
 
+// ../store-release/iap-pricing.ts
+function normalizeAmount(amount) {
+  const [whole, fraction = ""] = amount.trim().split(".");
+  const integer = whole.replace(/^0+(?=\d)/, "");
+  const decimals = fraction.replace(/0+$/, "");
+  return decimals ? `${integer}.${decimals}` : integer;
+}
+function compareAmounts(a, b) {
+  const [aWhole, aFraction = ""] = normalizeAmount(a).split(".");
+  const [bWhole, bFraction = ""] = normalizeAmount(b).split(".");
+  if (aWhole.length !== bWhole.length) return aWhole.length - bWhole.length;
+  if (aWhole !== bWhole) return aWhole < bWhole ? -1 : 1;
+  const width = Math.max(aFraction.length, bFraction.length);
+  const [x, y] = [aFraction.padEnd(width, "0"), bFraction.padEnd(width, "0")];
+  return x === y ? 0 : x < y ? -1 : 1;
+}
+function pickPoint(points, price) {
+  if (price.rule !== "atLeast") return points.find((p) => compareAmounts(p.customerPrice, price.amount) === 0);
+  return points.filter((p) => compareAmounts(p.customerPrice, price.amount) >= 0).sort((a, b) => compareAmounts(a.customerPrice, b.customerPrice))[0];
+}
+function nearestPrices(amounts, amount) {
+  const distance = (a) => Math.abs(Number(a) - Number(amount));
+  return [...amounts].sort((a, b) => distance(a) - distance(b)).slice(0, 2).sort(compareAmounts);
+}
+function describeRequestedPrice(price, target) {
+  const where = `${price.currency} in ${price.baseTerritory}`;
+  if (price.rule !== "atLeast") return `${price.amount} ${where}`;
+  return target ? `${target} ${where} (the lowest point at or above ${price.amount})` : `the lowest point at or above ${price.amount} ${where}`;
+}
+function noPricePointMessage(price, amounts) {
+  if (price.rule === "atLeast") {
+    const highest = [...amounts].sort((a, b) => compareAmounts(b, a))[0] ?? "none";
+    return `no Apple price point at or above ${price.amount} ${price.currency} in ${price.baseTerritory} (highest: ${highest}) \u2014 lower the manifest's amount and make a new plan.`;
+  }
+  return `no Apple price point of exactly ${price.amount} ${price.currency} in ${price.baseTerritory} (nearest: ${nearestPrices(amounts, price.amount).join(", ") || "none"}) \u2014 Apple sells only fixed price points; change the manifest's amount (or set price.rule "atLeast") and make a new plan. Nothing is rounded here.`;
+}
+var asPoints, PriceGrid;
+var init_iap_pricing = __esm({
+  "../store-release/iap-pricing.ts"() {
+    asPoints = (amounts) => amounts.map((customerPrice) => ({ customerPrice }));
+    PriceGrid = class {
+      constructor(api2) {
+        this.api = api2;
+      }
+      amounts = /* @__PURE__ */ new Map();
+      async pointsFor(resourceId, territory) {
+        const points = await this.api.listPricePoints(resourceId, territory);
+        this.amounts.set(territory, points.map((p) => p.customerPrice));
+        return points;
+      }
+      /** The amounts Apple offers in a territory, read through `viaResourceId` at most once per run. */
+      async amountsIn(territory, viaResourceId) {
+        const cached3 = this.amounts.get(territory);
+        if (cached3 || !viaResourceId) return cached3;
+        return (await this.pointsFor(viaResourceId, territory)).map((p) => p.customerPrice);
+      }
+      /** The Apple amount a price resolves to; undefined for atLeast until some product can show the grid. */
+      async targetAmount(price, viaResourceId) {
+        if (price.rule !== "atLeast") return price.amount;
+        const amounts = await this.amountsIn(price.baseTerritory, viaResourceId);
+        return amounts && pickPoint(asPoints(amounts), price)?.customerPrice;
+      }
+      /** Plan time: does Apple offer a point for this price? Answered from the cached grid. */
+      async check(price, viaResourceId) {
+        const amounts = await this.amountsIn(price.baseTerritory, viaResourceId) ?? [];
+        const amount = pickPoint(asPoints(amounts), price)?.customerPrice;
+        return amount ? { amount } : { failure: noPricePointMessage(price, amounts) };
+      }
+      /** Apply time: the point to write. Point ids are per product, so this lists the product's own. */
+      async resolve(resourceId, price) {
+        const points = await this.pointsFor(resourceId, price.baseTerritory);
+        const point = pickPoint(points, price);
+        return point ? { point } : { failure: noPricePointMessage(price, points.map((p) => p.customerPrice)) };
+      }
+    };
+  }
+});
+
 // ../store-release/iap-result.ts
 function remainingRequirements(observed) {
   if (!observed) return ["the product does not exist in App Store Connect yet"];
@@ -60391,8 +60723,8 @@ function mappingFor(target, item, appleResourceId) {
     wixSiteId: target.wixSiteId,
     appleAppId: target.appleAppId,
     bundleId: target.bundleId,
-    wixEntityType: item.wix.entityType,
-    wixEntityId: item.wix.entityId,
+    ...item.wix ? { wixEntityType: item.wix.entityType, wixEntityId: item.wix.entityId } : {},
+    ...item.unlocks ? { unlocks: item.unlocks } : {},
     entitlement: item.entitlement,
     appleProductId: item.productId,
     ...appleResourceId ? { appleResourceId } : {},
@@ -60420,7 +60752,7 @@ function itemResult(input) {
         ...observed?.availability ? { observed: observed.availability.territories, availableInNewTerritories: observed.availability.availableInNewTerritories } : {}
       },
       localizations: { requested: item.localizations.map((l) => l.locale), observed: observed?.localizations.map((l) => l.locale) ?? [] },
-      remainingRequirements: remainingRequirements(observed),
+      remainingRequirements: [...input.requirements ?? [], ...remainingRequirements(observed)],
       lastReadAt: input.readAt.toISOString()
     }
   };
@@ -60458,11 +60790,10 @@ var init_iap_result = __esm({
 });
 
 // ../store-release/iap-plan.ts
-function normalizeAmount(amount) {
-  const [whole, fraction = ""] = amount.trim().split(".");
-  const integer = whole.replace(/^0+(?=\d)/, "");
-  const decimals = fraction.replace(/0+$/, "");
-  return decimals ? `${integer}.${decimals}` : integer;
+function priceNote(price, target) {
+  if (price.rule !== "atLeast") return CONDITIONAL_PRICE_NOTE;
+  const where = `${price.currency} in ${price.baseTerritory}`;
+  return target ? `Apple price ${target} ${where} \u2014 the lowest price point at or above ${price.amount}` : `the lowest Apple price point at or above ${price.amount} ${where} is chosen once the product exists`;
 }
 function describeOp(op) {
   return "locale" in op ? `${op.kind} ${op.locale}` : op.kind;
@@ -60563,8 +60894,8 @@ async function observeProduct(api2, product) {
     ...availability ? { availability } : {}
   };
 }
-function priceMatches(observed, requested) {
-  return observed !== void 0 && observed.baseTerritory === requested.baseTerritory && observed.customerPrices.length === 1 && normalizeAmount(observed.customerPrices[0]) === normalizeAmount(requested.amount);
+function priceMatches(observed, requested, target) {
+  return target !== void 0 && observed !== void 0 && observed.baseTerritory === requested.baseTerritory && observed.customerPrices.length === 1 && compareAmounts(observed.customerPrices[0], target) === 0;
 }
 function availabilityMatches(observed, territories) {
   return observed !== void 0 && !observed.availableInNewTerritories && sameSet(observed.territories, territories);
@@ -60576,12 +60907,11 @@ function localizationDiffs(item, observed) {
     return found.name === wanted.name && found.description === wanted.description ? [] : [`localization ${wanted.locale} differs`];
   });
 }
-function priceDiff(item, observed) {
-  if (priceMatches(observed.price, item.price)) return [];
+function priceDiff(item, observed, target) {
+  if (priceMatches(observed.price, item.price, target)) return [];
   if (!observed.price) return ["no price is set"];
   const prices = observed.price.customerPrices.join("/") || "none";
-  const requested = `${item.price.amount} ${item.price.currency} in ${item.price.baseTerritory}`;
-  return [`price is ${prices} in ${observed.price.baseTerritory}; the manifest requests ${requested}`];
+  return [`price is ${prices} in ${observed.price.baseTerritory}; the manifest requests ${describeRequestedPrice(item.price, target)}`];
 }
 function availabilityDiff(item, observed) {
   if (availabilityMatches(observed.availability, item.territories)) return [];
@@ -60589,8 +60919,8 @@ function availabilityDiff(item, observed) {
   const auto = observed.availability.availableInNewTerritories ? " (plus new territories automatically)" : "";
   return [`available in ${observed.availability.territories.join(", ")}${auto}; the manifest requests ${item.territories.join(", ")}`];
 }
-function metadataDiffs(item, observed) {
-  return [...localizationDiffs(item, observed), ...priceDiff(item, observed), ...availabilityDiff(item, observed)];
+function metadataDiffs(item, observed, target = exactTarget(item.price)) {
+  return [...localizationDiffs(item, observed), ...priceDiff(item, observed, target), ...availabilityDiff(item, observed)];
 }
 function isLocked(observed) {
   return !EDITABLE_PRODUCT_STATES.has(observed.state) || observed.versions.some((v) => LOCKED_VERSION_STATES.has(v.state));
@@ -60598,8 +60928,9 @@ function isLocked(observed) {
 function itemPlan(item, decision, fields = {}) {
   return { productId: item.productId, decision, ops: [], conflicts: [], notes: [], ...fields };
 }
-function creationPlan(item) {
+function creationPlan(item, target) {
   return itemPlan(item, "create", {
+    ...target ? { applePrice: target, targetPrice: target } : {},
     ops: [
       { kind: "createProduct" },
       { kind: "createVersion" },
@@ -60607,17 +60938,20 @@ function creationPlan(item) {
       { kind: "setPrice" },
       { kind: "setAvailability" }
     ],
-    notes: [CONDITIONAL_PRICE_NOTE]
+    notes: [priceNote(item.price, target)]
   });
 }
 function identityConflicts(item, observed) {
   const conflicts = [];
-  if (observed.type !== APPLE_NON_CONSUMABLE) conflicts.push(`Apple has ${item.productId} as ${observed.type}; product ids and types are immutable, so it cannot become a non-consumable`);
+  if (observed.type !== appleProductType(item.type)) {
+    const wanted = item.type === "consumable" ? "a consumable" : "a non-consumable";
+    conflicts.push(`Apple has ${item.productId} as ${observed.type}; product ids and types are immutable, so it cannot become ${wanted}`);
+  }
   if (observed.referenceName !== item.referenceName) conflicts.push(`Apple's reference name is "${observed.referenceName}"; the manifest says "${item.referenceName}"`);
   return conflicts;
 }
-function lockedPlan(item, observed) {
-  const diffs = metadataDiffs(item, observed);
+function lockedPlan(item, observed, target) {
+  const diffs = metadataDiffs(item, observed, target);
   if (!diffs.length) return itemPlan(item, "reuse", { observed });
   const conflict = `${item.productId} is ${observed.state} and this command never changes a live or in-review product: ${diffs.join("; ")}`;
   return itemPlan(item, "conflict", { observed, conflicts: [conflict] });
@@ -60633,58 +60967,54 @@ function localizationOps(item, observed) {
     return found.name === wanted.name && found.description === wanted.description ? [] : [{ kind: "updateLocalization", locale: wanted.locale }];
   });
 }
-async function exactPricePoint(api2, resourceId, price) {
-  const points = await api2.listPricePoints(resourceId, price.baseTerritory);
-  const wanted = normalizeAmount(price.amount);
-  const point = points.find((p) => normalizeAmount(p.customerPrice) === wanted);
-  const distance = (p) => Math.abs(Number(p.customerPrice) - Number(price.amount));
-  const nearest = [...points].sort((a, b) => distance(a) - distance(b)).slice(0, 2).map((p) => p.customerPrice).sort((a, b) => Number(a) - Number(b));
-  return { point, nearest };
-}
-function noExactPriceMessage(price, nearest) {
-  return `no Apple price point of exactly ${price.amount} ${price.currency} in ${price.baseTerritory} (nearest: ${nearest.join(", ") || "none"}) \u2014 Apple sells only fixed price points; change the manifest's amount and make a new plan. Nothing is rounded here.`;
-}
-async function priceOps(api2, item, observed) {
+async function priceOps(pricing, item, observed, target) {
   if (observed.price) {
-    return { ops: [], conflicts: priceMatches(observed.price, item.price) ? [] : [`${priceDiff(item, observed)[0]} \u2014 an existing price is never changed here`] };
+    const matches = priceMatches(observed.price, item.price, target);
+    return { ops: [], conflicts: matches ? [] : [`${priceDiff(item, observed, target)[0]} \u2014 an existing price is never changed here`] };
   }
-  const { point, nearest } = await exactPricePoint(api2, observed.resourceId, item.price);
-  return point ? { ops: [{ kind: "setPrice" }], conflicts: [] } : { ops: [], conflicts: [noExactPriceMessage(item.price, nearest)] };
+  const { amount, failure } = await pricing.check(item.price, observed.resourceId);
+  return amount ? { ops: [{ kind: "setPrice" }], conflicts: [], applePrice: amount } : { ops: [], conflicts: [failure ?? "no Apple price point"] };
 }
 function availabilityOps(item, observed) {
   if (!observed.availability) return { ops: [{ kind: "setAvailability" }], conflicts: [] };
   const conflicts = availabilityMatches(observed.availability, item.territories) ? [] : [`${availabilityDiff(item, observed)[0]} \u2014 existing availability is never changed here`];
   return { ops: [], conflicts };
 }
-async function editablePlan(api2, item, observed) {
-  const price = await priceOps(api2, item, observed);
+async function editablePlan(pricing, item, observed, target) {
+  const price = await priceOps(pricing, item, observed, target);
   const availability = availabilityOps(item, observed);
   const conflicts = [...price.conflicts, ...availability.conflicts];
   if (conflicts.length) return itemPlan(item, "conflict", { observed, conflicts });
   const ops = [...localizationOps(item, observed), ...price.ops, ...availability.ops];
-  return itemPlan(item, ops.length ? "update" : "reuse", { observed, ops });
+  return itemPlan(item, ops.length ? "update" : "reuse", { observed, ops, ...price.applePrice ? { applePrice: price.applePrice } : {} });
 }
-async function planForProduct(api2, item, product) {
+async function planForProduct(api2, item, product, pricing) {
   const observed = await observeProduct(api2, product);
+  const target = await pricing.targetAmount(item.price, product.id);
   const conflicts = identityConflicts(item, observed);
-  if (conflicts.length) return itemPlan(item, "conflict", { observed, conflicts });
-  return isLocked(observed) ? lockedPlan(item, observed) : editablePlan(api2, item, observed);
+  const decided = conflicts.length ? itemPlan(item, "conflict", { observed, conflicts }) : isLocked(observed) ? lockedPlan(item, observed, target) : await editablePlan(pricing, item, observed, target);
+  return target ? { ...decided, targetPrice: target } : decided;
 }
-async function planItem(api2, item, products) {
+async function planItem(pricing, api2, item, products) {
   const nameClash = products.find((p) => p.referenceName === item.referenceName && p.productId !== item.productId);
   if (nameClash) return itemPlan(item, "conflict", { conflicts: [`reference name "${item.referenceName}" is already used by ${nameClash.productId}`] });
   const match = products.find((p) => p.productId === item.productId);
-  return match ? planForProduct(api2, item, match) : creationPlan(item);
+  if (match) return planForProduct(api2, item, match, pricing);
+  return creationPlan(item, await pricing.targetAmount(item.price, products[0]?.id));
 }
-async function planItems(context, manifest) {
+async function planItemsAt(context, manifest, indices = manifest.items.map((_, i) => i)) {
+  const pricing = context.pricing ?? new PriceGrid(context.api);
   return withAccessContext(context.identity, manifest.target, async () => {
     await verifyTarget(context.api, manifest, context.identity);
     const products = await discoverProducts(context, manifest);
-    const plans = [];
-    for (const item of manifest.items) plans.push(await planItem(context.api, item, products));
+    const plans = /* @__PURE__ */ new Map();
+    for (const i of indices) plans.set(i, await planItem(pricing, context.api, manifest.items[i], products));
     return plans;
   });
 }
+async function planItems(context, manifest) {
+  return [...(await planItemsAt(context, manifest)).values()];
+}
 function sealPlan(unsealed) {
   const normalized = JSON.parse(JSON.stringify(unsealed));
   return { ...normalized, planDigest: sha256Digest(normalized) };
@@ -60726,26 +61056,32 @@ function verifyPlan2(doc) {
   return plan;
 }
 async function statusIap(manifest, context) {
-  const plans = await planItems(context, manifest);
+  const pricing = context.pricing ?? new PriceGrid(context.api);
+  const plans = await planItems({ ...context, pricing }, manifest);
   const readAt = context.now();
-  const items = plans.map(
-    (p, i) => itemResult({
+  const items = [];
+  for (const [i, p] of plans.entries()) {
+    const item = manifest.items[i];
+    const target = p.observed ? await pricing.targetAmount(item.price, p.observed.resourceId) : void 0;
+    items.push(itemResult({
       target: manifest.target,
-      item: manifest.items[i],
+      item,
       observed: p.observed,
       outcome: STATUS_OUTCOMES[p.decision],
       conflicts: p.conflicts,
-      unmet: p.observed ? metadataDiffs(manifest.items[i], p.observed) : [],
+      unmet: p.observed ? metadataDiffs(item, p.observed, target) : [],
       readAt
-    })
-  );
+    }));
+  }
   return iapResult({ target: manifest.target, identity: context.identity, items, generatedAt: readAt });
 }
-var IapProvisionError, EDITABLE_VERSION_STATE, APPLE_NON_CONSUMABLE, EDITABLE_PRODUCT_STATES, LOCKED_VERSION_STATES, OP_KINDS, LOCALE_OPS, CONDITIONAL_PRICE_NOTE, STATUS_OUTCOMES, isoDay, planError;
+var IapProvisionError, EDITABLE_VERSION_STATE, EDITABLE_PRODUCT_STATES, LOCKED_VERSION_STATES, OP_KINDS, LOCALE_OPS, CONDITIONAL_PRICE_NOTE, STATUS_OUTCOMES, isoDay, exactTarget, planError;
 var init_iap_plan = __esm({
   "../store-release/iap-plan.ts"() {
+    init_iap_api();
     init_iap_client();
     init_iap_manifest();
+    init_iap_pricing();
     init_iap_result();
     IapProvisionError = class extends Error {
       constructor(reason, message) {
@@ -60755,7 +61091,6 @@ var init_iap_plan = __esm({
       }
     };
     EDITABLE_VERSION_STATE = "PREPARE_FOR_SUBMISSION";
-    APPLE_NON_CONSUMABLE = "NON_CONSUMABLE";
     EDITABLE_PRODUCT_STATES = /* @__PURE__ */ new Set(["MISSING_METADATA", "READY_TO_SUBMIT", "DEVELOPER_ACTION_NEEDED", "REJECTED"]);
     LOCKED_VERSION_STATES = /* @__PURE__ */ new Set(["READY_FOR_REVIEW", "WAITING_FOR_REVIEW", "IN_REVIEW", "ACCEPTED", "APPROVED"]);
     OP_KINDS = /* @__PURE__ */ new Set(["createProduct", "createVersion", "createLocalization", "updateLocalization", "setPrice", "setAvailability"]);
@@ -60763,6 +61098,7 @@ var init_iap_plan = __esm({
     CONDITIONAL_PRICE_NOTE = "the exact price point can only be looked up after the product exists \u2014 apply stops with a partial result if Apple has no point of exactly the requested amount";
     STATUS_OUTCOMES = { create: "absent", update: "incomplete", reuse: "reused", conflict: "conflict" };
     isoDay = (date) => date.toISOString().slice(0, 10);
+    exactTarget = (price) => price.rule === "atLeast" ? void 0 : price.amount;
     planError = (message) => new IapProvisionError("plan", message);
   }
 });
@@ -60785,7 +61121,7 @@ function driftOf(planned, live2) {
   return unplanned.length ? `${live2.productId} now needs ${unplanned.map(describeOp).join(", ")}, which the plan did not list` : void 0;
 }
 function assertNoDrift(plan, live2) {
-  const drift = plan.items.map((planned, i) => driftOf(planned, live2[i])).filter((d) => d !== void 0);
+  const drift = [...live2].map(([i, current]) => driftOf(plan.items[i], current)).filter((d) => d !== void 0);
   if (!drift.length) return;
   throw new IapProvisionError("drift", `App Store Connect changed since the plan was made \u2014 nothing was written:
   - ${drift.join("\n  - ")}
@@ -60836,12 +61172,13 @@ async function findLocalization(api2, versionId, locale, matchText) {
   if (!found || matchText && (found.name !== matchText.name || found.description !== matchText.description)) return void 0;
   return found;
 }
-function operationRunners(api2, manifest, sleep) {
+function operationRunners(context, manifest) {
+  const { api: api2, sleep, pricing } = context;
   const appId2 = manifest.target.appleAppId;
   return {
     createProduct: async (run2) => {
       const { item } = run2;
-      const newProduct = { productId: item.productId, referenceName: item.referenceName, ...item.reviewNote ? { reviewNote: item.reviewNote } : {} };
+      const newProduct = { productId: item.productId, referenceName: item.referenceName, type: item.type, ...item.reviewNote ? { reviewNote: item.reviewNote } : {} };
       const { value, state } = await ensure({ write: () => api2.createProduct(appId2, newProduct), find: () => findProduct(api2, appId2, item.productId) }, sleep);
       run2.resourceId = value.id;
       return { state, resourceId: value.id };
@@ -60869,9 +61206,9 @@ function operationRunners(api2, manifest, sleep) {
     setPrice: async (run2) => {
       const resourceId = required(run2.resourceId, "the product id");
       const { price } = run2.item;
-      const { point, nearest } = await exactPricePoint(api2, resourceId, price);
-      if (!point) throw new UnresolvedWriteError(noExactPriceMessage(price, nearest));
-      const matches = async () => priceMatches(await readObservedPrice(api2, resourceId), price) ? true : void 0;
+      const { point, failure } = await pricing.resolve(resourceId, price);
+      if (!point) throw new UnresolvedWriteError(failure ?? "no Apple price point");
+      const matches = async () => priceMatches(await readObservedPrice(api2, resourceId), price, point.customerPrice) ? true : void 0;
       const { state } = await ensure({ write: async () => (await api2.createPriceSchedule(resourceId, price.baseTerritory, point.id), true), find: matches }, sleep);
       return { state };
     },
@@ -60904,10 +61241,10 @@ async function runStep(runner2, run2, op, context, manifest) {
   context.journal.record({ productId: run2.item.productId, ...run2.resourceId ? { productResourceId: run2.resourceId } : {}, ...entry, at: context.now().toISOString() });
   return step;
 }
-async function resumeFromApple(run2, remaining, api2) {
-  const product = await api2.readProduct(required(run2.resourceId, "the product id"));
+async function resumeFromApple(run2, remaining, context) {
+  const product = await context.api.readProduct(required(run2.resourceId, "the product id"));
   if (!product) return { reason: "the product exists but cannot be read back yet \u2014 rerun apply later" };
-  const replanned = await planForProduct(api2, run2.item, product);
+  const replanned = await planForProduct(context.api, run2.item, product, context.pricing);
   if (replanned.decision === "conflict") return { reason: `the product already existed: ${replanned.conflicts.join("; ")}` };
   const unplanned = replanned.ops.filter((op) => !remaining.some((r) => sameOp(r, op)));
   if (unplanned.length) return { reason: `the product already existed and needs ${unplanned.map(describeOp).join(", ")}, which the plan did not list \u2014 make a new plan` };
@@ -60916,7 +61253,7 @@ async function resumeFromApple(run2, remaining, api2) {
   return { ops: replanned.ops };
 }
 async function runOps(run2, ops, context, manifest) {
-  const runners = operationRunners(context.api, manifest, context.sleep);
+  const runners = operationRunners(context, manifest);
   const steps = [];
   let queue = [...ops];
   for (let op = queue.shift(); op; op = queue.shift()) {
@@ -60924,7 +61261,7 @@ async function runOps(run2, ops, context, manifest) {
     steps.push(step);
     if (step.state === "failed") return [...steps, ...queue.map((rest) => stepFor(rest, "notRun"))];
     if (op.kind === "createProduct" && step.state === "reconciled") {
-      const resumed = await resumeFromApple(run2, queue, context.api).catch((e) => ({ reason: `could not re-read the product: ${explainFailure(e, context, manifest)}` }));
+      const resumed = await resumeFromApple(run2, queue, context).catch((e) => ({ reason: `could not re-read the product: ${explainFailure(e, context, manifest)}` }));
       if ("reason" in resumed) return [...steps, ...queue.map((rest, i) => stepFor(rest, "notRun", i === 0 ? { detail: resumed.reason } : {}))];
       queue = resumed.ops;
     }
@@ -60947,10 +61284,17 @@ async function readBack(run2, context, manifest) {
     return { failure: explainFailure(e, context, manifest) };
   }
 }
+async function unmetFor(item, observed, context) {
+  return observed ? metadataDiffs(item, observed, await context.pricing.targetAmount(item.price, observed.resourceId)) : [];
+}
+async function knownUnmetFor(item, planned, context) {
+  if (!planned.observed) return [];
+  return metadataDiffs(item, planned.observed, planned.targetPrice ?? await context.pricing.targetAmount(item.price));
+}
 async function applyItem(item, live2, context, manifest) {
   const base = { target: manifest.target, item, readAt: context.now() };
   if (live2.decision === "conflict") {
-    const unmet2 = live2.observed ? metadataDiffs(item, live2.observed) : [];
+    const unmet2 = await knownUnmetFor(item, live2, context);
     return itemResult({ ...base, observed: live2.observed, outcome: "conflict", conflicts: live2.conflicts, unmet: unmet2 });
   }
   const run2 = {
@@ -60961,29 +61305,55 @@ async function applyItem(item, live2, context, manifest) {
   };
   const steps = await runOps(run2, live2.ops, context, manifest);
   const { observed, failure } = await readBack(run2, context, manifest);
-  const unmet = failure ? [`could not read the product back: ${failure}`] : observed ? metadataDiffs(item, observed) : [];
+  const unmet = failure ? [`could not read the product back: ${failure}`] : await unmetFor(item, observed, context);
   const outcome = outcomeOf(live2.ops, steps, unmet);
   return itemResult({ ...base, readAt: context.now(), observed, outcome, steps, unmet, appleResourceId: run2.resourceId });
 }
-function effectivePlan(planned, live2) {
-  return planned.decision === "conflict" ? { ...live2, decision: "conflict", ops: [], conflicts: planned.conflicts } : live2;
+function deferredResult(item, live2, context, manifest) {
+  const steps = live2.ops.map((op) => stepFor(op, "notRun"));
+  return itemResult({ target: manifest.target, item, observed: live2.observed, outcome: "deferred", steps, requirements: [DEFERRED_REQUIREMENT], readAt: context.now() });
+}
+function needsRefresh(planned) {
+  return planned.decision !== "conflict" && planned.ops.length > 0;
 }
-async function applyIap(planDoc, context) {
+function plannedResult(item, planned, plan, context, manifest) {
+  if (planned.decision === "conflict") return applyItem(item, planned, context, manifest);
+  return itemResult({ target: manifest.target, item, observed: planned.observed, outcome: "reused", readAt: new Date(plan.createdAt) });
+}
+async function applyIap(planDoc, applyContext) {
   const plan = verifyPlan2(planDoc);
-  assertSameAccount(plan.identity, context.identity);
+  assertSameAccount(plan.identity, applyContext.identity);
+  const context = { ...applyContext, pricing: applyContext.pricing ?? new PriceGrid(applyContext.api) };
   const manifest = plan.manifest;
-  const live2 = await planItems(context, manifest);
+  const refresh = plan.items.flatMap((planned, i) => needsRefresh(planned) ? [i] : []);
+  const live2 = await planItemsAt(context, manifest, refresh);
   assertNoDrift(plan, live2);
   const items = [];
-  for (const [i, item] of manifest.items.entries()) items.push(await applyItem(item, effectivePlan(plan.items[i], live2[i]), context, manifest));
+  let created = 0;
+  for (const [i, item] of manifest.items.entries()) {
+    const itemPlan2 = live2.get(i);
+    if (!itemPlan2) {
+      items.push(await plannedResult(item, plan.items[i], plan, context, manifest));
+      continue;
+    }
+    const needsCreate = itemPlan2.ops.some((op) => op.kind === "createProduct");
+    if (needsCreate && context.createLimit !== void 0 && created >= context.createLimit) {
+      items.push(deferredResult(item, itemPlan2, context, manifest));
+      continue;
+    }
+    if (needsCreate) created++;
+    items.push(await applyItem(item, itemPlan2, context, manifest));
+  }
   return iapResult({ target: manifest.target, identity: context.identity, items, generatedAt: context.now() });
 }
-var RECONCILE_READS, RECONCILE_BASE_WAIT_MS, AMBIGUOUS_WRITE_KINDS, UnresolvedWriteError, required;
+var DEFERRED_REQUIREMENT, RECONCILE_READS, RECONCILE_BASE_WAIT_MS, AMBIGUOUS_WRITE_KINDS, UnresolvedWriteError, required;
 var init_iap_apply = __esm({
   "../store-release/iap-apply.ts"() {
     init_iap_client();
     init_iap_plan();
+    init_iap_pricing();
     init_iap_result();
+    DEFERRED_REQUIREMENT = "deferred by --limit \u2014 rerun apply to continue; nothing was written for this product in this run";
     RECONCILE_READS = 4;
     RECONCILE_BASE_WAIT_MS = 1e3;
     AMBIGUOUS_WRITE_KINDS = /* @__PURE__ */ new Set(["uncertain", "rateLimited", "conflict"]);
@@ -61184,6 +61554,182 @@ var init_iap_credentials = __esm({
   }
 });
 
+// ../store-release/iap-draft.ts
+import { createHash as createHash33 } from "node:crypto";
+function fit(text8, max) {
+  const chars = [...text8];
+  return chars.length <= max ? text8 : `${chars.slice(0, max - 1).join("").trimEnd()}${ELLIPSIS}`;
+}
+function plainText2(html) {
+  return html.replace(/<[^>]*>/g, " ").replace(/&(amp|nbsp|lt|gt|quot|#39);/g, (entity) => ENTITIES[entity]).replace(/\s+/g, " ").trim();
+}
+function displayName(name) {
+  const plain2 = plainText2(name);
+  return fit([...plain2].length >= APPLE_LIMITS.displayName.min ? plain2 : `${plain2} item`, APPLE_LIMITS.displayName.max);
+}
+function boundedProductId(bundleId, slug, tail, hashSource) {
+  const readable = `${bundleId}.${slug}.${tail}`;
+  if (tail && readable.length <= APPLE_LIMITS.productId) return readable;
+  const suffix = `.${slug}.${sha(hashSource).slice(0, 24)}`;
+  return `${bundleId.slice(0, APPLE_LIMITS.productId - suffix.length)}${suffix}`;
+}
+function productIdFor(bundleId, slug, wixId) {
+  return boundedProductId(bundleId, slug, wixId.toLowerCase().replace(/[^a-z0-9]/g, ""), wixId);
+}
+function applePointFor(amount, options) {
+  if (!options.applePrices) return void 0;
+  const price = { baseTerritory: options.baseTerritory, currency: options.currency, amount, rule: "atLeast" };
+  return pickPoint(options.applePrices.map((customerPrice) => ({ customerPrice })), price)?.customerPrice;
+}
+function highestApplePrice(options) {
+  return [...options.applePrices ?? []].sort((a, b) => Number(b) - Number(a))[0] ?? "none";
+}
+function skipReason(item, options) {
+  if (item.hidden) return "hidden in the Wix catalog (unpublished, archived or not visible)";
+  if (item.kind !== "digital") return SKIP_REASONS[item.kind];
+  if (!item.price || normalizeAmount(item.price.amount) === "0") return "free \u2014 there is nothing to sell";
+  if (item.price.currency !== options.currency) {
+    return `priced in ${item.price.currency}; the base territory ${options.baseTerritory} prices in ${options.currency}`;
+  }
+  if (options.applePrices && !applePointFor(item.price.amount, options)) {
+    return `priced above Apple's highest price point (${highestApplePrice(options)} ${options.currency}) in ${options.baseTerritory}`;
+  }
+  if ([item.name, item.description ?? ""].some(looksLikeCredential)) return "its name or description looks like a credential \u2014 fix the text in Wix";
+  return void 0;
+}
+function priceFor(amount, options) {
+  return { baseTerritory: options.baseTerritory, currency: options.currency, amount: normalizeAmount(amount), rule: "atLeast" };
+}
+function perItemProduct(item, options, names) {
+  const plainDescription = item.description ? plainText2(item.description) : "";
+  const name = nameOf(item);
+  return {
+    wix: { entityType: item.source, entityId: item.id },
+    classification: "digital",
+    entitlement: entityKey(item.source, item.id),
+    productId: productIdFor(options.target.bundleId, SOURCE_SLUGS[item.source], item.id),
+    type: "nonConsumable",
+    referenceName: names.claim(name, item.id),
+    localizations: [{ locale: options.locale, name: displayName(name), description: fit(plainDescription || `Unlock ${name}`, APPLE_LIMITS.description) }],
+    price: priceFor(item.price.amount, options),
+    territories: options.territories
+  };
+}
+function tierKey(amount, currency) {
+  return `${currency.toLowerCase()}_${normalizeAmount(amount).replace(".", "_")}`;
+}
+function unlockFor(item) {
+  return { entityType: item.source, entityId: item.id, entitlement: entityKey(item.source, item.id) };
+}
+function tierPrice(amount, applePoint, options) {
+  if (!applePoint) return priceFor(amount, options);
+  return { baseTerritory: options.baseTerritory, currency: options.currency, amount: normalizeAmount(applePoint) };
+}
+function newTier(key2, price, options, names) {
+  const label2 = `${price.amount} ${options.currency}`;
+  return {
+    unlocks: [],
+    classification: "digital",
+    entitlement: `tier:${key2}`,
+    productId: tierProductId(options, key2),
+    type: "consumable",
+    referenceName: names.claim(`Credit ${label2}`, key2),
+    localizations: [{ locale: options.locale, name: displayName(`Unlock (${label2})`), description: TIER_DESCRIPTION }],
+    price,
+    territories: options.territories
+  };
+}
+function draftTiers(items, options, names, existingItems) {
+  const byProductId = new Map(existingItems.map((i) => [i.productId, i]));
+  const created = [];
+  for (const item of items) {
+    const applePoint = applePointFor(item.price.amount, options);
+    const price = tierPrice(item.price.amount, applePoint, options);
+    const key2 = tierKey(price.amount, options.currency);
+    const productId = tierProductId(options, key2);
+    let tier = byProductId.get(productId);
+    if (!tier) {
+      tier = newTier(key2, price, options, names);
+      byProductId.set(productId, tier);
+      created.push(tier);
+    }
+    tier.unlocks = [...tier.unlocks ?? [], unlockFor(item)];
+  }
+  return created;
+}
+function draftManifest(catalog, options) {
+  const existingItems = structuredClone(options.existing?.items ?? []);
+  const mapped = new Set(existingItems.flatMap((i) => wixEntitiesOf(i).map((e) => entityKey(e.entityType, e.entityId))));
+  const names = new ReferenceNames(existingItems);
+  const skipped = [];
+  const toDraft = [];
+  let kept = 0;
+  for (const item of catalog) {
+    if (mapped.has(entityKey(item.source, item.id))) kept++;
+    else {
+      const reason = skipReason(item, options);
+      if (reason) skipped.push({ source: item.source, id: item.id, name: item.name, reason });
+      else toDraft.push(item);
+    }
+  }
+  const drafted = options.mode === "tiers" ? draftTiers(toDraft, options, names, existingItems) : toDraft.map((item) => perItemProduct(item, options, names));
+  const items = [...existingItems, ...drafted];
+  const newlyMapped = toDraft.length;
+  if (!items.length) return { skipped, kept, newlyMapped };
+  const manifest = { manifestVersion: 1, target: options.target, items };
+  return { manifest: parseIapManifest(JSON.stringify(manifest), "the drafted manifest"), skipped, kept, newlyMapped };
+}
+var SOURCE_SLUGS, SKIP_REASONS, TIER_DESCRIPTION, ELLIPSIS, entityKey, sha, ENTITIES, MAX_SUFFIX, ReferenceNames, nameOf, tierProductId;
+var init_iap_draft = __esm({
+  "../store-release/iap-draft.ts"() {
+    init_iap_manifest();
+    init_iap_pricing();
+    SOURCE_SLUGS = { storesProduct: "product", onlineProgram: "program", pricingPlan: "plan" };
+    SKIP_REASONS = {
+      physical: "physical goods are never sold through in-app purchase",
+      subscription: "a recurring plan needs an App Store subscription, which this version does not register",
+      unknown: "the catalog does not say whether it is digital"
+    };
+    TIER_DESCRIPTION = "Unlocks one item in the app";
+    ELLIPSIS = "\u2026";
+    entityKey = (entityType, entityId) => `${entityType}:${entityId}`;
+    sha = (text8) => createHash33("sha256").update(text8).digest("hex");
+    ENTITIES = { "&amp;": "&", "&nbsp;": " ", "&lt;": "<", "&gt;": ">", "&quot;": '"', "&#39;": "'" };
+    MAX_SUFFIX = 24;
+    ReferenceNames = class {
+      taken = /* @__PURE__ */ new Set();
+      constructor(existing) {
+        for (const item of existing) this.taken.add(item.referenceName);
+      }
+      /** The name itself, else name · id prefix, lengthening the prefix (then a hash, then counting) until unused. */
+      claim(name, disambiguator) {
+        const plain2 = plainText2(name);
+        for (const suffix of this.suffixes(disambiguator)) {
+          const room = Math.max(1, APPLE_LIMITS.referenceName - suffix.length - 3);
+          const candidate = suffix ? `${fit(plain2, room)} \xB7 ${suffix}` : fit(plain2, APPLE_LIMITS.referenceName);
+          if (!this.taken.has(candidate)) {
+            this.taken.add(candidate);
+            return candidate;
+          }
+        }
+        throw new Error(`could not find a unique reference name for "${plain2}"`);
+      }
+      /** Suffixes stay short (at most MAX_SUFFIX characters) so the name keeps room within Apple's 64. */
+      *suffixes(disambiguator) {
+        yield "";
+        const compact = disambiguator.replace(/[^A-Za-z0-9]/g, "");
+        for (let length = 8; length < Math.min(compact.length, MAX_SUFFIX); length += 4) yield compact.slice(0, length);
+        if (compact.length <= MAX_SUFFIX) yield compact;
+        const hash = sha(disambiguator).slice(0, 12);
+        yield hash;
+        for (let n = 2; n < 1e4; n++) yield `${hash}-${n}`;
+      }
+    };
+    nameOf = (item) => plainText2(item.name) || item.id;
+    tierProductId = (options, key2) => boundedProductId(options.target.bundleId, "tier", key2, key2);
+  }
+});
+
 // src/base44-analyze/redact.ts
 function isSecretKey(key2) {
   const words = key2.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
@@ -61267,6 +61813,161 @@ var init_redact = __esm({
   }
 });
 
+// src/store-iap-catalog.ts
+function amountText(value) {
+  if (typeof value === "number" && Number.isFinite(value)) return String(value);
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function priceOf(amount, currency) {
+  const text8 = amountText(amount);
+  return text8 && typeof currency === "string" && currency ? { amount: text8, currency } : void 0;
+}
+function catalogItem(fields) {
+  return Object.fromEntries(Object.entries(fields).filter(([, v]) => v !== void 0 && v !== "" && v !== false));
+}
+function productKind(productType) {
+  const type = String(productType ?? "").toLowerCase();
+  return type === "digital" || type === "physical" ? type : "unknown";
+}
+async function allByCursor(wix, path2, key2, extra = {}) {
+  const rows = [];
+  let cursor;
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const cursorPaging = cursor ? { limit: PAGE2, cursor } : { limit: PAGE2 };
+    const res = await withRetry(path2, () => wix("POST", path2, { ...extra, query: { cursorPaging } }));
+    rows.push(...res[key2] ?? []);
+    cursor = res.pagingMetadata?.cursors?.next;
+    if (!cursor) return rows;
+  }
+  throw new Error(`${path2} had more than ${MAX_PAGES2} pages \u2014 refusing to draft from a partial catalog`);
+}
+async function allByOffset(fetchPage, label2) {
+  const rows = [];
+  for (let page = 0; page < MAX_PAGES2; page++) {
+    const { rows: batch, total } = await withRetry(label2, () => fetchPage(rows.length));
+    rows.push(...batch);
+    const done = batch.length === 0 || (total !== void 0 ? rows.length >= total : batch.length < PAGE2);
+    if (done) return rows;
+  }
+  throw new Error(`${label2} had more than ${MAX_PAGES2} pages \u2014 refusing to draft from a partial catalog`);
+}
+function fromV3Product(p) {
+  return catalogItem({
+    source: "storesProduct",
+    id: p.id,
+    name: p.name || p.id,
+    description: p.plainDescription,
+    kind: productKind(p.productType),
+    price: priceOf(p.actualPriceRange?.minValue?.amount, p.currency),
+    hidden: p.visible === false || void 0
+  });
+}
+function fromV1Product(p) {
+  return catalogItem({
+    source: "storesProduct",
+    id: p.id,
+    name: p.name || p.id,
+    description: typeof p.description === "string" ? p.description : void 0,
+    kind: productKind(p.productType),
+    price: priceOf(p.priceData?.price ?? p.price?.price, p.priceData?.currency ?? p.price?.currency),
+    hidden: p.visible === false || void 0
+  });
+}
+async function readStores(wix, notes) {
+  try {
+    return (await allByCursor(wix, "/stores/v3/products/query", "products", { fields: ["CURRENCY", "PLAIN_DESCRIPTION"] })).map(fromV3Product);
+  } catch (e) {
+    if (isNotInstalled2(e)) return notInstalled(notes, "Wix Stores");
+    if (!isWrongCatalogVersion(e)) throw e;
+  }
+  notes.push("Wix Stores uses Catalog V1 on this site; read through the V1 product query.");
+  try {
+    const rows = await allByOffset(async (offset) => {
+      const res = await wix("POST", "/stores/v1/products/query", { query: { paging: { limit: PAGE2, offset } } });
+      return { rows: res.products ?? [], total: res.totalResults };
+    }, "/stores/v1/products/query");
+    return rows.map(fromV1Product);
+  } catch (e) {
+    if (isNotInstalled2(e)) return notInstalled(notes, "Wix Stores");
+    throw e;
+  }
+}
+function notInstalled(notes, vertical) {
+  notes.push(`${vertical} is not installed on this site.`);
+  return [];
+}
+function fromProgram(p) {
+  return catalogItem({
+    source: "onlineProgram",
+    id: p.id,
+    name: p.description?.title || p.id,
+    description: p.description?.details,
+    kind: "digital",
+    price: priceOf(p.price?.value, p.price?.currency),
+    hidden: p.status && p.status !== "PUBLISHED" || void 0
+  });
+}
+async function readPrograms(wix, notes) {
+  let listed;
+  try {
+    listed = await allByCursor(wix, "/online-programs/v3/programs/query", "programs");
+  } catch (e) {
+    if (isNotInstalled2(e)) return notInstalled(notes, "Online Programs");
+    throw e;
+  }
+  const full = await mapLimit(
+    listed,
+    PROGRAM_READ_CONCURRENCY,
+    (p) => withRetry(`program ${p.id}`, () => wix("GET", `/online-programs/v3/programs/${encodeURIComponent(p.id)}`))
+  );
+  return full.map((res) => fromProgram(res.program ?? {}));
+}
+function planKind(pricing) {
+  if (pricing?.singlePaymentUnlimited) return "digital";
+  return pricing?.subscription || pricing?.singlePaymentForDuration ? "subscription" : "unknown";
+}
+function fromPlan(p) {
+  return catalogItem({
+    source: "pricingPlan",
+    id: p.id,
+    name: p.name || p.id,
+    description: p.description,
+    kind: planKind(p.pricing),
+    price: priceOf(p.pricing?.price?.value, p.pricing?.price?.currency),
+    hidden: p.archived === true || p.public === false || void 0
+  });
+}
+async function readPlans(wix, notes) {
+  try {
+    const rows = await allByOffset(async (offset) => {
+      const res = await wix("GET", `/pricing-plans/v2/plans?limit=${PAGE2}&offset=${offset}`);
+      return { rows: res.plans ?? [], total: res.pagingMetadata?.total };
+    }, "/pricing-plans/v2/plans");
+    return rows.map(fromPlan);
+  } catch (e) {
+    if (isNotInstalled2(e)) return notInstalled(notes, "Pricing Plans");
+    throw e;
+  }
+}
+async function readWixCatalog(wix) {
+  const notes = [];
+  const items = [...await readStores(wix, notes), ...await readPrograms(wix, notes), ...await readPlans(wix, notes)];
+  notes.push(NEVER_DRAFTED_NOTE);
+  return { items, notes };
+}
+var PAGE2, MAX_PAGES2, PROGRAM_READ_CONCURRENCY, NEVER_DRAFTED_NOTE, isNotInstalled2, isWrongCatalogVersion;
+var init_store_iap_catalog = __esm({
+  "src/store-iap-catalog.ts"() {
+    init_wix_owner();
+    PAGE2 = 100;
+    MAX_PAGES2 = 500;
+    PROGRAM_READ_CONCURRENCY = 4;
+    NEVER_DRAFTED_NOTE = "Bookings services and events are real-world services, which Apple does not allow as in-app purchases \u2014 they are never drafted.";
+    isNotInstalled2 = (e) => e instanceof WixApiError && e.isAppNotInstalled;
+    isWrongCatalogVersion = (e) => e instanceof WixApiError && e.status === 428 && /CATALOG_V1/.test(e.message);
+  }
+});
+
 // src/store-iap.ts
 var store_iap_exports = {};
 __export(store_iap_exports, {
@@ -61277,7 +61978,7 @@ __export(store_iap_exports, {
   runStoreIap: () => runStoreIap
 });
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { mkdirSync as mkdirSync32, readFileSync as readFileSync77, rmSync as rmSync16, writeFileSync as writeFileSync26 } from "node:fs";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync32, readFileSync as readFileSync77, rmSync as rmSync16, writeFileSync as writeFileSync26 } from "node:fs";
 import { homedir as homedir7, hostname } from "node:os";
 import { join as join65 } from "node:path";
 function scrubDeep(value, scrub) {
@@ -61348,9 +62049,27 @@ function printItemPlan(out2, item) {
   for (const note of item.notes) out2.line(`      note: ${note}`);
   for (const conflict of item.conflicts) out2.line(`      \u2717 conflict: ${conflict}`);
 }
+function countsLine(values, order) {
+  return order.map((key2) => [key2, values.filter((v) => v === key2).length]).filter(([, n]) => n > 0).map(([key2, n]) => `${key2} ${n}`).join(" \xB7 ");
+}
+function priceIncreases(plan) {
+  return plan.items.flatMap((item, i) => {
+    const requested = plan.manifest.items[i].price;
+    if (!item.applePrice || normalizeAmount(item.applePrice) === normalizeAmount(requested.amount)) return [];
+    return [`${item.productId} ${requested.amount} \u2192 ${item.applePrice} ${requested.currency}`];
+  });
+}
 function printPlanItems(out2, plan) {
   printHeader(out2, plan.identity, plan.target);
-  for (const item of plan.items) printItemPlan(out2, item);
+  if (plan.items.length <= SUMMARY_THRESHOLD) {
+    for (const item of plan.items) printItemPlan(out2, item);
+  } else {
+    out2.line(`  ${plan.items.length} products: ${countsLine(plan.items.map((i) => i.decision), DECISION_ORDER)}`);
+    const increases = priceIncreases(plan);
+    if (increases.length) out2.line(`  price: ${increases.length} take a higher Apple price point than requested, e.g. ${increases.slice(0, 3).join(" \xB7 ")}`);
+    for (const item of plan.items.filter((i) => i.decision === "conflict").slice(0, SUMMARY_DETAIL_LIMIT)) printItemPlan(out2, item);
+    out2.line("  (every product is listed in the plan file)");
+  }
   out2.line();
 }
 function printPlan(out2, plan, planPath) {
@@ -61386,14 +62105,22 @@ function printItemResult(out2, item) {
 }
 function printResult(out2, result, resultPath) {
   printHeader(out2, result.identity, result.target);
-  for (const item of result.items) printItemResult(out2, item);
+  if (result.items.length <= SUMMARY_THRESHOLD) {
+    for (const item of result.items) printItemResult(out2, item);
+  } else {
+    out2.line(`  ${result.items.length} products: ${countsLine(result.items.map((i) => i.provisioning.outcome), OUTCOME_ORDER)}`);
+    const unfinished = result.items.filter((i) => !COMPLETE.has(i.provisioning.outcome));
+    for (const item of unfinished.slice(0, SUMMARY_DETAIL_LIMIT)) printItemResult(out2, item);
+    if (unfinished.length > SUMMARY_DETAIL_LIMIT) out2.line(`  \u2026and ${unfinished.length - SUMMARY_DETAIL_LIMIT} more not complete (see the result file)`);
+  }
   out2.line();
   if (resultPath) out2.line(`  result written to ${resultPath}`);
   out2.line("  backend sync: not configured \xB7 checkout: not active \u2014 the result is a mapping candidate, not an activation.");
 }
-function applyQuestion(plan) {
+function applyQuestion(plan, limit) {
   const operations = plan.items.reduce((n, item) => n + item.ops.length, 0);
-  return `  As profile "${plan.identity.profile}" (team ${plan.identity.team}), apply ${operations} operation(s) to App Store Connect app ${plan.target.appleAppId} (${plan.target.bundleId})?`;
+  const cap = limit === void 0 ? "" : `, creating at most ${limit} new product(s) in this run`;
+  return `  As profile "${plan.identity.profile}" (team ${plan.identity.team}), apply ${operations} planned operation(s) to App Store Connect app ${plan.target.appleAppId} (${plan.target.bundleId})${cap}?`;
 }
 async function planCommand(flags, deps, out2) {
   const manifestPath = requireFlag(flags, "manifest", "plan");
@@ -61408,10 +62135,17 @@ async function planCommand(flags, deps, out2) {
   else printPlan(out2, plan, planPath);
   return plan.items.some((i) => i.decision === "conflict") ? 1 : 0;
 }
-async function applyWithLock(deps, plan, session) {
+function createLimit(flags) {
+  const value = textFlag(flags, "limit");
+  if (value === void 0) return void 0;
+  if (!/^[1-9]\d*$/.test(value)) throw new UsageError(`--limit must be a positive whole number (got ${JSON.stringify(value)})`);
+  return Number(value);
+}
+async function applyWithLock(deps, plan, session, limit) {
   const release = deps.acquireLock(plan.target.appleAppId);
   try {
-    return await applyIap(plan, { api: session.api, identity: session.identity, now: deps.now, sleep: deps.sleep, journal: session.journal });
+    const context = { api: session.api, identity: session.identity, now: deps.now, sleep: deps.sleep, journal: session.journal };
+    return await applyIap(plan, limit === void 0 ? context : { ...context, createLimit: limit });
   } finally {
     release();
   }
@@ -61420,6 +62154,7 @@ async function applyCommand(flags, deps, out2) {
   const planPath = requireFlag(flags, "plan", "apply");
   const profile = requireFlag(flags, "profile", "apply");
   const resultPath = requireFlag(flags, "out", "apply");
+  const limit = createLimit(flags);
   const confirmed = flags.yes === true;
   const canAsk = out2.interactive && !out2.json && deps.canPrompt();
   if (!confirmed && !canAsk) {
@@ -61431,11 +62166,11 @@ async function applyCommand(flags, deps, out2) {
   const plan = readPlan(deps, planPath);
   const session = openSession(deps, out2, plan.target, profile);
   if (!out2.json) printApplyPreview(out2, plan, planPath);
-  if (!confirmed && !await deps.confirm(applyQuestion(plan))) {
+  if (!confirmed && !await deps.confirm(applyQuestion(plan, limit))) {
     out2.line("  aborted \u2014 nothing was changed in App Store Connect.");
     return 1;
   }
-  const result = await applyWithLock(deps, plan, session);
+  const result = await applyWithLock(deps, plan, session, limit);
   writeJson(deps, out2, resultPath, result);
   if (out2.json) out2.print({ ok: result.complete, result: resultPath, items: result.items });
   else printResult(out2, result, resultPath);
@@ -61453,6 +62188,104 @@ async function statusCommand(flags, deps, out2) {
   else printResult(out2, result, resultPath);
   return result.complete ? 0 : 1;
 }
+function draftMode(flags) {
+  const value = textFlag(flags, "mode") ?? "per-item";
+  const mode = DRAFT_MODES[value];
+  if (!mode) throw new UsageError(`--mode must be per-item or tiers (got ${JSON.stringify(value)})`);
+  return mode;
+}
+function territoriesFlag(flags, base) {
+  const territories = (textFlag(flags, "territories") ?? base).split(",").map((t) => t.trim().toUpperCase()).filter(Boolean);
+  const bad2 = territories.find((t) => !TERRITORY_CODE.test(t));
+  if (bad2) throw new UsageError(`--territories must be ISO 3166-1 alpha-3 codes such as USA (got ${JSON.stringify(bad2)})`);
+  const duplicate = territories.find((t, i) => territories.indexOf(t) !== i);
+  if (duplicate) throw new UsageError(`--territories: duplicate territory ${duplicate}`);
+  if (!territories.includes(base)) throw new UsageError(`--territories must include the base territory ${base}`);
+  return territories;
+}
+function localeFlag(flags) {
+  const locale = textFlag(flags, "locale") ?? "en-US";
+  if (!LOCALE_CODE.test(locale)) throw new UsageError(`--locale must be a locale such as en-US (got ${JSON.stringify(locale)})`);
+  return locale;
+}
+function baseTerritoryFlag(flags) {
+  const base = requireFlag(flags, "base-territory", "draft").toUpperCase();
+  if (!TERRITORY_CODE.test(base)) throw new UsageError(`--base-territory must be an ISO 3166-1 alpha-3 code such as USA (got ${JSON.stringify(base)})`);
+  return base;
+}
+async function applePriceGrid(session, target, baseTerritory) {
+  return withAccessContext(session.identity, target, async () => {
+    const [anyProduct] = await session.api.listProducts(target.appleAppId);
+    return anyProduct ? new PriceGrid(session.api).amountsIn(baseTerritory, anyProduct.id) : void 0;
+  });
+}
+function readMergeManifest(deps, path2, target) {
+  if (!path2) return void 0;
+  const existing = readManifest2(deps, path2);
+  if (existing.target.wixSiteId !== target.wixSiteId) {
+    throw new Error(`${path2} is for Wix site ${existing.target.wixSiteId}, not ${target.wixSiteId} \u2014 refusing to carry another site's mappings into this one.`);
+  }
+  if (existing.target.appleAppId !== target.appleAppId || existing.target.bundleId !== target.bundleId) {
+    throw new Error(`${path2} is for app ${existing.target.appleAppId} (${existing.target.bundleId}), not ${target.appleAppId} (${target.bundleId}) \u2014 refusing to merge another app's mapping.`);
+  }
+  return existing;
+}
+async function baseCurrency(session, target, baseTerritory) {
+  const territories = await withAccessContext(session.identity, target, () => session.api.listTerritories());
+  const currency = territories.find((t) => t.id === baseTerritory)?.currency;
+  if (!currency) throw new Error(`App Store Connect has no territory ${baseTerritory} \u2014 pass an ISO 3166-1 alpha-3 code such as USA or DEU.`);
+  return currency;
+}
+function skippedSummary(draft) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const s of draft.skipped) counts.set(s.reason, (counts.get(s.reason) ?? 0) + 1);
+  return [...counts].map(([reason, n]) => `${reason} \xD7${n}`).join(" \xB7 ");
+}
+function printDraft(out2, catalog, draft, args) {
+  out2.line(`  ${pad("catalog")}${catalog.items.length} Wix item(s) read`);
+  for (const note of args.notes) out2.line(`  ${pad("")}${note}`);
+  const kept = args.mergePath ? ` \xB7 kept ${draft.kept} from ${args.mergePath}` : "";
+  out2.line(`  ${pad("drafted")}${args.drafted} new product(s) for ${draft.newlyMapped} Wix item(s)${kept}`);
+  if (draft.skipped.length) out2.line(`  ${pad("skipped")}${draft.skipped.length} \u2014 ${skippedSummary(draft)}`);
+  out2.line();
+  if (!draft.manifest) {
+    out2.line("  nothing in the catalog can be sold through in-app purchase \u2014 no manifest written.");
+    return;
+  }
+  out2.line(`  manifest written to ${args.outPath} \u2014 review or trim it if you like; nothing was changed in App Store Connect.`);
+  out2.line(`  next: himi store iap plan --manifest ${args.outPath} --profile ${args.profile} --out ./iap-plan.json`);
+}
+async function draftCommand(flags, deps, out2) {
+  const site = requireFlag(flags, "site", "draft");
+  const profile = requireFlag(flags, "profile", "draft");
+  const appleAppId = requireFlag(flags, "apple-app", "draft");
+  const bundleId = requireFlag(flags, "bundle", "draft");
+  const baseTerritory = baseTerritoryFlag(flags);
+  const outPath = requireFlag(flags, "out", "draft");
+  const mode = draftMode(flags);
+  const territories = territoriesFlag(flags, baseTerritory);
+  const locale = localeFlag(flags);
+  const mergePath = textFlag(flags, "merge");
+  const target = { himiApp: textFlag(flags, "himi-app") ?? bundleId, wixSiteId: site, appleAppId, bundleId, teamId: deps.profileTeam(profile), profile };
+  const existing = readMergeManifest(deps, mergePath, target);
+  const session = openSession(deps, out2, target, profile);
+  const currency = await baseCurrency(session, target, baseTerritory);
+  const applePrices = await applePriceGrid(session, target, baseTerritory);
+  const catalog = await readWixCatalog(deps.wixTransport(site));
+  const notes = mode === "tiers" && !applePrices ? [...catalog.notes, GRID_UNAVAILABLE_NOTE] : catalog.notes;
+  const draft = draftManifest(catalog.items, { target, mode, baseTerritory, currency, territories, locale, existing, ...applePrices ? { applePrices } : {} });
+  const drafted = (draft.manifest?.items.length ?? 0) - (existing?.items.length ?? 0);
+  if (draft.manifest) writeJson(deps, out2, outPath, draft.manifest);
+  const report3 = { ok: draft.manifest !== void 0, manifest: draft.manifest ? outPath : null, mode: textFlag(flags, "mode") ?? "per-item", drafted, newlyMapped: draft.newlyMapped, kept: draft.kept, skipped: draft.skipped, notes };
+  const reportPath = textFlag(flags, "report");
+  if (reportPath) writeJson(deps, out2, reportPath, report3);
+  if (out2.json) out2.print(report3);
+  else {
+    printHeader(out2, session.identity, target);
+    printDraft(out2, catalog, draft, { drafted, outPath, profile, mergePath, notes });
+  }
+  return draft.manifest ? 0 : 1;
+}
 async function runStoreIap(pos, flags, io, deps) {
   const out2 = new CommandOutput(io, flags.json === true);
   const sub = pos[2];
@@ -61465,18 +62298,10 @@ async function runStoreIap(pos, flags, io, deps) {
     return failFrom(e, out2);
   }
 }
-function readJournalEntries(path2) {
-  try {
-    const doc = JSON.parse(readFileSync77(path2, "utf8"));
-    return Array.isArray(doc?.entries) ? doc.entries : [];
-  } catch {
-    return [];
-  }
-}
 function fileJournal(path2) {
   return {
-    record: (entry) => writeFileAtomic(path2, `${JSON.stringify({ journalVersion: 1, entries: [...readJournalEntries(path2), entry] }, null, 2)}
-`)
+    record: (entry) => appendFileSync2(path2, `${JSON.stringify(entry)}
+`, { mode: 384 })
   };
 }
 function readLockSummary(path2) {
@@ -61529,26 +62354,35 @@ function defaultStoreIapDeps() {
     writeFileAtomic,
     resolveCredentials: ({ profileFlag, target }) => resolveIapCredentials({ profileFlag, target }),
     createApi: (key2) => createIapApi(createAscClient({ key: key2 })),
-    openJournal: (appleAppId) => fileJournal(join65(stateDir(appleAppId), "journal.json")),
+    openJournal: (appleAppId) => fileJournal(join65(stateDir(appleAppId), "journal.jsonl")),
     acquireLock: (appleAppId) => acquireApplyLock(stateDir(appleAppId), appleAppId),
     canPrompt: () => process.stdin.isTTY === true,
+    wixTransport: (siteId) => ownerTransport(siteId),
+    profileTeam: (profile) => resolveStoreCredentials({ app: profile, cfg: {}, profileFlag: profile, env: {} }).team,
     confirm: confirmOnTerminal,
     now: () => /* @__PURE__ */ new Date(),
     sleep: (ms) => new Promise((resolve56) => setTimeout(resolve56, ms))
   };
 }
-var STORE_IAP_USAGE, UsageError, CommandOutput, pad, COMPLETE, COMMANDS;
+var STORE_IAP_USAGE, SUMMARY_THRESHOLD, SUMMARY_DETAIL_LIMIT, UsageError, CommandOutput, pad, DECISION_ORDER, OUTCOME_ORDER, COMPLETE, DRAFT_MODES, TERRITORY_CODE, LOCALE_CODE, GRID_UNAVAILABLE_NOTE, COMMANDS;
 var init_store_iap = __esm({
   "src/store-iap.ts"() {
     init_iap_api();
     init_iap_apply();
     init_iap_client();
+    init_credential_profile();
     init_iap_credentials();
+    init_iap_draft();
     init_iap_manifest();
+    init_iap_pricing();
     init_iap_plan();
     init_redact();
     init_progress();
-    STORE_IAP_USAGE = "himi store iap plan|apply|status \u2014 plan --manifest <file> --profile <name> --out <plan.json> \xB7 apply --plan <plan.json> --profile <name> --out <result.json> [--yes] \xB7 status --manifest <file> --profile <name> [--out <file>]";
+    init_store_iap_catalog();
+    init_wix_owner();
+    STORE_IAP_USAGE = "himi store iap draft|plan|apply|status \u2014 draft --site <msid> --profile <name> --apple-app <id> --bundle <id> --base-territory <ISO3> --out <manifest.json> [--territories <a,b>] [--locale <l>] [--mode per-item|tiers] [--merge <manifest.json>] [--report <file>] \xB7 plan --manifest <file> --profile <name> --out <plan.json> \xB7 apply --plan <plan.json> --profile <name> --out <result.json> [--yes] [--limit <n>] \xB7 status --manifest <file> --profile <name> [--out <file>]";
+    SUMMARY_THRESHOLD = 50;
+    SUMMARY_DETAIL_LIMIT = 20;
     UsageError = class extends Error {
     };
     CommandOutput = class {
@@ -61587,8 +62421,15 @@ var init_store_iap = __esm({
       }
     };
     pad = (label2, width = 12) => label2.padEnd(width);
+    DECISION_ORDER = ["create", "update", "reuse", "conflict"];
+    OUTCOME_ORDER = ["created", "updated", "reused", "conflict", "partial", "failed", "deferred", "absent", "incomplete"];
     COMPLETE = /* @__PURE__ */ new Set(["created", "updated", "reused"]);
+    DRAFT_MODES = { "per-item": "perItem", tiers: "tiers" };
+    TERRITORY_CODE = /^[A-Z]{3}$/;
+    LOCALE_CODE = /^[a-z]{2,3}(-[A-Za-z0-9]{2,8})*$/;
+    GRID_UNAVAILABLE_NOTE = "the app has no in-app purchase yet to read Apple's price grid through, so tiers are keyed by Wix price \u2014 prices that resolve to the same Apple point get separate tiers; redraft after the first product exists to merge them";
     COMMANDS = {
+      draft: draftCommand,
       plan: planCommand,
       apply: applyCommand,
       status: statusCommand
@@ -61973,7 +62814,7 @@ __export(preflight_app_exports, {
   profileAccount: () => profileAccount
 });
 import { readFileSync as readFileSync78, existsSync as existsSync67, readdirSync as readdirSync31, statSync as statSync18 } from "node:fs";
-import { createHash as createHash33 } from "node:crypto";
+import { createHash as createHash34 } from "node:crypto";
 import { join as join66 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
   const f = [];
@@ -62262,7 +63103,7 @@ function placeholderHashes2() {
     const p = join66(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync18(p).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash33("sha256").update(readFileSync78(p)).digest("hex")];
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash34("sha256").update(readFileSync78(p)).digest("hex")];
     } catch {
     }
   }
@@ -62299,7 +63140,7 @@ async function appIconState(iosDir) {
     try {
       if (!statSync18(p).isFile()) continue;
       const bytes2 = readFileSync78(p);
-      const hash = createHash33("sha256").update(bytes2).digest("hex");
+      const hash = createHash34("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
         exists: true,
@@ -62872,7 +63713,7 @@ var init_site_member = __esm({
 });
 
 // src/notify-ping-all.ts
-import { createHash as createHash34 } from "node:crypto";
+import { createHash as createHash35 } from "node:crypto";
 async function listApprovedMembers(input) {
   const first = await scanMembers(input);
   const second = await scanMembers(input);
@@ -62926,7 +63767,7 @@ async function scanMembers(input) {
   }
 }
 function campaignRequestId(campaignId, memberId) {
-  const bytes2 = createHash34("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
+  const bytes2 = createHash35("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
   bytes2[6] = bytes2[6] & 15 | 80;
   bytes2[8] = bytes2[8] & 63 | 128;
   const hex2 = bytes2.toString("hex");
@@ -64086,7 +64927,7 @@ var init_copy_clean = __esm({
 
 // src/site-analyze/published-html.ts
 function textFromHtml(fragment) {
-  return fragment.replace(/<[^>]*>/g, " ").replace(/&(amp|lt|gt|quot|#39|apos|nbsp);/g, (e) => ENTITIES[e] ?? " ").replace(/&#x?[0-9a-f]+;/gi, " ");
+  return fragment.replace(/<[^>]*>/g, " ").replace(/&(amp|lt|gt|quot|#39|apos|nbsp);/g, (e) => ENTITIES2[e] ?? " ").replace(/&#x?[0-9a-f]+;/gi, " ");
 }
 function unescapeJsonString(s) {
   return s.replace(/\\"/g, '"').replace(/\\n/g, " ").replace(/\\\\/g, "\\");
@@ -64225,7 +65066,7 @@ function appsFromDefIds(ids) {
     return name ? { id, name } : { id };
   });
 }
-var GRID_APP_ID_RE, MAIN_PAGE_RE, APP_DEF_RE, PAGE_ENTRY_RE, OG_IMAGE_RE, ICON_RE, HTML_LANG_RE, META_DESC_RE, OG_TITLE_RE, OG_DESC_RE, HEADING_RE, SKIP_SLUG, POPUP, WELL_KNOWN_WIX_APPS, ENTITIES;
+var GRID_APP_ID_RE, MAIN_PAGE_RE, APP_DEF_RE, PAGE_ENTRY_RE, OG_IMAGE_RE, ICON_RE, HTML_LANG_RE, META_DESC_RE, OG_TITLE_RE, OG_DESC_RE, HEADING_RE, SKIP_SLUG, POPUP, WELL_KNOWN_WIX_APPS, ENTITIES2;
 var init_published_html = __esm({
   "src/site-analyze/published-html.ts"() {
     init_rest();
@@ -64256,7 +65097,7 @@ var init_published_html = __esm({
       "14cc59bc-f0b7-15b8-e1c7-89ce41d0e0c9": "Wix Bookings Service Pages",
       "215238eb-22a5-4c36-9e7b-e7c08025e04e": "Wix Forms"
     };
-    ENTITIES = {
+    ENTITIES2 = {
       "&amp;": "&",
       "&lt;": "<",
       "&gt;": ">",
@@ -73100,10 +73941,10 @@ async function installVerticals(msid, wanted, token, fetchImpl = fetch, timeoutM
     body = text8 ? JSON.parse(text8) : {};
   } catch {
   }
-  const nameOf = (appDefId) => wanted.find((w) => w.appDefId === appDefId)?.vertical ?? appDefId;
+  const nameOf2 = (appDefId) => wanted.find((w) => w.appDefId === appDefId)?.vertical ?? appDefId;
   const out2 = { installed: [], errors: [], needsSetup: [] };
   for (const [appDefId, info2] of Object.entries(body.installedApps ?? {})) {
-    const vertical = nameOf(appDefId);
+    const vertical = nameOf2(appDefId);
     out2.installed.push({ vertical, appDefId, version: info2?.version });
     const actions = (info2?.requiredActions ?? []).filter((a) => a?.actionType || a?.link);
     for (const a of actions) {
@@ -73116,7 +73957,7 @@ async function installVerticals(msid, wanted, token, fetchImpl = fetch, timeoutM
     }
   }
   for (const [appDefId, err] of Object.entries(body.installErrors ?? {})) {
-    out2.errors.push({ vertical: nameOf(appDefId), appDefId, message: err?.message ?? "unknown" });
+    out2.errors.push({ vertical: nameOf2(appDefId), appDefId, message: err?.message ?? "unknown" });
   }
   return out2;
 }
@@ -73983,7 +74824,7 @@ var init_context = __esm({
 import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync88, mkdirSync as mkdirSync39, writeFileSync as writeFileSync35, existsSync as existsSync72, rmSync as rmSync20, readdirSync as readdirSync32, statSync as statSync20, lstatSync as lstatSync16, accessSync, constants as constants3, renameSync as renameSync9, cpSync as cpSync3 } from "node:fs";
 import { execFile as execFile2, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { createHash as createHash35, randomUUID as randomUUID8 } from "node:crypto";
+import { createHash as createHash36, randomUUID as randomUUID8 } from "node:crypto";
 import { tmpdir as tmpdir6, homedir as homedir10, hostname as hostname2 } from "node:os";
 import { join as join73, resolve as resolve55, relative as relative14, basename as basename17, dirname as dirname40 } from "node:path";
 import { fileURLToPath as fileURLToPath26 } from "node:url";
@@ -74552,11 +75393,11 @@ async function loadReleaseFromDir(app, dir) {
   const bundles = {};
   const seenSha = /* @__PURE__ */ new Set();
   for (const meta of Object.values(manifest.bundles ?? {})) {
-    const sha = meta?.sha256;
-    if (!sha || seenSha.has(sha)) continue;
-    seenSha.add(sha);
-    const b = await store.getBundle(app, sha);
-    if (b) bundles[sha] = asBuffer(b).toString("base64");
+    const sha2 = meta?.sha256;
+    if (!sha2 || seenSha.has(sha2)) continue;
+    seenSha.add(sha2);
+    const b = await store.getBundle(app, sha2);
+    if (b) bundles[sha2] = asBuffer(b).toString("base64");
   }
   const tokensBytes = await store.getTokens(app);
   const tokens2 = tokensBytes ? utf8Decode(tokensBytes) : void 0;
@@ -76623,16 +77464,28 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            team (guideline 4.2.6), declared per-app as
                                            ios.credentialProfile in store.config.yaml and resolved
                                            from ~/.himalaya/store-credentials/<name>.json.
+  himi store iap draft --site <msid> --profile <name> --apple-app <id> --bundle <id> --base-territory <ISO3>
+                      --out <manifest.json> [--territories <a,b>] [--locale <l>] [--mode per-item|tiers]
+                      [--merge <manifest.json>] [--report <file>] [--json]
+                                           READ-ONLY. Read the site's whole Wix catalog (Stores, Online
+                                           Programs, Pricing Plans) and write the manifest for you:
+                                           digital, priced items only (physical, recurring, free and
+                                           hidden ones are skipped with a reason), stable product ids,
+                                           prices at the next Apple price point up. --mode tiers makes
+                                           one consumable per price instead. --merge keeps an earlier
+                                           manifest's mappings (their product ids are permanent).
   himi store iap plan --manifest <file> --profile <name> --out <plan.json> [--json]
                                            READ-ONLY. Verify the owner's App Store Connect app and
                                            decide which selected digital products (one-time
                                            non-consumables) to register; writes a reviewable plan.
-  himi store iap apply --plan <plan.json> --profile <name> --out <result.json> [--yes] [--json]
+  himi store iap apply --plan <plan.json> --profile <name> --out <result.json> [--yes] [--limit <n>] [--json]
                                            create the planned products with draft metadata, an
                                            exact price and explicit territories. Re-reads Apple
                                            first, never edits a live product, never duplicates on
                                            a rerun; prompts unless --yes. Writes the Wix\u2192Apple
                                            mapping \u2014 backend sync not configured, checkout off.
+                                           --limit <n> creates at most n new products per run (big
+                                           catalogs go in batches; a rerun continues).
   himi store iap status --manifest <file> --profile <name> [--out <file>] [--json]
                                            READ-ONLY: what App Store Connect has for each product.
                                            No build, signing or repo checkout. Guide: himi docs iap-products
@@ -76918,7 +77771,7 @@ var COMMANDS2 = [
   { name: "visibility", summary: "read (no value) or set whether the public registry (/v1/apps + the Himi Player picker) LISTS the app. `public` lists it for everyone; `unlisted` hides it from listings while direct reads by app id \u2014 deep links, previews \u2014 keep working. App from --app or the content dir. Setting it needs no republish.", required: "[public|unlisted] [--app <a>] [--content <dir>] (--control-token)" },
   { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | player | demo-app); `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo --site <id>` reuses an existing customer ad-hoc profile and certificate for iOS; requires an owned site and a completed personal signing binding. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|player|demo-app] [--signing wix-managed|byo] [--site <id>] [--android-signing qa-keystore|wix-keystore|debug] [--borrow-ios-id <bundleId>] [--no-wait] [--force] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
   { name: "testflight", summary: 'build, sign and upload an app to TestFlight (internal testers \u2014 no Beta App Review), then WAIT until App Store Connect finishes processing it. Sugar for `store upload --track testflight`. Prompts first: a build number is consumed permanently on a real Apple account and cannot be reused \u2014 `--yes` for CI, `--dry-run` to see the plan without touching anything. The wait is the real check, not a nicety: fastlane prints "Successfully uploaded" for a binary App Store Connect then rejects in processing, and a rejected binary leaves NO build record at all (the reason is emailed). Public App Store review is deliberately NOT automatable here \u2014 `--track appstore` is refused; use /submit-ios-app when you mean to go public', required: "<app> [--track testflight|internal] [--profile <name>] [--yes] [--dry-run] [--skip-build] [--no-wait] [--json]" },
-  { name: "store", summary: "the App Store Connect group behind `testflight`. `preflight <app>` checks readiness offline (icon, entitlements, encryption flag, version, store.config ids, listing + review record); `upload <app>` is what `testflight` runs; `status <app>` reads live build + processing state. `--profile` selects WHICH App Store Connect account: an app built for a Wix customer ships under the CUSTOMER's Apple team (Apple guideline 4.2.6 forbids an app-generation service submitting on a client's behalf), declared per-app as ios.credentialProfile in store.config.yaml and resolved from ~/.himalaya/store-credentials/<name>.json \u2014 the .p8 itself never enters the repo. `iap plan|apply|status` registers an app owner's selected digital products (one-time non-consumables) as in-app purchases from a manifest: plan and status only read, apply is the one mutation boundary, and none of them builds, signs or needs a checkout (`himi docs iap-products`)", required: "preflight <app> [--profile <n>] | upload <app> [--track <t>] [--profile <n>] [--yes] [--dry-run] | status <app> [--profile <n>] | iap plan --manifest <f> --profile <n> --out <f> [--json] | iap apply --plan <f> --profile <n> --out <f> [--yes] [--json] | iap status --manifest <f> --profile <n> [--out <f>] [--json]" },
+  { name: "store", summary: "the App Store Connect group behind `testflight`. `preflight <app>` checks readiness offline (icon, entitlements, encryption flag, version, store.config ids, listing + review record); `upload <app>` is what `testflight` runs; `status <app>` reads live build + processing state. `--profile` selects WHICH App Store Connect account: an app built for a Wix customer ships under the CUSTOMER's Apple team (Apple guideline 4.2.6 forbids an app-generation service submitting on a client's behalf), declared per-app as ios.credentialProfile in store.config.yaml and resolved from ~/.himalaya/store-credentials/<name>.json \u2014 the .p8 itself never enters the repo. `iap draft|plan|apply|status` registers an app owner's digital products as in-app purchases (non-consumables, or consumable price tiers): draft reads the Wix catalog and writes the manifest, plan and status only read, apply is the one mutation boundary, and none of them builds, signs or needs a checkout (`himi docs iap-products`)", required: "preflight <app> [--profile <n>] | upload <app> [--track <t>] [--profile <n>] [--yes] [--dry-run] | status <app> [--profile <n>] | iap draft --site <msid> --profile <n> --apple-app <id> --bundle <id> --base-territory <t> --out <f> [--territories <a,b>] [--locale <l>] [--mode per-item|tiers] [--merge <f>] [--report <f>] [--json] | iap plan --manifest <f> --profile <n> --out <f> [--json] | iap apply --plan <f> --profile <n> --out <f> [--yes] [--limit <n>] [--json] | iap status --manifest <f> --profile <n> [--out <f>] [--json]" },
   { name: "guide", summary: "print the Himalaya overview + headless dev loop + available topics (offline)", required: "[--json]" },
   { name: "docs", summary: "print an authoring guide; no topic = list them (offline)", required: "[<topic>] [--json]" },
   { name: "components", summary: "print the SDUI component vocabulary + props; a name = that component (offline)", required: "[<Name>] [--json]" },
@@ -78143,7 +78996,7 @@ function templateNameError(name, from) {
   const composed2 = TEMPLATE_APP_PREFIX + name;
   return isValidAppId(composed2) ? null : `template name "${name}" (${from}) makes app id "${composed2}", which is over the serve plane's app-id length limit; pass a shorter --name`;
 }
-function materializeForPreview(appDir3, slug, displayName) {
+function materializeForPreview(appDir3, slug, displayName2) {
   if (!isTemplateSourceTree(appDir3)) return appDir3;
   const slugError = templateNameError(slug, "preview slug");
   if (slugError) throw Object.assign(new Error(slugError), { exitCode: 2 });
@@ -78175,7 +79028,7 @@ function materializeForPreview(appDir3, slug, displayName) {
   rmSync20(dest, { recursive: true, force: true });
   mkdirSync39(dest, { recursive: true });
   try {
-    materializeSource(forBuild, displayName, dest, slug);
+    materializeSource(forBuild, displayName2, dest, slug);
   } catch (e) {
     rmSync20(dest, { recursive: true, force: true });
     throw e;
@@ -79365,7 +80218,7 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
               try {
                 const bytes2 = readFileSync88(iconPath);
                 payload.icon = bytes2.toString("base64");
-                iconHash = createHash35("sha256").update(bytes2).digest("hex");
+                iconHash = createHash36("sha256").update(bytes2).digest("hex");
               } catch {
               }
             }
@@ -81214,7 +82067,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let localSourceHash;
           try {
             const { collectAppSource: collectAppSource2, zipAppSource: zipAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
-            localSourceHash = createHash35("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
+            localSourceHash = createHash36("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
           } catch {
           }
           return runReleasePatch({
@@ -81606,9 +82459,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const { packRelease: packRelease2, packReleaseToDir: packReleaseToDir2 } = await Promise.resolve().then(() => (init_pack(), pack_exports));
-        const displayName = str9(flags.name);
+        const displayName2 = str9(flags.name);
         const launchMode = flags.snapshot === true ? "snapshot" : "live";
-        const packOpts = { createdBy: `himi-cli ${cliVersion()}`, launchMode, ...displayName ? { displayName } : {} };
+        const packOpts = { createdBy: `himi-cli ${cliVersion()}`, launchMode, ...displayName2 ? { displayName: displayName2 } : {} };
         const writePack = (root, appName2, out2, source) => format === "dir" ? packReleaseToDir2(root, appName2, out2, packOpts) : packRelease2(root, appName2, out2, { ...packOpts, ...source ? { source } : {} });
         const releaseDir = str9(flags["release-dir"]);
         if (releaseDir) {
@@ -82860,7 +83713,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           });
         }
         const bytes2 = readFileSync88(file);
-        const sha = createHash35("sha256").update(bytes2).digest("hex");
+        const sha2 = createHash36("sha256").update(bytes2).digest("hex");
         const forScreens = (str9(flags["for-screen"]) ?? "").split(",").map((s) => s.trim()).filter(Boolean);
         if (flags["no-rebind"] !== void 0 && flags["no-rebind"] !== true) {
           io.error(JSON.stringify({ ok: false, error: "no_rebind_takes_no_value", message: "--no-rebind is a switch and takes no value; pass it bare.", usage: PATCH_USAGE }));
@@ -82886,7 +83739,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             ok: false,
             error: "orphan_bundle",
             app,
-            sha256: sha,
+            sha256: sha2,
             message: "publishing bundle bytes does not repoint any screen at them: the patch adds the bundle to the manifest and leaves every screen's `bundle` field where it was, so this patch would land bytes that nothing renders.",
             hint: "name the screens to repoint: --for-screen cart,orders. Pass --no-rebind if you really mean to upload bytes nothing references yet.",
             alternative: "`himi push --only bundle:<name>` infers this from the package and drags the referencing screens in for you.",
@@ -82895,9 +83748,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const patch = {
-          bundles: { [sha]: bytes2.toString("base64") }
+          bundles: { [sha2]: bytes2.toString("base64") }
         };
-        const touched = [`bundle:${sha.slice(0, 12)}`];
+        const touched = [`bundle:${sha2.slice(0, 12)}`];
         const rebound = {};
         const bundleBase = await fetchReleaseManifest(client2, app, fromRelease);
         if ("error" in bundleBase) {
@@ -82930,8 +83783,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               }, null, 2));
               return 1;
             }
-            patch.screens[id] = { descriptor: got.text, bundle: sha };
-            rebound[id] = sha;
+            patch.screens[id] = { descriptor: got.text, bundle: sha2 };
+            rebound[id] = sha2;
             touched.push(`screen:${id}`);
           }
         }
@@ -82939,7 +83792,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...common,
           fromRelease: baseId,
           plan: { patch, touched, included: [], rebound },
-          extra: { kind, file: { path: file, bytes: bytes2.length, sha256: sha } }
+          extra: { kind, file: { path: file, bytes: bytes2.length, sha256: sha2 } }
         });
       }
       // OPERATIONAL FLAGS (RFC 0013) — the surface the admin portal's FlagsPanel used to own.