@wix/himalaya-cli 0.1350.0 → 0.1352.0

package/dist/cli.mjs

@@ -22082,6 +22082,9 @@ function isBinaryCore(configTs, distributionJson) {
     return false;
   }
 }
+function binaryCoreSatelliteTrait(product) {
+  return product;
+}
 function binaryCoreSatellitePath(product) {
   return `Satellites/${product}`;
 }
@@ -22106,7 +22109,7 @@ function binaryCoreVersion(distributionJson, configTs = "") {
   }
   return /distribution:\s*\{[^}]*\bcoreVersion:\s*["']([^"']+)["']/.exec(configTs)?.[1]?.trim() || void 0;
 }
-var BINARY_CORE_USAGE_STRINGS, BINARY_CORE_PRE_SPLIT_USAGE_STRINGS, BINARY_CORE_SPM_PACKAGE, BINARY_CORE_MAVEN_GROUP, BINARY_CORE_IOS_SATELLITES, BINARY_CORE_ANDROID_PUBLISH_BUILDS, BINARY_CORE_MODULES_SINCE;
+var BINARY_CORE_USAGE_STRINGS, BINARY_CORE_PRE_SPLIT_USAGE_STRINGS, BINARY_CORE_SPM_PACKAGE, BINARY_CORE_MAVEN_GROUP, BINARY_CORE_IOS_SATELLITES, BINARY_CORE_IOS_PATH_ONLY_SATELLITES, BINARY_CORE_IOS_TRAIT_SATELLITES, BINARY_CORE_IOS_TRAIT_SELECTOR, BINARY_CORE_ANDROID_PUBLISH_BUILDS, BINARY_CORE_MODULES_SINCE;
 var init_binary_core = __esm({
   "../../core/sdk/capability-catalog/src/binary-core.ts"() {
     init_modules();
@@ -22133,6 +22136,11 @@ var init_binary_core = __esm({
       "HimalayaCoreGodot",
       "HimalayaCoreSentry"
     ]);
+    BINARY_CORE_IOS_PATH_ONLY_SATELLITES = Object.freeze(["HimalayaCoreGodot"]);
+    BINARY_CORE_IOS_TRAIT_SATELLITES = Object.freeze(
+      BINARY_CORE_IOS_SATELLITES.filter((p2) => !BINARY_CORE_IOS_PATH_ONLY_SATELLITES.includes(p2))
+    );
+    BINARY_CORE_IOS_TRAIT_SELECTOR = "HimalayaCoreTraits";
     BINARY_CORE_ANDROID_PUBLISH_BUILDS = Object.freeze({
       ":core-runtime-godot": "apps/himi-game/android"
     });
@@ -22965,10 +22973,13 @@ __export(gen_native_config_exports, {
   androidTvLeanbackPlan: () => androidTvLeanbackPlan,
   applyModuleFlags: () => applyModuleFlags,
   applyToFile: () => applyToFile,
+  applyTraitSelector: () => applyTraitSelector,
   assertModuleFlagsMarkers: () => assertModuleFlagsMarkers,
   assertSingleMarkerPair: () => assertSingleMarkerPair,
   assertSingleModuleInstall: () => assertSingleModuleInstall,
   automotiveAppDescPath: () => automotiveAppDescPath,
+  binaryCorePackage: () => binaryCorePackage,
+  binaryCorePackageFields: () => binaryCorePackageFields,
   binaryCorePackagePath: () => binaryCorePackagePath,
   buildSet: () => buildSet,
   buildSetOfAppDir: () => buildSetOfAppDir,
@@ -23013,6 +23024,7 @@ __export(gen_native_config_exports, {
   renderModulesSwiftInstall: () => renderModulesSwiftInstall,
   renderOrientationXml: () => renderOrientationXml,
   renderPlistYaml: () => renderPlistYaml,
+  renderTraitSelector: () => renderTraitSelector,
   resolveDistBake: () => resolveDistBake,
   swiftFilesWithModuleMarkers: () => swiftFilesWithModuleMarkers,
   tvInfoPlan: () => tvInfoPlan,
@@ -23188,38 +23200,85 @@ function renderModulesAndroidInclude(projects, indent) {
 function renderModulesAndroidLink(projects, indent) {
   return projects.map((p2) => `${indent}implementation(project("${p2}"))`);
 }
-function renderModulesIosLinkBinary(products, indent) {
+function renderModulesIosLinkBinary(products, indent, form = "path") {
   return products.flatMap(
-    (p2) => BINARY_CORE_IOS_SATELLITES.includes(p2) ? [`${indent}- package: ${p2}`, `${indent}  product: ${p2}`] : [`${indent}- package: ${BINARY_CORE_SPM_PACKAGE}`, `${indent}  product: ${p2}`]
+    (p2) => BINARY_CORE_IOS_SATELLITES.includes(p2) && form === "path" ? [`${indent}- package: ${p2}`, `${indent}  product: ${p2}`] : [`${indent}- package: ${BINARY_CORE_SPM_PACKAGE}`, `${indent}  product: ${p2}`]
   );
 }
-function renderModulesIosPackageBinary(products, corePackagePath, indent) {
+function renderModulesIosPackageBinary(products, core, indent) {
   const satellites = products.filter((p2) => BINARY_CORE_IOS_SATELLITES.includes(p2));
   if (!satellites.length) return [];
-  if (!corePackagePath) {
+  if (!core) {
     throw new Error(
-      `a binary-core app that links ${satellites.join(", ")} needs its ${BINARY_CORE_SPM_PACKAGE} package declared by \`path:\` in ios/project.yml \u2014 the satellite packages sit beside the locally built binary package (augment-with-wixauth.sh); the \`url:\` form has no published satellite to point at (#4129)`
+      `a binary-core app that links ${satellites.join(", ")} needs its ${BINARY_CORE_SPM_PACKAGE} package declared in ios/project.yml by \`path:\` or \`url:\` (#4129)`
     );
   }
-  return satellites.flatMap((p2) => [`${indent}${p2}:`, `${indent}  path: ${yamlScalar(`${corePackagePath.replace(/\/+$/, "")}/${binaryCoreSatellitePath(p2)}`)}`]);
+  if ("url" in core) {
+    assertUrlFormSatellites(satellites);
+    return [`${indent}${BINARY_CORE_IOS_TRAIT_SELECTOR}:`, `${indent}  path: ${BINARY_CORE_IOS_TRAIT_SELECTOR}`];
+  }
+  return satellites.flatMap((p2) => [`${indent}${p2}:`, `${indent}  path: ${yamlScalar(`${core.path.replace(/\/+$/, "")}/${binaryCoreSatellitePath(p2)}`)}`]);
 }
-function binaryCorePackagePath(projectYml) {
+function assertUrlFormSatellites(satellites) {
+  const pathOnly = satellites.filter((p2) => BINARY_CORE_IOS_PATH_ONLY_SATELLITES.includes(p2));
+  if (pathOnly.length) {
+    throw new Error(
+      `a binary-core app that links ${pathOnly.join(", ")} needs its ${BINARY_CORE_SPM_PACKAGE} package declared by \`path:\` in ios/project.yml: its third-party package needs a higher iOS floor than the published package's, and SwiftPM has no per-product platform, so the \`url:\` package cannot carry it (BINARY_CORE_IOS_PATH_ONLY_SATELLITES)`
+    );
+  }
+}
+function renderTraitSelector(products, core) {
+  if (!core || !("url" in core)) return void 0;
+  const satellites = products.filter((p2) => BINARY_CORE_IOS_SATELLITES.includes(p2));
+  if (!satellites.length) return void 0;
+  assertUrlFormSatellites(satellites);
+  const traits = satellites.filter((p2) => BINARY_CORE_IOS_TRAIT_SATELLITES.includes(p2)).map(binaryCoreSatelliteTrait).sort();
+  return `// swift-tools-version:6.1
+// GENERATED by tools/native-config from config.ts capabilities \u2014 do not edit.
+//
+// Enables the satellite modules this app links (${satellites.join(", ")}) in the published
+// ${BINARY_CORE_SPM_PACKAGE} package: each is a product there whose third-party packages are gated by a
+// package trait, off by default, and an Xcode project cannot set traits itself (#4129). No targets:
+// this package only depends on the same url with those traits.
+import PackageDescription
+
+let package = Package(
+    name: ${JSON.stringify(BINARY_CORE_IOS_TRAIT_SELECTOR)},
+    dependencies: [
+        .package(url: ${JSON.stringify(core.url)}, ${core.requirement}, traits: [${traits.map((t2) => JSON.stringify(t2)).join(", ")}]),
+    ]
+)
+`;
+}
+function binaryCorePackageFields(projectYml) {
   const lines = projectYml.replace(/\r\n?/g, "\n").split("\n");
   const head = lines.findIndex((l2) => new RegExp(`^[ \\t]*${BINARY_CORE_SPM_PACKAGE}:[ \\t]*(?:#.*)?$`).test(l2));
-  if (head < 0) return void 0;
+  const fields = {};
+  if (head < 0) return fields;
   const indent = /^[ \t]*/.exec(lines[head])[0].length;
   for (const line of lines.slice(head + 1)) {
     if (!line.trim() || /^[ \t]*#/.test(line)) continue;
     if (/^[ \t]*/.exec(line)[0].length <= indent) break;
-    const m2 = /^[ \t]*path:[ \t]*(.*)$/.exec(line);
+    const m2 = /^[ \t]*([A-Za-z]+):[ \t]*(.*)$/.exec(line);
     if (!m2) continue;
-    const v2 = m2[1];
+    const v2 = m2[2];
     const quoted2 = /^"((?:[^"\\]|\\.)*)"|^'((?:[^']|'')*)'/.exec(v2);
-    if (quoted2) return quoted2[1] !== void 0 ? JSON.parse(`"${quoted2[1]}"`) : quoted2[2].replace(/''/g, "'");
-    const plain2 = v2.replace(/[ \t]+#.*$/, "").trim();
-    return plain2 || void 0;
+    const value = quoted2 ? quoted2[1] !== void 0 ? JSON.parse(`"${quoted2[1]}"`) : quoted2[2].replace(/''/g, "'") : v2.replace(/[ \t]+#.*$/, "").trim();
+    if (value && !(m2[1] in fields)) fields[m2[1]] = value;
   }
-  return void 0;
+  return fields;
+}
+function binaryCorePackagePath(projectYml) {
+  return binaryCorePackageFields(projectYml).path;
+}
+function binaryCorePackage(projectYml) {
+  const f2 = binaryCorePackageFields(projectYml);
+  if (f2.path) return { path: f2.path };
+  if (!f2.url) return void 0;
+  const q2 = (v2) => JSON.stringify(v2);
+  const requirement = f2.from ?? f2.majorVersion ? `from: ${q2(f2.from ?? f2.majorVersion)}` : f2.minorVersion ? `.upToNextMinor(from: ${q2(f2.minorVersion)})` : f2.exactVersion ?? f2.version ? `exact: ${q2(f2.exactVersion ?? f2.version)}` : f2.minVersion && f2.maxVersion ? `${q2(f2.minVersion)}..<${q2(f2.maxVersion)}` : f2.branch ? `branch: ${q2(f2.branch)}` : f2.revision ? `revision: ${q2(f2.revision)}` : void 0;
+  if (!requirement) throw new Error(`ios/project.yml: the ${BINARY_CORE_SPM_PACKAGE} \`url:\` package has no version requirement native-config can read (from / exactVersion / minorVersion / minVersion+maxVersion / branch / revision)`);
+  return { url: f2.url, requirement };
 }
 function renderModulesAndroidLinkBinary(projects, coreVersion, indent) {
   return projects.map((p2) => {
@@ -23231,6 +23290,7 @@ function moduleLinkRenderers(modules, binary) {
   if (!binary) {
     return {
       iosLinked: () => modules.spm,
+      iosTraitSelector: () => void 0,
       iosPackage: (i2) => renderModulesIosPackage(modules.spm, i2),
       iosLink: (i2) => renderModulesIosLink(modules.spm, i2),
       androidInclude: (i2) => renderModulesAndroidInclude(modules.gradle, i2),
@@ -23238,11 +23298,13 @@ function moduleLinkRenderers(modules, binary) {
     };
   }
   const iosLinked = () => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? modules.spm : [];
+  const form = () => binary.corePackage?.() && "url" in binary.corePackage() ? "url" : "path";
   return {
     iosLinked,
-    iosPackage: (i2) => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? renderModulesIosPackageBinary(modules.spm, binary.corePackagePath?.(), i2) : [],
+    iosPackage: (i2) => iosLinked().length ? renderModulesIosPackageBinary(modules.spm, binary.corePackage?.(), i2) : [],
+    iosTraitSelector: () => iosLinked().length ? renderTraitSelector(modules.spm, binary.corePackage?.()) : void 0,
     // Same version rule as Android: a pre-split core carries the capabilities and has no products.
-    iosLink: (i2) => modules.spm.length && coreVersionHasModules(binary.coreVersion()) ? renderModulesIosLinkBinary(modules.spm, i2) : [],
+    iosLink: (i2) => iosLinked().length ? renderModulesIosLinkBinary(modules.spm, i2, form()) : [],
     androidInclude: () => [],
     // A core pinned below BINARY_CORE_MODULES_SINCE predates the split and carries the capabilities
     // itself; no module AAR exists at that version, so it links none.
@@ -23470,6 +23532,9 @@ function removeWholeFile(path2, check) {
   rmSync7(path2);
   return { path: path2, outcome: "removed" };
 }
+function applyTraitSelector(path2, content, check) {
+  return content === void 0 ? removeWholeFile(path2, check) : applyWholeFile(path2, content, check);
+}
 function iapBindingInfo(binding2) {
   return { HimiIapPurchasesAppId: binding2.purchasesAppId, HimiIapSiteId: binding2.siteId, HimiIapBundleId: binding2.bundleId };
 }
@@ -23535,7 +23600,7 @@ function genNativeConfig(app, opts = {}) {
         if (!v2) throw new Error(`${app}: a binary-core app that links native modules (${modules.gradle.join(", ")}) needs distribution.json coreVersion`);
         return v2;
       },
-      corePackagePath: () => existsSync34(iosProjectYml(app)) ? binaryCorePackagePath(readFileSync33(iosProjectYml(app), "utf8")) : void 0
+      corePackage: () => existsSync34(iosProjectYml(app)) ? binaryCorePackage(readFileSync33(iosProjectYml(app), "utf8")) : void 0
     } : void 0
   );
   if (binaryCore) {
@@ -23614,6 +23679,9 @@ function genNativeConfig(app, opts = {}) {
     applyToFile(iosProjectYml(app), "yaml", LABEL_MODULES_IOS_PACKAGE, moduleLinks.iosPackage, check),
     applyToFile(iosProjectYml(app), "yaml", LABEL_MODULES_IOS_LINK, moduleLinks.iosLink, check),
     applyModuleFlags(iosProjectYml(app), moduleLinks.iosLinked(), check),
+    // Model B, `url:` form: the trait selector package that enables the linked satellites' traits
+    // in the published package (#4129). Removed when the app links none, or is not in that form.
+    applyTraitSelector(join34(dirname21(iosProjectYml(app)), BINARY_CORE_IOS_TRAIT_SELECTOR, "Package.swift"), moduleLinks.iosTraitSelector(), check),
     // macOS (RFC 0046) reuses the iOS boot, so it links the same macOS-capable modules.
     applyToFile(macosProjectYml(app), "yaml", LABEL_MODULES_IOS_PACKAGE, (i2) => renderModulesIosPackage(modules.macos, i2), check),
     applyToFile(macosProjectYml(app), "yaml", LABEL_MODULES_IOS_LINK, (i2) => renderModulesIosLink(modules.macos, i2), check),
@@ -32757,8 +32825,15 @@ var init_app_identity = __esm({
 });
 
 // ../../core/ts/src/registry-app-normalize.ts
+function isPlayerRequirements(v2) {
+  if (!v2 || typeof v2 !== "object") return false;
+  const r2 = v2;
+  return PLAYER_REQUIREMENT_KINDS.every((kind) => Array.isArray(r2[kind]) && r2[kind].every((id) => typeof id === "string"));
+}
+var PLAYER_REQUIREMENT_KINDS;
 var init_registry_app_normalize = __esm({
   "../../core/ts/src/registry-app-normalize.ts"() {
+    PLAYER_REQUIREMENT_KINDS = ["capabilities", "nativeComponents", "authProviders"];
   }
 });
 
@@ -37349,7 +37424,7 @@ function newRicosRequestId() {
 async function runRicosImageUpload(o2) {
   const { session, uploadService: svc, requestId: requestId2, file: file2, deps } = o2;
   const t2 = deps.timers ?? { setTimeout: (fn2, ms2) => setTimeout(fn2, ms2), clearTimeout: (h2) => clearTimeout(h2) };
-  const fail4 = (reason) => {
+  const fail5 = (reason) => {
     session.failMedia(requestId2);
     return { ok: false, reason };
   };
@@ -37375,32 +37450,32 @@ async function runRicosImageUpload(o2) {
       });
       deps.dispatch({ actionId: `tier5.${svc}.genUpload`, args: { requestId: requestId2, mimeType: file2.mimeType, fileName: file2.fileName, ...file2.sizeBytes !== void 0 ? { sizeBytes: file2.sizeBytes } : {} } });
     });
-    if (!entry) return fail4("timeout");
-    if (entry.status !== "ready" || !entry.uploadUrl || !/^https:\/\//i.test(entry.uploadUrl)) return fail4("gen_upload");
+    if (!entry) return fail5("timeout");
+    if (entry.status !== "ready" || !entry.uploadUrl || !/^https:\/\//i.test(entry.uploadUrl)) return fail5("gen_upload");
     let body;
     try {
       body = typeof file2.body === "function" ? await file2.body() : file2.body;
     } catch {
-      return fail4("read");
+      return fail5("read");
     }
     const sep21 = entry.uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
       res = await deps.fetch(`${entry.uploadUrl}${sep21}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
     } catch {
-      return fail4("put");
+      return fail5("put");
     }
-    if (!res.ok) return fail4("put");
+    if (!res.ok) return fail5("put");
     let json6;
     try {
       json6 = await res.json();
     } catch {
-      return fail4("bad_descriptor");
+      return fail5("bad_descriptor");
     }
     const root = json6 && typeof json6 === "object" ? json6 : {};
     const d2 = root.file && typeof root.file === "object" ? root.file : root;
     const id = typeof d2.id === "string" ? d2.id : "";
-    if (!id) return fail4("bad_descriptor");
+    if (!id) return fail5("bad_descriptor");
     const ok2 = session.resolveMedia(requestId2, {
       id,
       url: typeof d2.url === "string" ? d2.url : "",
@@ -134449,7 +134524,7 @@ async function crawlScreen(opts) {
 async function crawlScreenJourney(opts) {
   return withSwallowedRejections(async () => {
     const findings = [];
-    const fail4 = (message, step) => {
+    const fail5 = (message, step) => {
       findings.push({
         screen: opts.screenId,
         trigger: step ? { tap: step.component ?? null, key: "journey", action: step.action } : "boot",
@@ -134460,7 +134535,7 @@ async function crawlScreenJourney(opts) {
       });
     };
     if (!opts.bundleJs) {
-      fail4(`journey "${opts.journey.name}" targets a screen without a worker bundle`);
+      fail5(`journey "${opts.journey.name}" targets a screen without a worker bundle`);
       return { screen: opts.screenId, journey: opts.journey.name, stepsExercised: 0, findings };
     }
     const { call: wixCall } = layeredTransport({ rules: opts.rules, cmsSeed: opts.cmsSeed, canned: opts.canned });
@@ -134485,23 +134560,23 @@ async function crawlScreenJourney(opts) {
     for (const step of opts.journey.steps) {
       const declared = sites.find((site2) => site2.actionId === step.action && (step.component === void 0 || site2.componentId === step.component));
       if (!declared) {
-        fail4(`journey "${opts.journey.name}" cannot find ${step.component ? `${step.component} \u2192 ` : ""}${step.action} in this screen`, step);
+        fail5(`journey "${opts.journey.name}" cannot find ${step.component ? `${step.component} \u2192 ` : ""}${step.action} in this screen`, step);
         continue;
       }
       const state = snapshot(worker).state;
       const site = effectiveSiteFor(declared, state);
       if (!site) {
-        fail4(`journey "${opts.journey.name}" cannot dispatch ${step.action}: its list has no rendered row`, step);
+        fail5(`journey "${opts.journey.name}" cannot dispatch ${step.action}: its list has no rendered row`, step);
         continue;
       }
       const parsed = parseWorkerAction(site.actionId);
       if (!parsed) {
-        fail4(`journey "${opts.journey.name}" step ${step.action} is not a worker action; cross-screen navigation belongs in the regular edge pass`, step);
+        fail5(`journey "${opts.journey.name}" step ${step.action} is not a worker action; cross-screen navigation belongs in the regular edge pass`, step);
         continue;
       }
       const handle = worker.handles[parsed.service];
       if (!handle || !handle.actionNames().includes(parsed.action)) {
-        fail4(`journey "${opts.journey.name}" names unavailable worker action ${step.action}`, step);
+        fail5(`journey "${opts.journey.name}" names unavailable worker action ${step.action}`, step);
         continue;
       }
       const mark = { wix: worker.calls.length, host: worker.hostCalls.length };
@@ -134510,18 +134585,18 @@ async function crawlScreenJourney(opts) {
         for (let i2 = 0; i2 < 8; i2++) await yieldMacrotask();
         stepsExercised += 1;
       } catch (error) {
-        fail4(`journey "${opts.journey.name}" step ${step.action} threw: ${errText(error)}`, step);
+        fail5(`journey "${opts.journey.name}" step ${step.action} threw: ${errText(error)}`, step);
       }
       const stepEffect = effectSince(worker, mark, site.actionId, site.componentId);
       if (stepEffect) effects.push(stepEffect);
     }
     const settled = snapshot(worker);
     if (worker.errors.length) {
-      for (const error of worker.errors) fail4(`journey "${opts.journey.name}" worker error: ${error.service}: ${error.message}`);
+      for (const error of worker.errors) fail5(`journey "${opts.journey.name}" worker error: ${error.service}: ${error.message}`);
     }
     const values = collectObservations(opts.descriptor, settled.state).join("\n");
     for (const expected of opts.journey.expectText) {
-      if (!values.includes(expected)) fail4(`journey "${opts.journey.name}" never rendered its expected visible result: ${JSON.stringify(expected)}`);
+      if (!values.includes(expected)) fail5(`journey "${opts.journey.name}" never rendered its expected visible result: ${JSON.stringify(expected)}`);
     }
     return { screen: opts.screenId, journey: opts.journey.name, stepsExercised, findings, ...effects.length ? { effects } : {} };
   });
@@ -135985,12 +136060,14 @@ __export(build_exports2, {
   bakeCatalogs: () => bakeCatalogs,
   bakeNeedsLiveOrigin: () => bakeNeedsLiveOrigin,
   bakeWidgets: () => bakeWidgets,
+  buildFromLoaded: () => buildFromLoaded,
   buildRelease: () => buildRelease,
   buildReleaseFromContent: () => buildReleaseFromContent,
   bundleNameFromUrl: () => bundleNameFromUrl,
   collectComponentTypes: () => collectComponentTypes,
   contentReleaseId: () => contentReleaseId,
   countingWixCall: () => countingWixCall,
+  declaresHostProvidedIdentity: () => declaresHostProvidedIdentity,
   gitSha: () => gitSha,
   isMonorepoCheckout: () => isMonorepoCheckout,
   l10nLintOptions: () => l10nLintOptions,
@@ -137149,6 +137226,11 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       nativeComponents: [...requiredNativeComponents].sort(),
       authProviders: [config.auth.providerId].filter(Boolean).sort()
     },
+    // #4091 — the app takes its Wix identity from a HOST (Spaces Lite) instead of signing in
+    // itself (#4088 `hostProvided` on its auth provider). A host that lends its identity only
+    // opens an app that accepts it. Written only when true, so every other app's release — and
+    // its releaseId — is byte-identical to one built before the field existed.
+    ...declaresHostProvidedIdentity(config.auth) ? { hostProvidedIdentity: true } : {},
     iconHash,
     ...brandFonts.length ? { brandFonts } : {},
     handlers,
@@ -137275,6 +137357,10 @@ function listBuildableApps() {
   const appsDir = join47(REPO_ROOT7, "apps");
   return readdirSync25(appsDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && !d2.name.startsWith("_")).map((d2) => d2.name);
 }
+function declaresHostProvidedIdentity(auth) {
+  const config = auth?.config;
+  return typeof config === "object" && config !== null && config.hostProvided === true;
+}
 var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, REPO_ROOT7, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL;
 var init_build3 = __esm({
   "../release-build/build.ts"() {
@@ -152306,30 +152392,30 @@ function logicalCollection(spec, app) {
 }
 function assertFieldValue(type, key2, value) {
   if (value === null) return;
-  const fail4 = () => {
+  const fail5 = () => {
     throw new Error(`field "${key2}" must be ${type}`);
   };
   if (type === "NUMBER") {
-    if (typeof value !== "number" || !Number.isFinite(value)) fail4();
+    if (typeof value !== "number" || !Number.isFinite(value)) fail5();
     return;
   }
   if (type === "BOOLEAN") {
-    if (typeof value !== "boolean") fail4();
+    if (typeof value !== "boolean") fail5();
     return;
   }
   if (type === "ARRAY_STRING") {
-    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) fail4();
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) fail5();
     return;
   }
   if (type === "ADDRESS" || type === "RICH_CONTENT") {
-    if (!value || typeof value !== "object" || Array.isArray(value)) fail4();
+    if (!value || typeof value !== "object" || Array.isArray(value)) fail5();
     return;
   }
   if (type === "MEDIA_GALLERY") {
-    if (!Array.isArray(value)) fail4();
+    if (!Array.isArray(value)) fail5();
     return;
   }
-  if (typeof value !== "string") fail4();
+  if (typeof value !== "string") fail5();
 }
 function createFunctionDataCapability(options) {
   const declaredKv = new Map((options.data?.kv ?? []).map((spec) => [spec.name, spec]));
@@ -155750,6 +155836,9 @@ ${releaseId}`;
             ...m2.publishedAt ? { publishedAt: m2.publishedAt } : {},
             ...publicationKind ? { publicationKind } : {},
             ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {},
+            // #4091 — whether the app accepts its host's identity; Spaces opens an owner-picked
+            // member app only when it does. Absent = it signs in itself (or predates the field).
+            ...m2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {},
             // RFC 0051 §3.6 — the release's surface envelope, for tooling that has no
             // source tree (hosted admin surface picker, gallery). Absent on releases
             // built before the envelope rode the manifest.
@@ -155870,11 +155959,11 @@ ${releaseId}`;
         if (pin) {
           const m3 = app ? await pinnedManifest(app, pin) : null;
           if (!m3) return json4(404, { error: "release_not_found", app, releaseId: pin });
-          return json4(200, { releaseId: m3.releaseId, app: m3.app, pinned: true, ...m3.minBinaryVersion ? { minBinaryVersion: m3.minBinaryVersion } : {}, ...m3.playerRequirements ? { playerRequirements: m3.playerRequirements } : {}, ...m3.platforms ? { platforms: m3.platforms } : {} });
+          return json4(200, { releaseId: m3.releaseId, app: m3.app, pinned: true, ...m3.minBinaryVersion ? { minBinaryVersion: m3.minBinaryVersion } : {}, ...m3.playerRequirements ? { playerRequirements: m3.playerRequirements } : {}, ...m3.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}, ...m3.platforms ? { platforms: m3.platforms } : {} });
         }
         const m2 = app ? await manifest(app) : null;
         if (!m2) return json4(404, { error: "no_release", app });
-        return json4(200, { releaseId: m2.releaseId, app: m2.app, ...m2.minBinaryVersion ? { minBinaryVersion: m2.minBinaryVersion } : {}, ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {}, ...m2.platforms ? { platforms: m2.platforms } : {} });
+        return json4(200, { releaseId: m2.releaseId, app: m2.app, ...m2.minBinaryVersion ? { minBinaryVersion: m2.minBinaryVersion } : {}, ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {}, ...m2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}, ...m2.platforms ? { platforms: m2.platforms } : {} });
       }
       const bundleMatch = /^\/v1\/bundles\/([a-f0-9]{64})\.bundle\.js$/.exec(path2);
       if (bundleMatch) {
@@ -156629,25 +156718,25 @@ var init_preview_assets_generated = __esm({
   "../../packages/serve/src/preview-assets.generated.ts"() {
     init_preview_assets_format();
     PREVIEW_ASSET_MANIFEST = [
-      { key: "assets/index--kRJ7P_E.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271821, sha256: "87107181cacd1af376a9b91a6f080ebd7e61065df0552e739ccae83acfe950d2" },
-      { key: "assets/pdf-BJ3YneSX.js", contentType: "application/javascript; charset=utf-8", offset: 1271829, length: 488199, sha256: "53cf93f5358265408b60a56beb5eb22d28bc2cf214a355a50667033600bc8619" },
-      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1760028, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
-      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1760101, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
-      { key: "assets/pdfDocument-B24sNAhs.js", contentType: "application/javascript; charset=utf-8", offset: 3077135, length: 2858, sha256: "f163aca14426d0dc201288c9714b35c8e27fe25afe141e2b658d12afd501a0bd" },
-      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3079993, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
-      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084603, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
-      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573187, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
-      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3664111, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
-      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3755095, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
-      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3846075, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
-      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3936947, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
-      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4027927, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
-      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136563, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
-      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245647, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
-      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354695, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
-      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462395, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
-      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550503, length: 4947, sha256: "68557062bf4ab1a75359e88b0ce25c7647b793adbbfc446e9e30503f570ab307" },
-      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555450, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
+      { key: "assets/index-BDNhcRLx.js", contentType: "application/javascript; charset=utf-8", offset: 8, length: 1271913, sha256: "b78f7b3400ea25a2066e24c6b771199b819a833b624499d221edbc5f1b01a18b" },
+      { key: "assets/pdf-mXRF2YFr.js", contentType: "application/javascript; charset=utf-8", offset: 1271921, length: 488199, sha256: "3ecd61c959307bee0f74d6d9a3c6ab94dbf7b7305d6d67e2f0167dbf3bc6034a" },
+      { key: "assets/pdf.worker.min-BQa_JDET.js", contentType: "application/javascript; charset=utf-8", offset: 1760120, length: 73, sha256: "41bcfda4f3c8c0a81c785ea87c69afc8e7d0ed8c333324aee94c273d881bb6aa" },
+      { key: "assets/pdf.worker.min-BmVo14Nb.mjs", contentType: "application/javascript; charset=utf-8", offset: 1760193, length: 1317034, sha256: "a33cfe728c584fdba4fcc1fd54bcdc2f9f2f13889ddbb5b2bd1d0f8cbe49b84e" },
+      { key: "assets/pdfDocument-BZIqh5sA.js", contentType: "application/javascript; charset=utf-8", offset: 3077227, length: 2858, sha256: "32abe2da16ae5c22ce831a4a75bdb6e6121dc99fdae72be8ec22038d6982dd81" },
+      { key: "fonts/Roboto-LICENSE.txt", contentType: "application/octet-stream", offset: 3080085, length: 4610, sha256: "994062dd7af4186a739de55dd9e151c63b6301f8e2cbafc608d35c2e87da0cd2" },
+      { key: "fonts/Roboto-Variable.ttf", contentType: "font/ttf", offset: 3084695, length: 488584, sha256: "d7598e12c5dbef095ff8272cfc55da0250bd07fbdecbac8a530b9b277872a134" },
+      { key: "fonts/WixMadeforDisplay-Bold.ttf", contentType: "font/ttf", offset: 3573279, length: 90924, sha256: "ec4c7d63772d980d6e147b2df6215fd2737e4b04cebe0cf7e11dc695fb63cdcf" },
+      { key: "fonts/WixMadeforDisplay-ExtraBold.ttf", contentType: "font/ttf", offset: 3664203, length: 90984, sha256: "bf4c16a2774edd38a921edf3099469866cd74c094fd596f3fa4e81f54a04dfaa" },
+      { key: "fonts/WixMadeforDisplay-Medium.ttf", contentType: "font/ttf", offset: 3755187, length: 90980, sha256: "368faca44fb9f7207e4af784e94750b1ee59c1098b8689e0f4a918926f244fb5" },
+      { key: "fonts/WixMadeforDisplay-Regular.ttf", contentType: "font/ttf", offset: 3846167, length: 90872, sha256: "97ed8f1a6772abe26e3d8af5cecfc4b02faa94497d585b0398b5053b739a70c1" },
+      { key: "fonts/WixMadeforDisplay-SemiBold.ttf", contentType: "font/ttf", offset: 3937039, length: 90980, sha256: "642feab8a48ddf6c7a89d7c2a7c0edfa0e6e773f671287e460e222703563191e" },
+      { key: "fonts/WixMadeforText-Bold.ttf", contentType: "font/ttf", offset: 4028019, length: 108636, sha256: "37c179b4fefb63ea9637322b84583a2df53aa226c150294eea1675c14b1b8e29" },
+      { key: "fonts/WixMadeforText-ExtraBold.ttf", contentType: "font/ttf", offset: 4136655, length: 109084, sha256: "62e2fe4718129f36ecdb0ae4de385bd6b81ecc876146447167c6c140fad699a9" },
+      { key: "fonts/WixMadeforText-Medium.ttf", contentType: "font/ttf", offset: 4245739, length: 109048, sha256: "4ecf270136af928612c76fe4ebade91d8156975e5ea4c0cf9225501dd1788e02" },
+      { key: "fonts/WixMadeforText-Regular.ttf", contentType: "font/ttf", offset: 4354787, length: 107700, sha256: "dee56f09fd3efc127c1ea95557edc74110c1460a46287da36e0af25efd341ef5" },
+      { key: "fonts/WixMadeforText-SemiBold.ttf", contentType: "font/ttf", offset: 4462487, length: 88108, sha256: "dced97a77624bc5f8b1ae65850360908297f4588e09feb6f22792d29dc7e765b" },
+      { key: "index.html", contentType: "text/html; charset=utf-8", offset: 4550595, length: 4947, sha256: "475486545202c2973900224ffffa48ffbd7313e49b559cbcf9be678b068bff82" },
+      { key: "t5-frame.html", contentType: "text/html; charset=utf-8", offset: 4555542, length: 17512, sha256: "c5c8612a8b3f5a1828d0c6593106036a180eea11da80232f5181548a50679137" }
     ];
   }
 });
@@ -160506,19 +160595,19 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
   const invokedAs = pos[0];
   const app = invokedAs === "testflight" ? pos[1] : pos[2];
   const print = (value) => io2.log(JSON.stringify(value, null, 2));
-  const fail4 = (error, extra = {}) => {
+  const fail5 = (error, extra = {}) => {
     io2.error(JSON.stringify({ error, provider: "wix-mobile-release", ...extra }));
     return 2;
   };
-  if (invokedAs !== "testflight" && !(invokedAs === "store" && pos[1] === "upload")) return fail4("Wix Mobile Release only supports `himi testflight <app>` or `himi store upload <app>`");
-  if (app !== "himi-player") return fail4("Wix Mobile Release is reserved for the Wix-owned Himi Player binary", { app });
-  if (str5(flags.artifact)) return fail4("--artifact is not accepted for Himi Player; pass --release so deployed serve can validate the Job Service IPA and call MRE with its service identity");
-  if (on2(flags["no-wait"])) return fail4("--no-wait is not supported for Himi Player TestFlight releases; wait for MRE processing to complete");
+  if (invokedAs !== "testflight" && !(invokedAs === "store" && pos[1] === "upload")) return fail5("Wix Mobile Release only supports `himi testflight <app>` or `himi store upload <app>`");
+  if (app !== "himi-player") return fail5("Wix Mobile Release is reserved for the Wix-owned Himi Player binary", { app });
+  if (str5(flags.artifact)) return fail5("--artifact is not accepted for Himi Player; pass --release so deployed serve can validate the Job Service IPA and call MRE with its service identity");
+  if (on2(flags["no-wait"])) return fail5("--no-wait is not supported for Himi Player TestFlight releases; wait for MRE processing to complete");
   const release2 = str5(flags.release);
   const version4 = str5(flags.version);
-  if (!release2) return fail4("--release is required for a Himi Player TestFlight release");
-  if (!version4 || !/^\d+(?:\.\d+){0,2}$/.test(version4)) return fail4("--version needs the Player marketing version (for example 1.0.0)");
-  if (str5(flags.track) && str5(flags.track) !== "testflight" && str5(flags.track) !== "internal") return fail4("Wix Mobile Release only supports TestFlight upload; public App Store release remains a separate human step");
+  if (!release2) return fail5("--release is required for a Himi Player TestFlight release");
+  if (!version4 || !/^\d+(?:\.\d+){0,2}$/.test(version4)) return fail5("--version needs the Player marketing version (for example 1.0.0)");
+  if (str5(flags.track) && str5(flags.track) !== "testflight" && str5(flags.track) !== "internal") return fail5("Wix Mobile Release only supports TestFlight upload; public App Store release remains a separate human step");
   const plan = {
     ok: true,
     dryRun: on2(flags["dry-run"]),
@@ -160533,9 +160622,9 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
     print(plan);
     return 0;
   }
-  if (!deps.releasePlayerJob) return fail4("this Himi CLI cannot create a service-side Himi Player TestFlight job; target deployed serve");
+  if (!deps.releasePlayerJob) return fail5("this Himi CLI cannot create a service-side Himi Player TestFlight job; target deployed serve");
   if (!on2(flags.yes)) {
-    if (io2.isTTY !== true) return fail4("refusing to dispatch a Wix TestFlight release without --yes in a non-interactive shell");
+    if (io2.isTTY !== true) return fail5("refusing to dispatch a Wix TestFlight release without --yes in a non-interactive shell");
     if (!await deps.confirm(`  Dispatch Himi Player ${version4} to Wix TestFlight?`)) {
       io2.log("  aborted \u2014 no release was dispatched.");
       return 1;
@@ -160544,11 +160633,11 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
   try {
     const released = await deps.releasePlayerJob(release2, version4);
     const status = released.status.toUpperCase();
-    if (mreStatusKind(status) !== "completed") return fail4(`Himi Player TestFlight job ${status || "FAILED"}`, { jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, ...released.error ? { error: released.error } : {} });
+    if (mreStatusKind(status) !== "completed") return fail5(`Himi Player TestFlight job ${status || "FAILED"}`, { jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, ...released.error ? { error: released.error } : {} });
     print({ ok: true, provider: "wix-mobile-release", app, jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, status, ...released.url ? { url: released.url } : {} });
     return 0;
   } catch (error) {
-    return fail4(`could not complete the Himi Player TestFlight Job Service release: ${error.message}`);
+    return fail5(`could not complete the Himi Player TestFlight Job Service release: ${error.message}`);
   }
 }
 var str5, on2;
@@ -160604,23 +160693,23 @@ async function runStore(pos, flags, io2, deps) {
   const app = invokedAs === "testflight" ? pos[1] : pos[2];
   const json6 = on3(flags.json);
   const print = (o2) => io2.log(JSON.stringify(o2, null, 2));
-  const fail4 = (error, extra = {}) => {
+  const fail5 = (error, extra = {}) => {
     io2.error(JSON.stringify({ error, ...extra }));
     return 2;
   };
   if (!sub || !["preflight", "upload", "status"].includes(sub)) {
-    return fail4(`unknown store subcommand ${sub ? `"${sub}"` : ""}`.trim(), {
+    return fail5(`unknown store subcommand ${sub ? `"${sub}"` : ""}`.trim(), {
       usage: "himi store preflight|upload|status <app>   \xB7   himi testflight <app>"
     });
   }
-  if (!app) return fail4(`store ${sub} needs an <app>`);
+  if (!app) return fail5(`store ${sub} needs an <app>`);
   if (flags.provider !== void 0) {
-    return fail4(`unknown release provider "${String(flags.provider)}"`, {
+    return fail5(`unknown release provider "${String(flags.provider)}"`, {
       known: ["wix-mobile-release"]
     });
   }
   if (!deps.hasRepoCheckout()) {
-    return fail4(
+    return fail5(
       "himi store needs a Himalaya monorepo checkout \u2014 it builds and signs apps/<app>'s native target, which does not exist off-repo. Content changes (screens, Tier-5 bundles, tokens, app-config) ship over the air with `himi push` and need no binary.",
       { app }
     );
@@ -160629,14 +160718,14 @@ async function runStore(pos, flags, io2, deps) {
   try {
     cfg = deps.loadStoreConfig(app);
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   if (sub === "status") {
     let creds2;
     try {
       creds2 = deps.resolveCredentials({ app, cfg, profileFlag: str6(flags.profile) });
     } catch (e2) {
-      return fail4(e2.message);
+      return fail5(e2.message);
     }
     try {
       const s2 = await deps.ascStatus(app, credsToEnv(creds2));
@@ -160649,14 +160738,14 @@ async function runStore(pos, flags, io2, deps) {
       }
       return 0;
     } catch (e2) {
-      return fail4(`could not read App Store Connect status: ${e2.message}`);
+      return fail5(`could not read App Store Connect status: ${e2.message}`);
     }
   }
   let findings;
   try {
     findings = await deps.preflightApp(app, { profileFlag: str6(flags.profile) });
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   const { errors, warnings } = partitionFindings(findings);
   if (sub === "preflight") {
@@ -160673,12 +160762,12 @@ async function runStore(pos, flags, io2, deps) {
   const configTrack = cfg.review?.defaultTrackIos;
   const track = explicitTrack ?? (invokedAs === "testflight" ? "testflight" : configTrack ?? "testflight");
   if (track === "appstore") {
-    return fail4(
+    return fail5(
       "himi store does not submit for public App Store review \u2014 that stays a human step. Use TestFlight here, then /submit-ios-app when you mean to go public." + (explicitTrack ? "" : ` (inherited from review.defaultTrackIos; pass --track testflight to upload.)`)
     );
   }
   if (!TRACKS.has(track)) {
-    return fail4(`unknown --track "${track}"`, { known: [...TRACKS] });
+    return fail5(`unknown --track "${track}"`, { known: [...TRACKS] });
   }
   const bundleId = cfg.ios?.bundleId ?? "(unset)";
   let creds;
@@ -160687,10 +160776,10 @@ async function runStore(pos, flags, io2, deps) {
     creds = deps.resolveCredentials({ app, cfg, profileFlag: str6(flags.profile) });
     version4 = deps.readVersion(app);
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   if (!Number.isInteger(version4.build)) {
-    return fail4(
+    return fail5(
       `${app} has a non-integer CFBundleVersion (${JSON.stringify(version4.build)}) \u2014 this command bumps and matches build numbers arithmetically. Use an integer CFBundleVersion.`,
       { app, marketing: version4.marketing }
     );
@@ -160705,7 +160794,7 @@ async function runStore(pos, flags, io2, deps) {
     for (const f2 of findings) io2.log(`  ${f2.level === "error" ? "\u2717" : "!"} ${f2.message}`);
   }
   if (errors.length) {
-    return fail4(`${app} is not ready to upload \u2014 ${errors.length} blocking preflight issue(s).`, {
+    return fail5(`${app} is not ready to upload \u2014 ${errors.length} blocking preflight issue(s).`, {
       findings: errors,
       hint: "himi store preflight " + app
     });
@@ -160736,7 +160825,7 @@ async function runStore(pos, flags, io2, deps) {
   }
   if (!on3(flags.yes)) {
     if (io2.isTTY !== true) {
-      return fail4(
+      return fail5(
         "refusing to upload without confirmation in a non-interactive shell. Pass --yes if you really mean to publish this build, or --dry-run to see the plan.",
         { app, track, team: creds.team }
       );
@@ -160751,7 +160840,7 @@ async function runStore(pos, flags, io2, deps) {
   try {
     uploaded = reuseExisting ? version4 : deps.bumpBuild(app);
   } catch (e2) {
-    return fail4(`could not bump the build number: ${e2.message}`);
+    return fail5(`could not bump the build number: ${e2.message}`);
   }
   const rollback = () => {
     if (reuseExisting) return;
@@ -160767,11 +160856,11 @@ async function runStore(pos, flags, io2, deps) {
       r2 = await deps.exec(step, env);
     } catch (e2) {
       rollback();
-      return fail4(`${step} failed: ${e2.message}`, { app, step, build: uploaded.build, buildNumberRestored: !reuseExisting });
+      return fail5(`${step} failed: ${e2.message}`, { app, step, build: uploaded.build, buildNumberRestored: !reuseExisting });
     }
     if (r2.code !== 0) {
       if (step !== "upload") rollback();
-      return fail4(`${step} failed (exit ${r2.code})`, {
+      return fail5(`${step} failed (exit ${r2.code})`, {
         app,
         step,
         build: uploaded.build,
@@ -160795,7 +160884,7 @@ async function runStore(pos, flags, io2, deps) {
     try {
       s2 = await deps.ascStatus(app, env);
     } catch (e2) {
-      return fail4(`uploaded build ${uploaded.build}, but could not read processing status: ${e2.message}`, {
+      return fail5(`uploaded build ${uploaded.build}, but could not read processing status: ${e2.message}`, {
         app,
         build: uploaded.build,
         uploaded: true
@@ -160811,7 +160900,7 @@ async function runStore(pos, flags, io2, deps) {
       return 0;
     }
     if (mine && (mine.processingState === "FAILED" || mine.processingState === "INVALID")) {
-      return fail4(`build ${uploaded.build} is ${mine.processingState} in App Store Connect`, {
+      return fail5(`build ${uploaded.build} is ${mine.processingState} in App Store Connect`, {
         app,
         build: uploaded.build,
         processingState: mine.processingState,
@@ -160819,7 +160908,7 @@ async function runStore(pos, flags, io2, deps) {
       });
     }
     if (waited >= deadline) {
-      return fail4(
+      return fail5(
         `build ${uploaded.build} never appeared in App Store Connect after ${Math.round(deadline / 6e4)} minutes. A binary rejected during processing leaves no record and the reason is emailed, not exposed by the API \u2014 check the Apple ID inbox for team ${creds.team}.`,
         { app, build: uploaded.build, uploaded: true, processed: false }
       );
@@ -165391,7 +165480,7 @@ async function ownerPass(appId2, ports, sample) {
   const gaps = [];
   const r2 = { identity: {}, entities: [], functions: [], agents: [], connectors: [], secrets: [], routes: [], sourceFiles: [], gaps };
   const client2 = api(ports, appId2);
-  const fail4 = (chapter, e2) => {
+  const fail5 = (chapter, e2) => {
     gaps.push({ chapter, reason: e2.message });
   };
   try {
@@ -165407,7 +165496,7 @@ async function ownerPass(appId2, ports, sample) {
       source: "rest"
     };
   } catch (e2) {
-    fail4("auth", e2);
+    fail5("auth", e2);
   }
   let files = /* @__PURE__ */ new Map();
   if (!ports.downloadSource) {
@@ -165424,7 +165513,7 @@ async function ownerPass(appId2, ports, sample) {
       files = new Map(kept.map((e2) => [e2.path, e2.bytes.toString("utf8")]));
       r2.source = { root: "source", files: kept.length, denied: skipped.map((p2) => p2.split("\\").join("/")), secretFlagged: flagged };
     } catch (e2) {
-      fail4("source", e2);
+      fail5("source", e2);
     } finally {
       dl2?.cleanup();
     }
@@ -165458,13 +165547,13 @@ async function ownerPass(appId2, ports, sample) {
       if (typeof f2.name !== "string" || r2.functions.some((x2) => x2.name === f2.name)) continue;
       r2.functions.push({ name: f2.name, kind: "unknown", invoke: `base44.functions.invoke(${JSON.stringify(f2.name)}, payload)`, ...typeof f2.entry === "string" ? { sourcePath: f2.entry } : {}, source: "rest" });
     }
-  } else if (!r2.functions.length) fail4("functions", fnList.reason);
+  } else if (!r2.functions.length) fail5("functions", fnList.reason);
   if (agentList.status === "fulfilled") {
     for (const cfg of agentList.value.items ?? []) {
       const a2 = agentFromConfig(cfg, "rest");
       if (a2 && !r2.agents.some((x2) => x2.name === a2.name)) r2.agents.push(a2);
     }
-  } else if (!r2.agents.length) fail4("agents", agentList.reason);
+  } else if (!r2.agents.length) fail5("agents", agentList.reason);
   if (connList.status === "fulfilled") {
     for (const c2 of connList.value.integrations ?? []) {
       const type = typeof c2.integration_type === "string" ? c2.integration_type : void 0;
@@ -165477,9 +165566,9 @@ async function ownerPass(appId2, ports, sample) {
         if (!existing.scopes.length) existing.scopes = scopes;
       } else r2.connectors.push({ type, scopes, ...status ? { status } : {}, source: "rest" });
     }
-  } else if (!r2.connectors.length) fail4("connectors", connList.reason);
+  } else if (!r2.connectors.length) fail5("connectors", connList.reason);
   if (secretMap.status === "fulfilled") r2.secrets = Object.keys(secretMap.value ?? {}).sort();
-  else fail4("secrets", secretMap.reason);
+  else fail5("secrets", secretMap.reason);
   if (sample > 0 && samples.status === "fulfilled") {
     const refused2 = [];
     samples.value.forEach((settled, i2) => {
@@ -169638,6 +169727,436 @@ var init_cli = __esm({
   }
 });
 
+// ../../apps/himi-spaces-lite/spaces-host-manifest.ts
+var SPACES_HOST_MANIFEST;
+var init_spaces_host_manifest = __esm({
+  "../../apps/himi-spaces-lite/spaces-host-manifest.ts"() {
+    SPACES_HOST_MANIFEST = {
+      "version": "1.3.0",
+      "capabilities": [
+        "animation",
+        "app_info",
+        "base44",
+        "browser_auth",
+        "calendar",
+        "clipboard",
+        "file_picker",
+        "files",
+        "godot",
+        "haptics",
+        "himi_apps",
+        "iap",
+        "keyboard",
+        "live_activity",
+        "local_database",
+        "media_playback",
+        "motion",
+        "on_device_ai",
+        "open_url",
+        "pdf",
+        "presigned_upload",
+        "push",
+        "release_control",
+        "secure_storage",
+        "share",
+        "speaker_diarization",
+        "stream",
+        "theme",
+        "ui",
+        "wix_api",
+        "wix_cashier",
+        "wix_platform"
+      ],
+      "unlinked": {
+        "ios": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "keyboard",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "macos": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "calendar",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "iap",
+          "keyboard",
+          "live_activity",
+          "motion",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "push",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "android": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "keyboard",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "web": []
+      },
+      "nativeComponents": [
+        "himi_spaces_lite.HimiSpacesLiteCard"
+      ],
+      "authProviders": [
+        "wix-consumer",
+        "wix-native"
+      ],
+      "nativeActions": [
+        "himi_spaces_lite.greet"
+      ]
+    };
+  }
+});
+
+// ../../core/ts/src/host-compatibility.ts
+function compareVersion(a2, b2) {
+  const parts = (v2) => v2.split("-")[0].split(".").map((p2) => /^\d+$/.test(p2) ? Number(p2) : 0);
+  const av = parts(a2);
+  const bv = parts(b2);
+  for (let i2 = 0; i2 < Math.max(av.length, bv.length); i2 += 1) {
+    if ((av[i2] ?? 0) !== (bv[i2] ?? 0)) return (av[i2] ?? 0) - (bv[i2] ?? 0);
+  }
+  return 0;
+}
+function claimsFor(host, shell) {
+  const gaps = shell && host.unlinked[shell] ? host.unlinked[shell] : [...host.unlinked.ios ?? [], ...host.unlinked.android ?? []];
+  const served = (ids) => ids.filter((id) => !gaps.includes(id));
+  return { capabilities: served(host.capabilities), nativeComponents: served(host.nativeComponents), authProviders: served(host.authProviders) };
+}
+function missingClaims(requirements, offered) {
+  const out2 = {};
+  for (const kind of HOST_CLAIM_KINDS) {
+    const has = new Set(offered[kind]);
+    out2[kind] = [...new Set(requirements[kind].filter((id) => !has.has(id)))];
+  }
+  return out2;
+}
+function missingReasons(missing, hostName = "the host") {
+  const reasons = [];
+  if (missing.capabilities.length) reasons.push(`Missing capabilities: ${missing.capabilities.join(", ")}`);
+  if (missing.nativeComponents.length) reasons.push(`Native components not compiled into ${hostName}: ${missing.nativeComponents.join(", ")}`);
+  if (missing.authProviders.length) reasons.push(`Unsupported auth providers: ${missing.authProviders.join(", ")}`);
+  return reasons;
+}
+function checkHostCompatibility(requirements, host, options = {}) {
+  const hostName = options.hostName ?? "the host";
+  const reasons = missingReasons(missingClaims(requirements, claimsFor(host, options.shell)), hostName);
+  const running = options.installedVersion || host.version;
+  if (requirements.minBinaryVersion && compareVersion(running, requirements.minBinaryVersion) < 0) {
+    reasons.push(`Requires ${hostName} ${requirements.minBinaryVersion} or newer (installed ${running})`);
+  }
+  if (options.requiresHostIdentity && !requirements.hostProvidedIdentity) {
+    reasons.push(`Does not accept ${hostName}'s sign-in: the app must take its identity from the host (hostProvided)`);
+  }
+  return reasons.length ? { ok: false, reason: reasons.join("; "), reasons } : { ok: true };
+}
+var HOST_CLAIM_KINDS;
+var init_host_compatibility = __esm({
+  "../../core/ts/src/host-compatibility.ts"() {
+    init_registry_app_normalize();
+    HOST_CLAIM_KINDS = PLAYER_REQUIREMENT_KINDS;
+  }
+});
+
+// ../../core/dev-server/tier5-bundles-src/_shared/branded-lite-hosted.ts
+var VERTICAL_ROOT_SCREENS, VERTICALS;
+var init_branded_lite_hosted = __esm({
+  "../../core/dev-server/tier5-bundles-src/_shared/branded-lite-hosted.ts"() {
+    VERTICAL_ROOT_SCREENS = {
+      store: ["himi_shop"],
+      bookings: ["himi_services"],
+      restaurants: ["himi_menu", "himi_reserve"],
+      programs: ["himi_programs"],
+      plans: ["himi_plans"],
+      feed: ["himi_feed"],
+      members: ["himi_members"],
+      forum: ["himi_forum"],
+      coupons: ["himi_coupons"],
+      notifications: ["himi_notifications"],
+      loyalty: ["himi_loyalty"],
+      reviews: ["himi_reviews"],
+      portfolio: ["himi_portfolio"],
+      reservations: ["himi_reservations"],
+      invoices: ["himi_invoices"],
+      badges: ["himi_badges"],
+      notifsettings: ["himi_notif_settings"],
+      events: ["himi_events"],
+      blog: ["himi_blog"],
+      groups: ["himi_groups"],
+      cms: ["himi_cms"],
+      donations: ["himi_donations"],
+      giftCards: ["himi_gift_cards"],
+      videos: ["himi_videos"],
+      podcasts: ["himi_podcasts"],
+      forms: ["himi_forms"],
+      galleries: ["himi_galleries"],
+      inbox: ["himi_inbox"],
+      faq: ["himi_faq"]
+    };
+    VERTICALS = new Set(Object.keys(VERTICAL_ROOT_SCREENS));
+  }
+});
+
+// ../../apps/himi-branded-lite/hosted-mode.ts
+var init_hosted_mode = __esm({
+  "../../apps/himi-branded-lite/hosted-mode.ts"() {
+    init_branded_lite_hosted();
+  }
+});
+
+// ../../apps/himi-branded-lite/site-provisioning.ts
+var init_site_provisioning = __esm({
+  "../../apps/himi-branded-lite/site-provisioning.ts"() {
+  }
+});
+
+// ../../apps/himi-spaces-lite/site-open.ts
+var HOSTED_MEMBER_APP;
+var init_site_open = __esm({
+  "../../apps/himi-spaces-lite/site-open.ts"() {
+    init_hosted_mode();
+    init_site_provisioning();
+    HOSTED_MEMBER_APP = "himi-branded-lite";
+  }
+});
+
+// ../../apps/himi-spaces-lite/site-app.ts
+function siteAppPickFrom(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const appId2 = value.appId;
+  if (appId2 === null) return null;
+  if (typeof appId2 !== "string") return void 0;
+  const id = appId2.trim();
+  return APP_ID3.test(id) ? id : void 0;
+}
+function siteAppRequirementsFrom(appId2, entry) {
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return { ok: false, reason: `No release of ${appId2} to judge` };
+  const e2 = entry;
+  const names = e2.id !== void 0 ? e2.id : e2.app;
+  if (names !== appId2) return { ok: false, reason: `No release of ${appId2} to judge` };
+  if (!isPlayerRequirements(e2.playerRequirements)) {
+    return { ok: false, reason: e2.playerRequirements === void 0 ? `${appId2}'s release does not declare what it requires (republish it)` : `${appId2}'s release declares malformed requirements` };
+  }
+  const minBinaryVersion = typeof e2.minBinaryVersion === "string" && e2.minBinaryVersion ? e2.minBinaryVersion : void 0;
+  return {
+    ok: true,
+    requirements: {
+      capabilities: [...e2.playerRequirements.capabilities],
+      nativeComponents: [...e2.playerRequirements.nativeComponents],
+      authProviders: [...e2.playerRequirements.authProviders],
+      ...minBinaryVersion ? { minBinaryVersion } : {},
+      // Only an explicit `true` counts: an app that signs in by itself would ask a member to sign
+      // in again inside Spaces, with an identity Spaces does not lend (#4088).
+      ...e2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}
+    }
+  };
+}
+function messageOf2(err) {
+  const message = err?.message;
+  return typeof message === "string" && message ? message : String(err);
+}
+function decideSiteApp(input) {
+  const fallback = (pickedAppId, reason) => ({ appId: DEFAULT_SITE_APP, source: "fallback", pickedAppId, reason });
+  if (input.pick === void 0) return { appId: DEFAULT_SITE_APP, source: "default" };
+  if (!input.pick.ok) return fallback(null, `Could not read the site's member app: ${messageOf2(input.pick.error)}`);
+  const picked = siteAppPickFrom(input.pick.value);
+  if (picked === void 0) return fallback(null, "The site's member app setting is unreadable");
+  if (picked === null || picked === DEFAULT_SITE_APP) return { appId: DEFAULT_SITE_APP, source: "default" };
+  if (input.release === void 0) return fallback(picked, `No release of ${picked} to judge`);
+  if (!input.release.ok) return fallback(picked, `Could not read ${picked}'s release: ${messageOf2(input.release.error)}`);
+  const req = siteAppRequirementsFrom(picked, input.release.value);
+  if (!req.ok) return fallback(picked, req.reason);
+  const verdict = checkHostCompatibility(req.requirements, input.host, {
+    hostName: "Spaces",
+    requiresHostIdentity: true,
+    ...input.shell ? { shell: input.shell } : {},
+    ...input.installedVersion ? { installedVersion: input.installedVersion } : {}
+  });
+  if (!verdict.ok) return fallback(picked, verdict.reason);
+  if (!(input.hostable ?? NATIVELY_HOSTABLE_APPS).includes(picked)) {
+    return fallback(picked, `This Spaces build cannot host a custom member app yet (${picked} is compatible)`);
+  }
+  return { appId: picked, source: "picked" };
+}
+var DEFAULT_SITE_APP, NATIVELY_HOSTABLE_APPS, APP_ID3;
+var init_site_app = __esm({
+  "../../apps/himi-spaces-lite/site-app.ts"() {
+    init_host_compatibility();
+    init_registry_app_normalize();
+    init_site_open();
+    DEFAULT_SITE_APP = HOSTED_MEMBER_APP;
+    NATIVELY_HOSTABLE_APPS = [DEFAULT_SITE_APP];
+    APP_ID3 = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+  }
+});
+
+// src/site-member-app.ts
+var site_member_app_exports = {};
+__export(site_member_app_exports, {
+  SITE_MEMBER_APP_CODES: () => SITE_MEMBER_APP_CODES,
+  SITE_MEMBER_APP_USAGE: () => SITE_MEMBER_APP_USAGE,
+  SPACES_DEFAULT_APP: () => SPACES_DEFAULT_APP,
+  memberAppVerdict: () => memberAppVerdict,
+  runSiteMemberApp: () => runSiteMemberApp
+});
+function codeFor(status, serverError) {
+  if (serverError === "forbidden_site" || serverError === "forbidden_app" || serverError === "app_bound_to_other_site") return serverError;
+  if (status === 401) return "unauthorized";
+  return "request_failed";
+}
+function memberAppVerdict(appId2, release2, shell) {
+  if (!appId2 || appId2 === SPACES_DEFAULT_APP) return { opens: SPACES_DEFAULT_APP, compatible: null };
+  const input = {
+    pick: { ok: true, value: { appId: appId2 } },
+    ...release2 !== void 0 ? { release: { ok: true, value: release2 } } : {},
+    host: SPACES_HOST_MANIFEST,
+    ...shell ? { shell } : {}
+  };
+  const fits = decideSiteApp({ ...input, hostable: [SPACES_DEFAULT_APP, appId2] });
+  const opens = decideSiteApp(input);
+  return {
+    opens: opens.appId,
+    compatible: fits.source === "picked",
+    ...opens.source === "fallback" ? { reason: opens.reason } : {}
+  };
+}
+async function runSiteMemberApp(input, deps = {}) {
+  const op = input.op;
+  if (op !== "set" && op !== "clear" && op !== "show") {
+    return fail4("invalid_usage", op ? `unknown site member-app op "${op}"` : "site member-app needs an op: set | clear | show", { usage: SITE_MEMBER_APP_USAGE });
+  }
+  const site = input.site;
+  if (!site || !SITE_RE2.test(site)) return fail4("invalid_usage", "a metaSiteId (UUID) is required", { usage: SITE_MEMBER_APP_USAGE });
+  if (op === "set" && !input.app) return fail4("invalid_usage", "set needs --app <id>", { usage: SITE_MEMBER_APP_USAGE });
+  if (op === "set" && !isValidAppId(input.app)) return fail4("invalid_usage", `--app "${input.app}" is not a valid app id`, { usage: SITE_MEMBER_APP_USAGE });
+  if (input.shell !== void 0 && input.shell !== "ios" && input.shell !== "android") {
+    return fail4("invalid_usage", `--platform must be ios or android (got "${input.shell}")`, { usage: SITE_MEMBER_APP_USAGE });
+  }
+  let target;
+  try {
+    target = (deps.resolve ?? resolveTarget)({ target: input.target, defaultTarget: input.defaultTarget, controlUrl: input.controlUrl, controlToken: input.controlToken });
+  } catch (err) {
+    return fail4("invalid_usage", err.message);
+  }
+  const insecure = credentialHostRefusal(target.control);
+  if (insecure) return fail4("insecure_target", insecure);
+  if (!target.controlToken) return fail4("control_token_required", "no control token \u2014 run `himi login` (or pass --control-token)");
+  let wixToken;
+  try {
+    wixToken = await (deps.wixToken ?? accountToken)();
+  } catch {
+    return fail4("wix_token_unavailable", "could not mint the account's Wix token (`wix token`) \u2014 the publishing service needs it to verify you own the site");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const control = target.control.replace(/\/+$/, "");
+  const url = `${control}/v1/admin/site/member-app${op === "set" ? "" : `?site=${encodeURIComponent(site)}`}`;
+  let status;
+  let body;
+  try {
+    const response = await fetchImpl(url, {
+      method: op === "set" ? "PUT" : op === "clear" ? "DELETE" : "GET",
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4),
+      headers: {
+        "content-type": "application/json",
+        "x-control-token": target.controlToken,
+        Authorization: wixToken,
+        ...target.previewRoute ? { "x-wix-route-serve": target.previewRoute } : {}
+      },
+      ...op === "set" ? { body: JSON.stringify({ site, app: input.app }) } : {}
+    });
+    status = response.status;
+    body = await response.json().catch(() => ({}));
+  } catch {
+    return fail4("control_unreachable", `could not reach the publishing service at ${control}`);
+  }
+  if (status < 200 || status >= 300) {
+    return fail4(
+      codeFor(status, body.error),
+      typeof body.error === "string" ? body.error : `HTTP ${status}`,
+      { status, ...typeof body.error === "string" ? { serverError: body.error } : {} }
+    );
+  }
+  if (op !== "show") return { ok: true, ...body };
+  const pick2 = body.memberAppInSpaces;
+  const appId2 = typeof pick2?.appId === "string" ? pick2.appId : null;
+  let release2;
+  if (appId2 && appId2 !== SPACES_DEFAULT_APP && !body.invalid) {
+    try {
+      const response = await fetchImpl(`${target.serve.replace(/\/+$/, "")}/v1/release/current?app=${encodeURIComponent(appId2)}`, {
+        redirect: "error",
+        signal: AbortSignal.timeout(3e4),
+        // The same deployment the pick was read from (a preview route), never production's release.
+        ...target.previewRoute ? { headers: { "x-wix-route-serve": target.previewRoute } } : {}
+      });
+      release2 = response.ok ? await response.json() : void 0;
+    } catch {
+      release2 = void 0;
+    }
+  }
+  const verdict = body.invalid ? { opens: SPACES_DEFAULT_APP, compatible: false, reason: `The pick is no longer valid (${String(body.invalid)}): the site resolves to Branded Lite` } : memberAppVerdict(appId2, release2, input.shell);
+  return { ok: true, ...body, ...verdict, host: { name: "Spaces", version: SPACES_HOST_MANIFEST.version, ...input.shell ? { shell: input.shell } : {} } };
+}
+var SPACES_DEFAULT_APP, SITE_MEMBER_APP_USAGE, SITE_MEMBER_APP_CODES, SITE_RE2, fail4;
+var init_site_member_app = __esm({
+  "src/site-member-app.ts"() {
+    init_config();
+    init_credential_hosts();
+    init_contract();
+    init_spaces_host_manifest();
+    init_site_app();
+    init_wix_owner();
+    SPACES_DEFAULT_APP = DEFAULT_SITE_APP;
+    SITE_MEMBER_APP_USAGE = "himi site member-app set <site> --app <id> | clear <site> | show <site> [--platform ios|android] [--target <name>] [--control-url <url>] [--control-token <t>]  (<site> may be given as --site <msid>)";
+    SITE_MEMBER_APP_CODES = [
+      "invalid_usage",
+      "insecure_target",
+      "control_token_required",
+      "wix_token_unavailable",
+      "forbidden_site",
+      "forbidden_app",
+      "app_bound_to_other_site",
+      "unauthorized",
+      "control_unreachable",
+      "request_failed"
+    ];
+    SITE_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+    fail4 = (code, error, extra = {}) => ({ ok: false, code, error, ...extra });
+  }
+});
+
 // src/site-analyze/visitor-auth.ts
 async function mintVisitorToken(fetchImpl, clientId) {
   const res = await fetchImpl(`${WIX_API3}/oauth2/token`, {
@@ -176397,7 +176916,7 @@ var COMMANDS2 = [
   { name: "connector", summary: "personal access tokens for the hosted MCP connector (Wix Native App Builder), for an AI tool that cannot sign in with OAuth (e.g. Base44's builder): `token create` opens a Wix sign-in page and prints a long-lived token once, to paste into the tool as `Authorization: Bearer <token>`; `token list` / `token revoke <id>` manage them with the `himi login --browser` token. The token can only build and publish DRAFTS.", required: "token create [--name <n>] [--days <1-90>] [--no-open] | token list | token revoke <id> [--target <t>]" },
   { name: "notify", summary: "Hosted --all-members requires --yes for a live send; --dry-run checks ownership/readiness and counts approved recipients without sending. `setup` optionally configures Branded/Ping from local customer key files; `status --refresh` reads live backend readiness. Setup may be deferred while building. These use serve-control and require owner plus Wix account authentication. `send`, `tokens`, `doctor`: send a REAL push notification to registered devices (RFC 0036 WS5) \u2014 APNs .p8 over HTTP/2 for iOS, FCM v1 for Android. `send` targets one device (--token / --device <registry id>) or fans out to the whole app (--all), reporting a per-device result; a token the provider says is uninstalled (APNs 410 Unregistered / FCM UNREGISTERED) is auto-disabled, while a merely wrong one (BadDeviceToken \u2014 usually a sandbox/production mismatch) is recorded and left enabled. `tokens` lists the registry. `doctor` reports which credentials resolve and which sender each platform picks. Talks to the admin-server via --admin-url/HIMALAYA_ADMIN_URL, authenticated with --admin-session/HIMALAYA_ADMIN_SESSION. `send --provider ping` is the hosted alternative: the serve plane sends to one site member (--member-email) or all approved members (--all-members) through Ping as Himalaya, with owner login instead of provider keys, and reports acceptance, never delivery. NOT `himi push`, which publishes a release.", required: "setup|status [--content <dir>] [--target <t>] [--refresh] [--yes] [--no-push-setup] | send --provider ping [--content <dir>] [--app <a>] [--site <msid>] (--member-email <email> | --all-members (--dry-run | --yes)) --title <s> [--body <s>] --link <url> [--request-id <uuid>] [--dry-run] [--json] | send|tokens|doctor [--app <a>] [--token <t> | --device <id> | --all] [--title <s>] [--body <s>] [--link <url>] [--platform ios|android] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]" },
   { name: "signing", summary: "READ-ONLY App Store Connect inventory for customer BYO TestFlight readiness. `inspect` lists whether the bundle id, distribution certificate, IOS_APP_STORE profile, and ASC app record exist for --bundle-id / --team-id using a local ASC .p8 (flags or ASC_KEY_* env). Never uploads or mutates Apple resources. Optional --cert-file/--profile-file classify on-disk material.", required: "inspect --bundle-id <id> --team-id <id> --asc-key-file <path> --asc-key-id <id> --asc-issuer-id <id> [--cert-file <p12> --cert-password <pw> --profile-file <mobileprovision>] [--json]" },
-  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no browser and never uploads or applies anything. A URL is optional there: `--url` lets it read the published page's Velo code-app ids (credential-free, pinned transport) so the backend source is found on sites where the owner code-app probe 404s. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--url <https>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
+  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no browser and never uploads or applies anything. A URL is optional there: `--url` lets it read the published page's Velo code-app ids (credential-free, pinned transport) so the backend source is found on sites where the owner code-app probe 404s. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json. `member-app set|clear|show <msid>` is the site's member app in Spaces (#4091): the himi app the site's members open in Spaces Lite instead of Branded Lite. `set --app <id>` takes the site's own app or one your account owns (an owned app not yet tied to the site is linked first; another account's app is refused, 403); `clear` returns the site to Branded Lite; `show` prints the pick plus the COMPUTED verdict \u2014 the picked release's requirements judged against the Spaces host manifest (checkHostCompatibility, `--platform` to judge one phone platform) \u2014 and `reason` when it falls back to Branded Lite. Auth is your `himi login` control token plus the account `wix token`, which the plane uses to verify you own the site.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--url <https>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke] | member-app set|clear|show <msid> [--app <id>] [--platform ios|android]" },
   { name: "base44", summary: "read a BASE44 app into an app book (book.json + BOOK.md) for the agent building a Himi app from it \u2014 the Base44 counterpart of `site analyze`, READ-ONLY. `analyze --url <published app>` is the VISITOR pass: the app id, name, favicon and colours from the published SPA, its router paths, and screenshots + look tokens from the Playwright crawl. `analyze --app-id <id>` adds the OWNER pass and needs a session: the project source under <out>/source/ (the read half of `base44 eject` \u2014 GET api/apps/<id>/eject \u2014 through the same deny-list and secret scan `himi push` uses, widened by the book's token shapes; `eject` itself is never run because it CREATES a copy of the app), every entity's JSON schema, required fields and RLS rules with up to --sample redacted rows (default 5, 0 = off), backend functions, agents, connectors (names and scopes only, never tokens), secret NAMES (never values), auth visibility + providers, and the route \u2192 component \u2192 entities map from the source router. Every chapter it could not read is listed in `gaps` rather than failing the run. `login` runs Base44's device sign-in and stores the session in ~/.himi/base44/session.json (never the repo; --from-base44-cli imports `npx base44 login`'s session instead); BASE44_ACCESS_TOKEN in the environment wins, for CI. `whoami` prints who is signed in (never the token); `logout` removes the stored session. `auth-check --url <tenant> --ios-app-id <PREFIX.bundle.id>` and/or `--android-package <package> --android-sha256 <fingerprint>` checks public native-login associations and prints missing entries; it never reads an owner token. --json prints the book itself. himi docs base44-app-context", required: "analyze (--url <https://\u2026> | --app-id <id>) [--out .himi/base44-book] [--sample <n>] [--json] | login [--from-base44-cli] | whoami | logout | auth-check --url <https://tenant> [--ios-app-id <PREFIX.bundle.id>] [--android-package <package> --android-sha256 <fingerprint>]" },
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "upgrade", summary: "install the newest published CLI (`npm i -g @wix/himalaya-cli@latest`) and report what moved. This is the explicit door: himi also updates itself when the running build is more than a week old \u2014 unattended it just does it and re-runs your command, at a terminal it asks first \u2014 and `HIMI_NO_UPDATE_CHECK=1` turns that off, leaving this command as the way to catch up. Reports `unchanged` rather than claiming success when npm exits 0 without moving the version, which is what a registry mirror serving its own pinned copy looks like.", required: "[--json]" },
@@ -177110,13 +177629,13 @@ function previewTelemetryUrl(serveBase, app, release2) {
 function diagnoseBody(body) {
   const findings = body.findings;
   if (!Array.isArray(findings)) return body;
-  const messageOf2 = (entry) => {
+  const messageOf3 = (entry) => {
     const message = entry && typeof entry === "object" ? entry.message : void 0;
     return typeof message === "string" ? message : void 0;
   };
-  const shown2 = new Set(findings.map(messageOf2).filter((message) => message !== void 0));
+  const shown2 = new Set(findings.map(messageOf3).filter((message) => message !== void 0));
   const folded = (value) => Array.isArray(value) && value.length > 0 && value.every((entry) => {
-    const message = messageOf2(entry);
+    const message = messageOf3(entry);
     return message !== void 0 && shown2.has(message);
   });
   const out2 = {};
@@ -184270,6 +184789,23 @@ Code: ${userCode}`);
       }
       case "site": {
         const sub = pos[1];
+        if (sub === "member-app") {
+          const { runSiteMemberApp: runSiteMemberApp2 } = await Promise.resolve().then(() => (init_site_member_app(), site_member_app_exports));
+          const r2 = await runSiteMemberApp2({
+            op: pos[2],
+            site: pos[3] ?? str9(flags.site),
+            app: str9(flags.app),
+            shell: str9(flags.platform),
+            target: str9(flags.target),
+            // Off-repo, `himi login` stores its token under `wix`; resolve where it did.
+            defaultTarget: contextualDefaultTarget,
+            controlUrl: str9(flags["control-url"]),
+            controlToken: str9(flags["control-token"])
+          });
+          if (r2.ok) print(r2);
+          else io2.error(JSON.stringify(r2));
+          return r2.ok ? 0 : r2.code === "invalid_usage" ? 2 : 1;
+        }
         if (sub === "function") {
           const { runSiteFunctionCli: runSiteFunctionCli2, SITE_FUNCTION_USAGE: SITE_FUNCTION_USAGE2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
           try {