@wix/himalaya-cli 0.1187.0 → 0.1188.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/core/ts/src/site-shell.d.ts

@@ -66,6 +66,16 @@ export interface SiteShellConfig {
      *  site's own cookie endpoint signs the WebView in). Set by the shell from its member binding;
      *  a Base44 site always bridges. */
     sessionBridge?: boolean;
+    /** The site's own Members Area pages a member notification can open — My Orders and My Bookings
+     *  — as paths relative to {@link origin}. They are never navigation rows (a signed-in utility,
+     *  not a destination), so they live here rather than in {@link pages}; the site analyzer fills
+     *  them from the pages it actually found. Absent ⇒ that notification opens the home page. */
+    memberPages?: SiteMemberPages;
+}
+/** Members Area pages, by what a notification is about. */
+export interface SiteMemberPages {
+    orders?: string;
+    bookings?: string;
 }
 /** At most four site tabs; the rest belong in the drawer. Four, not the usual phone-bar five,
  *  because every tab keeps its WebView warm (`keepAlive`) and the native keep-alive stores

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/core.mjs

@@ -13373,6 +13373,10 @@ function assertSiteShellConfig(site) {
     seen.add(page.id);
     sitePageUrl(site.origin, page.path);
   }
+  for (const [key, path] of Object.entries(site.memberPages ?? {})) {
+    if (typeof path !== "string" || !path) throw new Error(`site memberPages.${key} must be a path`);
+    sitePageUrl(site.origin, path);
+  }
   if (site.layout !== void 0 && !SITE_LAYOUTS.includes(site.layout)) {
     throw new Error(`site layout ${JSON.stringify(site.layout)} must be one of ${SITE_LAYOUTS.join(", ")}`);
   }

package/dist/cli.mjs

@@ -17406,12 +17406,20 @@ function needsNativeBuild(id) {
 }
 function capabilitiesUsedBy(bundleJs) {
   const out2 = /* @__PURE__ */ new Set();
-  for (const m of bundleJs.matchAll(/["'`]capability\.([a-z0-9_]+)(\.[A-Za-z0-9]+)?["'`]/g)) {
-    if (m[2] || isKnownCapability(m[1])) out2.add(m[1]);
+  for (const m of capabilityLiterals(bundleJs)) {
+    if (m.verb || isKnownCapability(m.id)) out2.add(m.id);
   }
   for (const [id, marker] of BRIDGE_MARKERS) if (marker.test(bundleJs)) out2.add(id);
   return [...out2].sort();
 }
+function capabilityDispatchesIn(bundleJs) {
+  const out2 = /* @__PURE__ */ new Set();
+  for (const m of capabilityLiterals(bundleJs)) if (m.verb) out2.add(`capability.${m.id}.${m.verb}`);
+  return [...out2].sort();
+}
+function capabilityLiterals(bundleJs) {
+  return [...bundleJs.matchAll(CAPABILITY_LITERAL)].map((m) => ({ id: m[1], ...m[2] ? { verb: m[2] } : {} }));
+}
 function distAddRefusal(rawId) {
   const id = catalogKey(rawId);
   if (!isKnownCapability(id)) return "is not a capability id the platform knows";
@@ -17438,7 +17446,7 @@ function usageStringCopyFor(permissionCopy) {
   }
   return out2;
 }
-var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, BRIDGE_MARKERS, NOT_DIST_ADDABLE;
+var BRIDGE_CAPABILITY_IDS, KNOWN_CAPABILITY_IDS, CAPABILITY_LITERAL, BRIDGE_MARKERS, NOT_DIST_ADDABLE;
 var init_known = __esm({
   "../../core/sdk/capability-catalog/src/known.ts"() {
     init_builtins();
@@ -17456,6 +17464,7 @@ var init_known = __esm({
         ])
       ].sort()
     );
+    CAPABILITY_LITERAL = /["'`]capability\.([a-z0-9_]+)(?:\.([A-Za-z0-9_]+))?["'`]/g;
     BRIDGE_MARKERS = [
       ["wix_api", /himalaya\.wixApi\b|\bwixApi\.call\b/],
       ["webview", /himalaya\.webview\b/]
@@ -22425,8 +22434,8 @@ var init_shell_capabilities_generated = __esm({
         appDir: "apps/himi-player",
         shared: true,
         extensible: false,
-        built: ["audio_record_background", "calls", "clipboard", "speech"],
-        serves: ["app_info", "audio_record", "audio_record_background", "browser_auth", "calls", "clipboard", "file_picker", "files", "himi_apps", "iap", "keyboard", "local_database", "on_device_ai", "open_url", "pdf", "presigned_upload", "release_control", "secure_storage", "share", "speaker_diarization", "speech", "stream", "wix_api", "wix_cashier", "wix_platform"]
+        built: ["audio_record_background", "biometrics", "calendar", "calls", "camera", "clipboard", "contacts", "haptic", "location", "media_playback", "motion", "photos", "speech"],
+        serves: ["app_info", "audio_record", "audio_record_background", "biometrics", "browser_auth", "calendar", "calls", "camera", "clipboard", "contacts", "file_picker", "files", "haptic", "himi_apps", "iap", "keyboard", "local_database", "location", "media_playback", "motion", "on_device_ai", "open_url", "pdf", "photos", "presigned_upload", "push", "release_control", "secure_storage", "share", "speaker_diarization", "speech", "stream", "wix_api", "wix_cashier", "wix_platform"]
       }
     };
   }
@@ -22436,6 +22445,7 @@ var init_shell_capabilities_generated = __esm({
 var capabilities_exports = {};
 __export(capabilities_exports, {
   DECLARE_HINT: () => DECLARE_HINT,
+  LAST_DIST_FILE: () => LAST_DIST_FILE,
   SHELLS: () => SHELLS,
   allCapabilities: () => allCapabilities,
   capabilitiesOfPackage: () => capabilitiesOfPackage,
@@ -22447,11 +22457,15 @@ __export(capabilities_exports, {
   formatCapabilityList: () => formatCapabilityList,
   formatDistPlan: () => formatDistPlan,
   isShell: () => isShell,
+  lastDistFromJob: () => lastDistFromJob,
+  needsBinaryNotice: () => needsBinaryNotice,
+  readLastDist: () => readLastDist,
   shellDistAdds: () => shellDistAdds,
   shellServes: () => shellServes,
-  shellSupport: () => shellSupport
+  shellSupport: () => shellSupport,
+  writeLastDist: () => writeLastDist
 });
-import { existsSync as existsSync33, readFileSync as readFileSync33 } from "node:fs";
+import { existsSync as existsSync33, lstatSync as lstatSync9, readFileSync as readFileSync33 } from "node:fs";
 import { join as join35 } from "node:path";
 function isShell(name) {
   return Object.hasOwn(SHELL_CAPABILITIES, name);
@@ -22515,6 +22529,47 @@ function contentShell(dir, flag) {
     return null;
   }
 }
+async function writeLastDist(dir, rec) {
+  const { realDirIn: realDirIn2, writeFileAtomic: writeFileAtomic2 } = await Promise.resolve().then(() => (init_progress(), progress_exports));
+  const himi = realDirIn2(dir, ".himi");
+  if (!himi) return null;
+  const path2 = join35(himi, "last-dist.json");
+  writeFileAtomic2(path2, `${JSON.stringify(rec, null, 2)}
+`);
+  return path2;
+}
+function readLastDist(dir) {
+  const path2 = join35(dir, LAST_DIST_FILE);
+  try {
+    if (lstatSync9(join35(dir, ".himi")).isSymbolicLink() || lstatSync9(path2).isSymbolicLink()) return null;
+  } catch {
+    return null;
+  }
+  try {
+    const v = JSON.parse(readFileSync33(path2, "utf8"));
+    if (typeof v.app !== "string" || typeof v.jobId !== "string" || typeof v.shell !== "string" || !Array.isArray(v.capabilities)) return null;
+    return { app: v.app, jobId: v.jobId, shell: v.shell, capabilities: v.capabilities.filter((x) => typeof x === "string") };
+  } catch {
+    return null;
+  }
+}
+function lastDistFromJob(job, now = /* @__PURE__ */ new Date()) {
+  if (job.status !== "SUCCESS" || !Array.isArray(job.buildCapabilities)) return null;
+  if (typeof job.app !== "string" || typeof job.jobId !== "string" || typeof job.shell !== "string") return null;
+  const capabilities = [...new Set(job.buildCapabilities.filter((x) => typeof x === "string").map(catalogKey))].sort();
+  return { app: job.app, jobId: job.jobId, shell: job.shell, capabilities, finishedAt: now.toISOString() };
+}
+function needsBinaryNotice(json6) {
+  const nb = json6?.needsBinary;
+  if (!nb || !Array.isArray(nb.missing)) return null;
+  const missing = nb.missing.filter((x) => typeof x === "string");
+  if (!missing.length) return null;
+  return {
+    missing,
+    ...typeof nb.lastDistJobId === "string" ? { lastDistJobId: nb.lastDistJobId } : {},
+    message: `needs a new binary: ${missing.join(", ")} \u2014 run himi dist`
+  };
+}
 function noImportLabel(id) {
   return BRIDGE_CAPABILITY_IDS.includes(id) || id === "wix_platform" ? "a bridge capability (no @himalaya import of its own)" : "declare-only (no @himalaya import of its own)";
 }
@@ -22583,7 +22638,7 @@ function didYouMean(id) {
   const best = KNOWN_CAPABILITY_IDS.map((k) => [k, editDistance2(id, k)]).sort((x, y) => x[1] - y[1])[0];
   return best && best[1] <= 2 ? ` Did you mean "${best[0]}"?` : "";
 }
-function capabilityIssues(usage, shell, strict) {
+function capabilityIssues(usage, shell, strict, lastDist) {
   if (!usage) return [];
   const warn = strict ? "error" : "warning";
   const issues = [];
@@ -22662,7 +22717,19 @@ function capabilityIssues(usage, shell, strict) {
     for (const sc of usage.screens) for (const id of [...sc.declared, ...sc.bundle ? usage.bundles[sc.bundle] ?? [] : []]) required3.add(catalogKey(id));
     const unserved = [...required3].filter((id) => isKnownCapability(id) && !shellServes(shell, id)).sort();
     const addable = s.extensible ? unserved.filter((id) => shellDistAdds(shell, id)) : [];
-    if (addable.length) {
+    const installed = lastDist && lastDist.shell === shell ? expandCapabilities(lastDist.capabilities.map(catalogKey)) : null;
+    if (installed) {
+      const stale = [...required3].filter((id) => isKnownCapability(id) && !installed.has(id) && (shellServes(shell, id) || s.extensible && shellDistAdds(shell, id))).sort();
+      if (stale.length) {
+        issues.push({
+          screen: null,
+          pass: "capabilities",
+          severity: "warning",
+          capability: stale.join(","),
+          message: `needs a new binary: ${stale.join(", ")} \u2014 your last \`himi dist\` (${lastDist.jobId}) was not built with ${stale.length === 1 ? "it" : "them"}, so that install cannot call ${stale.length === 1 ? "it" : "them"} until you run \`himi dist\` again. Preview with \`himi dist --plan\`.`
+        });
+      }
+    } else if (addable.length) {
       issues.push({
         screen: null,
         pass: "capabilities",
@@ -22722,7 +22789,7 @@ function capabilityConfigFindings(sourceDir, builtDir) {
   }
   return out2;
 }
-var DECLARE_HINT, REGISTRY, PACKAGES, SHELLS, servedSets, MAX_SUGGEST_LEN2, clip;
+var DECLARE_HINT, REGISTRY, PACKAGES, SHELLS, servedSets, LAST_DIST_FILE, MAX_SUGGEST_LEN2, clip;
 var init_capabilities = __esm({
   "src/capabilities.ts"() {
     init_src2();
@@ -22734,6 +22801,7 @@ var init_capabilities = __esm({
     PACKAGES = CAPABILITY_PACKAGES;
     SHELLS = Object.keys(SHELL_CAPABILITIES).sort();
     servedSets = /* @__PURE__ */ new Map();
+    LAST_DIST_FILE = join35(".himi", "last-dist.json");
     MAX_SUGGEST_LEN2 = 64;
     clip = (id) => id.length > MAX_SUGGEST_LEN2 ? `${id.slice(0, MAX_SUGGEST_LEN2)}\u2026` : id;
   }
@@ -22828,7 +22896,7 @@ var init_provisioning_facts = __esm({
 
 // ../../core/dev-server/src/app-assets.ts
 import { createHash as createHash10 } from "node:crypto";
-import { existsSync as existsSync34, lstatSync as lstatSync9, readFileSync as readFileSync35, readdirSync as readdirSync19, realpathSync as realpathSync5, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync34, lstatSync as lstatSync10, readFileSync as readFileSync35, readdirSync as readdirSync19, realpathSync as realpathSync5, statSync as statSync8 } from "node:fs";
 import { join as join36, resolve as resolve24, sep as sep8 } from "node:path";
 function contentTypeFor(name) {
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
@@ -22906,7 +22974,7 @@ function collectBrandFonts(appDir3) {
     if (rel.startsWith("/") || rel.split("/").includes("..")) continue;
     const path2 = join36(appDir3, rel);
     try {
-      if (!lstatSync9(path2).isFile()) continue;
+      if (!lstatSync10(path2).isFile()) continue;
       const root = realpathSync5(appDir3);
       if (!realpathSync5(path2).startsWith(root + sep8)) continue;
     } catch {
@@ -28204,6 +28272,10 @@ function assertSiteShellConfig(site) {
     seen.add(page.id);
     sitePageUrl(site.origin, page.path);
   }
+  for (const [key2, path2] of Object.entries(site.memberPages ?? {})) {
+    if (typeof path2 !== "string" || !path2) throw new Error(`site memberPages.${key2} must be a path`);
+    sitePageUrl(site.origin, path2);
+  }
   if (site.layout !== void 0 && !SITE_LAYOUTS.includes(site.layout)) {
     throw new Error(`site layout ${JSON.stringify(site.layout)} must be one of ${SITE_LAYOUTS.join(", ")}`);
   }
@@ -44696,17 +44768,21 @@ var init_net_scenario = __esm({
 });
 
 // ../../core/dev-server/src/capability-fixtures.ts
-function capabilityIdsIn(bundleJs) {
-  const out2 = /* @__PURE__ */ new Set();
-  for (const m of bundleJs.matchAll(/["'`]capability\.([a-z_0-9]+)\.([A-Za-z]+)["'`]/g)) {
-    if (STORE_BACKED.has(m[1])) continue;
-    out2.add(`capability.${m[1]}.${m[2]}`);
+function capabilityCoverageFor(bundleJs, granted) {
+  const out2 = {};
+  for (const action of capabilityDispatchesIn(bundleJs)) {
+    const id = action.split(".")[1];
+    out2[action] = !granted(id) ? "denied" : STORE_BACKED.has(id) ? "store" : CAPABILITY_SUCCESS[action] ? "success" : "unavailable-only";
   }
-  return [...out2].sort();
+  return out2;
+}
+function capabilityIdsIn(bundleJs) {
+  return capabilityDispatchesIn(bundleJs).filter((action) => !STORE_BACKED.has(action.split(".")[1]));
 }
 var decodeItem, MEDIA_EXT, MEDIA_MIME, FILE, CALL, MEDIA_STATUS, CAPABILITY_SUCCESS, STORE_BACKED;
 var init_capability_fixtures = __esm({
   "../../core/dev-server/src/capability-fixtures.ts"() {
+    init_known();
     decodeItem = (raw) => {
       if (typeof raw !== "string") return {};
       try {
@@ -44889,7 +44965,34 @@ var init_capability_fixtures = __esm({
         const name = path2.split("/").pop() || path2;
         return { uri: `file:///${path2.replace(/^\/+/, "")}`, name, mimeType: typeof p.mimeType === "string" ? p.mimeType : "application/octet-stream", sizeBytes: 1024, modifiedAt: ctx.clock };
       },
-      "capability.files.remove": () => ({ removed: true })
+      "capability.files.remove": () => ({ removed: true }),
+      // --- camera -----------------------------------------------------------------------------------
+      // `capturePhoto` THROWS on an envelope with no `uri` ("native handler returned no uri") and maps
+      // `cancelled` to null, so the answer is a bare CapturedAsset — not wrapped, not cancelled.
+      "capability.camera.capture": () => ({
+        uri: "file:///crawl/photo-1.jpg",
+        mime: "image/jpeg",
+        width: 1024,
+        height: 768,
+        byteSize: 204800
+      }),
+      "capability.camera.pickDocument": () => ({
+        uri: "file:///crawl/document-1.pdf",
+        name: "document-1.pdf",
+        mime: "application/pdf",
+        byteSize: 40960
+      }),
+      "capability.camera.scanQR": () => ({ code: "crawl-qr-code" }),
+      // --- location ---------------------------------------------------------------------------------
+      // `getCurrent` reads `r.position` and returns null without it — the very "no fix" arm the main
+      // axis already covers. The watch verbs are deliberately absent: `watchNext` is a long poll the
+      // binding loops on until `stopped`, and a stateless fixture that always answered a position would
+      // spin a `for await` for the crawl's whole budget.
+      "capability.location.getPermissionStatus": () => ({ status: "granted" }),
+      "capability.location.requestPermission": () => ({ status: "granted" }),
+      "capability.location.getCurrent": (_p, ctx) => ({
+        position: { lat: 32.0853, lng: 34.7818, accuracy: 10, timestamp: ctx.clock }
+      })
     };
     STORE_BACKED = /* @__PURE__ */ new Set(["local_database", "secure_storage"]);
   }
@@ -45642,7 +45745,7 @@ function declaredCapabilitiesOf(descriptor) {
   const list = Array.isArray(raw) ? raw : [];
   return new Set(list.filter((c) => typeof c === "string"));
 }
-function hostDispatch(localDbSchema, declaredCapabilities = /* @__PURE__ */ new Set(), capabilitySuccess = false, clock = 0) {
+function hostDispatch(localDbSchema, declaredCapabilities = /* @__PURE__ */ new Set(), capabilitySuccess = false, clock = 0, onDenied) {
   const localDb = /* @__PURE__ */ new Map();
   const writeQueue = [];
   const secureKv = /* @__PURE__ */ new Map();
@@ -45653,6 +45756,7 @@ function hostDispatch(localDbSchema, declaredCapabilities = /* @__PURE__ */ new
     const cap = CAPABILITY_ACTION.exec(action);
     if (cap) {
       if (!grants(declaredCapabilities, cap[1])) {
+        onDenied?.(cap[1], action);
         throw new Error(
           `${cap[1]}: capability not declared \u2014 add "${cap[1]}" to this screen's logic_bundle.declaredCapabilities. An undeclared capability call is blocked on device.`
         );
@@ -46035,7 +46139,16 @@ async function bootScreenWorker(opts) {
   };
   const appear = opts.skipAppear ? null : rootOnAppear(opts.descriptor);
   const hostCalls = [];
-  const host = hostDispatch(opts.localDbSchema, declaredCapabilitiesOf(opts.descriptor), opts.capabilitySuccess === true, opts.clock ?? CRAWL_CLOCK);
+  const deniedCapabilities = [];
+  const host = hostDispatch(
+    opts.localDbSchema,
+    declaredCapabilitiesOf(opts.descriptor),
+    opts.capabilitySuccess === true,
+    opts.clock ?? CRAWL_CLOCK,
+    (_id, action) => {
+      deniedCapabilities.push(action);
+    }
+  );
   const w = await bootBundleWorker(opts.bundleJs, {
     wixCall: opts.wixCall,
     input,
@@ -46070,7 +46183,7 @@ async function bootScreenWorker(opts) {
   }
   for (let i = 0; i < 20; i++) await yieldMacrotask();
   const { state, defects } = snapshot(w);
-  return { ...w, hostCalls, state: Object.keys(state).length ? state : w.services, defects, ...deadLifecycle ? { deadLifecycle } : {} };
+  return { ...w, hostCalls, deniedCapabilities, state: Object.keys(state).length ? state : w.services, defects, ...deadLifecycle ? { deadLifecycle } : {} };
 }
 function effectSince(w, mark, action, componentId) {
   const wix = w.calls.slice(mark.wix);
@@ -46131,12 +46244,14 @@ async function withSwallowedRejections(fn) {
 async function crawlScreenCapabilitySuccess(opts) {
   return withSwallowedRejections(async () => {
     const declared = declaredCapabilitiesOf(opts.descriptor);
+    const coverage = opts.bundleJs ? capabilityCoverageFor(opts.bundleJs, (id) => grants(declared, id)) : {};
     const modelled = opts.bundleJs ? capabilityIdsIn(opts.bundleJs).filter((id) => CAPABILITY_SUCCESS[id] && grants(declared, id.split(".")[1])) : [];
-    if (!modelled.length) return { findings: [], modelled: 0 };
+    if (!modelled.length) return { findings: [], modelled: 0, coverage };
     const r = await crawlScreenInner({ ...opts, capabilitySuccess: true });
     return {
       findings: r.findings.map((f) => ({ ...f, axis: f.axis ? `capability:success+${f.axis}` : "capability:success" })),
       modelled: modelled.length,
+      coverage,
       // The success arm is where a paid flow goes on past `isAvailable` to `proceedToPayment`, so
       // its effects are the write inventory's too — unlike its counts, they cannot double anything.
       ...r.effects?.length ? { effects: r.effects } : {}
@@ -46530,11 +46645,29 @@ async function crawlScreenInner(opts) {
       hint: `${d.reason === "no-service" ? "services defined" : "actions declared"}: ${d.declared.join(", ") || "none"}. The host fires onAppear on device, so this screen stays on its initial state forever.`
     });
   };
+  const deniedReported = /* @__PURE__ */ new Set();
+  const reportDenied = (actions, trigger) => {
+    for (const action of actions) {
+      const id = CAPABILITY_ACTION.exec(action)?.[1] ?? action;
+      if (deniedReported.has(id)) continue;
+      deniedReported.add(id);
+      findings.push({
+        screen: screenId,
+        trigger,
+        invariant: "capability-undeclared",
+        severity: "error",
+        actual: action,
+        message: `${action} was denied: "${id}" is not in this screen's logicBundle.declaredCapabilities \u2014 the call is blocked on device`,
+        hint: `add "${id}" to this screen's logicBundle.declaredCapabilities (the runtime gate) and to config.ts capabilities (what the binary is built with). If this screen should never make the call, it is reaching a shared worker action meant for another screen. A try/catch around the call hides this on device: the control just does nothing.`
+      });
+    }
+  };
   const first = await boot();
   if (first) {
     try {
       if (first.deadLifecycle) reportDeadLifecycle(first.deadLifecycle);
       check("boot", first.state, first.errors, first.defects);
+      reportDenied(first.deniedCapabilities, "boot");
       observations = collectObservations(descriptor, first.state);
       seedWords = seedTokens(first.state);
       harvestStaticEdges(first.state);
@@ -46628,6 +46761,7 @@ async function crawlScreenInner(opts) {
       const before = JSON.stringify(preState);
       const callsBefore = w.calls.length;
       const hostBefore = w.hostCalls.length;
+      const deniedBefore = w.deniedCapabilities.length;
       const errors = [];
       try {
         await handle.dispatch(parsed.action, ...workerArgs(dispatched));
@@ -46637,6 +46771,7 @@ async function crawlScreenInner(opts) {
       exercised += 1;
       const { state, defects } = snapshot(w);
       check(trigger, state, errors, defects);
+      reportDenied(w.deniedCapabilities.slice(deniedBefore), trigger);
       const navCountBefore = navEdges.length;
       drainWorkerEdges(w, `worker:${site.actionId}`);
       drainPollDirectives(w, trigger);
@@ -51098,7 +51233,7 @@ __export(config_push_edit_exports, {
   enablePushInConfig: () => enablePushInConfig,
   previewPushConfigEdit: () => previewPushConfigEdit
 });
-import { lstatSync as lstatSync10, readFileSync as readFileSync53 } from "node:fs";
+import { lstatSync as lstatSync11, readFileSync as readFileSync53 } from "node:fs";
 import { basename as basename13, join as join46 } from "node:path";
 import ts from "typescript";
 function enablePushInConfig(source, options) {
@@ -51328,7 +51463,7 @@ function backUp(dir, fileName, original) {
 }
 function isSymlink2(path2) {
   try {
-    return lstatSync10(path2).isSymbolicLink();
+    return lstatSync11(path2).isSymbolicLink();
   } catch {
     return false;
   }
@@ -51991,7 +52126,7 @@ __export(app_source_exports, {
   zipAppSource: () => zipAppSource
 });
 import { createHash as createHash24 } from "node:crypto";
-import { readdirSync as readdirSync27, lstatSync as lstatSync11, readFileSync as readFileSync55, mkdirSync as mkdirSync24, writeFileSync as writeFileSync19, existsSync as existsSync49, rmSync as rmSync11, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3 } from "node:fs";
+import { readdirSync as readdirSync27, lstatSync as lstatSync12, readFileSync as readFileSync55, mkdirSync as mkdirSync24, writeFileSync as writeFileSync19, existsSync as existsSync49, rmSync as rmSync11, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join48, resolve as resolve41, sep as sep11 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
@@ -52001,7 +52136,7 @@ function walkSourceTree(dir, file, skip, enter = () => {
     enter(relDir);
     for (const name of readdirSync27(join48(dir, relDir))) {
       const rel = relDir ? join48(relDir, name) : name;
-      const st = lstatSync11(join48(dir, rel));
+      const st = lstatSync12(join48(dir, rel));
       if (st.isSymbolicLink()) {
         skip(rel);
         continue;
@@ -52082,7 +52217,7 @@ function newestSourceChangeMs(dir) {
     dir,
     (archivePath, hostRel) => {
       if (/\.md$/i.test(archivePath) || !counts(hostRel)) return;
-      const m = lstatSync11(join48(dir, hostRel)).mtimeMs;
+      const m = lstatSync12(join48(dir, hostRel)).mtimeMs;
       if (m > newest) newest = m;
     },
     () => {
@@ -52094,7 +52229,7 @@ function newestSourceChangeMs(dir) {
     // Nor a root directory the render does not read: creating a file in `_qa/` moves `_qa/`.
     (hostRel) => {
       if (hostRel === "" || !inRead(hostRel)) return;
-      const m = lstatSync11(join48(dir, hostRel)).mtimeMs;
+      const m = lstatSync12(join48(dir, hostRel)).mtimeMs;
       if (m > newest) newest = m;
     }
   );
@@ -52142,7 +52277,7 @@ function readAppSource(zip) {
 }
 function pathKind(p) {
   try {
-    return lstatSync11(p);
+    return lstatSync12(p);
   } catch {
     return null;
   }
@@ -52239,7 +52374,7 @@ function pruneEmptyDirs(root, rel, needed, removed) {
   for (const name of readdirSync27(rel ? join48(root, rel) : root)) {
     const childRel = rel ? join48(rel, name) : name;
     const posix5 = childRel.split(sep11).join("/");
-    const kind = lstatSync11(join48(root, childRel));
+    const kind = lstatSync12(join48(root, childRel));
     if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name, rel)) {
       empty = false;
       continue;
@@ -52319,7 +52454,7 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync3, constants, existsSync as existsSync50, fstatSync, lstatSync as lstatSync12, statSync as statSync13, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync56, realpathSync as realpathSync7, renameSync as renameSync7, rmSync as rmSync12, writeFileSync as writeFileSync20, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync3, constants, existsSync as existsSync50, fstatSync, lstatSync as lstatSync13, statSync as statSync13, mkdirSync as mkdirSync25, openSync as openSync3, readFileSync as readFileSync56, realpathSync as realpathSync7, renameSync as renameSync7, rmSync as rmSync12, writeFileSync as writeFileSync20, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { extname as extname4, join as join49, resolve as resolve42, sep as sep12 } from "node:path";
 function diffReleases(prev, next) {
@@ -52442,11 +52577,11 @@ function serialize(task) {
 function himiDir(dir) {
   const root = join49(dir, ".himi");
   try {
-    return lstatSync12(root).isDirectory() ? root : null;
+    return lstatSync13(root).isDirectory() ? root : null;
   } catch (e) {
     if (e.code !== "ENOENT") return null;
     mkdirSync25(root, { recursive: true });
-    return lstatSync12(root).isDirectory() ? root : null;
+    return lstatSync13(root).isDirectory() ? root : null;
   }
 }
 function writeRunRecord(dir, record2) {
@@ -52466,7 +52601,7 @@ function writeRunRecord(dir, record2) {
 function removeRunRecord(dir, owner) {
   const root = join49(dir, ".himi");
   try {
-    if (!lstatSync12(root).isDirectory()) return;
+    if (!lstatSync13(root).isDirectory()) return;
   } catch {
     return;
   }
@@ -52484,7 +52619,7 @@ function removeRunRecord(dir, owner) {
 function removeInitWatchRecord(dir, owner) {
   const root = join49(dir, ".himi");
   try {
-    if (!lstatSync12(root).isDirectory()) return;
+    if (!lstatSync13(root).isDirectory()) return;
   } catch {
     return;
   }
@@ -52521,12 +52656,12 @@ function boardFile(dir, pathname) {
 }
 function readConfined(root, rel) {
   try {
-    if (!lstatSync12(root).isDirectory()) return null;
+    if (!lstatSync13(root).isDirectory()) return null;
     const parts = rel.split(sep12);
     let at2 = root;
     for (let i = 0; i < parts.length; i++) {
       at2 = join49(at2, parts[i]);
-      const st = lstatSync12(at2);
+      const st = lstatSync13(at2);
       if (st.isSymbolicLink() || !(i === parts.length - 1 ? st.isFile() : st.isDirectory())) return null;
     }
     const canonicalRoot = realpathSync7(root);
@@ -52592,7 +52727,7 @@ __export(screen_state_exports, {
   withHomeCaveat: () => withHomeCaveat
 });
 import { createHash as createHash25 } from "node:crypto";
-import { lstatSync as lstatSync13, readFileSync as readFileSync57 } from "node:fs";
+import { lstatSync as lstatSync14, readFileSync as readFileSync57 } from "node:fs";
 import { join as join50 } from "node:path";
 function quotableLine(text8) {
   if (!text8) return void 0;
@@ -52651,7 +52786,7 @@ function screenStateOf(services, html, opts = {}) {
 function readRecord(dir) {
   const file = join50(dir, SHOT_STATES_FILE);
   try {
-    if (!lstatSync13(file).isFile()) return {};
+    if (!lstatSync14(file).isFile()) return {};
     const r = JSON.parse(readFileSync57(file, "utf8"));
     return r.v === 1 && r.shots && typeof r.shots === "object" ? r.shots : {};
   } catch {
@@ -52727,7 +52862,7 @@ __export(studio_reel_exports, {
   utcDay: () => utcDay
 });
 import { createHash as createHash26 } from "node:crypto";
-import { lstatSync as lstatSync14, readFileSync as readFileSync58 } from "node:fs";
+import { lstatSync as lstatSync15, readFileSync as readFileSync58 } from "node:fs";
 import { basename as basename14, join as join51 } from "node:path";
 function loadMemory2(dir) {
   const m = readJson5(join51(dir, ".himi", "studio", "memory.json"));
@@ -52812,7 +52947,7 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
     if (!HISTORY_NAME.test(f)) return null;
     try {
       const path2 = join51(dir, HISTORY_DIR, f);
-      const st = lstatSync14(path2);
+      const st = lstatSync15(path2);
       if (!st.isFile() || st.nlink !== 1) return null;
       const bytes2 = readFileSync58(path2);
       return createHash26("sha256").update(bytes2).digest("hex") === f.slice(0, 64) && imageExtension(bytes2) === f.slice(65) ? bytes2 : null;
@@ -53019,7 +53154,7 @@ __export(milestones_exports, {
 });
 import { createHash as createHash27, randomUUID as randomUUID4 } from "node:crypto";
 import { spawn as spawn5 } from "node:child_process";
-import { closeSync as closeSync4, existsSync as existsSync51, lstatSync as lstatSync15, readFileSync as readFileSync59, statSync as statSync14 } from "node:fs";
+import { closeSync as closeSync4, existsSync as existsSync51, lstatSync as lstatSync16, readFileSync as readFileSync59, statSync as statSync14 } from "node:fs";
 import { createServer as createServer4 } from "node:net";
 import { basename as basename15, dirname as dirname29, isAbsolute as isAbsolute4, join as join52, relative as relative9, resolve as resolve43, sep as sep13 } from "node:path";
 function homeScreenIdOf(dir) {
@@ -53040,7 +53175,7 @@ function homeShotPath(dir, home) {
   if (!shot.startsWith(base + sep13)) return null;
   for (let p = shot; p !== root && p.startsWith(root + sep13); p = dirname29(p)) {
     try {
-      if (lstatSync15(p).isSymbolicLink()) return null;
+      if (lstatSync16(p).isSymbolicLink()) return null;
     } catch {
     }
   }
@@ -53375,7 +53510,7 @@ function rememberDraft(dir, releaseId, m) {
 function lastDraft(dir) {
   try {
     const file = join52(dir, LAST_DRAFT_FILE);
-    if (!lstatSync15(file).isFile()) return null;
+    if (!lstatSync16(file).isFile()) return null;
     const r = JSON.parse(readFileSync59(file, "utf8"));
     const m = r.manifest;
     if (r.v !== 1 || typeof r.releaseId !== "string" || !m || typeof m.screens !== "object" || !m.screens || typeof m.bundles !== "object" || !m.bundles) return null;
@@ -53437,7 +53572,7 @@ function recordInitSource(dir, opts = {}) {
 function readInitSource(dir) {
   const file = join52(dir, INIT_SOURCE_FILE);
   try {
-    if (!lstatSync15(file).isFile()) return null;
+    if (!lstatSync16(file).isFile()) return null;
     const r = JSON.parse(readFileSync59(file, "utf8"));
     if (r.v !== 1 || typeof r.fingerprint !== "string" || !/^[0-9a-f]{64}$/.test(r.fingerprint) || typeof r.newestMs !== "number") return null;
     return {
@@ -53512,7 +53647,7 @@ function contentHomePictures(dir, home) {
     if (r.state.state !== "content") continue;
     for (const file of [shot, hist && join52(hist, `${r.sha256}.png`)]) {
       try {
-        if (!file || !lstatSync15(file).isFile() || sha256Of2(file) !== r.sha256) continue;
+        if (!file || !lstatSync16(file).isFile() || sha256Of2(file) !== r.sha256) continue;
       } catch {
         continue;
       }
@@ -53525,7 +53660,7 @@ function contentHomePictures(dir, home) {
 function readInitWatch(dir) {
   const file = join52(dir, INIT_WATCH_FILE);
   try {
-    if (!lstatSync15(file).isFile()) return null;
+    if (!lstatSync16(file).isFile()) return null;
     const r = JSON.parse(readFileSync59(file, "utf8"));
     if (r.v !== 1 || typeof r.pid !== "number" || !Number.isInteger(r.pid) || r.pid < 1) return null;
     if (typeof r.url !== "string" || !/^http:\/\/127\.0\.0\.1:\d+\//.test(r.url) || typeof r.board !== "string" || typeof r.log !== "string" || typeof r.startedAt !== "string") return null;
@@ -53558,7 +53693,7 @@ function watchReminder(dir, opts = {}) {
     const file = join52(dir, REMINDERS_FILE);
     let last = Number.NaN;
     try {
-      if (lstatSync15(file).isFile()) last = Date.parse(JSON.parse(readFileSync59(file, "utf8")).watch ?? "");
+      if (lstatSync16(file).isFile()) last = Date.parse(JSON.parse(readFileSync59(file, "utf8")).watch ?? "");
     } catch {
     }
     if (Number.isFinite(last) && now - last >= 0 && now - last < WATCH_REMINDER_EVERY_MS) return void 0;
@@ -53681,7 +53816,7 @@ function afterHandoverPostcard(dir, opts = {}) {
   const file = join52(dir, ".himi", "making-of.html");
   let fresh = false;
   try {
-    const st = lstatSync15(file);
+    const st = lstatSync16(file);
     fresh = st.isFile() && !st.isSymbolicLink() && st.mtimeMs >= statSync14(join52(dir, ".himi", "progress.jsonl")).mtimeMs;
   } catch {
     fresh = false;
@@ -54811,6 +54946,7 @@ var test_exports = {};
 __export(test_exports, {
   TEST_CONFIG_FILE: () => TEST_CONFIG_FILE,
   defaultNetRules: () => defaultNetRules,
+  foldCapabilityCoverage: () => foldCapabilityCoverage,
   formatReport: () => formatReport,
   makeRecordingWixCall: () => makeRecordingWixCall,
   readCannedResponses: () => readCannedResponses,
@@ -55055,6 +55191,31 @@ async function runShotsPass(opts) {
   }
   return { dir: opts.outDir, written, ...Object.keys(states).length ? { states } : {} };
 }
+function declaredKey(descriptor) {
+  return [...declaredCapabilitiesOf(descriptor)].sort().join(",");
+}
+function foldCapabilityCoverage(perScreen) {
+  const acc = /* @__PURE__ */ new Map();
+  for (const { screen, coverage } of perScreen) {
+    for (const [call, arm] of Object.entries(coverage)) {
+      const e = acc.get(call) ?? { screens: [], deniedOn: [] };
+      if (!e.screens.includes(screen)) e.screens.push(screen);
+      if (arm === "denied") {
+        if (!e.deniedOn.includes(screen)) e.deniedOn.push(screen);
+      } else e.granted = arm;
+      acc.set(call, e);
+    }
+  }
+  const counts = { success: 0, store: 0, "unavailable-only": 0, denied: 0 };
+  const calls = {};
+  for (const call of [...acc.keys()].sort()) {
+    const e = acc.get(call);
+    const arm = e.granted ?? "denied";
+    counts[arm] += 1;
+    calls[call] = { arm, screens: e.screens.sort(), ...e.granted && e.deniedOn.length ? { deniedOn: e.deniedOn.sort() } : {} };
+  }
+  return { counts, calls };
+}
 function withCovered(rows, coveredBy) {
   const byScreen = new Map(rows.map((r) => [r.screen, r]));
   const out2 = [...rows];
@@ -55079,7 +55240,7 @@ async function runCrawl(opts) {
   if (!opts.allScreens) {
     const groups = /* @__PURE__ */ new Map();
     for (const d of requested) {
-      const key2 = `${d.bundleName ?? "-"}|${deps.crawlSignature(d.descriptor)}`;
+      const key2 = `${d.bundleName ?? "-"}|${deps.crawlSignature(d.descriptor)}|${declaredKey(d.descriptor)}`;
       const list = groups.get(key2) ?? [];
       list.push(d);
       groups.set(key2, list);
@@ -55105,6 +55266,7 @@ async function runCrawl(opts) {
   const relationFindings = [];
   let relationsChecked = 0;
   let capabilityModelled = 0;
+  const capabilityCoverageByScreen = [];
   const relationsByKind = { inverse: 0, refresh: 0, loadMore: 0, filter: 0 };
   const deepFindings = [];
   const journeyFindings = [];
@@ -55197,6 +55359,7 @@ async function runCrawl(opts) {
       const cr = await deps.crawlScreenCapabilitySuccess(args);
       writes.push(...writesFromEffects(baked.screenId, cr.effects));
       capabilityModelled += cr.modelled;
+      if (cr.coverage) capabilityCoverageByScreen.push({ screen: baked.screenId, coverage: cr.coverage });
       const keyOfC = deps.findingKey ?? ((f) => `${f.invariant}|${f.at ?? ""}|${f.screen}|${f.message}`);
       const seen = new Set([...r.findings, ...relationFindings].map(keyOfC));
       for (const f of cr.findings) if (!seen.has(keyOfC(f))) relationFindings.push(f);
@@ -55355,7 +55518,7 @@ async function runCrawl(opts) {
     ...retired.length ? { retired } : {},
     ...opts.deep && opts.deep >= 2 ? { deep: { depth: opts.deep, ...deepTotals } } : {},
     ...deps.crawlScreenRelations ? { relations: { checked: relationsChecked, byKind: relationsByKind } } : {},
-    ...deps.crawlScreenCapabilitySuccess ? { capabilities: { modelled: capabilityModelled } } : {},
+    ...deps.crawlScreenCapabilitySuccess ? { capabilities: { modelled: capabilityModelled }, capabilityCoverage: foldCapabilityCoverage(capabilityCoverageByScreen) } : {},
     ...journeyResults.length ? { journeys: journeyResults } : {},
     writes: inventory,
     ...unreachedWrites.length ? { unreachedWrites } : {},
@@ -55507,6 +55670,7 @@ var TEST_CONFIG_FILE, mapResult, triggerLabel;
 var init_test = __esm({
   "src/test.ts"() {
     init_app_map();
+    init_screen_crawl();
     init_wix_gateway_rules();
     init_crawl_layers();
     init_screen_state();
@@ -57420,7 +57584,7 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { closeSync as closeSync5, constants as constants2, lstatSync as lstatSync16, mkdirSync as mkdirSync28, openSync as openSync4, readdirSync as readdirSync28, readFileSync as readFileSync67, realpathSync as realpathSync8, renameSync as renameSync8, rmSync as rmSync13, statSync as statSync15, writeSync, existsSync as existsSync58 } from "node:fs";
+import { closeSync as closeSync5, constants as constants2, lstatSync as lstatSync17, mkdirSync as mkdirSync28, openSync as openSync4, readdirSync as readdirSync28, readFileSync as readFileSync67, realpathSync as realpathSync8, renameSync as renameSync8, rmSync as rmSync13, statSync as statSync15, writeSync, existsSync as existsSync58 } from "node:fs";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { dirname as dirname31, isAbsolute as isAbsolute5, join as join60, relative as relative11, resolve as resolve47, sep as sep15 } from "node:path";
 import * as z from "zod";
@@ -57443,7 +57607,7 @@ function symlinkComponent(base, abs) {
   for (const part of relative11(base, abs).split(sep15).filter(Boolean)) {
     cur = join60(cur, part);
     try {
-      if (lstatSync16(cur).isSymbolicLink()) return relative11(base, cur);
+      if (lstatSync17(cur).isSymbolicLink()) return relative11(base, cur);
     } catch {
       return void 0;
     }
@@ -57590,7 +57754,7 @@ function fileTools() {
         if (typeof app !== "string") return app;
         const p = confinedPath(app, a.path);
         if (typeof p !== "string") return refuse4("bad_path", p.error);
-        if (!existsSync58(p) || !lstatSync16(p).isFile()) return refuse4("not_found", `no file "${String(a.path)}"`);
+        if (!existsSync58(p) || !lstatSync17(p).isFile()) return refuse4("not_found", `no file "${String(a.path)}"`);
         const size = statSync15(p).size;
         if (size > MAX_FILE_BYTES) return refuse4("too_large", `"${String(a.path)}" is ${size} bytes \u2014 over the ${MAX_FILE_BYTES}-byte read limit`);
         return ok({ ok: true, path: a.path, bytes: size, content: readFileSync67(p, "utf8") });
@@ -57617,7 +57781,7 @@ function fileTools() {
           if (typeof p !== "string") refused2.push({ path: f.path, error: p.error });
           else if (typeof f.content !== "string") refused2.push({ path: f.path, error: "content must be text" });
           else if (Buffer.byteLength(f.content) > MAX_FILE_BYTES) refused2.push({ path: f.path, error: `over the ${MAX_FILE_BYTES}-byte limit` });
-          else if (existsSync58(p) && !lstatSync16(p).isFile()) refused2.push({ path: f.path, error: "not a regular file" });
+          else if (existsSync58(p) && !lstatSync17(p).isFile()) refused2.push({ path: f.path, error: "not a regular file" });
           else if (planned.some((q) => q.abs === p)) refused2.push({ path: f.path, error: "the same file twice in one call" });
           else planned.push({ abs: p, rel: String(f.path), content: f.content });
         }
@@ -57651,7 +57815,7 @@ function fileTools() {
           const p = confinedPath(app, rel);
           if (typeof p !== "string") refused2.push({ path: rel, error: p.error });
           else if (!existsSync58(p)) refused2.push({ path: rel, error: "no such file" });
-          else if (!lstatSync16(p).isFile()) refused2.push({ path: rel, error: "not a regular file" });
+          else if (!lstatSync17(p).isFile()) refused2.push({ path: rel, error: "not a regular file" });
           else if (!planned.includes(p)) {
             planned.push(p);
             deleted.push(rel);
@@ -74566,6 +74730,16 @@ function isSystemPage(path2, title) {
   const last = path2.split("/").filter(Boolean).pop() ?? "";
   return SYSTEM_SEGMENT.test(last) || SYSTEM_TITLE.test(title);
 }
+function deriveMemberPages(origin, urls) {
+  const found = {};
+  for (const url of urls) {
+    const path2 = pathOnSite(origin, url);
+    if (!path2) continue;
+    const key2 = MEMBER_PAGE_ROUTES[path2.split("/").filter(Boolean).join("/").toLowerCase()];
+    if (key2 && !found[key2]) found[key2] = path2;
+  }
+  return found.orders || found.bookings ? found : void 0;
+}
 function boundedTitle(s) {
   const t = oneLine2(s).replace(/\s*\(new\)\s*$/i, "");
   return t.length <= SITE_PAGE_TITLE_MAX ? t : t.slice(0, SITE_PAGE_TITLE_MAX).trimEnd();
@@ -74698,10 +74872,15 @@ function deriveSiteShell(input) {
   if (!published.length && !navLinks.length && !routes.length) {
     notes.push("site pages: the analysis read no page list, so the map has only Home \u2014 add the site's pages to `site.pages` before --apply.");
   }
+  const memberPages = deriveMemberPages(origin, navLinks.map((l) => l.href));
+  if (memberPages) {
+    notes.push(`member pages: ${Object.entries(memberPages).map(([k, v]) => `${k} \u2192 ${v}`).join(", ")} \u2014 order / booking notifications open them.`);
+  }
   const site = {
     origin,
     kind,
     pages,
+    ...memberPages ? { memberPages } : {},
     // Hidden by default — the product decision for the site shell (RFC 0062 §6); the owner can
     // turn any of them back on here, and the flags ride the OTA descriptor. A Base44 app has no
     // Wix ads to hide, so it never carries the flag (RFC 0062 §5.8).
@@ -74728,7 +74907,7 @@ function routeTitle(r) {
   const seg = r.path.split("/").filter(Boolean).pop() ?? r.path;
   return seg.replace(/[-_]+/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
 }
-var DERIVED_SITE_MAX_PAGES, SITE_PAGE_TITLE_MAX, ROLE_ICON, TAB_ROLES, SYSTEM_SEGMENT, SYSTEM_TITLE, HOME_WORD, oneLine2, RESERVED_PAGE_IDS;
+var DERIVED_SITE_MAX_PAGES, SITE_PAGE_TITLE_MAX, ROLE_ICON, TAB_ROLES, SYSTEM_SEGMENT, SYSTEM_TITLE, HOME_WORD, MEMBER_PAGE_ROUTES, oneLine2, RESERVED_PAGE_IDS;
 var init_site_shell_derive = __esm({
   "src/site-analyze/site-shell-derive.ts"() {
     init_site_shell();
@@ -74755,6 +74934,10 @@ var init_site_shell_derive = __esm({
     SYSTEM_SEGMENT = /^(popup-.*|lightbox.*|.*thank-?you.*|checkout|cart(-page)?|payment-request(-page)?|expired-reset-link|access-restricted|reservation|(event|experience|reservation|order|item)-details|(product|service|category|group|project|collection|reviews-collection|donation-thank-you)-page|post|project|collection|group|booking-(form|calendar)|plan-customization|notifications?|followers?|following|my-(?!account$)[a-z-]+|profile|search(-results)?|blank(-\d+)?|404)$/i;
     SYSTEM_TITLE = /\b(thank you|\(popup\)|leave (a )?review|notifications|followers|side cart|order error|pending approval|my (rewards|subscriptions|bookings|orders|groups|wallet))\b|\b(group|service|product|project|collection|category|cart|payment request) pages?$|\b(event|experience|reservation|item) details\b/i;
     HOME_WORD = /^(home|home ?page|main|start|accueil|inicio|início|startseite|home ?sweet ?home|בית|דף הבית|ראשי|الرئيسية|ホーム|首页|홈)$/i;
+    MEMBER_PAGE_ROUTES = {
+      "account/my-orders": "orders",
+      "account/my-bookings": "bookings"
+    };
     oneLine2 = (s) => s.replace(/[\u0000-\u001F\u007F\s]+/g, " ").trim();
     RESERVED_PAGE_IDS = /* @__PURE__ */ new Set(["account", "notifications"]);
   }
@@ -76630,7 +76813,7 @@ var init_context = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync91, mkdirSync as mkdirSync39, writeFileSync as writeFileSync35, existsSync as existsSync74, rmSync as rmSync20, readdirSync as readdirSync32, statSync as statSync20, lstatSync as lstatSync17, accessSync, constants as constants3, renameSync as renameSync9, cpSync as cpSync3 } from "node:fs";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync91, mkdirSync as mkdirSync39, writeFileSync as writeFileSync35, existsSync as existsSync74, rmSync as rmSync20, readdirSync as readdirSync32, statSync as statSync20, lstatSync as lstatSync18, accessSync, constants as constants3, renameSync as renameSync9, cpSync as cpSync3 } from "node:fs";
 import { execFile as execFile2, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash as createHash36, randomUUID as randomUUID8 } from "node:crypto";
@@ -80744,7 +80927,7 @@ function renameRestoredSource(restored, declaredApp, renamed) {
 function symlinkDestinationIssue(dest) {
   let kind;
   try {
-    kind = lstatSync17(dest);
+    kind = lstatSync18(dest);
   } catch {
     return null;
   }
@@ -82080,9 +82263,9 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
               message: `scaffold source (--source-dir ${sourceDir}): ${issue2.message}`
             }));
             const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
-            const { capabilityIssues: capabilityIssues2, contentShell: contentShell2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+            const { capabilityIssues: capabilityIssues2, contentShell: contentShell2, readLastDist: readLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
             const { report: report3, hasErrors } = summarizeLint(app, bres, outcome, strict, [
-              ...capabilityIssues2(outcome.capabilityUsage, contentShell2(buildDir, str9(flags.shell)), strict),
+              ...capabilityIssues2(outcome.capabilityUsage, contentShell2(buildDir, str9(flags.shell)), strict, readLastDist2(buildDir)),
               ...await cmsIssues(buildDir, app, strict, { local: true }),
               ...surfaceIssues(buildDir, outcome.surfaceNav, strict),
               ...tokenColorIssues(buildDir),
@@ -82367,9 +82550,9 @@ ${doNow.map((l) => `  ${l}`).join("\n")}`);
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
           collect: { lint: true, strict }
         });
-        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2, readLastDist: readLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
         const { report: report3, hasErrors } = summarizeLint(app, bres, outcome, strict, [
-          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict),
+          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict, readLastDist2(dir)),
           ...await cmsIssues(dir, app, strict, { local: true }),
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
@@ -83890,9 +84073,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           collect: { lint: true, strict }
         });
         const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
-        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2, readLastDist: readLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
         const { report: report3, hasErrors } = summarizeLint(declared, bres, outcome, strict, [
-          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict),
+          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict, readLastDist2(dir)),
           ...await cmsIssues(dir, declared, strict, { local: true }),
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
@@ -84217,11 +84400,13 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           // Its screen hashes say what changed since the last draft, on the postcard.
           manifest
         }) : null;
+        const needsBinary = (await Promise.resolve().then(() => (init_capabilities(), capabilities_exports))).needsBinaryNotice(r.json);
         print({
           ok: true,
           app,
           releaseId: release,
           draft,
+          ...needsBinary ? { needsBinary } : {},
           ...unchanged ? { unchanged: true, unchangedNote: "the serve plane already holds this exact release under this id, so nothing was written" } : {},
           ...afterDraft?.firstLook ? { firstLookPostcard: afterDraft.firstLook } : {},
           ...afterDraft?.postcard ? { postcard: afterDraft.postcard } : {},
@@ -84440,9 +84625,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           collect: { lint: true, strict }
         });
         const { navIssues: navIssues2 } = await Promise.resolve().then(() => (init_nav_lint(), nav_lint_exports));
-        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+        const { capabilityIssues: capabilityIssues2, contentShell: contentShell2, readLastDist: readLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
         const { report: report3, hasErrors } = summarizeLint(app, bres, outcome, strict, [
-          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict),
+          ...capabilityIssues2(outcome.capabilityUsage, contentShell2(dir, str9(flags.shell)), strict, readLastDist2(dir)),
           ...await cmsIssues(dir, app, strict, { local: true }),
           ...surfaceIssues(dir, outcome.surfaceNav, strict),
           ...tokenColorIssues(dir),
@@ -86043,6 +86228,20 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const sub = pos[1];
         const c = client2();
         const showDistQr = io.isTTY === true && flags.json !== true;
+        const rememberLastDist = async (jobs2) => {
+          try {
+            const dir = contentDir(flags);
+            if (!existsSync74(join75(dir, "himalaya.content.json"))) return;
+            const { lastDistFromJob: lastDistFromJob2, writeLastDist: writeLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
+            const own3 = await appId(dir);
+            for (const job of jobs2) {
+              const rec = lastDistFromJob2(job);
+              if (!rec || rec.app !== own3) continue;
+              await writeLastDist2(dir, rec);
+            }
+          } catch {
+          }
+        };
         const humanDistJob = (job) => {
           if (job.platform !== "ios" || !job.artifact || typeof job.artifact !== "object") return job;
           const { installLink: _hidden, ...safeArtifact } = job.artifact;
@@ -86138,6 +86337,7 @@ ${label2}`);
             return distUnreachable(e);
           }
           const body = { status: r2.status, ...r2.json ?? {} };
+          if (r2.ok) await rememberLastDist([body]);
           print(flags.json === true ? body : humanDistJob(body));
           if (showDistQr && r2.ok) await printDistQrForJob(body, String(body.app ?? ""));
           return r2.ok ? 0 : 1;
@@ -86178,6 +86378,7 @@ ${label2}`);
             }
             if (TERMINAL_DIST_STATUSES.has(status)) {
               const body = { status: s.status, ...rec };
+              await rememberLastDist([body]);
               print(flags.json === true ? body : humanDistJob(body));
               if (showDistQr && status === "SUCCESS") await printDistQrForJob(body, String(rec.app ?? ""));
               return status === "SUCCESS" ? 0 : 1;
@@ -86392,6 +86593,7 @@ ${label2}`);
             }
           }
         }
+        await rememberLastDist(done);
         const allOk = failures.length === 0 && done.every((d) => d.status === "SUCCESS");
         print({ ok: allOk, jobs: flags.json === true ? done : done.map(humanDistJob), ...failures.length ? { failures } : {} });
         await printDistQrsForJobs(done);

package/guides/capabilities.md

@@ -25,7 +25,7 @@ camera  —  import from @himalaya/camera
   exports:  capturePhoto, pickDocument, scanQR
   declare:  config.ts `capabilities` AND each calling screen's `logicBundle.declaredCapabilities`
   binary:   needs a NATIVE build — iOS NSCameraUsageDescription; Android android.permission.CAMERA …
-  shells:   served by owner-lite; NOT in the branded-lite, brandy, demo-app, player binary
+  shells:   served by owner-lite, player; `himi dist` adds it to base44, branded-lite, brandy; NOT in the demo-app binary
 ```
 
 Agents: the same data is the `himi_capabilities` MCP tool. `himi sdk <name>` also prints the
@@ -89,8 +89,23 @@ Name the shell your app ships in once, in `himalaya.content.json`, and both `him
 
 `himi test` boots every screen's real worker and dispatches its actions. A declared capability
 answers with its "unavailable" result there, so the crawl checks that your worker handles a
-declined camera or a missing position without breaking. In the web preview, camera capture and
-geolocation use the browser's own file picker and location prompt.
+declined camera or a missing position without breaking; a second pass then answers the modelled
+ones (camera, location, photos, speech, …) with a SUCCESS result, so the code behind a granted
+permission runs too. Two things in the `--json` report are about capabilities:
+
+- a **`capability-undeclared`** finding for every call the screen's gate denied — even one your
+  worker caught, which on device looks like a dead button rather than an error;
+- **`capabilityCoverage`**: each `capability.<id>.<verb>` your workers call, and what the crawl
+  answers it with — `success` (modelled), `store` (a real session store: `local_database`,
+  `secure_storage`), `unavailable-only` (no model yet, so only the declined path runs), or `denied`.
+  See [himi-test → Capabilities](himi-test.md#capabilities).
+
+The bundle scan only ever **reports**: it never adds a capability to a screen's declaration. The
+per-screen list is the authorization boundary, so a worker shared by two screens cannot widen the
+one that never makes the call.
+
+In the web preview, camera capture and geolocation use the browser's own file picker and location
+prompt.
 
 ## 5. Ship it
 
@@ -103,6 +118,14 @@ geolocation use the browser's own file picker and location prompt.
   entitlements, Android permissions / features) and registers their handlers at boot.
   `himi capabilities --shell <s>` shows such an id as `yes → dist`, and `himi validate` warns that
   it "needs a new `himi dist`" — the installed binary cannot call it until you rebuild.
+- **"needs a new binary".** A successful `himi dist` remembers what its binary was built with —
+  on the job (`buildCapabilities`) and in your package (`.himi/last-dist.json`). From then on
+  `himi push` prints `needs a new binary: <ids> — run himi dist` when the release declares an id
+  that build lacks, a following device's draft offer says the same, and `himi validate` compares
+  against that build rather than the committed shell.
+- **Never a silent strip.** On iOS, a capability whose entitlement the signing profile cannot grant
+  fails the dist job, naming the capability — the binary would otherwise build green and fail on
+  the first call. The minted profile's Apple capabilities are derived from the build's own set.
 - **Preview before you build:** `himi dist --plan` prints what the release declares, what the shell
   already serves, what the build would add and the exact native delta. No job is started.
 - **Write the permission prompt.** The OS shows a sentence when the app asks for camera, location,

package/guides/himi-test.md

@@ -125,6 +125,7 @@ Only **unambiguous** defects, so a green run stays worth trusting:
 | `poll-action-missing` | error | A `_poll` directive every host will silently ignore — an action the bundle never declares, a malformed `action`, a missing `id`, or a non-positive `intervalMs`. Each ends the same way: a screen that never refreshes, with nothing saying why. Nothing in the descriptor names the polled action, so no static check can see it. (A merely too-small interval is legal — the host clamps it.) |
 | `no-request-issued` | **warning** | A worker that uses the Wix transport but never fetches — "the screen loaded with sample data." A warning: a conditional or tap-triggered fetch is legitimate. |
 | `native-decode-failed` | error | Under `--native`, the real Swift/Kotlin decoder rejected the baked descriptor bytes (one bad enum blanks the whole screen on device). |
+| `capability-undeclared` | error | A `capability.<id>.<verb>` call the screen's gate denied — reported from the gate itself, so it is raised **even when the worker catches the rejection** (which on device leaves a control that silently does nothing). Fix: declare the id on that screen's `logicBundle.declaredCapabilities` and in `config.ts` `capabilities`. One per capability per screen. See [Capabilities](#capabilities). |
 | `journey-failed` | error | A `himi-test.json` journey named an action the screen lacks, threw, or never rendered its `expectText`. |
 | `inverse-pair-diverges` | **warning** | An action and the action that undoes it do not return to the state the boot settled on — `add` then `remove` leaving a different list, or a counter it forgot to put back. |
 | `refresh-not-idempotent` | **warning** | `refresh` from a fresh boot settles somewhere other than the boot did, on identical data — usually a refresh that appends instead of replacing. |
@@ -267,6 +268,36 @@ went unproven, it names the gap and pairs it with a himi command or a source edi
 derived from what actually ran, never homework. Assembly:
 `tools/himi-cli/src/coverage.ts`.
 
+## Capabilities
+
+A `capability.*` call is answered twice. The main pass answers every granted one with `null` — the
+device's "unavailable" arm — so a screen's declined-camera / no-position path is checked. The
+capability-success pass then re-crawls each screen whose bundle calls a **modelled** capability
+(audio-record, speech, on-device-ai, calls, media-playback, calendar, files, photos, pdf, share,
+open-url, camera, location) with a success answer shaped exactly like the one its SDK binding
+destructures, so the code behind a granted permission runs too. `local_database` and
+`secure_storage` are served from a real session store on both passes.
+
+`--json` carries what each call got as `capabilityCoverage`:
+
+```jsonc
+"capabilityCoverage": {
+  "counts": { "success": 2, "store": 1, "unavailable-only": 1, "denied": 0 },
+  "calls": {
+    "capability.camera.capture":          { "arm": "success",          "screens": ["notes"] },
+    "capability.local_database.getAll":   { "arm": "store",            "screens": ["notes"] },
+    "capability.location.getCurrent":     { "arm": "success",          "screens": ["notes"] },
+    "capability.haptic.play":             { "arm": "unavailable-only", "screens": ["notes"] }
+  }
+}
+```
+
+`unavailable-only` means no model exists yet, so only the declined path of that call has run;
+`denied` means no screen running the call grants its id (each denial is also a
+`capability-undeclared` finding), and `deniedOn` lists screens that deny a call others allow. The
+map is static — it says what a call would be answered with, not that a tap reached it; the gap
+ledger says that.
+
 ## Writes to Wix
 
 Every run lists what the app **writes** to the Wix site, per screen and action — the inventory an

package/guides/qa-builds.md

@@ -326,7 +326,7 @@ one never blocks a rollout — the dist routes just `501` with the reason.
 | `HIMI_DIST_ALLOWED_XCODE_VERSIONS` | comma-separated Xcode versions a caller may pin (`xcodeVersion` in the request body); unset ⇒ the built-in list. Nothing upstream constrains this field — the Job Service client validates it as `z.string().max(50)` — so without the allow-list it is caller-supplied text choosing a toolchain on a shared pool. A blank value reads as unset (the built-in list), never as "allow anything". |
 | `HIMI_DIST_APPLE_SIGNING` | **Minted iOS signing is ON by default** — set `0`/`false`/`off` to disable it and go back to scavenging a profile off the pool. Rarely what you want: minting ships the profile and the certificate with the job, so nothing has to pre-exist on the machine. (Earlier text here cited `0 profile(s) available` on four machines as a reason to keep minting on — that reading came from a TRUNCATED survey and is retracted below; build 992367 logged 352 profiles. The recommendation is unchanged, the evidence for it was wrong.) |
 | `HIMI_DIST_APPLE_API_KEY_NAME` | Apple account the identity is minted under; unset ⇒ `wix-enterprise` |
-| `HIMI_DIST_APPLE_CAPABILITIES` | COMPLETE capability set for a minted id (the sync call replaces rather than merges); unset ⇒ push + associated domains |
+| `HIMI_DIST_APPLE_CAPABILITIES` | Apple capability types to ADD to every minted id. The set itself is derived per job: push + associated domains (the template baseline) plus the Apple capability of every entitlement in the iOS plan of the job's `buildCapabilities` (`appleCapabilitiesForBuild`). This variable only **widens** that derived set (e.g. `APP_GROUPS` for a widget) — it can never remove a derived capability, because the sync call replaces rather than merges and a narrower list would switch off what the content asked for. Unset ⇒ the derived set alone |
 | `QA_DIST_SLACK_CHANNEL` | Post QA build results to a channel instead of DMing the requester. Worth setting: a DM is unreadable by anything but that person, so a channel is what makes build results scriptable (and visible to the team). |
 
 Both per-credential caps are **clamped into the range that can be enforced**, and the two ranges

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1187.0",
+  "version": "0.1188.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "ffb3ffbafe40c1d9eed8d08db97af4d46cc1506f60fc49e11cf7df80"
+  "falconPackageHash": "67d96922cd1adeed2becc3bef5c4d027397fd441f83346cd018cb252"
 }