@wix/himalaya-cli 0.1351.0 → 0.1352.0

package/dist/cli.mjs

@@ -7706,7 +7706,6 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -32826,8 +32825,15 @@ var init_app_identity = __esm({
 });
 
 // ../../core/ts/src/registry-app-normalize.ts
+function isPlayerRequirements(v2) {
+  if (!v2 || typeof v2 !== "object") return false;
+  const r2 = v2;
+  return PLAYER_REQUIREMENT_KINDS.every((kind) => Array.isArray(r2[kind]) && r2[kind].every((id) => typeof id === "string"));
+}
+var PLAYER_REQUIREMENT_KINDS;
 var init_registry_app_normalize = __esm({
   "../../core/ts/src/registry-app-normalize.ts"() {
+    PLAYER_REQUIREMENT_KINDS = ["capabilities", "nativeComponents", "authProviders"];
   }
 });
 
@@ -37418,7 +37424,7 @@ function newRicosRequestId() {
 async function runRicosImageUpload(o2) {
   const { session, uploadService: svc, requestId: requestId2, file: file2, deps } = o2;
   const t2 = deps.timers ?? { setTimeout: (fn2, ms2) => setTimeout(fn2, ms2), clearTimeout: (h2) => clearTimeout(h2) };
-  const fail4 = (reason) => {
+  const fail5 = (reason) => {
     session.failMedia(requestId2);
     return { ok: false, reason };
   };
@@ -37444,32 +37450,32 @@ async function runRicosImageUpload(o2) {
       });
       deps.dispatch({ actionId: `tier5.${svc}.genUpload`, args: { requestId: requestId2, mimeType: file2.mimeType, fileName: file2.fileName, ...file2.sizeBytes !== void 0 ? { sizeBytes: file2.sizeBytes } : {} } });
     });
-    if (!entry) return fail4("timeout");
-    if (entry.status !== "ready" || !entry.uploadUrl || !/^https:\/\//i.test(entry.uploadUrl)) return fail4("gen_upload");
+    if (!entry) return fail5("timeout");
+    if (entry.status !== "ready" || !entry.uploadUrl || !/^https:\/\//i.test(entry.uploadUrl)) return fail5("gen_upload");
     let body;
     try {
       body = typeof file2.body === "function" ? await file2.body() : file2.body;
     } catch {
-      return fail4("read");
+      return fail5("read");
     }
     const sep21 = entry.uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
       res = await deps.fetch(`${entry.uploadUrl}${sep21}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
     } catch {
-      return fail4("put");
+      return fail5("put");
     }
-    if (!res.ok) return fail4("put");
+    if (!res.ok) return fail5("put");
     let json6;
     try {
       json6 = await res.json();
     } catch {
-      return fail4("bad_descriptor");
+      return fail5("bad_descriptor");
     }
     const root = json6 && typeof json6 === "object" ? json6 : {};
     const d2 = root.file && typeof root.file === "object" ? root.file : root;
     const id = typeof d2.id === "string" ? d2.id : "";
-    if (!id) return fail4("bad_descriptor");
+    if (!id) return fail5("bad_descriptor");
     const ok2 = session.resolveMedia(requestId2, {
       id,
       url: typeof d2.url === "string" ? d2.url : "",
@@ -134518,7 +134524,7 @@ async function crawlScreen(opts) {
 async function crawlScreenJourney(opts) {
   return withSwallowedRejections(async () => {
     const findings = [];
-    const fail4 = (message, step) => {
+    const fail5 = (message, step) => {
       findings.push({
         screen: opts.screenId,
         trigger: step ? { tap: step.component ?? null, key: "journey", action: step.action } : "boot",
@@ -134529,7 +134535,7 @@ async function crawlScreenJourney(opts) {
       });
     };
     if (!opts.bundleJs) {
-      fail4(`journey "${opts.journey.name}" targets a screen without a worker bundle`);
+      fail5(`journey "${opts.journey.name}" targets a screen without a worker bundle`);
       return { screen: opts.screenId, journey: opts.journey.name, stepsExercised: 0, findings };
     }
     const { call: wixCall } = layeredTransport({ rules: opts.rules, cmsSeed: opts.cmsSeed, canned: opts.canned });
@@ -134554,23 +134560,23 @@ async function crawlScreenJourney(opts) {
     for (const step of opts.journey.steps) {
       const declared = sites.find((site2) => site2.actionId === step.action && (step.component === void 0 || site2.componentId === step.component));
       if (!declared) {
-        fail4(`journey "${opts.journey.name}" cannot find ${step.component ? `${step.component} \u2192 ` : ""}${step.action} in this screen`, step);
+        fail5(`journey "${opts.journey.name}" cannot find ${step.component ? `${step.component} \u2192 ` : ""}${step.action} in this screen`, step);
         continue;
       }
       const state = snapshot(worker).state;
       const site = effectiveSiteFor(declared, state);
       if (!site) {
-        fail4(`journey "${opts.journey.name}" cannot dispatch ${step.action}: its list has no rendered row`, step);
+        fail5(`journey "${opts.journey.name}" cannot dispatch ${step.action}: its list has no rendered row`, step);
         continue;
       }
       const parsed = parseWorkerAction(site.actionId);
       if (!parsed) {
-        fail4(`journey "${opts.journey.name}" step ${step.action} is not a worker action; cross-screen navigation belongs in the regular edge pass`, step);
+        fail5(`journey "${opts.journey.name}" step ${step.action} is not a worker action; cross-screen navigation belongs in the regular edge pass`, step);
         continue;
       }
       const handle = worker.handles[parsed.service];
       if (!handle || !handle.actionNames().includes(parsed.action)) {
-        fail4(`journey "${opts.journey.name}" names unavailable worker action ${step.action}`, step);
+        fail5(`journey "${opts.journey.name}" names unavailable worker action ${step.action}`, step);
         continue;
       }
       const mark = { wix: worker.calls.length, host: worker.hostCalls.length };
@@ -134579,18 +134585,18 @@ async function crawlScreenJourney(opts) {
         for (let i2 = 0; i2 < 8; i2++) await yieldMacrotask();
         stepsExercised += 1;
       } catch (error) {
-        fail4(`journey "${opts.journey.name}" step ${step.action} threw: ${errText(error)}`, step);
+        fail5(`journey "${opts.journey.name}" step ${step.action} threw: ${errText(error)}`, step);
       }
       const stepEffect = effectSince(worker, mark, site.actionId, site.componentId);
       if (stepEffect) effects.push(stepEffect);
     }
     const settled = snapshot(worker);
     if (worker.errors.length) {
-      for (const error of worker.errors) fail4(`journey "${opts.journey.name}" worker error: ${error.service}: ${error.message}`);
+      for (const error of worker.errors) fail5(`journey "${opts.journey.name}" worker error: ${error.service}: ${error.message}`);
     }
     const values = collectObservations(opts.descriptor, settled.state).join("\n");
     for (const expected of opts.journey.expectText) {
-      if (!values.includes(expected)) fail4(`journey "${opts.journey.name}" never rendered its expected visible result: ${JSON.stringify(expected)}`);
+      if (!values.includes(expected)) fail5(`journey "${opts.journey.name}" never rendered its expected visible result: ${JSON.stringify(expected)}`);
     }
     return { screen: opts.screenId, journey: opts.journey.name, stepsExercised, findings, ...effects.length ? { effects } : {} };
   });
@@ -136054,12 +136060,14 @@ __export(build_exports2, {
   bakeCatalogs: () => bakeCatalogs,
   bakeNeedsLiveOrigin: () => bakeNeedsLiveOrigin,
   bakeWidgets: () => bakeWidgets,
+  buildFromLoaded: () => buildFromLoaded,
   buildRelease: () => buildRelease,
   buildReleaseFromContent: () => buildReleaseFromContent,
   bundleNameFromUrl: () => bundleNameFromUrl,
   collectComponentTypes: () => collectComponentTypes,
   contentReleaseId: () => contentReleaseId,
   countingWixCall: () => countingWixCall,
+  declaresHostProvidedIdentity: () => declaresHostProvidedIdentity,
   gitSha: () => gitSha,
   isMonorepoCheckout: () => isMonorepoCheckout,
   l10nLintOptions: () => l10nLintOptions,
@@ -137218,6 +137226,11 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       nativeComponents: [...requiredNativeComponents].sort(),
       authProviders: [config.auth.providerId].filter(Boolean).sort()
     },
+    // #4091 — the app takes its Wix identity from a HOST (Spaces Lite) instead of signing in
+    // itself (#4088 `hostProvided` on its auth provider). A host that lends its identity only
+    // opens an app that accepts it. Written only when true, so every other app's release — and
+    // its releaseId — is byte-identical to one built before the field existed.
+    ...declaresHostProvidedIdentity(config.auth) ? { hostProvidedIdentity: true } : {},
     iconHash,
     ...brandFonts.length ? { brandFonts } : {},
     handlers,
@@ -137344,6 +137357,10 @@ function listBuildableApps() {
   const appsDir = join47(REPO_ROOT7, "apps");
   return readdirSync25(appsDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && !d2.name.startsWith("_")).map((d2) => d2.name);
 }
+function declaresHostProvidedIdentity(auth) {
+  const config = auth?.config;
+  return typeof config === "object" && config !== null && config.hostProvided === true;
+}
 var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, REPO_ROOT7, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL;
 var init_build3 = __esm({
   "../release-build/build.ts"() {
@@ -152375,30 +152392,30 @@ function logicalCollection(spec, app) {
 }
 function assertFieldValue(type, key2, value) {
   if (value === null) return;
-  const fail4 = () => {
+  const fail5 = () => {
     throw new Error(`field "${key2}" must be ${type}`);
   };
   if (type === "NUMBER") {
-    if (typeof value !== "number" || !Number.isFinite(value)) fail4();
+    if (typeof value !== "number" || !Number.isFinite(value)) fail5();
     return;
   }
   if (type === "BOOLEAN") {
-    if (typeof value !== "boolean") fail4();
+    if (typeof value !== "boolean") fail5();
     return;
   }
   if (type === "ARRAY_STRING") {
-    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) fail4();
+    if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) fail5();
     return;
   }
   if (type === "ADDRESS" || type === "RICH_CONTENT") {
-    if (!value || typeof value !== "object" || Array.isArray(value)) fail4();
+    if (!value || typeof value !== "object" || Array.isArray(value)) fail5();
     return;
   }
   if (type === "MEDIA_GALLERY") {
-    if (!Array.isArray(value)) fail4();
+    if (!Array.isArray(value)) fail5();
     return;
   }
-  if (typeof value !== "string") fail4();
+  if (typeof value !== "string") fail5();
 }
 function createFunctionDataCapability(options) {
   const declaredKv = new Map((options.data?.kv ?? []).map((spec) => [spec.name, spec]));
@@ -155819,6 +155836,9 @@ ${releaseId}`;
             ...m2.publishedAt ? { publishedAt: m2.publishedAt } : {},
             ...publicationKind ? { publicationKind } : {},
             ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {},
+            // #4091 — whether the app accepts its host's identity; Spaces opens an owner-picked
+            // member app only when it does. Absent = it signs in itself (or predates the field).
+            ...m2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {},
             // RFC 0051 §3.6 — the release's surface envelope, for tooling that has no
             // source tree (hosted admin surface picker, gallery). Absent on releases
             // built before the envelope rode the manifest.
@@ -155939,11 +155959,11 @@ ${releaseId}`;
         if (pin) {
           const m3 = app ? await pinnedManifest(app, pin) : null;
           if (!m3) return json4(404, { error: "release_not_found", app, releaseId: pin });
-          return json4(200, { releaseId: m3.releaseId, app: m3.app, pinned: true, ...m3.minBinaryVersion ? { minBinaryVersion: m3.minBinaryVersion } : {}, ...m3.playerRequirements ? { playerRequirements: m3.playerRequirements } : {}, ...m3.platforms ? { platforms: m3.platforms } : {} });
+          return json4(200, { releaseId: m3.releaseId, app: m3.app, pinned: true, ...m3.minBinaryVersion ? { minBinaryVersion: m3.minBinaryVersion } : {}, ...m3.playerRequirements ? { playerRequirements: m3.playerRequirements } : {}, ...m3.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}, ...m3.platforms ? { platforms: m3.platforms } : {} });
         }
         const m2 = app ? await manifest(app) : null;
         if (!m2) return json4(404, { error: "no_release", app });
-        return json4(200, { releaseId: m2.releaseId, app: m2.app, ...m2.minBinaryVersion ? { minBinaryVersion: m2.minBinaryVersion } : {}, ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {}, ...m2.platforms ? { platforms: m2.platforms } : {} });
+        return json4(200, { releaseId: m2.releaseId, app: m2.app, ...m2.minBinaryVersion ? { minBinaryVersion: m2.minBinaryVersion } : {}, ...m2.playerRequirements ? { playerRequirements: m2.playerRequirements } : {}, ...m2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}, ...m2.platforms ? { platforms: m2.platforms } : {} });
       }
       const bundleMatch = /^\/v1\/bundles\/([a-f0-9]{64})\.bundle\.js$/.exec(path2);
       if (bundleMatch) {
@@ -160575,19 +160595,19 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
   const invokedAs = pos[0];
   const app = invokedAs === "testflight" ? pos[1] : pos[2];
   const print = (value) => io2.log(JSON.stringify(value, null, 2));
-  const fail4 = (error, extra = {}) => {
+  const fail5 = (error, extra = {}) => {
     io2.error(JSON.stringify({ error, provider: "wix-mobile-release", ...extra }));
     return 2;
   };
-  if (invokedAs !== "testflight" && !(invokedAs === "store" && pos[1] === "upload")) return fail4("Wix Mobile Release only supports `himi testflight <app>` or `himi store upload <app>`");
-  if (app !== "himi-player") return fail4("Wix Mobile Release is reserved for the Wix-owned Himi Player binary", { app });
-  if (str5(flags.artifact)) return fail4("--artifact is not accepted for Himi Player; pass --release so deployed serve can validate the Job Service IPA and call MRE with its service identity");
-  if (on2(flags["no-wait"])) return fail4("--no-wait is not supported for Himi Player TestFlight releases; wait for MRE processing to complete");
+  if (invokedAs !== "testflight" && !(invokedAs === "store" && pos[1] === "upload")) return fail5("Wix Mobile Release only supports `himi testflight <app>` or `himi store upload <app>`");
+  if (app !== "himi-player") return fail5("Wix Mobile Release is reserved for the Wix-owned Himi Player binary", { app });
+  if (str5(flags.artifact)) return fail5("--artifact is not accepted for Himi Player; pass --release so deployed serve can validate the Job Service IPA and call MRE with its service identity");
+  if (on2(flags["no-wait"])) return fail5("--no-wait is not supported for Himi Player TestFlight releases; wait for MRE processing to complete");
   const release2 = str5(flags.release);
   const version4 = str5(flags.version);
-  if (!release2) return fail4("--release is required for a Himi Player TestFlight release");
-  if (!version4 || !/^\d+(?:\.\d+){0,2}$/.test(version4)) return fail4("--version needs the Player marketing version (for example 1.0.0)");
-  if (str5(flags.track) && str5(flags.track) !== "testflight" && str5(flags.track) !== "internal") return fail4("Wix Mobile Release only supports TestFlight upload; public App Store release remains a separate human step");
+  if (!release2) return fail5("--release is required for a Himi Player TestFlight release");
+  if (!version4 || !/^\d+(?:\.\d+){0,2}$/.test(version4)) return fail5("--version needs the Player marketing version (for example 1.0.0)");
+  if (str5(flags.track) && str5(flags.track) !== "testflight" && str5(flags.track) !== "internal") return fail5("Wix Mobile Release only supports TestFlight upload; public App Store release remains a separate human step");
   const plan = {
     ok: true,
     dryRun: on2(flags["dry-run"]),
@@ -160602,9 +160622,9 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
     print(plan);
     return 0;
   }
-  if (!deps.releasePlayerJob) return fail4("this Himi CLI cannot create a service-side Himi Player TestFlight job; target deployed serve");
+  if (!deps.releasePlayerJob) return fail5("this Himi CLI cannot create a service-side Himi Player TestFlight job; target deployed serve");
   if (!on2(flags.yes)) {
-    if (io2.isTTY !== true) return fail4("refusing to dispatch a Wix TestFlight release without --yes in a non-interactive shell");
+    if (io2.isTTY !== true) return fail5("refusing to dispatch a Wix TestFlight release without --yes in a non-interactive shell");
     if (!await deps.confirm(`  Dispatch Himi Player ${version4} to Wix TestFlight?`)) {
       io2.log("  aborted \u2014 no release was dispatched.");
       return 1;
@@ -160613,11 +160633,11 @@ async function runWixMobileRelease(pos, flags, io2, deps) {
   try {
     const released = await deps.releasePlayerJob(release2, version4);
     const status = released.status.toUpperCase();
-    if (mreStatusKind(status) !== "completed") return fail4(`Himi Player TestFlight job ${status || "FAILED"}`, { jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, ...released.error ? { error: released.error } : {} });
+    if (mreStatusKind(status) !== "completed") return fail5(`Himi Player TestFlight job ${status || "FAILED"}`, { jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, ...released.error ? { error: released.error } : {} });
     print({ ok: true, provider: "wix-mobile-release", app, jobId: released.jobId, ...released.requestId ? { requestId: released.requestId } : {}, status, ...released.url ? { url: released.url } : {} });
     return 0;
   } catch (error) {
-    return fail4(`could not complete the Himi Player TestFlight Job Service release: ${error.message}`);
+    return fail5(`could not complete the Himi Player TestFlight Job Service release: ${error.message}`);
   }
 }
 var str5, on2;
@@ -160673,23 +160693,23 @@ async function runStore(pos, flags, io2, deps) {
   const app = invokedAs === "testflight" ? pos[1] : pos[2];
   const json6 = on3(flags.json);
   const print = (o2) => io2.log(JSON.stringify(o2, null, 2));
-  const fail4 = (error, extra = {}) => {
+  const fail5 = (error, extra = {}) => {
     io2.error(JSON.stringify({ error, ...extra }));
     return 2;
   };
   if (!sub || !["preflight", "upload", "status"].includes(sub)) {
-    return fail4(`unknown store subcommand ${sub ? `"${sub}"` : ""}`.trim(), {
+    return fail5(`unknown store subcommand ${sub ? `"${sub}"` : ""}`.trim(), {
       usage: "himi store preflight|upload|status <app>   \xB7   himi testflight <app>"
     });
   }
-  if (!app) return fail4(`store ${sub} needs an <app>`);
+  if (!app) return fail5(`store ${sub} needs an <app>`);
   if (flags.provider !== void 0) {
-    return fail4(`unknown release provider "${String(flags.provider)}"`, {
+    return fail5(`unknown release provider "${String(flags.provider)}"`, {
       known: ["wix-mobile-release"]
     });
   }
   if (!deps.hasRepoCheckout()) {
-    return fail4(
+    return fail5(
       "himi store needs a Himalaya monorepo checkout \u2014 it builds and signs apps/<app>'s native target, which does not exist off-repo. Content changes (screens, Tier-5 bundles, tokens, app-config) ship over the air with `himi push` and need no binary.",
       { app }
     );
@@ -160698,14 +160718,14 @@ async function runStore(pos, flags, io2, deps) {
   try {
     cfg = deps.loadStoreConfig(app);
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   if (sub === "status") {
     let creds2;
     try {
       creds2 = deps.resolveCredentials({ app, cfg, profileFlag: str6(flags.profile) });
     } catch (e2) {
-      return fail4(e2.message);
+      return fail5(e2.message);
     }
     try {
       const s2 = await deps.ascStatus(app, credsToEnv(creds2));
@@ -160718,14 +160738,14 @@ async function runStore(pos, flags, io2, deps) {
       }
       return 0;
     } catch (e2) {
-      return fail4(`could not read App Store Connect status: ${e2.message}`);
+      return fail5(`could not read App Store Connect status: ${e2.message}`);
     }
   }
   let findings;
   try {
     findings = await deps.preflightApp(app, { profileFlag: str6(flags.profile) });
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   const { errors, warnings } = partitionFindings(findings);
   if (sub === "preflight") {
@@ -160742,12 +160762,12 @@ async function runStore(pos, flags, io2, deps) {
   const configTrack = cfg.review?.defaultTrackIos;
   const track = explicitTrack ?? (invokedAs === "testflight" ? "testflight" : configTrack ?? "testflight");
   if (track === "appstore") {
-    return fail4(
+    return fail5(
       "himi store does not submit for public App Store review \u2014 that stays a human step. Use TestFlight here, then /submit-ios-app when you mean to go public." + (explicitTrack ? "" : ` (inherited from review.defaultTrackIos; pass --track testflight to upload.)`)
     );
   }
   if (!TRACKS.has(track)) {
-    return fail4(`unknown --track "${track}"`, { known: [...TRACKS] });
+    return fail5(`unknown --track "${track}"`, { known: [...TRACKS] });
   }
   const bundleId = cfg.ios?.bundleId ?? "(unset)";
   let creds;
@@ -160756,10 +160776,10 @@ async function runStore(pos, flags, io2, deps) {
     creds = deps.resolveCredentials({ app, cfg, profileFlag: str6(flags.profile) });
     version4 = deps.readVersion(app);
   } catch (e2) {
-    return fail4(e2.message);
+    return fail5(e2.message);
   }
   if (!Number.isInteger(version4.build)) {
-    return fail4(
+    return fail5(
       `${app} has a non-integer CFBundleVersion (${JSON.stringify(version4.build)}) \u2014 this command bumps and matches build numbers arithmetically. Use an integer CFBundleVersion.`,
       { app, marketing: version4.marketing }
     );
@@ -160774,7 +160794,7 @@ async function runStore(pos, flags, io2, deps) {
     for (const f2 of findings) io2.log(`  ${f2.level === "error" ? "\u2717" : "!"} ${f2.message}`);
   }
   if (errors.length) {
-    return fail4(`${app} is not ready to upload \u2014 ${errors.length} blocking preflight issue(s).`, {
+    return fail5(`${app} is not ready to upload \u2014 ${errors.length} blocking preflight issue(s).`, {
       findings: errors,
       hint: "himi store preflight " + app
     });
@@ -160805,7 +160825,7 @@ async function runStore(pos, flags, io2, deps) {
   }
   if (!on3(flags.yes)) {
     if (io2.isTTY !== true) {
-      return fail4(
+      return fail5(
         "refusing to upload without confirmation in a non-interactive shell. Pass --yes if you really mean to publish this build, or --dry-run to see the plan.",
         { app, track, team: creds.team }
       );
@@ -160820,7 +160840,7 @@ async function runStore(pos, flags, io2, deps) {
   try {
     uploaded = reuseExisting ? version4 : deps.bumpBuild(app);
   } catch (e2) {
-    return fail4(`could not bump the build number: ${e2.message}`);
+    return fail5(`could not bump the build number: ${e2.message}`);
   }
   const rollback = () => {
     if (reuseExisting) return;
@@ -160836,11 +160856,11 @@ async function runStore(pos, flags, io2, deps) {
       r2 = await deps.exec(step, env);
     } catch (e2) {
       rollback();
-      return fail4(`${step} failed: ${e2.message}`, { app, step, build: uploaded.build, buildNumberRestored: !reuseExisting });
+      return fail5(`${step} failed: ${e2.message}`, { app, step, build: uploaded.build, buildNumberRestored: !reuseExisting });
     }
     if (r2.code !== 0) {
       if (step !== "upload") rollback();
-      return fail4(`${step} failed (exit ${r2.code})`, {
+      return fail5(`${step} failed (exit ${r2.code})`, {
         app,
         step,
         build: uploaded.build,
@@ -160864,7 +160884,7 @@ async function runStore(pos, flags, io2, deps) {
     try {
       s2 = await deps.ascStatus(app, env);
     } catch (e2) {
-      return fail4(`uploaded build ${uploaded.build}, but could not read processing status: ${e2.message}`, {
+      return fail5(`uploaded build ${uploaded.build}, but could not read processing status: ${e2.message}`, {
         app,
         build: uploaded.build,
         uploaded: true
@@ -160880,7 +160900,7 @@ async function runStore(pos, flags, io2, deps) {
       return 0;
     }
     if (mine && (mine.processingState === "FAILED" || mine.processingState === "INVALID")) {
-      return fail4(`build ${uploaded.build} is ${mine.processingState} in App Store Connect`, {
+      return fail5(`build ${uploaded.build} is ${mine.processingState} in App Store Connect`, {
         app,
         build: uploaded.build,
         processingState: mine.processingState,
@@ -160888,7 +160908,7 @@ async function runStore(pos, flags, io2, deps) {
       });
     }
     if (waited >= deadline) {
-      return fail4(
+      return fail5(
         `build ${uploaded.build} never appeared in App Store Connect after ${Math.round(deadline / 6e4)} minutes. A binary rejected during processing leaves no record and the reason is emailed, not exposed by the API \u2014 check the Apple ID inbox for team ${creds.team}.`,
         { app, build: uploaded.build, uploaded: true, processed: false }
       );
@@ -165460,7 +165480,7 @@ async function ownerPass(appId2, ports, sample) {
   const gaps = [];
   const r2 = { identity: {}, entities: [], functions: [], agents: [], connectors: [], secrets: [], routes: [], sourceFiles: [], gaps };
   const client2 = api(ports, appId2);
-  const fail4 = (chapter, e2) => {
+  const fail5 = (chapter, e2) => {
     gaps.push({ chapter, reason: e2.message });
   };
   try {
@@ -165476,7 +165496,7 @@ async function ownerPass(appId2, ports, sample) {
       source: "rest"
     };
   } catch (e2) {
-    fail4("auth", e2);
+    fail5("auth", e2);
   }
   let files = /* @__PURE__ */ new Map();
   if (!ports.downloadSource) {
@@ -165493,7 +165513,7 @@ async function ownerPass(appId2, ports, sample) {
       files = new Map(kept.map((e2) => [e2.path, e2.bytes.toString("utf8")]));
       r2.source = { root: "source", files: kept.length, denied: skipped.map((p2) => p2.split("\\").join("/")), secretFlagged: flagged };
     } catch (e2) {
-      fail4("source", e2);
+      fail5("source", e2);
     } finally {
       dl2?.cleanup();
     }
@@ -165527,13 +165547,13 @@ async function ownerPass(appId2, ports, sample) {
       if (typeof f2.name !== "string" || r2.functions.some((x2) => x2.name === f2.name)) continue;
       r2.functions.push({ name: f2.name, kind: "unknown", invoke: `base44.functions.invoke(${JSON.stringify(f2.name)}, payload)`, ...typeof f2.entry === "string" ? { sourcePath: f2.entry } : {}, source: "rest" });
     }
-  } else if (!r2.functions.length) fail4("functions", fnList.reason);
+  } else if (!r2.functions.length) fail5("functions", fnList.reason);
   if (agentList.status === "fulfilled") {
     for (const cfg of agentList.value.items ?? []) {
       const a2 = agentFromConfig(cfg, "rest");
       if (a2 && !r2.agents.some((x2) => x2.name === a2.name)) r2.agents.push(a2);
     }
-  } else if (!r2.agents.length) fail4("agents", agentList.reason);
+  } else if (!r2.agents.length) fail5("agents", agentList.reason);
   if (connList.status === "fulfilled") {
     for (const c2 of connList.value.integrations ?? []) {
       const type = typeof c2.integration_type === "string" ? c2.integration_type : void 0;
@@ -165546,9 +165566,9 @@ async function ownerPass(appId2, ports, sample) {
         if (!existing.scopes.length) existing.scopes = scopes;
       } else r2.connectors.push({ type, scopes, ...status ? { status } : {}, source: "rest" });
     }
-  } else if (!r2.connectors.length) fail4("connectors", connList.reason);
+  } else if (!r2.connectors.length) fail5("connectors", connList.reason);
   if (secretMap.status === "fulfilled") r2.secrets = Object.keys(secretMap.value ?? {}).sort();
-  else fail4("secrets", secretMap.reason);
+  else fail5("secrets", secretMap.reason);
   if (sample > 0 && samples.status === "fulfilled") {
     const refused2 = [];
     samples.value.forEach((settled, i2) => {
@@ -169707,6 +169727,436 @@ var init_cli = __esm({
   }
 });
 
+// ../../apps/himi-spaces-lite/spaces-host-manifest.ts
+var SPACES_HOST_MANIFEST;
+var init_spaces_host_manifest = __esm({
+  "../../apps/himi-spaces-lite/spaces-host-manifest.ts"() {
+    SPACES_HOST_MANIFEST = {
+      "version": "1.3.0",
+      "capabilities": [
+        "animation",
+        "app_info",
+        "base44",
+        "browser_auth",
+        "calendar",
+        "clipboard",
+        "file_picker",
+        "files",
+        "godot",
+        "haptics",
+        "himi_apps",
+        "iap",
+        "keyboard",
+        "live_activity",
+        "local_database",
+        "media_playback",
+        "motion",
+        "on_device_ai",
+        "open_url",
+        "pdf",
+        "presigned_upload",
+        "push",
+        "release_control",
+        "secure_storage",
+        "share",
+        "speaker_diarization",
+        "stream",
+        "theme",
+        "ui",
+        "wix_api",
+        "wix_cashier",
+        "wix_platform"
+      ],
+      "unlinked": {
+        "ios": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "keyboard",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "macos": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "calendar",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "iap",
+          "keyboard",
+          "live_activity",
+          "motion",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "push",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "android": [
+          "animation",
+          "base44",
+          "browser_auth",
+          "file_picker",
+          "files",
+          "godot",
+          "himi_apps",
+          "keyboard",
+          "on_device_ai",
+          "pdf",
+          "presigned_upload",
+          "speaker_diarization",
+          "ui",
+          "wix-native",
+          "wix_cashier"
+        ],
+        "web": []
+      },
+      "nativeComponents": [
+        "himi_spaces_lite.HimiSpacesLiteCard"
+      ],
+      "authProviders": [
+        "wix-consumer",
+        "wix-native"
+      ],
+      "nativeActions": [
+        "himi_spaces_lite.greet"
+      ]
+    };
+  }
+});
+
+// ../../core/ts/src/host-compatibility.ts
+function compareVersion(a2, b2) {
+  const parts = (v2) => v2.split("-")[0].split(".").map((p2) => /^\d+$/.test(p2) ? Number(p2) : 0);
+  const av = parts(a2);
+  const bv = parts(b2);
+  for (let i2 = 0; i2 < Math.max(av.length, bv.length); i2 += 1) {
+    if ((av[i2] ?? 0) !== (bv[i2] ?? 0)) return (av[i2] ?? 0) - (bv[i2] ?? 0);
+  }
+  return 0;
+}
+function claimsFor(host, shell) {
+  const gaps = shell && host.unlinked[shell] ? host.unlinked[shell] : [...host.unlinked.ios ?? [], ...host.unlinked.android ?? []];
+  const served = (ids) => ids.filter((id) => !gaps.includes(id));
+  return { capabilities: served(host.capabilities), nativeComponents: served(host.nativeComponents), authProviders: served(host.authProviders) };
+}
+function missingClaims(requirements, offered) {
+  const out2 = {};
+  for (const kind of HOST_CLAIM_KINDS) {
+    const has = new Set(offered[kind]);
+    out2[kind] = [...new Set(requirements[kind].filter((id) => !has.has(id)))];
+  }
+  return out2;
+}
+function missingReasons(missing, hostName = "the host") {
+  const reasons = [];
+  if (missing.capabilities.length) reasons.push(`Missing capabilities: ${missing.capabilities.join(", ")}`);
+  if (missing.nativeComponents.length) reasons.push(`Native components not compiled into ${hostName}: ${missing.nativeComponents.join(", ")}`);
+  if (missing.authProviders.length) reasons.push(`Unsupported auth providers: ${missing.authProviders.join(", ")}`);
+  return reasons;
+}
+function checkHostCompatibility(requirements, host, options = {}) {
+  const hostName = options.hostName ?? "the host";
+  const reasons = missingReasons(missingClaims(requirements, claimsFor(host, options.shell)), hostName);
+  const running = options.installedVersion || host.version;
+  if (requirements.minBinaryVersion && compareVersion(running, requirements.minBinaryVersion) < 0) {
+    reasons.push(`Requires ${hostName} ${requirements.minBinaryVersion} or newer (installed ${running})`);
+  }
+  if (options.requiresHostIdentity && !requirements.hostProvidedIdentity) {
+    reasons.push(`Does not accept ${hostName}'s sign-in: the app must take its identity from the host (hostProvided)`);
+  }
+  return reasons.length ? { ok: false, reason: reasons.join("; "), reasons } : { ok: true };
+}
+var HOST_CLAIM_KINDS;
+var init_host_compatibility = __esm({
+  "../../core/ts/src/host-compatibility.ts"() {
+    init_registry_app_normalize();
+    HOST_CLAIM_KINDS = PLAYER_REQUIREMENT_KINDS;
+  }
+});
+
+// ../../core/dev-server/tier5-bundles-src/_shared/branded-lite-hosted.ts
+var VERTICAL_ROOT_SCREENS, VERTICALS;
+var init_branded_lite_hosted = __esm({
+  "../../core/dev-server/tier5-bundles-src/_shared/branded-lite-hosted.ts"() {
+    VERTICAL_ROOT_SCREENS = {
+      store: ["himi_shop"],
+      bookings: ["himi_services"],
+      restaurants: ["himi_menu", "himi_reserve"],
+      programs: ["himi_programs"],
+      plans: ["himi_plans"],
+      feed: ["himi_feed"],
+      members: ["himi_members"],
+      forum: ["himi_forum"],
+      coupons: ["himi_coupons"],
+      notifications: ["himi_notifications"],
+      loyalty: ["himi_loyalty"],
+      reviews: ["himi_reviews"],
+      portfolio: ["himi_portfolio"],
+      reservations: ["himi_reservations"],
+      invoices: ["himi_invoices"],
+      badges: ["himi_badges"],
+      notifsettings: ["himi_notif_settings"],
+      events: ["himi_events"],
+      blog: ["himi_blog"],
+      groups: ["himi_groups"],
+      cms: ["himi_cms"],
+      donations: ["himi_donations"],
+      giftCards: ["himi_gift_cards"],
+      videos: ["himi_videos"],
+      podcasts: ["himi_podcasts"],
+      forms: ["himi_forms"],
+      galleries: ["himi_galleries"],
+      inbox: ["himi_inbox"],
+      faq: ["himi_faq"]
+    };
+    VERTICALS = new Set(Object.keys(VERTICAL_ROOT_SCREENS));
+  }
+});
+
+// ../../apps/himi-branded-lite/hosted-mode.ts
+var init_hosted_mode = __esm({
+  "../../apps/himi-branded-lite/hosted-mode.ts"() {
+    init_branded_lite_hosted();
+  }
+});
+
+// ../../apps/himi-branded-lite/site-provisioning.ts
+var init_site_provisioning = __esm({
+  "../../apps/himi-branded-lite/site-provisioning.ts"() {
+  }
+});
+
+// ../../apps/himi-spaces-lite/site-open.ts
+var HOSTED_MEMBER_APP;
+var init_site_open = __esm({
+  "../../apps/himi-spaces-lite/site-open.ts"() {
+    init_hosted_mode();
+    init_site_provisioning();
+    HOSTED_MEMBER_APP = "himi-branded-lite";
+  }
+});
+
+// ../../apps/himi-spaces-lite/site-app.ts
+function siteAppPickFrom(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+  const appId2 = value.appId;
+  if (appId2 === null) return null;
+  if (typeof appId2 !== "string") return void 0;
+  const id = appId2.trim();
+  return APP_ID3.test(id) ? id : void 0;
+}
+function siteAppRequirementsFrom(appId2, entry) {
+  if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return { ok: false, reason: `No release of ${appId2} to judge` };
+  const e2 = entry;
+  const names = e2.id !== void 0 ? e2.id : e2.app;
+  if (names !== appId2) return { ok: false, reason: `No release of ${appId2} to judge` };
+  if (!isPlayerRequirements(e2.playerRequirements)) {
+    return { ok: false, reason: e2.playerRequirements === void 0 ? `${appId2}'s release does not declare what it requires (republish it)` : `${appId2}'s release declares malformed requirements` };
+  }
+  const minBinaryVersion = typeof e2.minBinaryVersion === "string" && e2.minBinaryVersion ? e2.minBinaryVersion : void 0;
+  return {
+    ok: true,
+    requirements: {
+      capabilities: [...e2.playerRequirements.capabilities],
+      nativeComponents: [...e2.playerRequirements.nativeComponents],
+      authProviders: [...e2.playerRequirements.authProviders],
+      ...minBinaryVersion ? { minBinaryVersion } : {},
+      // Only an explicit `true` counts: an app that signs in by itself would ask a member to sign
+      // in again inside Spaces, with an identity Spaces does not lend (#4088).
+      ...e2.hostProvidedIdentity === true ? { hostProvidedIdentity: true } : {}
+    }
+  };
+}
+function messageOf2(err) {
+  const message = err?.message;
+  return typeof message === "string" && message ? message : String(err);
+}
+function decideSiteApp(input) {
+  const fallback = (pickedAppId, reason) => ({ appId: DEFAULT_SITE_APP, source: "fallback", pickedAppId, reason });
+  if (input.pick === void 0) return { appId: DEFAULT_SITE_APP, source: "default" };
+  if (!input.pick.ok) return fallback(null, `Could not read the site's member app: ${messageOf2(input.pick.error)}`);
+  const picked = siteAppPickFrom(input.pick.value);
+  if (picked === void 0) return fallback(null, "The site's member app setting is unreadable");
+  if (picked === null || picked === DEFAULT_SITE_APP) return { appId: DEFAULT_SITE_APP, source: "default" };
+  if (input.release === void 0) return fallback(picked, `No release of ${picked} to judge`);
+  if (!input.release.ok) return fallback(picked, `Could not read ${picked}'s release: ${messageOf2(input.release.error)}`);
+  const req = siteAppRequirementsFrom(picked, input.release.value);
+  if (!req.ok) return fallback(picked, req.reason);
+  const verdict = checkHostCompatibility(req.requirements, input.host, {
+    hostName: "Spaces",
+    requiresHostIdentity: true,
+    ...input.shell ? { shell: input.shell } : {},
+    ...input.installedVersion ? { installedVersion: input.installedVersion } : {}
+  });
+  if (!verdict.ok) return fallback(picked, verdict.reason);
+  if (!(input.hostable ?? NATIVELY_HOSTABLE_APPS).includes(picked)) {
+    return fallback(picked, `This Spaces build cannot host a custom member app yet (${picked} is compatible)`);
+  }
+  return { appId: picked, source: "picked" };
+}
+var DEFAULT_SITE_APP, NATIVELY_HOSTABLE_APPS, APP_ID3;
+var init_site_app = __esm({
+  "../../apps/himi-spaces-lite/site-app.ts"() {
+    init_host_compatibility();
+    init_registry_app_normalize();
+    init_site_open();
+    DEFAULT_SITE_APP = HOSTED_MEMBER_APP;
+    NATIVELY_HOSTABLE_APPS = [DEFAULT_SITE_APP];
+    APP_ID3 = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
+  }
+});
+
+// src/site-member-app.ts
+var site_member_app_exports = {};
+__export(site_member_app_exports, {
+  SITE_MEMBER_APP_CODES: () => SITE_MEMBER_APP_CODES,
+  SITE_MEMBER_APP_USAGE: () => SITE_MEMBER_APP_USAGE,
+  SPACES_DEFAULT_APP: () => SPACES_DEFAULT_APP,
+  memberAppVerdict: () => memberAppVerdict,
+  runSiteMemberApp: () => runSiteMemberApp
+});
+function codeFor(status, serverError) {
+  if (serverError === "forbidden_site" || serverError === "forbidden_app" || serverError === "app_bound_to_other_site") return serverError;
+  if (status === 401) return "unauthorized";
+  return "request_failed";
+}
+function memberAppVerdict(appId2, release2, shell) {
+  if (!appId2 || appId2 === SPACES_DEFAULT_APP) return { opens: SPACES_DEFAULT_APP, compatible: null };
+  const input = {
+    pick: { ok: true, value: { appId: appId2 } },
+    ...release2 !== void 0 ? { release: { ok: true, value: release2 } } : {},
+    host: SPACES_HOST_MANIFEST,
+    ...shell ? { shell } : {}
+  };
+  const fits = decideSiteApp({ ...input, hostable: [SPACES_DEFAULT_APP, appId2] });
+  const opens = decideSiteApp(input);
+  return {
+    opens: opens.appId,
+    compatible: fits.source === "picked",
+    ...opens.source === "fallback" ? { reason: opens.reason } : {}
+  };
+}
+async function runSiteMemberApp(input, deps = {}) {
+  const op = input.op;
+  if (op !== "set" && op !== "clear" && op !== "show") {
+    return fail4("invalid_usage", op ? `unknown site member-app op "${op}"` : "site member-app needs an op: set | clear | show", { usage: SITE_MEMBER_APP_USAGE });
+  }
+  const site = input.site;
+  if (!site || !SITE_RE2.test(site)) return fail4("invalid_usage", "a metaSiteId (UUID) is required", { usage: SITE_MEMBER_APP_USAGE });
+  if (op === "set" && !input.app) return fail4("invalid_usage", "set needs --app <id>", { usage: SITE_MEMBER_APP_USAGE });
+  if (op === "set" && !isValidAppId(input.app)) return fail4("invalid_usage", `--app "${input.app}" is not a valid app id`, { usage: SITE_MEMBER_APP_USAGE });
+  if (input.shell !== void 0 && input.shell !== "ios" && input.shell !== "android") {
+    return fail4("invalid_usage", `--platform must be ios or android (got "${input.shell}")`, { usage: SITE_MEMBER_APP_USAGE });
+  }
+  let target;
+  try {
+    target = (deps.resolve ?? resolveTarget)({ target: input.target, defaultTarget: input.defaultTarget, controlUrl: input.controlUrl, controlToken: input.controlToken });
+  } catch (err) {
+    return fail4("invalid_usage", err.message);
+  }
+  const insecure = credentialHostRefusal(target.control);
+  if (insecure) return fail4("insecure_target", insecure);
+  if (!target.controlToken) return fail4("control_token_required", "no control token \u2014 run `himi login` (or pass --control-token)");
+  let wixToken;
+  try {
+    wixToken = await (deps.wixToken ?? accountToken)();
+  } catch {
+    return fail4("wix_token_unavailable", "could not mint the account's Wix token (`wix token`) \u2014 the publishing service needs it to verify you own the site");
+  }
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const control = target.control.replace(/\/+$/, "");
+  const url = `${control}/v1/admin/site/member-app${op === "set" ? "" : `?site=${encodeURIComponent(site)}`}`;
+  let status;
+  let body;
+  try {
+    const response = await fetchImpl(url, {
+      method: op === "set" ? "PUT" : op === "clear" ? "DELETE" : "GET",
+      redirect: "error",
+      signal: AbortSignal.timeout(3e4),
+      headers: {
+        "content-type": "application/json",
+        "x-control-token": target.controlToken,
+        Authorization: wixToken,
+        ...target.previewRoute ? { "x-wix-route-serve": target.previewRoute } : {}
+      },
+      ...op === "set" ? { body: JSON.stringify({ site, app: input.app }) } : {}
+    });
+    status = response.status;
+    body = await response.json().catch(() => ({}));
+  } catch {
+    return fail4("control_unreachable", `could not reach the publishing service at ${control}`);
+  }
+  if (status < 200 || status >= 300) {
+    return fail4(
+      codeFor(status, body.error),
+      typeof body.error === "string" ? body.error : `HTTP ${status}`,
+      { status, ...typeof body.error === "string" ? { serverError: body.error } : {} }
+    );
+  }
+  if (op !== "show") return { ok: true, ...body };
+  const pick2 = body.memberAppInSpaces;
+  const appId2 = typeof pick2?.appId === "string" ? pick2.appId : null;
+  let release2;
+  if (appId2 && appId2 !== SPACES_DEFAULT_APP && !body.invalid) {
+    try {
+      const response = await fetchImpl(`${target.serve.replace(/\/+$/, "")}/v1/release/current?app=${encodeURIComponent(appId2)}`, {
+        redirect: "error",
+        signal: AbortSignal.timeout(3e4),
+        // The same deployment the pick was read from (a preview route), never production's release.
+        ...target.previewRoute ? { headers: { "x-wix-route-serve": target.previewRoute } } : {}
+      });
+      release2 = response.ok ? await response.json() : void 0;
+    } catch {
+      release2 = void 0;
+    }
+  }
+  const verdict = body.invalid ? { opens: SPACES_DEFAULT_APP, compatible: false, reason: `The pick is no longer valid (${String(body.invalid)}): the site resolves to Branded Lite` } : memberAppVerdict(appId2, release2, input.shell);
+  return { ok: true, ...body, ...verdict, host: { name: "Spaces", version: SPACES_HOST_MANIFEST.version, ...input.shell ? { shell: input.shell } : {} } };
+}
+var SPACES_DEFAULT_APP, SITE_MEMBER_APP_USAGE, SITE_MEMBER_APP_CODES, SITE_RE2, fail4;
+var init_site_member_app = __esm({
+  "src/site-member-app.ts"() {
+    init_config();
+    init_credential_hosts();
+    init_contract();
+    init_spaces_host_manifest();
+    init_site_app();
+    init_wix_owner();
+    SPACES_DEFAULT_APP = DEFAULT_SITE_APP;
+    SITE_MEMBER_APP_USAGE = "himi site member-app set <site> --app <id> | clear <site> | show <site> [--platform ios|android] [--target <name>] [--control-url <url>] [--control-token <t>]  (<site> may be given as --site <msid>)";
+    SITE_MEMBER_APP_CODES = [
+      "invalid_usage",
+      "insecure_target",
+      "control_token_required",
+      "wix_token_unavailable",
+      "forbidden_site",
+      "forbidden_app",
+      "app_bound_to_other_site",
+      "unauthorized",
+      "control_unreachable",
+      "request_failed"
+    ];
+    SITE_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+    fail4 = (code, error, extra = {}) => ({ ok: false, code, error, ...extra });
+  }
+});
+
 // src/site-analyze/visitor-auth.ts
 async function mintVisitorToken(fetchImpl, clientId) {
   const res = await fetchImpl(`${WIX_API3}/oauth2/token`, {
@@ -176466,7 +176916,7 @@ var COMMANDS2 = [
   { name: "connector", summary: "personal access tokens for the hosted MCP connector (Wix Native App Builder), for an AI tool that cannot sign in with OAuth (e.g. Base44's builder): `token create` opens a Wix sign-in page and prints a long-lived token once, to paste into the tool as `Authorization: Bearer <token>`; `token list` / `token revoke <id>` manage them with the `himi login --browser` token. The token can only build and publish DRAFTS.", required: "token create [--name <n>] [--days <1-90>] [--no-open] | token list | token revoke <id> [--target <t>]" },
   { name: "notify", summary: "Hosted --all-members requires --yes for a live send; --dry-run checks ownership/readiness and counts approved recipients without sending. `setup` optionally configures Branded/Ping from local customer key files; `status --refresh` reads live backend readiness. Setup may be deferred while building. These use serve-control and require owner plus Wix account authentication. `send`, `tokens`, `doctor`: send a REAL push notification to registered devices (RFC 0036 WS5) \u2014 APNs .p8 over HTTP/2 for iOS, FCM v1 for Android. `send` targets one device (--token / --device <registry id>) or fans out to the whole app (--all), reporting a per-device result; a token the provider says is uninstalled (APNs 410 Unregistered / FCM UNREGISTERED) is auto-disabled, while a merely wrong one (BadDeviceToken \u2014 usually a sandbox/production mismatch) is recorded and left enabled. `tokens` lists the registry. `doctor` reports which credentials resolve and which sender each platform picks. Talks to the admin-server via --admin-url/HIMALAYA_ADMIN_URL, authenticated with --admin-session/HIMALAYA_ADMIN_SESSION. `send --provider ping` is the hosted alternative: the serve plane sends to one site member (--member-email) or all approved members (--all-members) through Ping as Himalaya, with owner login instead of provider keys, and reports acceptance, never delivery. NOT `himi push`, which publishes a release.", required: "setup|status [--content <dir>] [--target <t>] [--refresh] [--yes] [--no-push-setup] | send --provider ping [--content <dir>] [--app <a>] [--site <msid>] (--member-email <email> | --all-members (--dry-run | --yes)) --title <s> [--body <s>] --link <url> [--request-id <uuid>] [--dry-run] [--json] | send|tokens|doctor [--app <a>] [--token <t> | --device <id> | --all] [--title <s>] [--body <s>] [--link <url>] [--platform ios|android] [--badge <n>] [--channel <id>] [--silent] [--dry-run] [--json]" },
   { name: "signing", summary: "READ-ONLY App Store Connect inventory for customer BYO TestFlight readiness. `inspect` lists whether the bundle id, distribution certificate, IOS_APP_STORE profile, and ASC app record exist for --bundle-id / --team-id using a local ASC .p8 (flags or ASC_KEY_* env). Never uploads or mutates Apple resources. Optional --cert-file/--profile-file classify on-disk material.", required: "inspect --bundle-id <id> --team-id <id> --asc-key-file <path> --asc-key-id <id> --asc-issuer-id <id> [--cert-file <p12> --cert-password <pw> --profile-file <mobileprovision>] [--json]" },
-  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no browser and never uploads or applies anything. A URL is optional there: `--url` lets it read the published page's Velo code-app ids (credential-free, pinned transport) so the backend source is found on sites where the owner code-app probe 404s. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--url <https>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke]" },
+  { name: "site", summary: "PROVISION a Wix project, then analyze or extend it. `create` is the one door that makes a site instead of adopting one: POST /funnel/projects/v1/create (a WIX site, a HEADLESS backend, a BRANDED_APP, or a VIBE site), and for headless it also mints the OAuth app whose id IS the `WIX_CLIENT_ID` \u2014 with --redirect-uri already registered, because an unregistered redirect makes native signInDirect fail at redirect-session. `--verticals` REQUIRES `--template` and reports only what Wix confirmed: measured, installing onto a project created from the BLANK template returns 200 while the vertical's API answers 428 forever, because there is no site for it to attach to (the install asks for CREATE_SITE). A real template ships its verticals installed and populated, and installing further ones onto it then works. It MUTATES your Wix account and needs --yes; without it you get the payload and nothing is sent. `list` is the read-only site inventory (with each site's premium flag, which is what explains an installed-but-428 vertical). Auth is the account-scoped `wix token` (no --site), falling back to WIX_API_KEY + WIX_ACCOUNT_ID. `client` is the same OAuth step for a site that ALREADY exists \u2014 the one himi adopts rather than makes \u2014 so a clientId no longer means a manual trip to the dashboard: `client ensure` reconciles rather than mints, because a site can already carry a client with NO registered redirect and shipping that one fails signInDirect at runtime; it reuses a client that carries --redirect-uri, PATCHes one that matches --name but lacks it (unioning, so another app's redirect survives), and creates only when there is nothing to reuse (--new forces a fresh one). --name IS the idempotency key. `client` auth is SITE-scoped (`wix token --site <msid>`) because minting is owner-of-that-site, and --yes gates every mutation: a site that already has a usable client resolves WITHOUT it, but --write-provisioning needs --yes even then because it rewrites a manifest on disk (the dry run's planned.provisioning names the file). That query endpoint IGNORES paging (measured: query.paging, cursorPaging and a top-level paging all return the full set at offset 0), so when pagingMetadata reports more clients than came back, `ensure` REFUSES EVERY outcome \u2014 create, patch AND reuse. Reuse is refused too because pickClient breaks ties on the OLDEST createdDate, so an omitted older same-named MOBILE client with the same redirect would win a later complete read and the resolved clientId would MOVE between runs \u2014 and it gets written into provisioning.json; convergence is what makes a stray duplicate untidy rather than harmful. --name cannot narrow the query (no filter is sent; the name is applied to the rows after they arrive), so the recovery is the dashboard; --new skips the query entirely. A `patched` result is verified against what Wix STORED \u2014 the redirect list is read off the PATCH response, and re-read via GET when the response omits it, because falling back to the list himi just sent would make the guard pass vacuously on exactly the silent no-op it exists to catch. `client list` is the read-only inventory of a site's clients: act on its `shippable` column rather than `hasRedirect`, because shippable ALSO requires a MOBILE applicationType and `ensure` refuses a WEB client \u2014 a WEB one carrying your redirect looks right and is not a candidate \u2014 and it sets truncated:true rather than presenting a partial inventory as the whole one. `analyze --read-only` returns API-only generation context as JSON (identity, access probes, CMS permissions and selected redacted Velo source); it needs no browser and never uploads or applies anything. A URL is optional there: `--url` lets it read the published page's Velo code-app ids (credential-free, pinned transport) so the backend source is found on sites where the owner code-app probe 404s. `analyze` reads a site into a business-book folder (REST + Playwright, GET-only); `--url` alone is the visitor-only pass over the published pages, and `--client-id` adds the vertical probes and the app binding `--apply` requires; `site function` list/get/put/publish/invokes that site's Velo HTTP functions and is not `himi functions` (serve-plane jobs). `--apply` bakes into a brandable shell (a site shell needs no `--client-id`: it is visitor-only and binds no client); `--shell` takes the same names `himi dist --shell` does and defaults to branded-lite, and a shell that ships no prepare:customer is refused by name rather than half-built. `--shell brandy` (the site shell, RFC 0062) also derives the site's page map from its published pages and header menu \u2014 Home first, up to four tabs for the pages a visitor returns to, the rest in the drawer \u2014 into the overlay's `site` block, so it can be edited before `--apply`; only a site shell ever receives that block. It never overwrites any shell's committed apps/<shell>/provisioning.json. `member-app set|clear|show <msid>` is the site's member app in Spaces (#4091): the himi app the site's members open in Spaces Lite instead of Branded Lite. `set --app <id>` takes the site's own app or one your account owns (an owned app not yet tied to the site is linked first; another account's app is refused, 403); `clear` returns the site to Branded Lite; `show` prints the pick plus the COMPUTED verdict \u2014 the picked release's requirements judged against the Spaces host manifest (checkHostCompatibility, `--platform` to judge one phone platform) \u2014 and `reason` when it falls back to Branded Lite. Auth is your `himi login` control token plus the account `wix token`, which the plane uses to verify you own the site.", required: "create <name> [--type wix|headless|branded-app|vibe] [--template <guid>] [--verticals stores,bookings,\u2026] [--folder <guid>] [--redirect-uri <uri>] [--no-oauth-app] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | list | client ensure|list --site <msid> [--name <name>] [--redirect-uri <uri>] [--new] [--write-provisioning [path]] [--site-url <url>] [--json] --yes | analyze --read-only [--site <msid>] [--client-id <id>] [--url <https>] [--json] | analyze --url <https> [--client-id <id>] [--site <msid>] [--out <dir>] [--redirect-uri <uri>] [--apply] [--shell " + SHELL_ENUM + "] | function list|get|put|publish|invoke [--site <msid>] [--url <https>] [--method GET|POST|PUT|DELETE] [--source <file>] [--body <json>] [--publish] [--invoke] | member-app set|clear|show <msid> [--app <id>] [--platform ios|android]" },
   { name: "base44", summary: "read a BASE44 app into an app book (book.json + BOOK.md) for the agent building a Himi app from it \u2014 the Base44 counterpart of `site analyze`, READ-ONLY. `analyze --url <published app>` is the VISITOR pass: the app id, name, favicon and colours from the published SPA, its router paths, and screenshots + look tokens from the Playwright crawl. `analyze --app-id <id>` adds the OWNER pass and needs a session: the project source under <out>/source/ (the read half of `base44 eject` \u2014 GET api/apps/<id>/eject \u2014 through the same deny-list and secret scan `himi push` uses, widened by the book's token shapes; `eject` itself is never run because it CREATES a copy of the app), every entity's JSON schema, required fields and RLS rules with up to --sample redacted rows (default 5, 0 = off), backend functions, agents, connectors (names and scopes only, never tokens), secret NAMES (never values), auth visibility + providers, and the route \u2192 component \u2192 entities map from the source router. Every chapter it could not read is listed in `gaps` rather than failing the run. `login` runs Base44's device sign-in and stores the session in ~/.himi/base44/session.json (never the repo; --from-base44-cli imports `npx base44 login`'s session instead); BASE44_ACCESS_TOKEN in the environment wins, for CI. `whoami` prints who is signed in (never the token); `logout` removes the stored session. `auth-check --url <tenant> --ios-app-id <PREFIX.bundle.id>` and/or `--android-package <package> --android-sha256 <fingerprint>` checks public native-login associations and prints missing entries; it never reads an owner token. --json prints the book itself. himi docs base44-app-context", required: "analyze (--url <https://\u2026> | --app-id <id>) [--out .himi/base44-book] [--sample <n>] [--json] | login [--from-base44-cli] | whoami | logout | auth-check --url <https://tenant> [--ios-app-id <PREFIX.bundle.id>] [--android-package <package> --android-sha256 <fingerprint>]" },
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "upgrade", summary: "install the newest published CLI (`npm i -g @wix/himalaya-cli@latest`) and report what moved. This is the explicit door: himi also updates itself when the running build is more than a week old \u2014 unattended it just does it and re-runs your command, at a terminal it asks first \u2014 and `HIMI_NO_UPDATE_CHECK=1` turns that off, leaving this command as the way to catch up. Reports `unchanged` rather than claiming success when npm exits 0 without moving the version, which is what a registry mirror serving its own pinned copy looks like.", required: "[--json]" },
@@ -177179,13 +177629,13 @@ function previewTelemetryUrl(serveBase, app, release2) {
 function diagnoseBody(body) {
   const findings = body.findings;
   if (!Array.isArray(findings)) return body;
-  const messageOf2 = (entry) => {
+  const messageOf3 = (entry) => {
     const message = entry && typeof entry === "object" ? entry.message : void 0;
     return typeof message === "string" ? message : void 0;
   };
-  const shown2 = new Set(findings.map(messageOf2).filter((message) => message !== void 0));
+  const shown2 = new Set(findings.map(messageOf3).filter((message) => message !== void 0));
   const folded = (value) => Array.isArray(value) && value.length > 0 && value.every((entry) => {
-    const message = messageOf2(entry);
+    const message = messageOf3(entry);
     return message !== void 0 && shown2.has(message);
   });
   const out2 = {};
@@ -184339,6 +184789,23 @@ Code: ${userCode}`);
       }
       case "site": {
         const sub = pos[1];
+        if (sub === "member-app") {
+          const { runSiteMemberApp: runSiteMemberApp2 } = await Promise.resolve().then(() => (init_site_member_app(), site_member_app_exports));
+          const r2 = await runSiteMemberApp2({
+            op: pos[2],
+            site: pos[3] ?? str9(flags.site),
+            app: str9(flags.app),
+            shell: str9(flags.platform),
+            target: str9(flags.target),
+            // Off-repo, `himi login` stores its token under `wix`; resolve where it did.
+            defaultTarget: contextualDefaultTarget,
+            controlUrl: str9(flags["control-url"]),
+            controlToken: str9(flags["control-token"])
+          });
+          if (r2.ok) print(r2);
+          else io2.error(JSON.stringify(r2));
+          return r2.ok ? 0 : r2.code === "invalid_usage" ? 2 : 1;
+        }
         if (sub === "function") {
           const { runSiteFunctionCli: runSiteFunctionCli2, SITE_FUNCTION_USAGE: SITE_FUNCTION_USAGE2 } = await Promise.resolve().then(() => (init_cli2(), cli_exports2));
           try {

package/guides/himi-json-output.md

@@ -6,7 +6,7 @@ repurposed when human wording changes. New codes may be added; consumers must
 handle an unknown code as a failure, without parsing prose.
 
 **Rollout:** this contract is enforced for **`himi push`**, including `--only`,
-first, and for **`himi store iap connect`**. Other subcommands still have legacy failures without codes and are a
+first, for **`himi store iap connect`**, and for **`himi site member-app`**. Other subcommands still have legacy failures without codes and are a
 follow-up migration. This is an additive change: existing `error`, `errors`,
 `message`, `hint`, status, body, and gate-specific fields stay as they were.
 Some legacy envelopes have no singular `error` or `hint`; consumers must not
@@ -106,6 +106,31 @@ failure codes. A forced push still follows the existing override rules.
 | `config_not_applied` | `--content` was given, but the binding is not in its `config.ts` (no config file, a dynamic or symlinked config, an edit `himi validate` rolled back, or no validator); the `config` report or `note` says what to add by hand. |
 | `connect_failed` | An otherwise unclassified error stopped connect (for example an unreadable manifest, or a failed `--out` write). The original message is preserved. |
 
+## `himi site member-app` codes
+
+`himi site member-app set|clear|show <site>` prints one envelope. A refusal from the publishing service
+keeps the service's own `error` in `serverError` and its HTTP `status`; the CLI `code` is one of:
+
+| Code | Meaning |
+|---|---|
+| `invalid_usage` | Missing or malformed op, site id, `--app` or `--platform`. Nothing was sent. |
+| `insecure_target` | The target's control URL is not an https `wix.com` host (or loopback), so the Wix credential was neither minted nor sent. Nothing was sent. |
+| `control_token_required` | No control token for the target — run `himi login`. Nothing was sent. |
+| `wix_token_unavailable` | The account Wix token (`wix token`) could not be minted; the publishing service needs it to verify site ownership. Nothing was sent. |
+| `forbidden_site` | The publishing service could not verify that your account owns the site (403). |
+| `forbidden_app` | The app is not yours, or does not exist (403). Nothing was stored. |
+| `app_bound_to_other_site` | The app is another site's own app (403). |
+| `unauthorized` | The control token was refused or revoked (401). |
+| `control_unreachable` | The publishing service could not be reached. |
+| `request_failed` | Any other refusal; `status` and `serverError` say which. |
+
+`show` succeeds with `opens` (what members get: the picked app or `himi-branded-lite`), `compatible`
+(whether the picked release fits the Spaces host manifest, judged with `checkHostCompatibility`), and —
+whenever members get Branded Lite instead of the pick — `reason`. `opens` is Spaces' own decision, so a
+compatible pick that this Spaces build cannot host yet reports `compatible: true` with `opens:
+"himi-branded-lite"` and that reason. An incompatible pick is not a failure: it is `ok: true` with
+`compatible: false`.
+
 ## Follow-ups
 
 - Migrate failure envelopes in subcommands other than `push`, keeping this contract.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1351.0",
+  "version": "0.1352.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "7a0aebeceac5d04d67aaff28b7a887d5cdd1d32013f8f26f81a04b81"
+  "falconPackageHash": "3d6e10a135511ba6f09d842a8dd9aee9013e5b36a3f4d79fe5a3f266"
 }