@wix/himalaya-cli 0.1369.0 → 0.1371.0

package/dist/cli.mjs

@@ -28688,8 +28688,17 @@ var init_wix_cache_defaults_generated = __esm({
 });
 
 // ../../core/dev-server/src/wix-cache-policy.ts
+function rulePath(pathPrefix) {
+  const m2 = /^https?:\/\/[^/]+(\/.*)?$/i.exec(pathPrefix);
+  return m2 ? m2[1] ?? "/" : pathPrefix;
+}
+function originOf(pathPrefix) {
+  const m2 = /^(https?:\/\/[^/]+)/i.exec(pathPrefix);
+  return m2 ? m2[1] : null;
+}
 function clampRule(rule, denyPrefixes, maxTTL) {
-  const denied2 = denyPrefixes.some((p2) => rule.pathPrefix.startsWith(p2));
+  const path2 = rulePath(rule.pathPrefix);
+  const denied2 = denyPrefixes.some((p2) => path2.startsWith(p2));
   return {
     ...rule,
     cacheable: rule.cacheable && !denied2,
@@ -28712,10 +28721,11 @@ function resolveWixCachePolicy(appName2, declared) {
   const legacy = CACHE_OVERRIDES[appName2] ?? [];
   const appLevel = [...own4, ...legacy];
   const defaults = declared?.platformDefaults === false ? [] : PLATFORM_DEFAULT_WIX_CACHE_RULES.filter((d2) => !appLevel.some((a2) => shadows(a2, d2)));
-  const denies = [
-    ...[...PLATFORM_DENY_PREFIXES, ...PERSONAL_DATA_PREFIXES].map((pathPrefix) => ({ method: null, pathPrefix, cacheable: false, ttl: 0, swr: 0, tag: null })),
-    ...PERSONAL_DATA_READS.map(([method, pathPrefix]) => ({ method, pathPrefix, cacheable: false, ttl: 0, swr: 0, tag: null }))
-  ];
+  const origins = ["", ...new Set(appLevel.map((r2) => originOf(r2.pathPrefix)).filter((o2) => !!o2))];
+  const denies = origins.flatMap((origin) => [
+    ...[...PLATFORM_DENY_PREFIXES, ...PERSONAL_DATA_PREFIXES].map((p2) => ({ method: null, pathPrefix: origin + p2, cacheable: false, ttl: 0, swr: 0, tag: null })),
+    ...PERSONAL_DATA_READS.map(([method, p2]) => ({ method, pathPrefix: origin + p2, cacheable: false, ttl: 0, swr: 0, tag: null }))
+  ]);
   const rules = [...appLevel, ...defaults, ...denies].map((r2) => clampRule(r2, PLATFORM_DENY_PREFIXES, PLATFORM_MAX_TTL));
   return { rules, defaultCacheable: declared?.defaultCacheable ?? false };
 }
@@ -33216,7 +33226,89 @@ function wixClientIdOf(appConfigJson) {
   if (typeof clientId !== "string" || !clientId) return { error: "no_client_id" };
   return { clientId };
 }
-var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache;
+function isForwardableWixSessionCookie(name) {
+  return name === "wixSession2" || name.startsWith("session3") || name === "XSRF-TOKEN" || name === "petri_ovr" || name.toLowerCase() === "svsession" || name === "wixUIDX";
+}
+function forwardableWixSessionCookies(cookieHeader) {
+  const pairs = (cookieHeader ?? "").split(/;\s*/).filter((pair) => {
+    const eq = pair.indexOf("=");
+    return eq > 0 && isForwardableWixSessionCookie(pair.slice(0, eq).trim());
+  });
+  return pairs.some((pair) => pair.startsWith("wixSession2=")) ? pairs.join("; ") : "";
+}
+function wixAccountSignInUrl(postLogin) {
+  const signIn = new URL("https://users.wix.com/signin");
+  signIn.searchParams.set("postLogin", postLogin);
+  return signIn.toString();
+}
+function allowedAccountTarget(method, url) {
+  let target;
+  try {
+    target = new URL(url);
+  } catch {
+    return null;
+  }
+  if (target.protocol !== "https:" || target.port !== "" && target.port !== "443" || target.username || target.password) return null;
+  const host = target.hostname.toLowerCase();
+  const verb = method.toUpperCase();
+  return ACCOUNT_FORWARD_ALLOWLIST.some((e2) => e2.host === host && e2.method === verb && e2.path === target.pathname) ? target : null;
+}
+function isAccountJoinCall(method, url) {
+  const target = allowedAccountTarget(method, url);
+  return !!target && ACCOUNT_JOIN_PATHS.has(target.pathname);
+}
+async function wixAccountCall(method, url, body, sessionCookie, fetchImpl = fetch, forwardedHeaders = {}, memberInstance) {
+  const target = allowedAccountTarget(method, url);
+  if (!target) throw new Error("not an allowlisted account endpoint");
+  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(sessionCookie)?.[1];
+  const res = await fetchImpl(target.toString(), {
+    method: method.toUpperCase(),
+    headers: {
+      ...forwardedHeaders,
+      Cookie: sessionCookie,
+      Accept: "application/json",
+      ...xsrf ? { "x-xsrf-token": xsrf } : {},
+      ...memberInstance ? { Authorization: memberInstance } : {},
+      ...body ? { "Content-Type": "application/json" } : {}
+    },
+    body: method.toUpperCase() === "GET" || method.toUpperCase() === "HEAD" ? void 0 : body,
+    redirect: "manual"
+  });
+  return { status: res.status, body: await res.text() };
+}
+function instancePayload(instance) {
+  const part = instance.split(".")[1];
+  if (!part) return null;
+  try {
+    const b64 = part.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(part.length / 4) * 4, "=");
+    const parsed = JSON.parse(decodeURIComponent(Array.from(atob(b64), (c2) => `%${c2.charCodeAt(0).toString(16).padStart(2, "0")}`).join("")));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function memberInstanceRejection(instance, metaSiteId) {
+  const p2 = instancePayload(instance);
+  if (!p2) return "undecodable instance";
+  if (typeof p2.metaSiteId !== "string" || !p2.metaSiteId) return "no metaSiteId";
+  if (p2.metaSiteId !== metaSiteId) return "instance is for another site";
+  if (typeof p2.siteMemberId !== "string" || !p2.siteMemberId) return "no siteMemberId";
+  if (p2.uid !== p2.siteMemberId) return "uid is not the site member";
+  if (p2.permissions !== void 0) return "a User instance, not a Member one";
+  return null;
+}
+function memberInstanceRefreshAt(instance, now, fallbackMs = 12e4) {
+  const raw = instancePayload(instance)?.expirationDate;
+  const expiry = typeof raw === "string" ? Date.parse(raw) : NaN;
+  return Number.isFinite(expiry) ? Math.max(now, expiry - MEMBER_REFRESH_MARGIN_MS) : now + fallbackMs;
+}
+function memberInstanceRefusal(e2) {
+  if (e2 instanceof NotSiteMember) return { status: 403, body: { error: "NotSiteMember", metaSiteId: e2.metaSiteId, reason: e2.reason } };
+  if (e2 instanceof AccountSessionExpired) return { status: 401, body: { error: "AccountSessionExpired", metaSiteId: e2.metaSiteId, reason: e2.reason } };
+  if (e2 instanceof SiteInstanceUnavailable) return { status: 502, body: { error: "SiteInstanceUnavailable", metaSiteId: e2.metaSiteId, reason: e2.reason } };
+  return { status: 502, body: { error: "SiteInstanceUnavailable" } };
+}
+var WIX_API, ONE_APP_SESSION, OWNER_SCOPED_WIX_HOST, WIX_FORWARDABLE_HEADERS, OWNER_REFRESH_MARGIN_MS, OWNER_RENEW_MIN_AGE_MS, OWNER_MINT_TIMEOUT_MS, OwnerInstanceCache, OWNER_SITES_QUERY_PATH, OWNER_SITES_COUNT_PATH, OwnerSitesCache, ACCOUNT_FORWARD_ALLOWLIST, ACCOUNT_JOIN_PATHS, NotSiteMember, AccountSessionExpired, SiteInstanceUnavailable, MEMBER_REFRESH_MARGIN_MS, MEMBER_NEGATIVE_TTL_MS, MEMBER_TRANSIENT_TTL_MS, MemberInstanceCache;
 var init_wix_bridge = __esm({
   "../../core/serve-runtime/src/wix-bridge.ts"() {
     init_sha256();
@@ -33365,6 +33457,166 @@ ${cookieHeader}`);
         this.cache.delete(this.key(cookieHeader, limit));
       }
     };
+    ACCOUNT_FORWARD_ALLOWLIST = [
+      // My Sites (my-sites.ts)
+      { host: "apps.wix.com", method: "GET", path: "/_api/app-state/v1/user/state" },
+      { host: "apps.wix.com", method: "GET", path: "/wixapp/api/v1/businesses/recent" },
+      { host: "manage.wix.com", method: "POST", path: "/_serverless/mobile-apps-editor-middleware/spaces-businesses" },
+      { host: "apps.wix.com", method: "GET", path: "/api/v1/mobile-platform-facade/business/pending" },
+      { host: "apps.wix.com", method: "POST", path: "/api/v1/mobile-platform-facade/business/pinned" },
+      { host: "apps.wix.com", method: "POST", path: "/api/v1/mobile-platform-facade/business/hidden" },
+      { host: "apps.wix.com", method: "POST", path: "/growth/v1/business/pending/cancel" },
+      { host: "www.wixapis.com", method: "POST", path: OWNER_SITES_QUERY_PATH },
+      // Site open (site-open.ts)
+      { host: "apps.wix.com", method: "GET", path: "/wixapp/api/v1/business" },
+      // Join, invite, leave (join.ts)
+      { host: "apps.wix.com", method: "GET", path: "/clubs/api/v1/invites/details" },
+      { host: "apps.wix.com", method: "POST", path: "/clubs/api/v1/business/join/details" },
+      { host: "apps.wix.com", method: "POST", path: "/clubs/api/v1/invites/accept" },
+      { host: "apps.wix.com", method: "POST", path: "/clubs/api/v1/business/join" },
+      { host: "apps.wix.com", method: "POST", path: "/clubs/api/v1/invites" },
+      { host: "apps.wix.com", method: "DELETE", path: "/api/v1/mobile-platform-facade/members/me" }
+    ];
+    ACCOUNT_JOIN_PATHS = /* @__PURE__ */ new Set(["/clubs/api/v1/invites/accept", "/clubs/api/v1/business/join"]);
+    NotSiteMember = class extends Error {
+      constructor(metaSiteId, reason) {
+        super(`NotSiteMember(metaSiteId: ${metaSiteId}): ${reason}`);
+        this.metaSiteId = metaSiteId;
+        this.reason = reason;
+        this.name = "NotSiteMember";
+      }
+      code = "NotSiteMember";
+    };
+    AccountSessionExpired = class extends Error {
+      constructor(metaSiteId, reason) {
+        super(`AccountSessionExpired(metaSiteId: ${metaSiteId}): ${reason}`);
+        this.metaSiteId = metaSiteId;
+        this.reason = reason;
+        this.name = "AccountSessionExpired";
+      }
+      code = "AccountSessionExpired";
+    };
+    SiteInstanceUnavailable = class extends Error {
+      constructor(metaSiteId, reason) {
+        super(`SiteInstanceUnavailable(metaSiteId: ${metaSiteId}): ${reason}`);
+        this.metaSiteId = metaSiteId;
+        this.reason = reason;
+        this.name = "SiteInstanceUnavailable";
+      }
+      code = "SiteInstanceUnavailable";
+    };
+    MEMBER_REFRESH_MARGIN_MS = 6e4;
+    MEMBER_NEGATIVE_TTL_MS = 1e4;
+    MEMBER_TRANSIENT_TTL_MS = 3e3;
+    MemberInstanceCache = class {
+      constructor(fetchImpl = fetch, mintTimeoutMs = OWNER_MINT_TIMEOUT_MS) {
+        this.fetchImpl = fetchImpl;
+        this.mintTimeoutMs = mintTimeoutMs;
+      }
+      cache = /* @__PURE__ */ new Map();
+      inflight = /* @__PURE__ */ new Map();
+      refusals = /* @__PURE__ */ new Map();
+      /** Per session: bumped by `forgetSession` / `forgetRefusals`. A mint that started under an older
+       *  generation still answers its own callers, but writes nothing back — otherwise a mint in flight
+       *  across a sign-out re-caches the signed-out instance, and one in flight across a join re-caches
+       *  the `NotSiteMember` the join just made stale. */
+      generations = /* @__PURE__ */ new Map();
+      session(sessionCookie) {
+        return sha256Hex(/(?:^|;\s*)wixSession2=([^;]*)/.exec(sessionCookie)?.[1] ?? sessionCookie);
+      }
+      key(msid, session) {
+        return sha256Hex(`${msid}
+Member
+${session}`);
+      }
+      /** The site's Member instance for this session. Throws `NotSiteMember` or `SiteInstanceUnavailable`.
+       *  `force`: Wix refused the instance this cache handed out (a 401) — mint a new one. */
+      async instance(msid, sessionCookie, opts = {}) {
+        const now = opts.now ?? Date.now();
+        const session = this.session(sessionCookie);
+        const key2 = this.key(msid, session);
+        const generation = this.generations.get(session) ?? 0;
+        const pending = this.inflight.get(key2);
+        if (pending && pending.generation === generation) return (await pending.mint).instance;
+        const refused2 = this.refusals.get(key2);
+        if (refused2 && refused2.until > now && !opts.force) throw refused2.error;
+        const hit = this.cache.get(key2);
+        if (hit && !opts.force && hit.refreshAt > now) return hit.instance;
+        const mint = this.mint(key2, msid, sessionCookie, session, now, generation).finally(() => {
+          if (this.inflight.get(key2)?.mint === mint) this.inflight.delete(key2);
+        });
+        this.inflight.set(key2, { mint, generation });
+        return (await mint).instance;
+      }
+      /** Drop everything held for this session — instances and refusals alike: its sign-out or expiry
+       *  (RFC 0071 §6, sign-out purges every per-site instance). */
+      forgetSession(sessionCookie) {
+        const session = this.session(sessionCookie);
+        for (const [key2, entry] of this.cache) if (entry.session === session) this.cache.delete(key2);
+        this.forgetRefusals(sessionCookie);
+      }
+      /** Drop every refusal held for this session — after a join, which makes them stale. */
+      forgetRefusals(sessionCookie) {
+        const session = this.session(sessionCookie);
+        this.generations.set(session, (this.generations.get(session) ?? 0) + 1);
+        for (const [key2, refusal] of this.refusals) if (refusal.session === session) this.refusals.delete(key2);
+      }
+      async mint(key2, msid, sessionCookie, session, now, generation) {
+        const current = () => (this.generations.get(session) ?? 0) === generation;
+        const refuse7 = (error, ttl2) => {
+          if (!current()) throw error;
+          this.cache.delete(key2);
+          this.refusals.set(key2, { error, until: now + ttl2, session });
+          throw error;
+        };
+        const abort = new AbortController();
+        let timer;
+        const timedOut = new Promise((_2, reject) => {
+          timer = setTimeout(() => {
+            abort.abort();
+            reject(new Error(`timed out after ${this.mintTimeoutMs}ms`));
+          }, this.mintTimeoutMs);
+        });
+        const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(sessionCookie)?.[1];
+        let status;
+        let text9;
+        try {
+          const res = await Promise.race([
+            this.fetchImpl(`${ONE_APP_SESSION}/${msid}/signed-instance?signed_instance_type=Member`, {
+              method: "GET",
+              headers: { Cookie: sessionCookie, Accept: "application/json", ...xsrf ? { "x-xsrf-token": xsrf } : {} },
+              signal: abort.signal,
+              redirect: "manual"
+            }),
+            timedOut
+          ]);
+          status = res.status;
+          text9 = await Promise.race([res.text(), timedOut]);
+        } catch (e2) {
+          return refuse7(new SiteInstanceUnavailable(msid, `mint failed: ${e2?.message ?? e2}`), MEMBER_TRANSIENT_TTL_MS);
+        } finally {
+          clearTimeout(timer);
+        }
+        if (status === 403 || status === 404) return refuse7(new NotSiteMember(msid, `mint refused (${status})`), MEMBER_NEGATIVE_TTL_MS);
+        if (status === 401) return refuse7(new AccountSessionExpired(msid, `mint refused (${status})`), MEMBER_TRANSIENT_TTL_MS);
+        let instance;
+        try {
+          instance = JSON.parse(text9).signedInstance;
+        } catch {
+        }
+        if (status < 200 || status >= 300 || typeof instance !== "string" || !instance) {
+          return refuse7(new SiteInstanceUnavailable(msid, `mint failed (${status})`), MEMBER_TRANSIENT_TTL_MS);
+        }
+        const rejection = memberInstanceRejection(instance, msid);
+        if (rejection) return refuse7(new NotSiteMember(msid, rejection), MEMBER_NEGATIVE_TTL_MS);
+        const entry = { instance, refreshAt: memberInstanceRefreshAt(instance, now), session };
+        if (current()) {
+          this.refusals.delete(key2);
+          this.cache.set(key2, entry);
+        }
+        return entry;
+      }
+    };
   }
 });
 
@@ -34144,6 +34396,238 @@ var init_aria_realtime_dev = __esm({
   }
 });
 
+// ../../core/serve-runtime/src/wix-account.ts
+function unwrapString(v2) {
+  if (typeof v2 === "string") return v2;
+  if (v2 && typeof v2 === "object" && typeof v2.value === "string") {
+    return v2.value;
+  }
+  return void 0;
+}
+function hasWixSession(cookieHeader) {
+  return !!cookieHeader && /(?:^|;\s*)wixSession2=/.test(cookieHeader);
+}
+function normalizeWixAuthorization(raw) {
+  if (!raw) return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  const bearer = /^Bearer\s+(.+)$/i.exec(trimmed);
+  const value = (bearer ? bearer[1] : trimmed).trim();
+  if (!value) return null;
+  if (/^(?:Bearer|Basic|Digest|Negotiate|NTLM)$/i.test(value)) return null;
+  if (/^Basic\s/i.test(value)) return null;
+  return value;
+}
+async function resolveWixAccounts(cookieHeader, fetchImpl = fetch, authorization) {
+  const hasCookie = hasWixSession(cookieHeader);
+  const auth = hasCookie ? null : normalizeWixAuthorization(authorization);
+  if (!auth && !hasCookie) return { ok: false, reason: "no_session" };
+  const cookie = cookieHeader ?? "";
+  const xsrf = /(?:^|;\s*)XSRF-TOKEN=([^;]+)/.exec(cookie)?.[1];
+  let res;
+  try {
+    res = await fetchImpl(`${ACCOUNT_SERVER}/v1/users/my_accounts`, {
+      method: "GET",
+      headers: auth ? { Authorization: auth, Accept: "application/json" } : {
+        Cookie: cookie,
+        Accept: "application/json",
+        ...xsrf ? { "x-xsrf-token": xsrf } : {}
+      }
+    });
+  } catch (err) {
+    return { ok: false, reason: "upstream_failed", status: 0, detail: err.message };
+  }
+  if (auth && res.status === 428) return resolveAccountCredential(auth, fetchImpl);
+  if (res.status === 428 || res.status === 401 || res.status === 403) {
+    return { ok: false, reason: "no_session" };
+  }
+  const text9 = await res.text();
+  if (!res.ok) {
+    return { ok: false, reason: "upstream_failed", status: res.status, detail: text9.slice(0, 200) };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text9);
+  } catch {
+    return { ok: false, reason: "upstream_failed", status: res.status, detail: "unparseable_body" };
+  }
+  if (!parsed || !Array.isArray(parsed.accounts)) {
+    return { ok: false, reason: "upstream_failed", status: res.status, detail: "no_accounts_array" };
+  }
+  const accounts = [];
+  for (const raw of parsed.accounts) {
+    const account = toWixAccount(raw);
+    if (account) accounts.push(account);
+  }
+  if (accounts.length === 0) return { ok: false, reason: "no_session" };
+  return { ok: true, accounts };
+}
+function toWixAccount(raw) {
+  if (!raw || typeof raw !== "object") return void 0;
+  const a2 = raw;
+  const accountId = typeof a2.accountId === "string" ? a2.accountId : void 0;
+  if (!accountId) return void 0;
+  return {
+    accountId,
+    ...typeof a2.slug === "string" ? { slug: a2.slug } : {},
+    ...typeof a2.status === "string" ? { status: a2.status } : {},
+    ...typeof a2.accountOwner === "string" ? { accountOwner: a2.accountOwner } : {},
+    ...unwrapString(a2.accountName) ? { name: unwrapString(a2.accountName) } : {}
+  };
+}
+async function resolveAccountCredential(auth, fetchImpl) {
+  let res;
+  try {
+    res = await fetchImpl(`${ACCOUNT_SERVER}/v1/accounts/my_account`, {
+      method: "GET",
+      headers: { Authorization: auth, Accept: "application/json" }
+    });
+  } catch (err) {
+    return { ok: false, reason: "upstream_failed", status: 0, detail: err.message };
+  }
+  if (res.status === 428 || res.status === 401 || res.status === 403 || res.status === 404) {
+    return { ok: false, reason: "no_session" };
+  }
+  const text9 = await res.text();
+  if (!res.ok) {
+    return { ok: false, reason: "upstream_failed", status: res.status, detail: text9.slice(0, 200) };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text9);
+  } catch {
+    return { ok: false, reason: "upstream_failed", status: res.status, detail: "unparseable_body" };
+  }
+  const account = toWixAccount(parsed && typeof parsed === "object" ? parsed.account : void 0);
+  if (!account) return { ok: false, reason: "upstream_failed", status: res.status, detail: "no_account" };
+  return { ok: true, accounts: [account] };
+}
+var ACCOUNT_SERVER;
+var init_wix_account = __esm({
+  "../../core/serve-runtime/src/wix-account.ts"() {
+    ACCOUNT_SERVER = "https://www.wix.com/_api/account-server";
+  }
+});
+
+// ../../core/dev-server/src/person-session-auth.ts
+import { join as pathJoin } from "node:path";
+import { homedir as homedir5 } from "node:os";
+function isWixSessionExpired(token, nowMs = Date.now()) {
+  try {
+    const raw = token.startsWith("JWT.") ? token.slice(4) : token;
+    const mid = raw.split(".")[1];
+    if (!mid) return false;
+    const payload = JSON.parse(Buffer.from(mid, "base64url").toString("utf8"));
+    const data = typeof payload.data === "string" ? JSON.parse(payload.data) : payload.data;
+    const wxexp = data?.wxexp;
+    if (!wxexp || typeof wxexp !== "string") return false;
+    const expMs = Date.parse(wxexp);
+    if (Number.isNaN(expMs)) return false;
+    return expMs <= nowMs;
+  } catch {
+    return false;
+  }
+}
+var AUTOMATION_KEY_PATH, DPX_SESSION_PATH, DEFAULT_PERSON_EMAIL;
+var init_person_session_auth = __esm({
+  "../../core/dev-server/src/person-session-auth.ts"() {
+    AUTOMATION_KEY_PATH = pathJoin(homedir5(), ".argus", "automation_master_key");
+    DPX_SESSION_PATH = pathJoin(homedir5(), ".dpx", "session", "wix-session");
+    DEFAULT_PERSON_EMAIL = process.env.WIX_PERSON_SESSION_EMAIL ?? "bookingsowner@test.com";
+  }
+});
+
+// ../../core/dev-server/src/wix-account-session.ts
+import { readFileSync as readFileSync44 } from "node:fs";
+import { homedir as homedir6 } from "node:os";
+import { join as pathJoin2 } from "node:path";
+import { createHash as createHash16 } from "node:crypto";
+function captureAccountSession(req, opts = {}) {
+  const env = opts.env ?? process.env;
+  const now = opts.now ?? Date.now();
+  const live3 = (cookie) => {
+    const ws2 = /(?:^|;\s*)wixSession2=([^;]+)/.exec(cookie)?.[1];
+    if (!ws2) return false;
+    let value = ws2;
+    try {
+      value = decodeURIComponent(ws2);
+    } catch {
+    }
+    return !isWixSessionExpired(value, now);
+  };
+  const fromRequest = forwardableWixSessionCookies(req.headers.cookie);
+  if (fromRequest && live3(fromRequest)) return { cookie: fromRequest, source: "cookie" };
+  if (!opts.machineSession) return null;
+  const fromEnv = forwardableWixSessionCookies(env.HIMI_WEB_ACCOUNT_COOKIE);
+  if (fromEnv && live3(fromEnv)) return { cookie: fromEnv, source: "env" };
+  let fromFile = "";
+  try {
+    fromFile = readFileSync44(opts.dpxSessionPath ?? pathJoin2(homedir6(), ".dpx", "session", "wix-session"), "utf8").trim();
+  } catch {
+  }
+  if (fromFile && /^[^;\s=]+$/.test(fromFile)) {
+    const cookie = `wixSession2=${fromFile}`;
+    if (live3(cookie)) return { cookie, source: "file" };
+  }
+  return null;
+}
+function isLocalDeveloperRequest(req) {
+  if (!LOOPBACK_PEERS.has(req.socket?.remoteAddress ?? "")) return false;
+  const hostname3 = (req.headers.host ?? "").replace(/:\d+$/, "").toLowerCase();
+  return hostname3 === "localhost" || hostname3 === "127.0.0.1" || hostname3 === "[::1]";
+}
+async function accountPrincipal(cookie, fetchImpl = fetch) {
+  const identity = await resolveWixAccounts(cookie, fetchImpl);
+  if (!identity.ok) return { ok: false, reason: identity.reason };
+  const ids = identity.accounts.map((a2) => a2.accountId).sort().join("\n");
+  return { ok: true, principal: `acct_${createHash16("sha256").update(ids).digest("hex").slice(0, 32)}` };
+}
+function safeAccountReturn(raw, requestHost, requestProto = "http") {
+  if (typeof raw !== "string" || !raw) return "/";
+  if (raw.startsWith("/") && !raw.startsWith("//") && !raw.startsWith("/\\")) {
+    const base = "http://placeholder.invalid";
+    try {
+      const url = new URL(raw, base);
+      if (url.origin !== base || url.pathname.startsWith("//")) return "/";
+      return `${url.pathname}${url.search}${url.hash}`;
+    } catch {
+      return "/";
+    }
+  }
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return "/";
+    if (url.username || url.password) return "/";
+    return !!requestHost && url.host === requestHost && url.protocol === `${requestProto}:` ? url.toString() : "/";
+  } catch {
+    return "/";
+  }
+}
+function isWixAccountOrigin(host) {
+  const hostname3 = (host ?? "").replace(/:\d+$/, "").toLowerCase();
+  return hostname3 === "wix.com" || hostname3.endsWith(".wix.com");
+}
+function withAccountOutcome(target, outcome) {
+  const absolute = /^https?:\/\//i.test(target);
+  const url = new URL(target, "http://placeholder.invalid");
+  url.searchParams.set("webwix_account", outcome);
+  return absolute ? url.toString() : `${url.pathname}${url.search}${url.hash}`;
+}
+function isWixAccountModeApp(app) {
+  const auth = app?.meta.auth;
+  return auth?.providerId === "wix-native" && auth.config?.mode === "account";
+}
+var LOOPBACK_PEERS, ACCOUNT_SESSION_HINT;
+var init_wix_account_session = __esm({
+  "../../core/dev-server/src/wix-account-session.ts"() {
+    init_wix_bridge();
+    init_wix_account();
+    init_person_session_auth();
+    LOOPBACK_PEERS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+    ACCOUNT_SESSION_HINT = "Wix sign-in cannot redirect back to this origin. Set HIMI_WEB_ACCOUNT_COOKIE to your *.wix.com session cookies, or provision ~/.dpx/session/wix-session (docs/wix-authentication.md).";
+  }
+});
+
 // ../../core/serve-runtime/src/flag-assignments.ts
 function bad(error) {
   return new Response(JSON.stringify({ error }), { status: 400, headers: { "content-type": JSON_CT, "cache-control": "no-store" } });
@@ -34206,9 +34690,9 @@ var init_flag_assignments = __esm({
 });
 
 // ../../core/dev-server/src/images.ts
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 function svgFor(productId, title, sku) {
-  const seedHex = createHash16("sha1").update(productId + ":" + title).digest("hex");
+  const seedHex = createHash17("sha1").update(productId + ":" + title).digest("hex");
   const h2 = (n2) => parseInt(seedHex.slice(n2, n2 + 2), 16);
   const hue1 = h2(0) % 360;
   const hue2 = (hue1 + 30 + h2(2) % 60) % 360;
@@ -34240,7 +34724,7 @@ function escapeXml(s2) {
   return s2.replace(/[<>&"']/g, (c2) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c2] ?? c2);
 }
 function wixPhotoSvg(category, seed2) {
-  const seedHex = createHash16("sha1").update(category + ":" + seed2).digest("hex");
+  const seedHex = createHash17("sha1").update(category + ":" + seed2).digest("hex");
   const h2 = (n2) => parseInt(seedHex.slice(n2, n2 + 2), 16);
   const palette2 = paletteForCategory(category, h2);
   const glyph = glyphForCategory(category);
@@ -34365,9 +34849,9 @@ var init_stable_ids = __esm({
 
 // ../../core/dev-server/src/preview.ts
 import { spawn as spawn4 } from "node:child_process";
-import { createHash as createHash17 } from "node:crypto";
-import { existsSync as existsSync43, createReadStream, statSync as statSync11, readFileSync as readFileSync44, renameSync as renameSync9, unlinkSync as unlinkSync3 } from "node:fs";
-import { homedir as homedir5, tmpdir as tmpdir2 } from "node:os";
+import { createHash as createHash18 } from "node:crypto";
+import { existsSync as existsSync43, createReadStream, statSync as statSync11, readFileSync as readFileSync45, renameSync as renameSync9, unlinkSync as unlinkSync3 } from "node:fs";
+import { homedir as homedir7, tmpdir as tmpdir2 } from "node:os";
 import { resolve as resolvePath, dirname as dirname27 } from "node:path";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
 function firstExisting(paths) {
@@ -34381,7 +34865,7 @@ function macosWinlistBin() {
 }
 function macosWinlistSourceHash() {
   try {
-    return createHash17("sha1").update(readFileSync44(MACOS_WINLIST)).digest("hex").slice(0, 12);
+    return createHash18("sha1").update(readFileSync45(MACOS_WINLIST)).digest("hex").slice(0, 12);
   } catch {
     return "missing";
   }
@@ -34526,7 +35010,7 @@ async function captureFrame(params, format = "png") {
     const tmp = resolvePath(tmpdir2(), `himalaya-macos-preview-${windowId}-${process.pid}-${++macosCaptureSeq}.png`);
     try {
       await runner.capture(SCREENCAPTURE_BIN, ["-o", "-x", `-l${windowId}`, tmp]);
-      return { buf: readFileSync44(tmp), mime: "image/png" };
+      return { buf: readFileSync45(tmp), mime: "image/png" };
     } finally {
       try {
         unlinkSync3(tmp);
@@ -35188,7 +35672,7 @@ var init_preview2 = __esm({
     };
     runner = defaultRunner2;
     ADB_BIN = process.env.HIMALAYA_ADB_PATH ?? firstExisting([
-      resolvePath(homedir5(), "Library/Android/sdk/platform-tools/adb"),
+      resolvePath(homedir7(), "Library/Android/sdk/platform-tools/adb"),
       "/Users/Shared/Android/sdk/platform-tools/adb",
       "/opt/android-sdk/platform-tools/adb"
     ]) ?? "adb";
@@ -35237,9 +35721,9 @@ var init_preview2 = __esm({
 });
 
 // ../../core/dev-server/src/tier4-integrity.ts
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 function computeSri(bytes2) {
-  const digest2 = createHash18("sha384").update(bytes2).digest("base64");
+  const digest2 = createHash19("sha384").update(bytes2).digest("base64");
   return `sha384-${digest2}`;
 }
 function parseManifestIntegrity(manifest) {
@@ -35254,7 +35738,7 @@ var init_tier4_integrity = __esm({
 });
 
 // ../../core/dev-server/src/tier4-verifier.ts
-import { readFileSync as readFileSync45, existsSync as existsSync44 } from "node:fs";
+import { readFileSync as readFileSync46, existsSync as existsSync44 } from "node:fs";
 import { resolve as resolve34 } from "node:path";
 var TierFourVerifier;
 var init_tier4_verifier = __esm({
@@ -35272,7 +35756,7 @@ var init_tier4_verifier = __esm({
         const expected = this.expectedSri(bundleId, relPath);
         if (!expected) return { ok: true };
         const path2 = resolve34(this.tier4Root, bundleId, relPath);
-        const bytes2 = providedBytes ?? (existsSync44(path2) ? readFileSync45(path2) : null);
+        const bytes2 = providedBytes ?? (existsSync44(path2) ? readFileSync46(path2) : null);
         if (!bytes2) return { ok: false, reason: "file not found" };
         if (computeSri(bytes2) !== expected) return { ok: false, reason: "sri mismatch" };
         return { ok: true };
@@ -35282,7 +35766,7 @@ var init_tier4_verifier = __esm({
         if (cached3) return cached3;
         const manifestPath = resolve34(this.tier4Root, bundleId, "manifest.json");
         if (!existsSync44(manifestPath)) return void 0;
-        const manifest = JSON.parse(readFileSync45(manifestPath, "utf8"));
+        const manifest = JSON.parse(readFileSync46(manifestPath, "utf8"));
         cached3 = { integrity: parseManifestIntegrity(manifest) };
         this.cache.set(bundleId, cached3);
         return cached3;
@@ -35346,13 +35830,13 @@ var init_net_mocks_rollover = __esm({
 });
 
 // ../../core/dev-server/src/player-proxy.ts
-import { readFileSync as readFileSync46 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
+import { readFileSync as readFileSync47 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
 import { dirname as dirname28, join as join42 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
 function readJson2(path2) {
   try {
-    return JSON.parse(readFileSync46(path2, "utf8"));
+    return JSON.parse(readFileSync47(path2, "utf8"));
   } catch {
     return void 0;
   }
@@ -35364,7 +35848,7 @@ function ledgerDevServerPort(tenant) {
   return typeof port === "number" ? port : void 0;
 }
 function loadSupervisorRegistry() {
-  const home = process.env.HIMALAYA_HOME ?? join42(homedir6(), ".himalaya");
+  const home = process.env.HIMALAYA_HOME ?? join42(homedir8(), ".himalaya");
   const reg = readJson2(join42(home, "instances.json"));
   return { instances: reg?.instances && typeof reg.instances === "object" ? reg.instances : {} };
 }
@@ -35424,7 +35908,7 @@ function tenantPrefixed(url, hostApp, method = "GET") {
   return tenantsOf(hostApp).includes(tenant) ? { tenant, url: tenantUrl } : null;
 }
 function forwardedBaseUrl(req) {
-  if (!LOOPBACK_PEERS.has(req.socket?.remoteAddress ?? "")) return null;
+  if (!LOOPBACK_PEERS2.has(req.socket?.remoteAddress ?? "")) return null;
   const first = (h2) => (Array.isArray(h2) ? h2[0] : h2)?.split(",", 1)[0]?.trim() ?? "";
   const host = first(req.headers["x-forwarded-host"]);
   if (!host || !/^[A-Za-z0-9.\-:[\]]+$/.test(host)) return null;
@@ -35573,7 +36057,7 @@ async function proxyToServe(base, req, res, opts = {}) {
   res.writeHead(upstream.status, outHeaders);
   res.end(buf);
 }
-var PLAYER_APP_ID, HOSTED_TENANTS, TENANT_PREFIX, LOOPBACK_PEERS, STRIP_RESPONSE_HEADERS, STRIP_REQUEST_HEADERS;
+var PLAYER_APP_ID, HOSTED_TENANTS, TENANT_PREFIX, LOOPBACK_PEERS2, STRIP_RESPONSE_HEADERS, STRIP_REQUEST_HEADERS;
 var init_player_proxy = __esm({
   "../../core/dev-server/src/player-proxy.ts"() {
     init_config();
@@ -35583,7 +36067,7 @@ var init_player_proxy = __esm({
       "himi-spaces-lite": ["himi-branded-lite"]
     };
     TENANT_PREFIX = "/__tenant/";
-    LOOPBACK_PEERS = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+    LOOPBACK_PEERS2 = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
     STRIP_RESPONSE_HEADERS = /* @__PURE__ */ new Set([
       "connection",
       "keep-alive",
@@ -128622,12 +129106,12 @@ var init_render_descriptor = __esm({
 });
 
 // ../../core/dev-server/src/render-fonts.ts
-import { existsSync as existsSync45, readFileSync as readFileSync47 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync48 } from "node:fs";
 import { extname, join as join43 } from "node:path";
 function servedFontFaces(appDir3, tokens2) {
   try {
     const policyPath = join43(appDir3, "fonts.json");
-    const policy = existsSync45(policyPath) ? JSON.parse(readFileSync47(policyPath, "utf8")) : {};
+    const policy = existsSync45(policyPath) ? JSON.parse(readFileSync48(policyPath, "utf8")) : {};
     let plan = planFonts(tokens2, policy);
     if (!hasVendoredFloor()) plan = { ...plan, families: plan.families.filter((f2) => !isHostProvided(f2.name)) };
     if (plan.families.length === 0) return void 0;
@@ -128648,7 +129132,7 @@ async function faceBytes(face, catalog3, opts) {
   try {
     if (opts.source) {
       const path2 = opts.source(face.file, face.sha256);
-      return path2 ? readFileSync47(path2) : null;
+      return path2 ? readFileSync48(path2) : null;
     }
     const bytes2 = await catalogFaceBytes(face.sha256, { catalog: catalog3, ...opts.fetchFace ? { fetchFace: opts.fetchFace } : {} });
     return bytes2 ?? null;
@@ -128714,7 +129198,7 @@ async function idiomFontFaceCss(idiomContext) {
   const bundled = idiomControls2(controlIdiomFor2(idiomContext)).font.bundled;
   if (!bundled) return "";
   try {
-    const bytes2 = readFileSync47(new URL(`../../web-host/public/${bundled.file}`, import.meta.url));
+    const bytes2 = readFileSync48(new URL(`../../web-host/public/${bundled.file}`, import.meta.url));
     return `@font-face { font-family: "${bundled.family}"; font-weight: 100 900; font-style: normal; src: url(data:font/ttf;base64,${bytes2.toString("base64")}) format("truetype"); }`;
   } catch {
     return "";
@@ -128757,7 +129241,7 @@ var init_tier = __esm({
 });
 
 // ../../core/dev-server/src/flags/index.ts
-import { readFileSync as readFileSync48 } from "node:fs";
+import { readFileSync as readFileSync49 } from "node:fs";
 import { resolve as resolve35 } from "node:path";
 function selectProvider(config, store) {
   const local = new LocalFlagProvider(store, () => config?.overrides);
@@ -128853,7 +129337,7 @@ var init_flags2 = __esm({
         if (now - this.lastFetch < this.ttlMs) return;
         this.lastFetch = now;
         try {
-          const defs = JSON.parse(readFileSync48(resolve35(appDir3, "flags.json"), "utf8"));
+          const defs = JSON.parse(readFileSync49(resolve35(appDir3, "flags.json"), "utf8"));
           if (Array.isArray(defs) && defs.length > 0) store.replaceAll(defs);
         } catch {
         }
@@ -128903,19 +129387,19 @@ var init_motion_flags = __esm({
 });
 
 // ../../core/dev-server/src/kits.ts
-import { readdirSync as readdirSync24, readFileSync as readFileSync49 } from "node:fs";
+import { readdirSync as readdirSync24, readFileSync as readFileSync50 } from "node:fs";
 import { resolve as resolve36, join as join44 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function listKits() {
   return readdirSync24(CATALOG).filter((f2) => f2.endsWith(".json")).map((f2) => {
-    const { tokens: tokens2, ...meta } = JSON.parse(readFileSync49(join44(CATALOG, f2), "utf8"));
+    const { tokens: tokens2, ...meta } = JSON.parse(readFileSync50(join44(CATALOG, f2), "utf8"));
     return meta;
   });
 }
 function readKit(id) {
   if (!/^[a-z0-9-]+$/.test(id)) return null;
   try {
-    return JSON.parse(readFileSync49(join44(CATALOG, `${id}.json`), "utf8"));
+    return JSON.parse(readFileSync50(join44(CATALOG, `${id}.json`), "utf8"));
   } catch {
     return null;
   }
@@ -128946,7 +129430,7 @@ __export(widgets_exports, {
   viewWidgetId: () => viewWidgetId,
   widgetRealm: () => widgetRealm
 });
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 import { inspect } from "node:util";
 async function widgetRealm() {
   if (!realmPromise) {
@@ -129002,7 +129486,7 @@ function dropEntry(cache, key2) {
   cache.bytes -= entry.bytes;
 }
 function produceCacheKey(bundleJs, timeoutMs, clock) {
-  const digest2 = createHash19("sha256").update(bundleJs).digest("base64");
+  const digest2 = createHash20("sha256").update(bundleJs).digest("base64");
   return `${timeoutMs}|${clock === void 0 ? "live" : Math.trunc(clock)}|${digest2}`;
 }
 function cachedProduce(evaluator, key2) {
@@ -129393,7 +129877,7 @@ function contentEtag(snapshot2) {
     // Lever A — a timeline change must bump the etag (frame values/times are content).
     frames: snapshot2.frames ?? null
   });
-  return "sha256-" + createHash19("sha256").update(canonical4).digest("base64");
+  return "sha256-" + createHash20("sha256").update(canonical4).digest("base64");
 }
 async function buildWidgetSnapshot(bundleJs, widgetId, opts = {}) {
   const { widgets } = await extractWidgets(bundleJs, opts);
@@ -129650,7 +130134,7 @@ __export(config_exports2, {
   serializeRolloutYaml: () => serializeRolloutYaml,
   validateOverlayPatch: () => validateOverlayPatch
 });
-import { mkdirSync as mkdirSync22, readFileSync as readFileSync50, writeFileSync as writeFileSync19 } from "node:fs";
+import { mkdirSync as mkdirSync22, readFileSync as readFileSync51, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname29, join as join45, resolve as resolve37 } from "node:path";
 import { fileURLToPath as fileURLToPath21 } from "node:url";
 function strip(line) {
@@ -129718,7 +130202,7 @@ function appConfigPath(app, file2, root = REPO_ROOT6) {
   for (const base of ["apps", "test-apps"]) {
     const p2 = join45(root, base, app, file2);
     try {
-      readFileSync50(p2);
+      readFileSync51(p2);
       return p2;
     } catch {
     }
@@ -129771,7 +130255,7 @@ function validateOverlayPatch(patch) {
 }
 function readJsonAt(app, file2, root) {
   try {
-    return JSON.parse(readFileSync50(appConfigPath(app, file2, root), "utf8"));
+    return JSON.parse(readFileSync51(appConfigPath(app, file2, root), "utf8"));
   } catch {
     return null;
   }
@@ -129809,14 +130293,14 @@ function saveLocalFlags(app, defs, root = REPO_ROOT6) {
 }
 function loadRollout(app) {
   try {
-    return parseRolloutYaml(readFileSync50(appConfigPath(app, "rollout.yaml"), "utf8"));
+    return parseRolloutYaml(readFileSync51(appConfigPath(app, "rollout.yaml"), "utf8"));
   } catch {
     return null;
   }
 }
 function loadRevocations(app) {
   try {
-    return parseRevocationsYaml(readFileSync50(appConfigPath(app, "revocations.yaml"), "utf8")).revoked;
+    return parseRevocationsYaml(readFileSync51(appConfigPath(app, "revocations.yaml"), "utf8")).revoked;
   } catch {
     return [];
   }
@@ -129894,9 +130378,9 @@ var init_config2 = __esm({
 // ../../core/dev-server/src/index.ts
 import { createServer as createServer3 } from "node:http";
 import { readFile, stat } from "node:fs/promises";
-import { readFileSync as readFileSync51, existsSync as existsSync46, watch, mkdirSync as mkdirSync23, rmSync as rmSync11 } from "node:fs";
+import { readFileSync as readFileSync52, existsSync as existsSync46, watch, mkdirSync as mkdirSync23, rmSync as rmSync11 } from "node:fs";
 import { basename as basename10, dirname as dirname30, extname as extname2, join as join46, relative as relative8, resolve as resolve38, normalize as normalize3, sep as sep10 } from "node:path";
-import { createHash as createHash20, randomUUID as randomUUID5 } from "node:crypto";
+import { createHash as createHash21, randomUUID as randomUUID5 } from "node:crypto";
 import { fileURLToPath as fileURLToPath22, pathToFileURL as pathToFileURL6 } from "node:url";
 function readLogicBundle(read, tier5Dir, name) {
   return read(tier5Dir ?? TIER5_ROOT2, name) ?? (tier5Dir && tier5Dir !== TIER5_ROOT2 ? read(TIER5_ROOT2, name) : void 0);
@@ -129942,7 +130426,7 @@ async function readBody2(req) {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function makeEtag(body) {
-  return `"${createHash20("sha256").update(body).digest("hex").slice(0, 32)}"`;
+  return `"${createHash21("sha256").update(body).digest("hex").slice(0, 32)}"`;
 }
 function servedTokensPath(app) {
   return app.module.designTokensPath ?? resolve38(app.dir, uiConfig(app.module.config).designTokensPath ?? "tokens.json");
@@ -129950,7 +130434,7 @@ function servedTokensPath(app) {
 function readAppTokens(state) {
   if (!state.app) return null;
   try {
-    const parsed = JSON.parse(readFileSync51(servedTokensPath(state.app), "utf8"));
+    const parsed = JSON.parse(readFileSync52(servedTokensPath(state.app), "utf8"));
     delete parsed._meta;
     return parsed;
   } catch {
@@ -129962,7 +130446,7 @@ function effectiveAppConfigOverride(state) {
   if (state.app) {
     try {
       gitOverlay = JSON.parse(
-        readFileSync51(resolve38(state.app.dir, "app-config.overlay.json"), "utf8")
+        readFileSync52(resolve38(state.app.dir, "app-config.overlay.json"), "utf8")
       );
     } catch {
     }
@@ -130031,7 +130515,7 @@ function handleL10nRequest(req, res, state) {
   let messages;
   try {
     messages = Object.fromEntries(
-      keyMap(parseCatalog(readFileSync51(path2, "utf8")), { sourceFallback: tag === sourceLocale })
+      keyMap(parseCatalog(readFileSync52(path2, "utf8")), { sourceFallback: tag === sourceLocale })
     );
   } catch {
     return sendJson(res, 500, { error: "catalog_unreadable", app, tag }, cors);
@@ -130433,8 +130917,8 @@ async function buildDescriptorForScreenId(state, screenId, query = new URLSearch
 function bundleIntegritySync(name, dir) {
   for (const root of dir ? [dir, TIER5_ROOT2] : [TIER5_ROOT2]) {
     try {
-      const bytes2 = readFileSync51(resolve38(root, `${name}.bundle.js`));
-      return "sha256-" + createHash20("sha256").update(bytes2).digest("base64");
+      const bytes2 = readFileSync52(resolve38(root, `${name}.bundle.js`));
+      return "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
     } catch {
     }
   }
@@ -130855,7 +131339,7 @@ function tokensAreDerived(state) {
 }
 function servedTokensHash(app) {
   try {
-    return createHash20("sha256").update(readFileSync51(servedTokensPath(app))).digest("hex");
+    return createHash21("sha256").update(readFileSync52(servedTokensPath(app))).digest("hex");
   } catch {
     return "";
   }
@@ -131066,6 +131550,13 @@ function resolveWebWixAuth(app) {
     redirectUri: WEBWIX_REDIRECT
   });
 }
+function rotateWebWixSession(req, res, state, session) {
+  const current = req.headers.cookie?.match(new RegExp(`(?:^|;\\s*)${WEBWIX_COOKIE}=([^;]+)`))?.[1];
+  if (current && state.wixWebSessions.get(current) === session) state.wixWebSessions.set(current, {});
+  const id = randomUUID5();
+  state.wixWebSessions.set(id, session);
+  res.setHeader("set-cookie", `${WEBWIX_COOKIE}=${id}; Path=/; HttpOnly; SameSite=Lax`);
+}
 function webWixSession(req, res, state) {
   const requestedId = req.headers.cookie?.match(new RegExp(`(?:^|;\\s*)${WEBWIX_COOKIE}=([^;]+)`))?.[1];
   const id = requestedId && state.wixWebSessions.has(requestedId) ? requestedId : randomUUID5();
@@ -131260,20 +131751,68 @@ async function handleWebWix(req, res, state) {
       session.memberToken = memberToken;
       session.visitorToken = visitorToken;
       session.email = String(b2.email ?? "");
+      if (session.account) webAccountMemberInstances.forgetSession(session.account.cookie);
+      session.account = void 0;
       return reply(200, { ok: true, email: session.email });
     } catch (e2) {
       return reply(200, { ok: false, error: String(e2?.message ?? e2) });
     }
   }
+  const accountApp = isWixAccountModeApp(state.app);
+  if (path2 === "/v1/__webwix/account/login" || path2 === "/v1/__webwix/account/callback") {
+    if (!accountApp) return reply(404, { error: "webwix_account_unsupported" });
+    const query = new URL(req.url ?? "", "http://localhost").searchParams;
+    const forwardedHost = req.headers["x-forwarded-host"];
+    const requestHost = (Array.isArray(forwardedHost) ? forwardedHost[0] : forwardedHost) ?? req.headers.host;
+    const forwardedProto = req.headers["x-forwarded-proto"];
+    const proto = (Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto) === "https" ? "https" : "http";
+    const back = safeAccountReturn(query.get("return"), requestHost, proto);
+    const wixOrigin = isWixAccountOrigin(requestHost);
+    const signInUrl = wixOrigin ? wixAccountSignInUrl(`${proto}://${requestHost}/v1/__webwix/account/callback?return=${encodeURIComponent(back)}`) : void 0;
+    const machineSession = path2 === "/v1/__webwix/account/login" && !wixOrigin && isLocalDeveloperRequest(req);
+    const establish = async () => {
+      const captured = captureAccountSession(req, { machineSession });
+      if (!captured) return { ok: false, error: "webwix_account_no_session" };
+      const who = await accountPrincipal(captured.cookie);
+      if (!who.ok) return { ok: false, error: who.reason === "no_session" ? "webwix_account_no_session" : "webwix_account_upstream_failed" };
+      session.account = { cookie: captured.cookie, principal: who.principal };
+      session.memberToken = void 0;
+      session.email = void 0;
+      rotateWebWixSession(req, res, state, session);
+      return { ok: true, principal: who.principal };
+    };
+    res.setHeader("cache-control", "no-store");
+    if (path2 === "/v1/__webwix/account/login" && req.method === "GET" && signInUrl) {
+      res.statusCode = 302;
+      res.setHeader("location", signInUrl);
+      return void res.end();
+    }
+    if (path2 === "/v1/__webwix/account/login" && req.method === "POST") {
+      const outcome = await establish();
+      return outcome.ok ? reply(200, { ok: true, authenticated: true, userId: outcome.principal }) : reply(outcome.error === "webwix_account_no_session" ? 401 : 502, {
+        ok: false,
+        error: outcome.error,
+        ...signInUrl ? { signInUrl } : { hint: ACCOUNT_SESSION_HINT }
+      });
+    }
+    if (req.method === "GET") {
+      const outcome = await establish();
+      res.statusCode = 302;
+      res.setHeader("location", withAccountOutcome(back, outcome.ok ? "signed_in" : outcome.error));
+      return void res.end();
+    }
+    return reply(405, { error: "method_not_allowed" });
+  }
   if (path2 === "/v1/__webwix/call" && req.method === "POST") {
     const b2 = await readJson9();
     const ownerRung = b2.ownerMsid !== void 0 || b2.checkOwnerSession === true;
+    const accountRung = !ownerRung && accountApp && !!session.account;
     const msid = String(b2.ownerMsid ?? "");
     const cookie = req.headers.cookie ?? "";
     const method = String(b2.method ?? "GET").toUpperCase();
     const requestedPath = String(b2.path ?? "/");
     const started = Date.now();
-    const capability = ownerRung ? "wix_api.web.owner" : "wix_api.web";
+    const capability = ownerRung ? "wix_api.web.owner" : accountRung ? "wix_api.web.account" : "wix_api.web";
     const refuseEarly = (status, error, parsed) => {
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
         ts: started,
@@ -131300,6 +131839,7 @@ async function handleWebWix(req, res, state) {
     }
     const body = b2.body === void 0 ? void 0 : typeof b2.body === "string" ? b2.body : JSON.stringify(b2.body);
     const forwardedHeaders = normalizeWixForwardedHeaders(b2.headers, requestedPath);
+    const logged = accountApp ? new URL(`${target.origin}${target.pathname}`) : target;
     const record2 = (source, status, respBody, mockRuleId, respHeaders) => {
       const redactBodies = source === "proxy" || mockRuleId === UNMATCHED_FAIL_CLOSED_ID;
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
@@ -131308,7 +131848,7 @@ async function handleWebWix(req, res, state) {
         capability,
         host: target.host,
         method,
-        url: target.toString(),
+        url: logged.toString(),
         path: target.pathname,
         status,
         durationMs: Date.now() - started,
@@ -131318,7 +131858,7 @@ async function handleWebWix(req, res, state) {
         mockRuleId
       });
     };
-    if (b2.checkOwnerSession !== true && state.wix.mode === "mock" && (!ownerRung || failsClosed(state.wix))) {
+    if (b2.checkOwnerSession !== true && state.wix.mode === "mock" && (!ownerRung && !accountRung || failsClosed(state.wix))) {
       const matchCtx = { host: target.host, query: Object.fromEntries(target.searchParams.entries()), headers: forwardedHeaders, body };
       let match = matchRuleEx(state.wix.rules, method, target.pathname, matchCtx);
       if (match && (match.rule.kind ?? "mock") !== "mock") {
@@ -131338,6 +131878,44 @@ async function handleWebWix(req, res, state) {
         return reply(200, { status: refusal.status, body: refusal.body });
       }
     }
+    if (accountRung && session.account) {
+      const account = session.account;
+      const absolute = /^[a-z][a-z0-9+.-]*:\/\//i.test(requestedPath);
+      const allowed2 = absolute && !!allowedAccountTarget(method, requestedPath);
+      const siteId = Object.entries(forwardedHeaders).find(([name]) => name.toLowerCase() === "wix-site-id")?.[1]?.trim() ?? "";
+      if (allowed2 || !absolute && siteId) {
+        if (siteId && !isSafeMsid(siteId)) return refuseEarly(400, "webwix_account_bad_site_id", logged);
+        res.setHeader("cache-control", "no-store");
+        const send2 = async (force) => {
+          const instance = siteId ? await webAccountMemberInstances.instance(siteId, account.cookie, { force }) : void 0;
+          return allowed2 ? wixAccountCall(method, requestedPath, body, account.cookie, fetch, forwardedHeaders, instance) : wixVisitorCall(method, requestedPath, body, instance ?? "", fetch, forwardedHeaders);
+        };
+        try {
+          let result = await send2(false);
+          if (result.status === 401 && siteId) result = await send2(true);
+          if (result.status >= 200 && result.status < 300 && isAccountJoinCall(method, requestedPath)) {
+            webAccountMemberInstances.forgetRefusals(account.cookie);
+          }
+          record2("proxy", result.status, result.body);
+          return reply(200, result);
+        } catch (e2) {
+          if (e2 instanceof AccountSessionExpired) {
+            webAccountMemberInstances.forgetSession(account.cookie);
+            if (session.account === account) session.account = void 0;
+          }
+          if (e2 instanceof NotSiteMember || e2 instanceof SiteInstanceUnavailable || e2 instanceof AccountSessionExpired) {
+            const refusal = memberInstanceRefusal(e2);
+            record2("proxy", refusal.status, void 0);
+            return reply(refusal.status, refusal.body);
+          }
+          record2("proxy", 502, void 0);
+          return reply(502, { error: "webwix_bridge_upstream_failed" });
+        }
+      }
+    }
+    if (accountApp && !ownerRung && !session.account && /^[a-z][a-z0-9+.-]*:\/\//i.test(requestedPath) && allowedAccountTarget(method, requestedPath)) {
+      return refuseEarly(401, "webwix_account_signed_out", logged);
+    }
     if (ownerRung) {
       try {
         if (b2.checkOwnerSession !== true && method === "POST" && isOwnerSitesPath(requestedPath)) {
@@ -131393,11 +131971,16 @@ async function handleWebWix(req, res, state) {
     }
   }
   if (path2 === "/v1/__webwix/logout" && req.method === "POST") {
+    if (session.account) webAccountMemberInstances.forgetSession(session.account.cookie);
     session.memberToken = void 0;
     session.email = void 0;
+    session.account = void 0;
     return reply(200, { ok: true });
   }
   if (path2 === "/v1/__webwix/identity" && (req.method === "GET" || req.method === "POST")) {
+    if (accountApp && session.account) {
+      return reply(200, { authenticated: true, mode: "account", userId: session.account.principal, email: "" });
+    }
     if (!session.memberToken) return reply(200, { authenticated: false, userId: null, email: "" });
     const userId = await readMemberId(session.memberToken);
     const preferenceIdentity = session.email?.trim().toLowerCase() || userId;
@@ -131406,7 +131989,7 @@ async function handleWebWix(req, res, state) {
       userId: userId ?? session.email ?? null,
       email: session.email ?? "",
       preferenceContext: preferenceIdentity ? {
-        accountId: `m_${createHash20("sha256").update(preferenceIdentity).digest("hex")}`,
+        accountId: `m_${createHash21("sha256").update(preferenceIdentity).digest("hex")}`,
         // Headless client IDs are site-bound and come from the server's app
         // configuration, never the URL's user-supplied business parameter.
         businessId: auth.clientId
@@ -131427,6 +132010,8 @@ async function handleWebWix(req, res, state) {
       session.memberToken = memberToken;
       session.visitorToken = visitorToken;
       session.email = String(b2.email ?? "");
+      if (session.account) webAccountMemberInstances.forgetSession(session.account.cookie);
+      session.account = void 0;
       return reply(200, { ok: true, email: session.email });
     } catch (e2) {
       return reply(200, { ok: false, error: String(e2?.message ?? e2) });
@@ -132125,7 +132710,7 @@ async function readBundleFile(name, dir) {
     if (!roots.some((root) => path2.startsWith(root))) continue;
     try {
       const bytes2 = await readFile(path2);
-      const integrity2 = "sha256-" + createHash20("sha256").update(bytes2).digest("base64");
+      const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
       return { bytes: bytes2, integrity: integrity2 };
     } catch {
     }
@@ -132290,12 +132875,12 @@ function readActionHandlerManifest(app) {
   let decls;
   let bytes2;
   try {
-    decls = JSON.parse(readFileSync51(manifestPath, "utf8"));
-    bytes2 = readFileSync51(bundlePath);
+    decls = JSON.parse(readFileSync52(manifestPath, "utf8"));
+    bytes2 = readFileSync52(bundlePath);
   } catch {
     return { handlers: [] };
   }
-  const integrity2 = "sha256-" + createHash20("sha256").update(bytes2).digest("base64");
+  const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
   const bundleUrl = `/v1/action-handler-bundles/${app}`;
   return { handlers: decls.map((d2) => ({ id: d2.id, policy: d2.policy, description: d2.description, bundleUrl, integrity: integrity2 })) };
 }
@@ -132308,7 +132893,7 @@ async function handleActionHandlerBundleGet(res, app) {
   if (!path2.startsWith(ACTION_HANDLERS_ROOT)) return sendJson(res, 404, { error: "not_found" });
   try {
     const bytes2 = await readFile(path2);
-    const integrity2 = "sha256-" + createHash20("sha256").update(bytes2).digest("base64");
+    const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
     res.setHeader("content-type", "application/javascript; charset=utf-8");
     res.setHeader("cache-control", "max-age=300");
     res.setHeader("x-himalaya-bundle-integrity", integrity2);
@@ -132610,7 +133195,7 @@ function createDevServer(opts = {}) {
           const q2 = new URLSearchParams(url.split("?")[1] ?? "");
           const assetApp = q2.get("app") ?? state.appName;
           const assetDir = state.app && assetApp === state.app.name ? state.app.dir : resolveAppDir(assetApp);
-          const hit = assetDir ? collectAssets(assetDir).find((a2) => assetSha256(readFileSync51(a2.path)) === sha2) : void 0;
+          const hit = assetDir ? collectAssets(assetDir).find((a2) => assetSha256(readFileSync52(a2.path)) === sha2) : void 0;
           if (!hit && assetDir) {
             const fontBytes = await fontFaceBytesBySha(assetDir, sha2);
             if (fontBytes) {
@@ -132633,7 +133218,7 @@ function createDevServer(opts = {}) {
             res.end(JSON.stringify({ error: "asset_not_found", app: assetApp, sha: sha2 }));
             return;
           }
-          const bytes2 = readFileSync51(hit.path);
+          const bytes2 = readFileSync52(hit.path);
           res.writeHead(200, {
             "content-type": hit.contentType,
             "content-length": String(bytes2.length),
@@ -132726,7 +133311,7 @@ function createDevServer(opts = {}) {
         if (url === "/v1/schema/screen-descriptor.json" && req.method === "GET") {
           try {
             const schemaPath = resolve38(ROOT6, "core/schema/generated/screen-descriptor.schema.json");
-            const body = readFileSync51(schemaPath, "utf8");
+            const body = readFileSync52(schemaPath, "utf8");
             return send(res, 200, body, {
               "content-type": "application/schema+json; charset=utf-8",
               "cache-control": "no-store",
@@ -132777,7 +133362,7 @@ function createDevServer(opts = {}) {
             try {
               const { parseRevocationsYaml: parseRevocationsYaml2 } = await Promise.resolve().then(() => (init_config2(), config_exports2));
               revoked = parseRevocationsYaml2(
-                readFileSync51(resolve38(state.app.dir, "revocations.yaml"), "utf8")
+                readFileSync52(resolve38(state.app.dir, "revocations.yaml"), "utf8")
               ).revoked;
             } catch {
             }
@@ -132990,7 +133575,7 @@ ${err.message}`);
   });
   return httpServer;
 }
-var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, MIME, widgetOverrides;
+var ROOT6, TIER3_ROOT, TIER4_ROOT, tier4Verifier, TIER5_ROOT2, ACTION_HANDLERS_ROOT, SAMPLES_ROOT, TELEMETRY_BUFFER_CAP, overrideHistorySeq, CACHE_CONTROL, TIER5_SRC_ROOT, HMR_TMP_DIR, appReloadSeq, appReloadChain, WEBWIX_CLIENT_ID, WEBWIX_REDIRECT, WEBWIX_COOKIE, webOwnerPreviewInstances, webAccountMemberInstances, MIME, widgetOverrides;
 var init_src6 = __esm({
   "../../core/dev-server/src/index.ts"() {
     init_inject();
@@ -133004,6 +133589,7 @@ var init_src6 = __esm({
     init_aria_realtime_dev();
     init_wix_member_login();
     init_wix_bridge();
+    init_wix_account_session();
     init_flag_assignments();
     init_images();
     init_l10n();
@@ -133052,6 +133638,7 @@ var init_src6 = __esm({
     WEBWIX_REDIRECT = "himalaya-demo-app://oauth/callback";
     WEBWIX_COOKIE = "himi_webwix_session";
     webOwnerPreviewInstances = new OwnerInstanceCache(fetch);
+    webAccountMemberInstances = new MemberInstanceCache(fetch);
     MIME = {
       ".html": "text/html; charset=utf-8",
       ".css": "text/css; charset=utf-8",
@@ -133071,9 +133658,9 @@ var init_src6 = __esm({
 });
 
 // ../../core/serve-storage/src/release-patch.ts
-import { createHash as createHash21 } from "node:crypto";
+import { createHash as createHash22 } from "node:crypto";
 function sha256hex(b2) {
-  return createHash21("sha256").update(b2).digest("hex");
+  return createHash22("sha256").update(b2).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -136004,11 +136591,11 @@ var init_dependencies = __esm({
 });
 
 // ../../core/functions-build/src/sbom.ts
-import { createHash as createHash22 } from "node:crypto";
+import { createHash as createHash23 } from "node:crypto";
 function createFunctionSbom(packages) {
   const components2 = [...packages].sort((a2, b2) => a2.name.localeCompare(b2.name)).map(({ name, version: version4, integrity: integrity2, license }) => ({ name, version: version4, integrity: integrity2, license }));
   const body = JSON.stringify({ format: "himalaya-sbom-v1", components: components2 });
-  return { format: "himalaya-sbom-v1", components: components2, hash: createHash22("sha256").update(body).digest("hex") };
+  return { format: "himalaya-sbom-v1", components: components2, hash: createHash23("sha256").update(body).digest("hex") };
 }
 var init_sbom = __esm({
   "../../core/functions-build/src/sbom.ts"() {
@@ -136016,12 +136603,12 @@ var init_sbom = __esm({
 });
 
 // ../../core/functions-build/src/build.ts
-import { createHash as createHash23 } from "node:crypto";
+import { createHash as createHash24 } from "node:crypto";
 function sha2563(value) {
-  return createHash23("sha256").update(value).digest("hex");
+  return createHash24("sha256").update(value).digest("hex");
 }
 function sri(value) {
-  return `sha256-${createHash23("sha256").update(value).digest("base64")}`;
+  return `sha256-${createHash24("sha256").update(value).digest("base64")}`;
 }
 function schemaHash(schema) {
   if (!schema) return "";
@@ -136215,8 +136802,8 @@ __export(build_exports2, {
   withStoreNavBundle: () => withStoreNavBundle,
   withoutDevOnlyAppConfig: () => withoutDevOnlyAppConfig
 });
-import { createHash as createHash24 } from "node:crypto";
-import { readFileSync as readFileSync52, readdirSync as readdirSync25, existsSync as existsSync47 } from "node:fs";
+import { createHash as createHash25 } from "node:crypto";
+import { readFileSync as readFileSync53, readdirSync as readdirSync25, existsSync as existsSync47 } from "node:fs";
 import { dirname as dirname31, join as join47, resolve as resolve39 } from "node:path";
 import { fileURLToPath as fileURLToPath23 } from "node:url";
 import { createRequire as createRequire2 } from "node:module";
@@ -136262,7 +136849,7 @@ function l10nLintOptions(locale, appDir3) {
     const path2 = join47(appDir3, "l10n", `${tag}.json`);
     if (!existsSync47(path2)) continue;
     try {
-      const parsed = JSON.parse(readFileSync52(path2, "utf8"));
+      const parsed = JSON.parse(readFileSync53(path2, "utf8"));
       for (const m2 of Object.values(parsed.messages ?? {})) {
         if (typeof m2?.source === "string" && typeof m2.translation === "string" && m2.translation.length > 0) {
           catalog3.add(m2.source);
@@ -136298,10 +136885,10 @@ function servesMessages(text9) {
   }
 }
 function sha2564(buf) {
-  return createHash24("sha256").update(buf).digest("hex");
+  return createHash25("sha256").update(buf).digest("hex");
 }
 function sri2(buf) {
-  return "sha256-" + createHash24("sha256").update(buf).digest("base64");
+  return "sha256-" + createHash25("sha256").update(buf).digest("base64");
 }
 async function widgetFailureDetail(res) {
   try {
@@ -136629,7 +137216,7 @@ async function buildReleaseFromContent(contentDir2, dest, opts = {}) {
 function readTokensForLint(preloaded) {
   try {
     const tokenPath = preloaded.module.designTokensPath ?? resolve39(preloaded.dir, uiConfig(preloaded.module.config).designTokensPath ?? "tokens.json");
-    const parsed = JSON.parse(readFileSync52(tokenPath, "utf8"));
+    const parsed = JSON.parse(readFileSync53(tokenPath, "utf8"));
     delete parsed._meta;
     return parsed;
   } catch {
@@ -136651,7 +137238,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   const readBundle = (name) => {
     const path2 = bundlePath(name);
-    return path2 ? readFileSync52(path2, "utf8") : void 0;
+    return path2 ? readFileSync53(path2, "utf8") : void 0;
   };
   const collect2 = opts.collect;
   const config = preloaded.module.config;
@@ -136797,11 +137384,11 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   };
   checkRegistry(preloaded.module.actions);
   const contentManifestPath2 = join47(preloaded.dir, "himalaya.content.json");
-  const contentManifest = existsSync47(contentManifestPath2) ? JSON.parse(readFileSync52(contentManifestPath2, "utf8")) : void 0;
+  const contentManifest = existsSync47(contentManifestPath2) ? JSON.parse(readFileSync53(contentManifestPath2, "utf8")) : void 0;
   let screenMetadata = parseScreenMetadata(contentManifest?.screens);
   if (contentManifest?.shell === "brandy" && screenMetadata) {
     const provisioningPath2 = join47(preloaded.dir, "provisioning.json");
-    if (existsSync47(provisioningPath2)) screenMetadata = siteViewMetadataForBuild(screenMetadata, JSON.parse(readFileSync52(provisioningPath2, "utf8")).site);
+    if (existsSync47(provisioningPath2)) screenMetadata = siteViewMetadataForBuild(screenMetadata, JSON.parse(readFileSync53(provisioningPath2, "utf8")).site);
   }
   await store.reset(app);
   const bundles = {};
@@ -136838,7 +137425,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     try {
       const path2 = bundlePath(name);
       if (!path2) return null;
-      bytes2 = readFileSync52(path2);
+      bytes2 = readFileSync53(path2);
     } catch {
       return null;
     }
@@ -136862,7 +137449,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     for (const [name, file2] of [["spec", "SPEC.md"], ["mobile-ux", "MOBILE-UX.md"]]) {
       const path2 = join47(preloaded.dir, file2);
       if (!existsSync47(path2)) continue;
-      const bytes2 = readFileSync52(path2);
+      const bytes2 = readFileSync53(path2);
       if (bytes2.length === 0 || bytes2.length > MAX_AUTHORING_DOC_BYTES) {
         throw new Error(`${file2} must be non-empty and at most ${MAX_AUTHORING_DOC_BYTES} bytes to ship with a release.`);
       }
@@ -136877,7 +137464,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     const iconPath = resolveAppDirIcon(preloaded.dir);
     if (iconPath) {
       try {
-        const bytes2 = readFileSync52(iconPath);
+        const bytes2 = readFileSync53(iconPath);
         await store.putIcon(app, bytes2);
         iconHash = sha2564(bytes2);
       } catch {
@@ -136899,7 +137486,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     }
     const seenAssetSha = /* @__PURE__ */ new Set();
     for (const a2 of collected) {
-      const bytes2 = readFileSync52(a2.path);
+      const bytes2 = readFileSync53(a2.path);
       const hash2 = sha2564(bytes2);
       if (!seenAssetSha.has(hash2)) {
         await store.putAsset(app, hash2, bytes2, a2.contentType);
@@ -136921,7 +137508,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const fontWarnings = [];
   try {
     const appTokens = readTokensForLint(preloaded) ?? {};
-    const policy = existsSync47(join47(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync52(join47(preloaded.dir, "fonts.json"), "utf8")) : {};
+    const policy = existsSync47(join47(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync53(join47(preloaded.dir, "fonts.json"), "utf8")) : {};
     fontPlan = planFonts(appTokens, policy);
   } catch (err) {
     throw new Error(
@@ -136937,7 +137524,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
             `[release-build] ${family.name} face ${face.postScriptName} has no local bytes (sha ${face.sha256.slice(0, 12)}\u2026), so the release would declare a face the asset route cannot serve. Run \`npm run fonts:catalog\` to warm the cache before publishing.`
           );
         }
-        const bytes2 = readFileSync52(src);
+        const bytes2 = readFileSync53(src);
         const hash2 = sha2564(bytes2);
         if (hash2 !== face.sha256) {
           throw new Error(
@@ -136987,7 +137574,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   if (store.putAsset) {
     for (const face of collectBrandFonts(preloaded.dir)) {
       try {
-        const bytes2 = readFileSync52(face.path);
+        const bytes2 = readFileSync53(face.path);
         if (bytes2.length === 0) continue;
         const hash2 = sha2564(bytes2);
         await store.putAsset(app, hash2, bytes2, "font/ttf");
@@ -137454,7 +138041,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
     const candidates = [".ts", ".js", ".mts", ".mjs"].map((extension) => join47(preloaded.dir, "functions", `${definition.name}${extension}`));
     const source = candidates.find((candidate) => existsSync47(candidate));
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
-    sources[definition.name] = readFileSync52(source, "utf8");
+    sources[definition.name] = readFileSync53(source, "utf8");
   }
   const built = await buildFunctions(config.functions.functions, sources);
   const bundles = {};
@@ -138089,7 +138676,7 @@ __export(build_changes_exports, {
   diffTokens: () => diffTokens,
   headline: () => headline
 });
-import { existsSync as existsSync48, readdirSync as readdirSync26, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync48, readdirSync as readdirSync26, readFileSync as readFileSync54 } from "node:fs";
 import { join as join48 } from "node:path";
 function componentsOf(descriptor) {
   const out2 = /* @__PURE__ */ new Map();
@@ -138229,7 +138816,7 @@ var init_build_changes = __esm({
     scalar2 = (v2) => typeof v2 === "string" || typeof v2 === "number" || typeof v2 === "boolean";
     readJson3 = (path2) => {
       try {
-        return JSON.parse(readFileSync53(path2, "utf8"));
+        return JSON.parse(readFileSync54(path2, "utf8"));
       } catch {
         return void 0;
       }
@@ -138246,7 +138833,7 @@ var init_build_changes = __esm({
 });
 
 // src/studio-timeline.ts
-import { existsSync as existsSync49, readFileSync as readFileSync54 } from "node:fs";
+import { existsSync as existsSync49, readFileSync as readFileSync55 } from "node:fs";
 import { join as join49 } from "node:path";
 function stateOf(view) {
   const j2 = view.journal[0];
@@ -138317,7 +138904,7 @@ function readTimeline(dir) {
   const file2 = join49(dir, TIMELINE_FILE);
   if (!existsSync49(file2)) return [];
   const out2 = [];
-  for (const line of readFileSync54(file2, "utf8").split("\n")) {
+  for (const line of readFileSync55(file2, "utf8").split("\n")) {
     if (!line.trim()) continue;
     try {
       const f2 = JSON.parse(line);
@@ -138410,8 +138997,8 @@ __export(studio_exports, {
   renderStudioHtml: () => renderStudioHtml,
   writeStudioRecord: () => writeStudioRecord
 });
-import { createHash as createHash25 } from "node:crypto";
-import { existsSync as existsSync50, readdirSync as readdirSync27, readFileSync as readFileSync55, realpathSync as realpathSync8, statSync as statSync12 } from "node:fs";
+import { createHash as createHash26 } from "node:crypto";
+import { existsSync as existsSync50, readdirSync as readdirSync27, readFileSync as readFileSync56, realpathSync as realpathSync8, statSync as statSync12 } from "node:fs";
 import { basename as basename11, extname as extname3, join as join50, relative as relative9, resolve as resolve40, sep as sep11 } from "node:path";
 import { pathToFileURL as pathToFileURL7 } from "node:url";
 function realInside(dir, abs) {
@@ -138442,7 +139029,7 @@ function archiveFile(dir, memory, abs) {
   }
   let archived;
   try {
-    archived = archiveBytes(dir, readFileSync55(real));
+    archived = archiveBytes(dir, readFileSync56(real));
   } catch {
     return null;
   }
@@ -138692,7 +139279,7 @@ function buildView(dir, memory, now) {
     reveal: memory.reveal ?? null
   };
   const { generatedAt: _ignored, timelineFrames: _count, ...stable } = view;
-  const v2 = createHash25("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
+  const v2 = createHash26("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
   return { v: v2, ...view };
 }
 function writeAtomic(file2, content) {
@@ -138770,7 +139357,7 @@ var init_studio = __esm({
     MAX_NAV_EDGES = 40;
     readJson4 = (file2) => {
       try {
-        return JSON.parse(readFileSync55(file2, "utf8"));
+        return JSON.parse(readFileSync56(file2, "utf8"));
       } catch {
         return null;
       }
@@ -139334,11 +139921,11 @@ __export(captcha_exports, {
   captchaContentInput: () => captchaContentInput,
   runCaptcha: () => runCaptcha
 });
-import { readFileSync as readFileSync56 } from "node:fs";
+import { readFileSync as readFileSync57 } from "node:fs";
 import { resolve as resolve41 } from "node:path";
 function readObject(path2) {
   try {
-    return JSON.parse(readFileSync56(path2, "utf8"));
+    return JSON.parse(readFileSync57(path2, "utf8"));
   } catch {
     return {};
   }
@@ -139408,7 +139995,7 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync51, readFileSync as readFileSync57 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync58 } from "node:fs";
 import { isAbsolute as isAbsolute4, relative as relative10, resolve as resolve42 } from "node:path";
 function isInsideRepo(p2) {
   const rel = relative10(REPO_ROOT3, resolve42(p2));
@@ -139468,7 +140055,7 @@ function loadStoreConfig(app) {
   if (!existsSync51(p2)) {
     throw new Error(`No store config at ${p2}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
-  return parseStoreConfig(readFileSync57(p2, "utf8"));
+  return parseStoreConfig(readFileSync58(p2, "utf8"));
 }
 var init_preflight = __esm({
   "../store-release/preflight.ts"() {
@@ -145538,7 +146125,7 @@ var init_fxp = __esm({
 });
 
 // ../../packages/serve/src/pkcs12.ts
-import { X509Certificate, createHash as createHash26, createPrivateKey as createPrivateKey2, createPublicKey, pbkdf2Sync, createDecipheriv } from "node:crypto";
+import { X509Certificate, createHash as createHash27, createPrivateKey as createPrivateKey2, createPublicKey, pbkdf2Sync, createDecipheriv } from "node:crypto";
 function decodePkcs12(der, password) {
   try {
     const pfx = readSequence(der, 0);
@@ -145812,7 +146399,7 @@ function expand(src, v2) {
   return out2;
 }
 function sha12(data) {
-  return createHash26("sha1").update(data).digest();
+  return createHash27("sha1").update(data).digest();
 }
 function readAt(buf, i2) {
   if (i2 >= buf.length) return void 0;
@@ -145901,7 +146488,7 @@ var init_pkcs12 = __esm({
 });
 
 // ../../packages/serve/src/customer-signing-assets.ts
-import { createHash as createHash27 } from "node:crypto";
+import { createHash as createHash28 } from "node:crypto";
 function readValue(node) {
   const [tag, children] = Object.entries(node)[0] ?? [];
   if (!tag || !Array.isArray(children)) return refuse3("customer_profile_invalid");
@@ -145979,7 +146566,7 @@ function toBundle(assets, expected, decoded, profileType, apns, deviceCount) {
     provisioningProfile: Buffer.from(assets.provisioningProfile).toString("base64"),
     profileSha256: sha2565(assets.provisioningProfile),
     certificateSha256: sha2565(decoded.cert.raw),
-    certificateSha1: createHash27("sha1").update(decoded.cert.raw).digest("hex").toUpperCase(),
+    certificateSha1: createHash28("sha1").update(decoded.cert.raw).digest("hex").toUpperCase(),
     expiresAt: new Date(Math.min(decoded.expiration, Date.parse(decoded.cert.validTo))).toISOString(),
     ...apns ? { apnsEnvironment: apns } : {},
     deviceCount
@@ -146030,7 +146617,7 @@ var init_customer_signing_assets = __esm({
     init_fxp();
     init_pkcs12();
     init_customer_dist_signing();
-    sha2565 = (bytes2) => createHash27("sha256").update(bytes2).digest("hex");
+    sha2565 = (bytes2) => createHash28("sha256").update(bytes2).digest("hex");
     refuse3 = (code) => {
       throw new CustomerSigningError(code);
     };
@@ -146197,11 +146784,11 @@ var init_customer_signing_inspect = __esm({
 });
 
 // src/push-onboarding.ts
-import { existsSync as existsSync52, mkdirSync as mkdirSync24, readFileSync as readFileSync58, statSync as statSync13, writeFileSync as writeFileSync20, chmodSync as chmodSync2 } from "node:fs";
+import { existsSync as existsSync52, mkdirSync as mkdirSync24, readFileSync as readFileSync59, statSync as statSync13, writeFileSync as writeFileSync20, chmodSync as chmodSync2 } from "node:fs";
 import { basename as basename12, dirname as dirname32, join as join51, resolve as resolve43 } from "node:path";
 function readJson5(path2) {
   try {
-    const parsed = JSON.parse(readFileSync58(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync59(path2, "utf8"));
     return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
   } catch {
     return {};
@@ -146286,7 +146873,7 @@ function readKeyFile(path2) {
   }
   let body;
   try {
-    body = readFileSync58(path2, "utf8");
+    body = readFileSync59(path2, "utf8");
   } catch {
     return { ok: false, code: "key_file_unreadable", reason: "cannot read the selected key file; check its path and file permissions" };
   }
@@ -146444,7 +147031,7 @@ var signing_inspect_exports = {};
 __export(signing_inspect_exports, {
   runSigningInspect: () => runSigningInspect
 });
-import { existsSync as existsSync53, readFileSync as readFileSync59, statSync as statSync14 } from "node:fs";
+import { existsSync as existsSync53, readFileSync as readFileSync60, statSync as statSync14 } from "node:fs";
 import { isAbsolute as isAbsolute5, resolve as resolve44 } from "node:path";
 function fail3(io2, code, fields = {}) {
   io2.error(JSON.stringify({ ok: false, code, ...fields }));
@@ -146541,9 +147128,9 @@ async function runSigningInspect(pos, flags, io2, deps = {}) {
       return fail3(io2, "signing_inspect_local_assets_unreadable", { error: "cert or profile file is unexpectedly large" });
     }
     assets = {
-      certificate: readFileSync59(certPath),
+      certificate: readFileSync60(certPath),
       certificatePassword: text4(flags["cert-password"]),
-      provisioningProfile: readFileSync59(profilePath2)
+      provisioningProfile: readFileSync60(profilePath2)
     };
   }
   try {
@@ -146828,7 +147415,7 @@ __export(config_push_edit_exports, {
   enablePushInConfig: () => enablePushInConfig,
   previewPushConfigEdit: () => previewPushConfigEdit
 });
-import { readFileSync as readFileSync60 } from "node:fs";
+import { readFileSync as readFileSync61 } from "node:fs";
 import { basename as basename13 } from "node:path";
 import ts6 from "typescript";
 function enablePushInConfig(source, options) {
@@ -146948,7 +147535,7 @@ function noLiteralInstruction(pingAppName) {
 function previewPushConfigEdit(dir, options) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
-  const { applied, instructions } = enablePushInConfig(readFileSync60(path2, "utf8"), { ...options, fileName: basename13(path2) });
+  const { applied, instructions } = enablePushInConfig(readFileSync61(path2, "utf8"), { ...options, fileName: basename13(path2) });
   return { wouldApply: applied, instructions };
 }
 async function applyPushConfigEdit(dir, options, validate4) {
@@ -146957,7 +147544,7 @@ async function applyPushConfigEdit(dir, options, validate4) {
   const fileName = basename13(path2);
   const refuse7 = (why) => ({ changed: false, pushOn: false, applied: [], instructions: [why] });
   if (isSymlink2(path2)) return refuse7(`${fileName} is a symlink, so it was not edited: turn push on in the file it points to.`);
-  const original = readFileSync60(path2, "utf8");
+  const original = readFileSync61(path2, "utf8");
   const edit = enablePushInConfig(original, { ...options, fileName });
   const { applied, instructions, pushOn } = edit;
   if (!edit.changed) return { changed: false, pushOn, applied, instructions };
@@ -147275,9 +147862,9 @@ __export(pack_exports, {
   unpackTo: () => unpackTo,
   writeZip: () => writeZip
 });
-import { createHash as createHash28 } from "node:crypto";
+import { createHash as createHash29 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync54, mkdirSync as mkdirSync25, readFileSync as readFileSync61, readdirSync as readdirSync28, rmSync as rmSync12, statSync as statSync15, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync54, mkdirSync as mkdirSync25, readFileSync as readFileSync62, readdirSync as readdirSync28, rmSync as rmSync12, statSync as statSync15, writeFileSync as writeFileSync21 } from "node:fs";
 import { dirname as dirname33, join as join53, resolve as resolve46 } from "node:path";
 function writeZip(entries) {
   const sorted2 = entries.slice().sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
@@ -147372,7 +147959,7 @@ function inflateEntry(buf, entry) {
   return bytes2;
 }
 function readIf(path2) {
-  return existsSync54(path2) && statSync15(path2).isFile() ? readFileSync61(path2) : null;
+  return existsSync54(path2) && statSync15(path2).isFile() ? readFileSync62(path2) : null;
 }
 function listDir(dir) {
   return existsSync54(dir) ? readdirSync28(dir).filter((f2) => statSync15(join53(dir, f2)).isFile()) : [];
@@ -147425,11 +148012,11 @@ function gatherReleaseEntries(appDir3) {
   return { entries, manifest, skipped };
 }
 function sha256Hex4(bytes2) {
-  return createHash28("sha256").update(bytes2).digest("hex");
+  return createHash29("sha256").update(bytes2).digest("hex");
 }
 function computeContentHash(entries) {
   const input = packageHashInput(entries.map((e2) => ({ path: e2.path, hash: sha256Hex4(e2.bytes) })));
-  return "sha256-" + createHash28("sha256").update(input).digest("base64");
+  return "sha256-" + createHash29("sha256").update(input).digest("base64");
 }
 function buildEntries(appDir3, app, opts) {
   const { entries: released, manifest, skipped } = gatherReleaseEntries(appDir3);
@@ -147522,7 +148109,7 @@ function openPackageBuffer(buf) {
   return openFromEntries(readZip(buf), { requireHeader: true });
 }
 function openPackageFile(file2) {
-  return openPackageBuffer(readFileSync61(file2));
+  return openPackageBuffer(readFileSync62(file2));
 }
 function openPackageDir(dir) {
   const root = resolve46(dir);
@@ -147533,7 +148120,7 @@ function openPackageDir(dir) {
       const childRel = rel ? `${rel}/${name}` : name;
       const childAbs = join53(abs, name);
       if (statSync15(childAbs).isDirectory()) walk2(childRel);
-      else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync61(childAbs));
+      else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync62(childAbs));
     }
   };
   if (!existsSync54(root)) throw new Error(`no such package directory: ${root}`);
@@ -147620,8 +148207,8 @@ __export(app_source_exports, {
   writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { createHash as createHash29 } from "node:crypto";
-import { readdirSync as readdirSync29, lstatSync as lstatSync15, readFileSync as readFileSync62, mkdirSync as mkdirSync26, writeFileSync as writeFileSync22, existsSync as existsSync55, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync4 } from "node:fs";
+import { createHash as createHash30 } from "node:crypto";
+import { readdirSync as readdirSync29, lstatSync as lstatSync15, readFileSync as readFileSync63, mkdirSync as mkdirSync26, writeFileSync as writeFileSync22, existsSync as existsSync55, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync4 } from "node:fs";
 import { join as join54, resolve as resolve47, sep as sep13 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
@@ -147655,7 +148242,7 @@ function collectAppSource(dir) {
   const skipped = [];
   walkSourceTree(
     dir,
-    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync62(join54(dir, hostRel)) }),
+    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync63(join54(dir, hostRel)) }),
     (hostRel) => skipped.push(hostRel)
   );
   entries.sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
@@ -147736,13 +148323,13 @@ function sourceFingerprint(dir) {
     dir,
     (archivePath, hostRel) => {
       if (/\.md$/i.test(archivePath)) return;
-      files.push(`${archivePath}\0${createHash29("sha256").update(readFileSync62(join54(dir, hostRel))).digest("hex")}`);
+      files.push(`${archivePath}\0${createHash30("sha256").update(readFileSync63(join54(dir, hostRel))).digest("hex")}`);
     },
     () => {
     }
   );
   files.sort();
-  return createHash29("sha256").update(files.join("\n")).digest("hex");
+  return createHash30("sha256").update(files.join("\n")).digest("hex");
 }
 function largestEntries(entries, limit = 5) {
   return entries.map((e2) => ({
@@ -147949,7 +148536,7 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync4, constants as constants2, existsSync as existsSync56, fstatSync, lstatSync as lstatSync16, statSync as statSync16, readdirSync as readdirSync30, mkdirSync as mkdirSync27, openSync as openSync4, readFileSync as readFileSync63, realpathSync as realpathSync9, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync23, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync4, constants as constants2, existsSync as existsSync56, fstatSync, lstatSync as lstatSync16, statSync as statSync16, readdirSync as readdirSync30, mkdirSync as mkdirSync27, openSync as openSync4, readFileSync as readFileSync64, realpathSync as realpathSync9, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync23, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID6 } from "node:crypto";
 import { extname as extname4, join as join55, resolve as resolve48, sep as sep14 } from "node:path";
 function diffReleases(prev, next) {
@@ -148207,7 +148794,7 @@ function readConfined(root, rel) {
     const fd = openSync4(at2, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
-      return readFileSync63(fd);
+      return readFileSync64(fd);
     } finally {
       closeSync4(fd);
     }
@@ -148264,8 +148851,8 @@ __export(screen_state_exports, {
   shotStateFor: () => shotStateFor,
   withHomeCaveat: () => withHomeCaveat
 });
-import { createHash as createHash30 } from "node:crypto";
-import { lstatSync as lstatSync17, readFileSync as readFileSync64 } from "node:fs";
+import { createHash as createHash31 } from "node:crypto";
+import { lstatSync as lstatSync17, readFileSync as readFileSync65 } from "node:fs";
 import { join as join56 } from "node:path";
 function quotableLine(text9) {
   if (!text9) return void 0;
@@ -148325,7 +148912,7 @@ function readRecord(dir) {
   const file2 = join56(dir, SHOT_STATES_FILE);
   try {
     if (!lstatSync17(file2).isFile()) return {};
-    const r2 = JSON.parse(readFileSync64(file2, "utf8"));
+    const r2 = JSON.parse(readFileSync65(file2, "utf8"));
     return r2.v === 1 && r2.shots && typeof r2.shots === "object" ? r2.shots : {};
   } catch {
     return {};
@@ -148384,7 +148971,7 @@ var init_screen_state = __esm({
     KEEP = 40;
     LINE_MAX = 120;
     str3 = (v2) => typeof v2 === "string" && v2.trim() ? v2 : void 0;
-    sha256Of = (file2) => createHash30("sha256").update(readFileSync64(file2)).digest("hex");
+    sha256Of = (file2) => createHash31("sha256").update(readFileSync65(file2)).digest("hex");
   }
 });
 
@@ -148399,8 +148986,8 @@ __export(studio_reel_exports, {
   thin: () => thin,
   utcDay: () => utcDay
 });
-import { createHash as createHash31 } from "node:crypto";
-import { lstatSync as lstatSync18, readFileSync as readFileSync65 } from "node:fs";
+import { createHash as createHash32 } from "node:crypto";
+import { lstatSync as lstatSync18, readFileSync as readFileSync66 } from "node:fs";
 import { basename as basename14, join as join57 } from "node:path";
 function loadMemory2(dir) {
   const m2 = readJson6(join57(dir, ".himi", "studio", "memory.json"));
@@ -148487,8 +149074,8 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
       const path2 = join57(dir, HISTORY_DIR, f2);
       const st2 = lstatSync18(path2);
       if (!st2.isFile() || st2.nlink !== 1) return null;
-      const bytes2 = readFileSync65(path2);
-      return createHash31("sha256").update(bytes2).digest("hex") === f2.slice(0, 64) && imageExtension(bytes2) === f2.slice(65) ? bytes2 : null;
+      const bytes2 = readFileSync66(path2);
+      return createHash32("sha256").update(bytes2).digest("hex") === f2.slice(0, 64) && imageExtension(bytes2) === f2.slice(65) ? bytes2 : null;
     } catch {
       return null;
     }
@@ -148621,7 +149208,7 @@ var init_studio_reel = __esm({
     mimeOf = (file2) => MIME2[file2.slice(65)] ?? "image/png";
     readJson6 = (file2) => {
       try {
-        return JSON.parse(readFileSync65(file2, "utf8"));
+        return JSON.parse(readFileSync66(file2, "utf8"));
       } catch {
         return null;
       }
@@ -148638,12 +149225,12 @@ var init_studio_reel = __esm({
 });
 
 // src/home-screen-id.ts
-import { readFileSync as readFileSync66 } from "node:fs";
+import { readFileSync as readFileSync67 } from "node:fs";
 import { join as join58 } from "node:path";
 function homeScreenIdOf(dir) {
   let src;
   try {
-    src = readFileSync66(join58(dir, "dev", "index.ts"), "utf8");
+    src = readFileSync67(join58(dir, "dev", "index.ts"), "utf8");
   } catch {
     return null;
   }
@@ -148709,9 +149296,9 @@ __export(milestones_exports, {
   watchUrlFor: () => watchUrlFor,
   writeHandoverReel: () => writeHandoverReel
 });
-import { createHash as createHash32, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash33, randomUUID as randomUUID7 } from "node:crypto";
 import { spawn as spawn5 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync57, lstatSync as lstatSync19, readFileSync as readFileSync67, statSync as statSync17 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync57, lstatSync as lstatSync19, readFileSync as readFileSync68, statSync as statSync17 } from "node:fs";
 import { createServer as createServer4 } from "node:net";
 import { basename as basename15, dirname as dirname34, isAbsolute as isAbsolute6, join as join59, relative as relative11, resolve as resolve49, sep as sep15 } from "node:path";
 function homeShotPath(dir, home) {
@@ -149057,7 +149644,7 @@ function lastDraft(dir) {
   try {
     const file2 = join59(dir, LAST_DRAFT_FILE);
     if (!lstatSync19(file2).isFile()) return null;
-    const r2 = JSON.parse(readFileSync67(file2, "utf8"));
+    const r2 = JSON.parse(readFileSync68(file2, "utf8"));
     const m2 = r2.manifest;
     if (r2.v !== 1 || typeof r2.releaseId !== "string" || !m2 || typeof m2.screens !== "object" || !m2.screens || typeof m2.bundles !== "object" || !m2.bundles) return null;
     return { releaseId: r2.releaseId, manifest: m2 };
@@ -149119,7 +149706,7 @@ function readInitSource(dir) {
   const file2 = join59(dir, INIT_SOURCE_FILE);
   try {
     if (!lstatSync19(file2).isFile()) return null;
-    const r2 = JSON.parse(readFileSync67(file2, "utf8"));
+    const r2 = JSON.parse(readFileSync68(file2, "utf8"));
     if (r2.v !== 1 || typeof r2.fingerprint !== "string" || !/^[0-9a-f]{64}$/.test(r2.fingerprint) || typeof r2.newestMs !== "number") return null;
     return {
       v: 1,
@@ -149207,7 +149794,7 @@ function readInitWatch(dir) {
   const file2 = join59(dir, INIT_WATCH_FILE);
   try {
     if (!lstatSync19(file2).isFile()) return null;
-    const r2 = JSON.parse(readFileSync67(file2, "utf8"));
+    const r2 = JSON.parse(readFileSync68(file2, "utf8"));
     if (r2.v !== 1 || typeof r2.pid !== "number" || !Number.isInteger(r2.pid) || r2.pid < 1) return null;
     if (typeof r2.url !== "string" || !/^http:\/\/127\.0\.0\.1:\d+\//.test(r2.url) || typeof r2.board !== "string" || typeof r2.log !== "string" || typeof r2.startedAt !== "string") return null;
     if (r2.root !== runRootId(dir)) return null;
@@ -149239,7 +149826,7 @@ function watchReminder(dir, opts = {}) {
     const file2 = join59(dir, REMINDERS_FILE);
     let last = Number.NaN;
     try {
-      if (lstatSync19(file2).isFile()) last = Date.parse(JSON.parse(readFileSync67(file2, "utf8")).watch ?? "");
+      if (lstatSync19(file2).isFile()) last = Date.parse(JSON.parse(readFileSync68(file2, "utf8")).watch ?? "");
     } catch {
     }
     if (Number.isFinite(last) && now - last >= 0 && now - last < WATCH_REMINDER_EVERY_MS) return void 0;
@@ -149399,7 +149986,7 @@ var init_milestones = __esm({
     INIT_SOURCE_FILE = join59(".himi", "init-source.json");
     STARTING_POINT_REF = "starting-point";
     TEMPLATE_NAME = /^[A-Za-z0-9._-]{1,64}$/;
-    sha256Of2 = (file2) => createHash32("sha256").update(readFileSync67(file2)).digest("hex");
+    sha256Of2 = (file2) => createHash33("sha256").update(readFileSync68(file2)).digest("hex");
     WATCH_REMINDER_EVERY_MS = 10 * 60 * 1e3;
     REMINDERS_FILE = join59(".himi", "reminders.json");
     pidAlive = (pid) => {
@@ -149446,7 +150033,7 @@ __export(template_sweep_exports, {
   sweepCopy: () => sweepCopy,
   sweepPairs: () => sweepPairs
 });
-import { readFileSync as readFileSync68, writeFileSync as writeFileSync24 } from "node:fs";
+import { readFileSync as readFileSync69, writeFileSync as writeFileSync24 } from "node:fs";
 import { join as join60 } from "node:path";
 import ts7 from "typescript";
 function isCopy(node, file2) {
@@ -149488,7 +150075,7 @@ function sweepCopy(dir, pairs, dryRun) {
   const next = /* @__PURE__ */ new Map();
   const replaced = pairs.map(([from, to2]) => ({ from, to: to2, files: {} }));
   for (const f2 of files) {
-    const text9 = readFileSync68(join60(dir, f2), "utf8");
+    const text9 = readFileSync69(join60(dir, f2), "utf8");
     if (!pairs.some(([from]) => text9.includes(from) || text9.includes(JSON.stringify(from).slice(1, -1)))) continue;
     const kind = f2.endsWith(".json") ? ts7.ScriptKind.JSON : f2.endsWith("x") ? ts7.ScriptKind.TSX : ts7.ScriptKind.TS;
     const sf2 = ts7.createSourceFile(f2, text9, ts7.ScriptTarget.Latest, true, kind);
@@ -149517,8 +150104,8 @@ function sweepCopy(dir, pairs, dryRun) {
     if (errors.length) throw new TrimRefusal(`the sweep would break ${f2} \u2014 nothing written: ${errors[0]}`);
     next.set(f2, out2);
   }
-  const dev = next.get("dev/index.ts") ?? readFileSync68(join60(dir, "dev", "index.ts"), "utf8");
-  const config = next.get("config.ts") ?? readFileSync68(join60(dir, "config.ts"), "utf8");
+  const dev = next.get("dev/index.ts") ?? readFileSync69(join60(dir, "dev", "index.ts"), "utf8");
+  const config = next.get("config.ts") ?? readFileSync69(join60(dir, "config.ts"), "utf8");
   try {
     parseApp(dev, config);
   } catch (e2) {
@@ -149526,7 +150113,7 @@ function sweepCopy(dir, pairs, dryRun) {
   }
   if (!dryRun) for (const [f2, t2] of next) writeFileSync24(join60(dir, f2), t2);
   const g2 = new RegExp(PLACEHOLDER.source, `${PLACEHOLDER.flags.replace("g", "")}g`);
-  const placeholdersLeft = all.reduce((n2, f2) => n2 + [...(next.get(f2) ?? readFileSync68(join60(dir, f2), "utf8")).matchAll(g2)].length, 0);
+  const placeholdersLeft = all.reduce((n2, f2) => n2 + [...(next.get(f2) ?? readFileSync69(join60(dir, f2), "utf8")).matchAll(g2)].length, 0);
   return {
     ok: true,
     dryRun,
@@ -149543,7 +150130,7 @@ function sweepPairs(set, mapFile) {
     pairs.push([s2.slice(0, at2), s2.slice(at2 + 2)]);
   }
   if (mapFile) {
-    const map = JSON.parse(readFileSync68(mapFile, "utf8"));
+    const map = JSON.parse(readFileSync69(mapFile, "utf8"));
     for (const [k2, v2] of Object.entries(map)) {
       if (typeof v2 !== "string") throw new TrimRefusal(`--map ${mapFile}: "${k2}" must map to a string`);
       pairs.push([k2, v2]);
@@ -149788,18 +150375,18 @@ __export(template_recommend_exports, {
   recommendTemplates: () => recommendTemplates,
   verticalsFromBook: () => verticalsFromBook
 });
-import { existsSync as existsSync58, readFileSync as readFileSync69 } from "node:fs";
+import { existsSync as existsSync58, readFileSync as readFileSync70 } from "node:fs";
 import { join as join61 } from "node:path";
 function verticalsFromBook(path2) {
   const dir = existsSync58(join61(path2, "book.json")) || existsSync58(join61(path2, "provisioning.overlay.json")) ? path2 : join61(path2, ".himi", "business-book");
   const overlay = join61(dir, "provisioning.overlay.json");
   if (existsSync58(overlay)) {
-    const v2 = JSON.parse(readFileSync69(overlay, "utf8")).installedVerticals;
+    const v2 = JSON.parse(readFileSync70(overlay, "utf8")).installedVerticals;
     if (Array.isArray(v2) && v2.length) return v2.filter((x2) => typeof x2 === "string");
   }
   const book = join61(dir, "book.json");
   if (existsSync58(book)) {
-    const probes = JSON.parse(readFileSync69(book, "utf8")).probes;
+    const probes = JSON.parse(readFileSync70(book, "utf8")).probes;
     if (Array.isArray(probes)) return installedFromProbes(probes);
   }
   throw new Error(`no book.json / provisioning.overlay.json under ${path2} \u2014 run \`himi site analyze\` first, or pass --verticals`);
@@ -150209,7 +150796,7 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync59, mkdirSync as mkdirSync28, readFileSync as readFileSync70, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync59, mkdirSync as mkdirSync28, readFileSync as readFileSync71, writeFileSync as writeFileSync25 } from "node:fs";
 import { dirname as dirname35, join as join62, relative as relative12, resolve as resolve50, sep as sep16 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve50(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
@@ -150253,7 +150840,7 @@ function ejectModule(opts) {
 // gate still applies. Ejecting buys layout and flow, never the floor.
 
 `;
-  const normalized = readFileSync70(found.path, "utf8").replace(
+  const normalized = readFileSync71(found.path, "utf8").replace(
     /(["'])@himalaya\/([a-z0-9-]+(?:\/[a-z0-9-]+)?)\1/g,
     (_m, q2, sub) => `${q2}@wix/himalaya/${sub}${q2}`
   );
@@ -150261,7 +150848,7 @@ function ejectModule(opts) {
   const rewired = [];
   for (const f2 of files) {
     if (!existsSync59(f2)) continue;
-    const before = readFileSync70(f2, "utf8");
+    const before = readFileSync71(f2, "utf8");
     let after = before;
     let rel = relative12(dirname35(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
@@ -150381,7 +150968,7 @@ var init_app_map = __esm({
 });
 
 // src/wix-writes.ts
-import { existsSync as existsSync60, readFileSync as readFileSync71 } from "node:fs";
+import { existsSync as existsSync60, readFileSync as readFileSync72 } from "node:fs";
 import { join as join63 } from "node:path";
 function isProvenRead(method, path2) {
   if (/[#\x00-\x1F\x7F]/.test(path2)) return false;
@@ -150504,7 +151091,7 @@ function readDataAccess(dir) {
     if (!existsSync60(p2)) continue;
     let text9;
     try {
-      text9 = readFileSync71(p2, "utf8");
+      text9 = readFileSync72(p2, "utf8");
     } catch {
       continue;
     }
@@ -150618,14 +151205,14 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync61, mkdirSync as mkdirSync29, readFileSync as readFileSync72, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync61, mkdirSync as mkdirSync29, readFileSync as readFileSync73, writeFileSync as writeFileSync26 } from "node:fs";
 import { join as join64, resolve as resolve51 } from "node:path";
 function readTestConfig(dir) {
   const p2 = resolve51(dir, TEST_CONFIG_FILE);
   if (!existsSync61(p2)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync72(p2, "utf8"));
+    parsed = JSON.parse(readFileSync73(p2, "utf8"));
   } catch (e2) {
     throw new Error(`${TEST_CONFIG_FILE} is not valid JSON \u2014 ${e2.message}`);
   }
@@ -150672,7 +151259,7 @@ function readTestConfig(dir) {
 function readNetRules(path2) {
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync72(path2, "utf8"));
+    parsed = JSON.parse(readFileSync73(path2, "utf8"));
   } catch (e2) {
     throw new Error(`--net ${path2} could not be read as JSON \u2014 ${e2.message}`);
   }
@@ -150709,7 +151296,7 @@ function readCannedResponses() {
   ];
   for (const url of candidates) {
     try {
-      const parsed = JSON.parse(readFileSync72(url, "utf8"));
+      const parsed = JSON.parse(readFileSync73(url, "utf8"));
       const byKey = {};
       for (const [k2, v2] of Object.entries(parsed)) {
         if (!k2.startsWith("//")) byKey[k2] = v2;
@@ -151346,14 +151933,14 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync62, readFileSync as readFileSync73 } from "node:fs";
+import { existsSync as existsSync62, readFileSync as readFileSync74 } from "node:fs";
 import { join as join65 } from "node:path";
 function mobileUxIssues(dir, strict) {
   const file2 = join65(dir, "MOBILE-UX.md");
   if (!existsSync62(file2)) return [];
   let text9;
   try {
-    text9 = readFileSync73(file2, "utf8");
+    text9 = readFileSync74(file2, "utf8");
   } catch {
     return [];
   }
@@ -152203,10 +152790,10 @@ var init_calls = __esm({
 });
 
 // ../../core/functions-runtime/src/queue.ts
-import { createHash as createHash33 } from "node:crypto";
+import { createHash as createHash34 } from "node:crypto";
 function inputSchemaHash(definition) {
   const schema = definition.input;
-  return schema ? createHash33("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
+  return schema ? createHash34("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
 }
 function createFunctionEnqueueCapability(options) {
   return {
@@ -152272,14 +152859,14 @@ var init_queue = __esm({
 });
 
 // ../../core/data-resources/src/plan.ts
-import { createHash as createHash34 } from "node:crypto";
+import { createHash as createHash35 } from "node:crypto";
 function canonical3(value) {
   if (Array.isArray(value)) return `[${value.map(canonical3).join(",")}]`;
   if (value && typeof value === "object") return `{${Object.entries(value).sort(([a2], [b2]) => a2.localeCompare(b2)).map(([key2, item]) => `${JSON.stringify(key2)}:${canonical3(item)}`).join(",")}}`;
   return JSON.stringify(value);
 }
 function hashResourcePlan(plan) {
-  return createHash34("sha256").update(canonical3(plan)).digest("hex");
+  return createHash35("sha256").update(canonical3(plan)).digest("hex");
 }
 function finalize(input) {
   return { ...input, hash: hashResourcePlan(input) };
@@ -153034,7 +153621,7 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync74, existsSync as existsSync63 } from "node:fs";
+import { readFileSync as readFileSync75, existsSync as existsSync63 } from "node:fs";
 import { join as join66, resolve as resolve52 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
@@ -153056,7 +153643,7 @@ async function loadFunctionsApp(dir) {
   for (const definition of config.functions.functions) {
     const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join66(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync63);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
-    sources[definition.name] = readFileSync74(source, "utf8");
+    sources[definition.name] = readFileSync75(source, "utf8");
   }
   const data = config.cms || config.data ? mergeDataResources(config) : void 0;
   const dataErrors = validateDataResources(data, loaded.name).filter((issue2) => issue2.severity === "error");
@@ -153244,7 +153831,7 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { closeSync as closeSync6, constants as constants3, lstatSync as lstatSync20, mkdirSync as mkdirSync30, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync75, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync15, statSync as statSync18, writeSync, existsSync as existsSync64 } from "node:fs";
+import { closeSync as closeSync6, constants as constants3, lstatSync as lstatSync20, mkdirSync as mkdirSync30, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync76, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync15, statSync as statSync18, writeSync, existsSync as existsSync64 } from "node:fs";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { dirname as dirname36, isAbsolute as isAbsolute7, join as join67, relative as relative13, resolve as resolve53, sep as sep17 } from "node:path";
 import * as z2 from "zod";
@@ -153417,7 +154004,7 @@ function fileTools() {
         if (!existsSync64(p2) || !lstatSync20(p2).isFile()) return refuse5("not_found", `no file "${String(a2.path)}"`);
         const size = statSync18(p2).size;
         if (size > MAX_FILE_BYTES) return refuse5("too_large", `"${String(a2.path)}" is ${size} bytes \u2014 over the ${MAX_FILE_BYTES}-byte read limit`);
-        return ok({ ok: true, path: a2.path, bytes: size, content: readFileSync75(p2, "utf8") });
+        return ok({ ok: true, path: a2.path, bytes: size, content: readFileSync76(p2, "utf8") });
       }
     },
     {
@@ -154029,7 +154616,7 @@ __export(server_exports, {
   protectStdout: () => protectStdout,
   startMcpServer: () => startMcpServer
 });
-import { mkdirSync as mkdirSync31, readFileSync as readFileSync76 } from "node:fs";
+import { mkdirSync as mkdirSync31, readFileSync as readFileSync77 } from "node:fs";
 import { fileURLToPath as fileURLToPath24 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/server";
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
@@ -154089,7 +154676,7 @@ async function startMcpServer(opts) {
       status: (dir) => previewStatus(dir, previewDeps),
       stop: (dir) => stopPreview(dir, previewDeps)
     },
-    readFile: (p2) => readFileSync76(p2),
+    readFile: (p2) => readFileSync77(p2),
     login: createLoginSession({ ...defaultLoginDeps, selfCommand: previewDeps.selfCommand, ...opts.login }),
     ...opts.workspace ? { workspaceBoundary: opts.workspace } : {}
   };
@@ -154133,7 +154720,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync65, mkdtempSync as mkdtempSync2, readFileSync as readFileSync77, rmSync as rmSync16, writeFileSync as writeFileSync27 } from "node:fs";
+import { existsSync as existsSync65, mkdtempSync as mkdtempSync2, readFileSync as readFileSync78, rmSync as rmSync16, writeFileSync as writeFileSync27 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join68 } from "node:path";
 import { fileURLToPath as fileURLToPath25 } from "node:url";
@@ -154169,7 +154756,7 @@ function detectNativeDecode(options = {}) {
 }
 function localPropertiesSdk(harnessDir) {
   try {
-    const match = readFileSync77(join68(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
+    const match = readFileSync78(join68(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
     return match?.[1]?.trim().replace(/\\([ :\\])/g, "$1") ?? null;
   } catch {
     return null;
@@ -154320,7 +154907,7 @@ function runAndroidNativeDecode(options) {
       stdio: ["ignore", "ignore", "pipe"],
       encoding: "utf8"
     });
-    const stdout = readFileSync77(outputPath, "utf8");
+    const stdout = readFileSync78(outputPath, "utf8");
     return {
       platform: "android",
       verdicts: parseNativeDecodeOutput(stdout, options.descriptors.map((descriptor) => descriptor.screenId), "android"),
@@ -154389,8 +154976,8 @@ __export(browser_authoring_exports, {
   sdkSubpathReader: () => sdkSubpathReader
 });
 import { createServer as createServer5 } from "node:http";
-import { createHash as createHash35, randomBytes as randomBytes5 } from "node:crypto";
-import { existsSync as existsSync66, readdirSync as readdirSync32, readFileSync as readFileSync78, realpathSync as realpathSync11, statSync as statSync19 } from "node:fs";
+import { createHash as createHash36, randomBytes as randomBytes5 } from "node:crypto";
+import { existsSync as existsSync66, readdirSync as readdirSync32, readFileSync as readFileSync79, realpathSync as realpathSync11, statSync as statSync19 } from "node:fs";
 import { join as join69, posix as posix3, relative as relative14, sep as sep18 } from "node:path";
 function humanMs(ms2) {
   return ms2 < 1e3 ? `${ms2}ms` : `${Math.round(ms2 / 1e3)}s`;
@@ -154409,7 +154996,7 @@ function collectWorkerSources(tier5SrcDir, bundleName) {
       if (statSync19(childAbs).isDirectory()) {
         walk2(childAbs, childRel);
       } else if (/\.(ts|tsx|js|mjs|json)$/.test(name)) {
-        files[childRel] = readFileSync78(childAbs, "utf8");
+        files[childRel] = readFileSync79(childAbs, "utf8");
       }
     }
   };
@@ -154443,7 +155030,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
         if (!existsSync66(abs) || statSync19(abs).isDirectory()) continue;
         const key2 = `/tier5-src/${relative14(tier5SrcDir, abs).split(sep18).join(posix3.sep)}`;
         if (key2 in files) break;
-        files[key2] = readFileSync78(abs, "utf8");
+        files[key2] = readFileSync79(abs, "utf8");
         queue.push(key2);
         break;
       }
@@ -154478,7 +155065,7 @@ function collectSdkModules(files, resolveSubpath) {
 function sdkSubpathReader(resolve62) {
   return (sub) => {
     try {
-      return readFileSync78(resolve62(`@wix/himalaya/${sub}`), "utf8");
+      return readFileSync79(resolve62(`@wix/himalaya/${sub}`), "utf8");
     } catch {
       return null;
     }
@@ -154488,7 +155075,7 @@ function encodeJob(job) {
   return Buffer.from(JSON.stringify(job), "utf8").toString("base64");
 }
 function mintToken2(payload, nonce = randomBytes5(16).toString("hex")) {
-  const digest2 = createHash35("sha256").update(payload, "utf8").digest("base64url");
+  const digest2 = createHash36("sha256").update(payload, "utf8").digest("base64url");
   return `${nonce}.${digest2}`;
 }
 function defaultOpenBrowser2(url) {
@@ -154650,7 +155237,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync67, mkdirSync as mkdirSync32, readFileSync as readFileSync79, writeFileSync as writeFileSync28 } from "node:fs";
+import { existsSync as existsSync67, mkdirSync as mkdirSync32, readFileSync as readFileSync80, writeFileSync as writeFileSync28 } from "node:fs";
 import { dirname as dirname37, join as join70 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -154835,7 +155422,7 @@ function trendAndStore(dir, entries, suppressed) {
   let previous = null;
   try {
     if (existsSync67(p2)) {
-      const parsed = JSON.parse(readFileSync79(p2, "utf8"));
+      const parsed = JSON.parse(readFileSync80(p2, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k2) => typeof k2 === "string");
     }
   } catch {
@@ -154878,7 +155465,7 @@ function diffAndStoreObservations(dir, current) {
   let previous = null;
   try {
     if (existsSync67(p2)) {
-      const parsed = JSON.parse(readFileSync79(p2, "utf8"));
+      const parsed = JSON.parse(readFileSync80(p2, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v2) => Array.isArray(v2) && v2.every((l2) => typeof l2 === "string")
       )) {
@@ -154939,7 +155526,7 @@ __export(design_kits_exports, {
   kitsDir: () => kitsDir,
   listKits: () => listKits2
 });
-import { existsSync as existsSync68, readFileSync as readFileSync80, readdirSync as readdirSync33 } from "node:fs";
+import { existsSync as existsSync68, readFileSync as readFileSync81, readdirSync as readdirSync33 } from "node:fs";
 import { join as join71, basename as basename16 } from "node:path";
 import { fileURLToPath as fileURLToPath26 } from "node:url";
 function kitsDir() {
@@ -154967,7 +155554,7 @@ In a published @wix/himalaya-cli this is a packaging bug \u2014 the kits should
   if (!kits.includes(name)) {
     return { ok: false, kit: name, kits, problems: [`no design kit named "${name}". Available: ${kits.join(", ")}`] };
   }
-  const raw = readFileSync80(join71(dir, `${name}.json`), "utf8");
+  const raw = readFileSync81(join71(dir, `${name}.json`), "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -155007,11 +155594,11 @@ __export(assets_exports, {
   removeAssetPayload: () => removeAssetPayload,
   verifyReport: () => verifyReport
 });
-import { readFileSync as readFileSync81 } from "node:fs";
+import { readFileSync as readFileSync82 } from "node:fs";
 import { basename as basename17 } from "node:path";
 function declaredAssets(dir) {
   return collectAssets(dir).map((a2) => {
-    const bytes2 = readFileSync81(a2.path);
+    const bytes2 = readFileSync82(a2.path);
     return {
       name: a2.name,
       sha256: assetSha256(bytes2),
@@ -155088,7 +155675,7 @@ function verifyReport(dir, app, manifest) {
   };
 }
 function addAssetPayload(manifest, filePath, opts) {
-  const bytes2 = readFileSync81(filePath);
+  const bytes2 = readFileSync82(filePath);
   const name = opts.name ?? basename17(filePath);
   const sha2566 = assetSha256(bytes2);
   const record2 = {
@@ -156882,7 +157469,7 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync as cpSync2, existsSync as existsSync69, mkdirSync as mkdirSync33, mkdtempSync as mkdtempSync3, readFileSync as readFileSync82, rmSync as rmSync17, statSync as statSync20 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync69, mkdirSync as mkdirSync33, mkdtempSync as mkdtempSync3, readFileSync as readFileSync83, rmSync as rmSync17, statSync as statSync20 } from "node:fs";
 import { networkInterfaces as osNetworkInterfaces, tmpdir as tmpdir4 } from "node:os";
 import { dirname as dirname38, join as join72 } from "node:path";
 import { fileURLToPath as fileURLToPath27 } from "node:url";
@@ -156942,7 +157529,7 @@ async function resolvePackage(source, workDir) {
     }
     throw new Error(`${source} is a directory but has no release-manifest.json \u2014 is it a package?`);
   }
-  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync82(source);
+  const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync83(source);
   const root = workDir ?? mkdtempSync3(join72(tmpdir4(), "himi-run-"));
   const { app, appDir: appDir3 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir3);
@@ -156973,7 +157560,7 @@ async function loadPreviewAssets() {
     ];
     for (const path2 of candidates) {
       if (!existsSync69(path2)) continue;
-      const blob = readFileSync82(path2);
+      const blob = readFileSync83(path2);
       return mod.assemblePreviewAssetsFromBlob(new Uint8Array(blob.buffer, blob.byteOffset, blob.byteLength));
     }
     return /* @__PURE__ */ new Map();
@@ -157110,7 +157697,7 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer7 } from "node:http";
-import { existsSync as existsSync70, readFileSync as readFileSync83 } from "node:fs";
+import { existsSync as existsSync70, readFileSync as readFileSync84 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { dirname as dirname39, resolve as resolve55 } from "node:path";
 import { fileURLToPath as fileURLToPath28 } from "node:url";
@@ -157218,7 +157805,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
       }
       let bytes2;
       try {
-        bytes2 = readFileSync83(resolve55(stagedDir(), name));
+        bytes2 = readFileSync84(resolve55(stagedDir(), name));
       } catch (e2) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "browser_plane_unstaged", file: name, detail: String(e2) }));
@@ -157271,14 +157858,14 @@ var hhp_preview_exports = {};
 __export(hhp_preview_exports, {
   hhpPreviewResponse: () => hhpPreviewResponse
 });
-import { existsSync as existsSync71, readFileSync as readFileSync84 } from "node:fs";
+import { existsSync as existsSync71, readFileSync as readFileSync85 } from "node:fs";
 import { join as join73 } from "node:path";
 function hhpPreviewResponse(root, request) {
   if (new URL(request.url).pathname !== "/__himi/hhp-preview" || !existsSync71(join73(root, "hhp.json"))) return null;
   if (request.method !== "GET") return new Response(null, { status: 405 });
   try {
     const file2 = localPath(root, ".himi/hhp-preview.json");
-    const authored2 = existsSync71(file2) ? JSON.parse(readFileSync84(file2, "utf8")) : {};
+    const authored2 = existsSync71(file2) ? JSON.parse(readFileSync85(file2, "utf8")) : {};
     if (authored2.mockCapabilities && (!Array.isArray(authored2.mockCapabilities) || authored2.mockCapabilities.some((v2) => typeof v2 !== "string"))) throw new Error("mockCapabilities must be a string array.");
     const fixtures = authored2.fixtures ?? {};
     if (typeof fixtures !== "object" || Array.isArray(fixtures) || fixtures === null) throw new Error("fixtures must be an object.");
@@ -157428,7 +158015,7 @@ var init_embedded_bundles = __esm({
 });
 
 // ../store-release/register-bundle.ts
-import { readFileSync as readFileSync85 } from "node:fs";
+import { readFileSync as readFileSync86 } from "node:fs";
 import { createPrivateKey as createPrivateKey4, sign as sign2 } from "node:crypto";
 function b64url2(b2) {
   return Buffer.from(b2).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
@@ -157446,7 +158033,7 @@ function bundleIdBody(identifier, name, platform = "IOS") {
 async function registerBundleId(opts) {
   const env = requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync85(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync86(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   const res = await fetch(`${ASC_API}/v1/bundleIds`, {
     method: "POST",
     headers: { Authorization: `Bearer ${jwt}`, "Content-Type": "application/json" },
@@ -157476,7 +158063,7 @@ async function main() {
   }
   const ni2 = rest.indexOf("--name");
   const name = ni2 >= 0 ? rest[ni2 + 1] : cfg.app ?? app;
-  const yml = readFileSync85(iosProjectYml(app), "utf8");
+  const yml = readFileSync86(iosProjectYml(app), "utf8");
   for (const { id, label: label2 } of [{ id: identifier, label: name }, ...embeddedBundles(yml).map((b2) => ({
     id: embeddedBundleId(identifier, b2),
     label: `${name} ${embeddedAppIdLabel(b2)}`
@@ -157887,7 +158474,7 @@ var init_iap_api = __esm({
 });
 
 // ../store-release/iap-manifest.ts
-import { createHash as createHash36 } from "node:crypto";
+import { createHash as createHash37 } from "node:crypto";
 function readTarget(reader, value) {
   const obj3 = reader.object(value, "target", TARGET_KEYS);
   return {
@@ -158031,7 +158618,7 @@ function canonicalJson(value) {
   return JSON.stringify(sortKeys(value));
 }
 function sha256Digest(value) {
-  return `sha256:${createHash36("sha256").update(canonicalJson(value)).digest("hex")}`;
+  return `sha256:${createHash37("sha256").update(canonicalJson(value)).digest("hex")}`;
 }
 function manifestDigest(manifest) {
   return sha256Digest(manifest);
@@ -158885,13 +159472,13 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync72, readFileSync as readFileSync86 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
+import { existsSync as existsSync72, readFileSync as readFileSync87 } from "node:fs";
+import { homedir as homedir9 } from "node:os";
 import { join as join74 } from "node:path";
-function credentialsDir(home = homedir7()) {
+function credentialsDir(home = homedir9()) {
   return join74(home, ".himalaya", "store-credentials");
 }
-function profilePath(name, home = homedir7()) {
+function profilePath(name, home = homedir9()) {
   if (!PROFILE_NAME.test(name)) {
     throw new Error(
       `credential profile ${JSON.stringify(name)} is not a profile name \u2014 use letters, digits, ".", "_" or "-" starting with a letter or digit. It names ${join74(credentialsDir(home), "<name>.json")}; it is never a path.`
@@ -158927,8 +159514,8 @@ function namedProfile(cfg, profileFlag) {
 function resolveStoreCredentials(opts) {
   const { app, cfg } = opts;
   const env = opts.env ?? process.env;
-  const home = opts.home ?? homedir7();
-  const read = opts.readProfile ?? ((p2) => readFileSync86(p2, "utf8"));
+  const home = opts.home ?? homedir9();
+  const read = opts.readProfile ?? ((p2) => readFileSync87(p2, "utf8"));
   const exists = opts.profileExists ?? existsSync72;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
@@ -158994,11 +159581,11 @@ var init_credential_profile = __esm({
 });
 
 // ../store-release/iap-credentials.ts
-import { createHash as createHash37 } from "node:crypto";
-import { existsSync as existsSync73, readFileSync as readFileSync87, realpathSync as realpathSync12 } from "node:fs";
-import { homedir as homedir8 } from "node:os";
+import { createHash as createHash38 } from "node:crypto";
+import { existsSync as existsSync73, readFileSync as readFileSync88, realpathSync as realpathSync12 } from "node:fs";
+import { homedir as homedir10 } from "node:os";
 function accountFingerprint(keyId, issuerId) {
-  return `sha256:${createHash37("sha256").update(`${issuerId}:${keyId}`).digest("hex").slice(0, 16)}`;
+  return `sha256:${createHash38("sha256").update(`${issuerId}:${keyId}`).digest("hex").slice(0, 16)}`;
 }
 function requireExplicitProfile(profileFlag, target) {
   const profile = profileFlag?.trim();
@@ -159028,8 +159615,8 @@ function canonicalKeyPath(path2, profile, realpath) {
 }
 function resolveIapCredentials(options) {
   const { target } = options;
-  const home = options.home ?? homedir8();
-  const readFile3 = options.readFile ?? ((p2) => readFileSync87(p2, "utf8"));
+  const home = options.home ?? homedir10();
+  const readFile3 = options.readFile ?? ((p2) => readFileSync88(p2, "utf8"));
   const realpath = options.realpath ?? realpathSync12;
   const profile = requireExplicitProfile(options.profileFlag, target);
   const creds = resolveStoreCredentials({
@@ -159075,7 +159662,7 @@ var init_wix_payments_contract = __esm({
 });
 
 // ../store-release/iap-draft.ts
-import { createHash as createHash38 } from "node:crypto";
+import { createHash as createHash39 } from "node:crypto";
 function fit(text9, max) {
   const chars = [...text9];
   return chars.length <= max ? text9 : `${chars.slice(0, max - 1).join("").trimEnd()}${ELLIPSIS}`;
@@ -159213,7 +159800,7 @@ var init_iap_draft = __esm({
     TIER_DESCRIPTION = "Unlocks one item in the app";
     ELLIPSIS = "\u2026";
     entityKey = (entityType, entityId) => `${entityType}:${entityId}`;
-    sha = (text9) => createHash38("sha256").update(text9).digest("hex");
+    sha = (text9) => createHash39("sha256").update(text9).digest("hex");
     ENTITIES = { "&amp;": "&", "&nbsp;": " ", "&lt;": "<", "&gt;": ">", "&quot;": '"', "&#39;": "'" };
     MAX_SUFFIX = 24;
     ReferenceNames = class {
@@ -159351,7 +159938,7 @@ __export(version_exports, {
   stampTargetVersion: () => stampTargetVersion,
   stampVersionKeys: () => stampVersionKeys
 });
-import { readFileSync as readFileSync88, writeFileSync as writeFileSync29 } from "node:fs";
+import { readFileSync as readFileSync89, writeFileSync as writeFileSync29 } from "node:fs";
 function readIosVersion(projectYml) {
   const marketing = matchScalar(projectYml, "CFBundleShortVersionString");
   const build3 = matchScalar(projectYml, "CFBundleVersion");
@@ -159498,8 +160085,8 @@ function setAndroidVersion(gradle, v2) {
 function bumpVersion(app, opts) {
   const iosPath = iosProjectYml(app);
   const gradlePath = androidGradle(app);
-  const iosYml = readFileSync88(iosPath, "utf8");
-  const gradle = readFileSync88(gradlePath, "utf8");
+  const iosYml = readFileSync89(iosPath, "utf8");
+  const gradle = readFileSync89(gradlePath, "utf8");
   const current = readIosVersion(iosYml);
   const next = {
     marketing: opts.marketing ?? current.marketing,
@@ -159529,7 +160116,7 @@ var init_store_spec = __esm({
 });
 
 // src/iap-config-edit.ts
-import { existsSync as existsSync74, readFileSync as readFileSync89 } from "node:fs";
+import { existsSync as existsSync74, readFileSync as readFileSync90 } from "node:fs";
 import { basename as basename18, join as join75 } from "node:path";
 import ts8 from "typescript";
 function bindPurchasesAppInConfig(source, options) {
@@ -159611,14 +160198,14 @@ function withStoreBundle(dir, options) {
   if (options.storeBundleId) return options;
   const path2 = join75(dir, "store", "store.config.yaml");
   if (!existsSync74(path2)) return options;
-  const storeBundleId = parseStoreConfig(readFileSync89(path2, "utf8")).ios?.bundleId;
+  const storeBundleId = parseStoreConfig(readFileSync90(path2, "utf8")).ios?.bundleId;
   return storeBundleId ? { ...options, storeBundleId } : options;
 }
 function previewIapConfigEdit(dir, options) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
   if (isSymlink2(path2)) return { path: path2, changed: false, applied: [], conflicts: [], instructions: [`${basename18(path2)} is a symlink, so it would not be edited: add the purchases app in the file it points to.`] };
-  const { changed, applied, conflicts, instructions } = bindPurchasesAppInConfig(readFileSync89(path2, "utf8"), { ...withStoreBundle(dir, options), fileName: basename18(path2) });
+  const { changed, applied, conflicts, instructions } = bindPurchasesAppInConfig(readFileSync90(path2, "utf8"), { ...withStoreBundle(dir, options), fileName: basename18(path2) });
   return { path: path2, changed, applied, conflicts, instructions };
 }
 async function applyIapConfigEdit(dir, options, validate4) {
@@ -159627,7 +160214,7 @@ async function applyIapConfigEdit(dir, options, validate4) {
   const fileName = basename18(path2);
   const refuse7 = (why) => ({ path: path2, changed: false, applied: [], conflicts: [], instructions: [why] });
   if (isSymlink2(path2)) return refuse7(`${fileName} is a symlink, so it was not edited: add the purchases app in the file it points to.`);
-  const original = readFileSync89(path2, "utf8");
+  const original = readFileSync90(path2, "utf8");
   const edit = bindPurchasesAppInConfig(original, { ...withStoreBundle(dir, options), fileName });
   const { applied, conflicts, instructions } = edit;
   if (!edit.changed) return { path: path2, changed: false, applied, conflicts, instructions };
@@ -160100,8 +160687,8 @@ __export(store_iap_exports, {
   runStoreIap: () => runStoreIap
 });
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync34, readFileSync as readFileSync90, realpathSync as realpathSync13, rmSync as rmSync18, writeFileSync as writeFileSync30 } from "node:fs";
-import { homedir as homedir9, hostname } from "node:os";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync34, readFileSync as readFileSync91, realpathSync as realpathSync13, rmSync as rmSync18, writeFileSync as writeFileSync30 } from "node:fs";
+import { homedir as homedir11, hostname } from "node:os";
 import { join as join76 } from "node:path";
 function scrubDeep(value, scrub) {
   if (typeof value === "string") return scrub(value);
@@ -160558,7 +161145,7 @@ function fileJournal(path2) {
 }
 function readLockSummary(path2) {
   try {
-    const { pid, host, at: at2 } = JSON.parse(readFileSync90(path2, "utf8"));
+    const { pid, host, at: at2 } = JSON.parse(readFileSync91(path2, "utf8"));
     return `pid ${pid} on ${host} since ${at2}`;
   } catch {
     return "unreadable lock";
@@ -160578,7 +161165,7 @@ function acquireApplyLock(dir, appleAppId) {
   return () => {
     let current = "";
     try {
-      current = readFileSync90(path2, "utf8");
+      current = readFileSync91(path2, "utf8");
     } catch {
       return;
     }
@@ -160586,7 +161173,7 @@ function acquireApplyLock(dir, appleAppId) {
   };
 }
 function stateDir(appleAppId) {
-  const dir = join76(homedir9(), ".himalaya", "store-iap", appleAppId);
+  const dir = join76(homedir11(), ".himalaya", "store-iap", appleAppId);
   mkdirSync34(dir, { recursive: true, mode: 448 });
   return dir;
 }
@@ -160602,7 +161189,7 @@ async function confirmOnTerminal(question) {
 }
 function defaultStoreIapDeps() {
   return {
-    readFile: (path2) => readFileSync90(path2, "utf8"),
+    readFile: (path2) => readFileSync91(path2, "utf8"),
     writeFileAtomic,
     resolveCredentials: ({ profileFlag, target }) => resolveIapCredentials({ profileFlag, target }),
     createApi: (key2) => createIapApi(createAscClient({ key: key2 })),
@@ -161084,8 +161671,8 @@ __export(preflight_app_exports, {
   preflightApp: () => preflightApp,
   profileAccount: () => profileAccount
 });
-import { readFileSync as readFileSync91, existsSync as existsSync75, readdirSync as readdirSync34, statSync as statSync21 } from "node:fs";
-import { createHash as createHash39 } from "node:crypto";
+import { readFileSync as readFileSync92, existsSync as existsSync75, readdirSync as readdirSync34, statSync as statSync21 } from "node:fs";
+import { createHash as createHash40 } from "node:crypto";
 import { join as join77 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
   const f2 = [];
@@ -161150,8 +161737,8 @@ function profileAccount(app, storeConfig, opts = {}) {
   }
 }
 async function preflightApp(app, opts = {}) {
-  const projectYml = existsSync75(iosProjectYml(app)) ? readFileSync91(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync75(storeConfigPath(app)) ? readFileSync91(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync75(iosProjectYml(app)) ? readFileSync92(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync75(storeConfigPath(app)) ? readFileSync92(storeConfigPath(app), "utf8") : "";
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }];
   const findings = analyze(
     projectYml,
@@ -161310,7 +161897,7 @@ function playListingAssets(app, locale = "en-US") {
     for (const name of names) {
       const p2 = join77(dir, name);
       try {
-        if (statSync21(p2).isFile()) return { name, bytes: readFileSync91(p2) };
+        if (statSync21(p2).isFile()) return { name, bytes: readFileSync92(p2) };
       } catch {
       }
     }
@@ -161350,7 +161937,7 @@ function listScreenshots(app, locale = "en-US") {
   const flat = join77(storeDir(app), "screenshots", locale);
   if (existsSync75(flat)) {
     for (const png of readdirSync34(flat).filter((n2) => n2.endsWith(".png"))) {
-      const sz = pngSize(readFileSync91(join77(flat, png)));
+      const sz = pngSize(readFileSync92(join77(flat, png)));
       if (sz) out2.push({ name: png, w: sz.w, h: sz.h });
     }
   }
@@ -161360,7 +161947,7 @@ function listScreenshots(app, locale = "en-US") {
       const d2 = join77(legacy, deviceDir);
       if (!statSync21(d2).isDirectory()) continue;
       for (const png of readdirSync34(d2).filter((n2) => n2.endsWith(".png"))) {
-        const sz = pngSize(readFileSync91(join77(d2, png)));
+        const sz = pngSize(readFileSync92(join77(d2, png)));
         if (sz) out2.push({ name: `${deviceDir}/${png}`, w: sz.w, h: sz.h });
       }
     }
@@ -161374,7 +161961,7 @@ function placeholderHashes2() {
     const p2 = join77(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync21(p2).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash39("sha256").update(readFileSync91(p2)).digest("hex")];
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash40("sha256").update(readFileSync92(p2)).digest("hex")];
     } catch {
     }
   }
@@ -161410,8 +161997,8 @@ async function appIconState(iosDir) {
     const p2 = join77(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync21(p2).isFile()) continue;
-      const bytes2 = readFileSync91(p2);
-      const hash2 = createHash39("sha256").update(bytes2).digest("hex");
+      const bytes2 = readFileSync92(p2);
+      const hash2 = createHash40("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
         exists: true,
@@ -161477,7 +162064,7 @@ __export(asc_status_exports, {
   ascStatus: () => ascStatus,
   buildVerdict: () => buildVerdict
 });
-import { readFileSync as readFileSync92 } from "node:fs";
+import { readFileSync as readFileSync93 } from "node:fs";
 function buildVerdict(builds) {
   if (!builds.length) {
     return "NO builds registered \u2014 if you uploaded recently and it's been >15 min, the binary was REJECTED IN PROCESSING (reason is email-only; run validate-binary.ts / scan-purpose-strings.ts to reproduce it).";
@@ -161491,7 +162078,7 @@ function buildVerdict(builds) {
 function client(creds) {
   const env = creds ?? requireEnv(["ASC_KEY_ID", "ASC_ISSUER_ID", "ASC_KEY_PATH"]);
   assertCredentialOutsideRepo("ASC_KEY_PATH", env.ASC_KEY_PATH);
-  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync92(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
+  const jwt = ascJwt(env.ASC_KEY_ID, env.ASC_ISSUER_ID, readFileSync93(env.ASC_KEY_PATH, "utf8"), Math.floor(Date.now() / 1e3));
   return async (path2) => {
     const r2 = await fetch(`${ASC}${path2}`, { headers: { Authorization: `Bearer ${jwt}` } });
     return { status: r2.status, json: await r2.json().catch(() => ({})) };
@@ -161756,7 +162343,7 @@ __export(secrets_exports, {
   runRemoteSecretsCommand: () => runRemoteSecretsCommand,
   runSecretsCommand: () => runSecretsCommand
 });
-import { readFileSync as readFileSync93 } from "node:fs";
+import { readFileSync as readFileSync94 } from "node:fs";
 function environment(value) {
   if (value === "preview" || value === "production") return value;
   throw new Error("--environment must be preview or production");
@@ -161787,7 +162374,7 @@ async function runSecretsCommand(operation, flags, io2, options = {}) {
       io2.log(JSON.stringify(await vault.list({ app, environment: env })));
       return 0;
     }
-    const value = options.readValue ? options.readValue() : readFileSync93(0, "utf8").replace(/\r?\n$/, "");
+    const value = options.readValue ? options.readValue() : readFileSync94(0, "utf8").replace(/\r?\n$/, "");
     if (operation === "set") await vault.set({ app, environment: env, name, value });
     else if (operation === "rotate") await vault.rotate({ app, environment: env, name, value });
     else throw new Error(`unknown secrets operation ${operation}`);
@@ -161816,7 +162403,7 @@ async function runRemoteSecretsCommand(operation, flags, io2, options) {
     }
     let body;
     if (operation !== "list") {
-      const value = options.readValue ? options.readValue() : readFileSync93(0, "utf8").replace(/\r?\n$/, "");
+      const value = options.readValue ? options.readValue() : readFileSync94(0, "utf8").replace(/\r?\n$/, "");
       body = JSON.stringify({ value });
     }
     const response = await (options.fetchImpl ?? fetch)(url, { method: operation === "list" ? "GET" : operation === "set" ? "PUT" : "POST", headers: headers2, body });
@@ -162010,7 +162597,7 @@ var init_site_member = __esm({
 });
 
 // src/notify-ping-all.ts
-import { createHash as createHash40 } from "node:crypto";
+import { createHash as createHash41 } from "node:crypto";
 async function listApprovedMembers(input) {
   const first = await scanMembers(input);
   const second = await scanMembers(input);
@@ -162064,7 +162651,7 @@ async function scanMembers(input) {
   }
 }
 function campaignRequestId(campaignId, memberId) {
-  const bytes2 = createHash40("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
+  const bytes2 = createHash41("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
   bytes2[6] = bytes2[6] & 15 | 80;
   bytes2[8] = bytes2[8] & 63 | 128;
   const hex2 = bytes2.toString("hex");
@@ -162314,15 +162901,15 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync35, readFileSync as readFileSync94, writeFileSync as writeFileSync31 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync35, readFileSync as readFileSync95, writeFileSync as writeFileSync31 } from "node:fs";
+import { homedir as homedir12 } from "node:os";
 import { dirname as dirname41, join as join78 } from "node:path";
 function defaultSessionsPath() {
-  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join78(homedir10(), ".himalaya", "admin-sessions.json");
+  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join78(homedir12(), ".himalaya", "admin-sessions.json");
 }
 function loadSessionsFile(path2 = defaultSessionsPath()) {
   try {
-    return JSON.parse(readFileSync94(path2, "utf8"));
+    return JSON.parse(readFileSync95(path2, "utf8"));
   } catch {
     return {};
   }
@@ -162699,20 +163286,20 @@ __export(base44_auth_exports, {
   usableBase44Auth: () => usableBase44Auth,
   writeBase44Session: () => writeBase44Session
 });
-import { chmodSync as chmodSync4, existsSync as existsSync76, mkdirSync as mkdirSync36, readFileSync as readFileSync95, rmSync as rmSync19, writeFileSync as writeFileSync32 } from "node:fs";
-import { homedir as homedir11 } from "node:os";
+import { chmodSync as chmodSync4, existsSync as existsSync76, mkdirSync as mkdirSync36, readFileSync as readFileSync96, rmSync as rmSync19, writeFileSync as writeFileSync32 } from "node:fs";
+import { homedir as homedir13 } from "node:os";
 import { dirname as dirname42, join as join79 } from "node:path";
 function base44ApiBase(env = process.env) {
   return (env.BASE44_API_URL?.trim() || "https://app.base44.com").replace(/\/+$/, "");
 }
-function base44SessionPath(home = homedir11()) {
+function base44SessionPath(home = homedir13()) {
   return join79(home, ".himi", "base44", "session.json");
 }
 function readBase44Session(home) {
   const p2 = base44SessionPath(home);
   if (!existsSync76(p2)) return void 0;
   try {
-    const s2 = JSON.parse(readFileSync95(p2, "utf8"));
+    const s2 = JSON.parse(readFileSync96(p2, "utf8"));
     return typeof s2.accessToken === "string" && s2.accessToken ? s2 : void 0;
   } catch {
     return void 0;
@@ -162822,10 +163409,10 @@ async function base44DeviceLogin(opts) {
   }
   throw new Error("the Base44 sign-in code expired before it was approved \u2014 run `himi base44 login` again");
 }
-function importBase44CliSession(home = homedir11(), env = process.env) {
+function importBase44CliSession(home = homedir13(), env = process.env) {
   const src = join79(home, ".base44", "auth", "auth.json");
   if (!existsSync76(src)) throw new Error(`no Base44 CLI session at ${src} \u2014 run \`npx base44 login\` first, or use \`himi base44 login\``);
-  const a2 = JSON.parse(readFileSync95(src, "utf8"));
+  const a2 = JSON.parse(readFileSync96(src, "utf8"));
   if (typeof a2.accessToken !== "string" || !a2.accessToken) throw new Error(`${src} holds no access token`);
   const session = {
     accessToken: a2.accessToken,
@@ -166129,11 +166716,11 @@ var init_analyze = __esm({
 });
 
 // src/base44-analyze/write-artifacts.ts
-import { existsSync as existsSync77, mkdirSync as mkdirSync38, readFileSync as readFileSync96, rmSync as rmSync20, writeFileSync as writeFileSync34 } from "node:fs";
+import { existsSync as existsSync77, mkdirSync as mkdirSync38, readFileSync as readFileSync97, rmSync as rmSync20, writeFileSync as writeFileSync34 } from "node:fs";
 import { dirname as dirname43, join as join81, resolve as resolve57, sep as sep19 } from "node:path";
 function isBookFolder(dir) {
   try {
-    return JSON.parse(readFileSync96(join81(dir, "book.json"), "utf8")).kind === "base44-app-book";
+    return JSON.parse(readFileSync97(join81(dir, "book.json"), "utf8")).kind === "base44-app-book";
   } catch {
     return false;
   }
@@ -171549,7 +172136,7 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync78, readFileSync as readFileSync97, writeFileSync as writeFileSync36, copyFileSync as copyFileSync2, mkdirSync as mkdirSync40, realpathSync as realpathSync14, statSync as statSync22 } from "node:fs";
+import { existsSync as existsSync78, readFileSync as readFileSync98, writeFileSync as writeFileSync36, copyFileSync as copyFileSync2, mkdirSync as mkdirSync40, realpathSync as realpathSync14, statSync as statSync22 } from "node:fs";
 import { dirname as dirname44, isAbsolute as isAbsolute8, join as join83, resolve as resolve59, sep as sep20 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
@@ -171672,7 +172259,7 @@ function buildMergedContract(options) {
   if (!existsSync78(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
-  const committed = JSON.parse(readFileSync97(committedPath, "utf8"));
+  const committed = JSON.parse(readFileSync98(committedPath, "utf8"));
   const merged = mergeCustomerOwned(committed, overlay);
   const overlayFontFamily = (overlay.branding ?? {}).fontFamily;
   const branding = merged.branding ?? {};
@@ -171711,7 +172298,7 @@ function buildMergedContract(options) {
   if (existsSync78(facesPath)) {
     let faces = [];
     try {
-      const parsed = JSON.parse(readFileSync97(facesPath, "utf8"));
+      const parsed = JSON.parse(readFileSync98(facesPath, "utf8"));
       faces = Array.isArray(parsed) ? parsed : [];
     } catch {
       faces = [];
@@ -171772,7 +172359,7 @@ function staticFaqFor(overlay, overlayPath) {
   const bookPath = join83(dirname44(resolve59(overlayPath)), "book.json");
   if (!existsSync78(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync97(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync98(bookPath, "utf8"));
     const copy = book?.copy;
     if (!copy || typeof copy !== "object" || copy.unavailable) return void 0;
     const pairs = deriveStaticFaq(copy.faq);
@@ -171789,7 +172376,7 @@ function staticGalleriesFor(overlay, overlayPath) {
   const bookPath = join83(dirname44(resolve59(overlayPath)), "book.json");
   if (!existsSync78(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync97(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync98(bookPath, "utf8"));
     if (!book.look || book.look.unavailable || !Array.isArray(book.look.pages)) return void 0;
     const galleries = deriveStaticGalleries(book.look.pages);
     return galleries.length || book.look.complete === true ? galleries : void 0;
@@ -171801,8 +172388,8 @@ async function applyOverlays(input) {
   const cwd = resolve59(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
-  const overlay = JSON.parse(readFileSync97(input.overlayPath, "utf8"));
-  const tokens2 = JSON.parse(readFileSync97(input.tokensPath, "utf8"));
+  const overlay = JSON.parse(readFileSync98(input.overlayPath, "utf8"));
+  const tokens2 = JSON.parse(readFileSync98(input.tokensPath, "utf8"));
   const faq = staticFaqFor(overlay, input.overlayPath);
   if (faq !== void 0) overlay.faq = faq;
   const galleries = staticGalleriesFor(overlay, input.overlayPath);
@@ -171821,7 +172408,7 @@ async function applyOverlays(input) {
     }
     const appDir3 = join83(repoRoot2, shellAppDir(shell));
     const committedPath = join83(appDir3, "provisioning.json");
-    const committedSite = existsSync78(committedPath) ? JSON.parse(readFileSync97(committedPath, "utf8")).site : void 0;
+    const committedSite = existsSync78(committedPath) ? JSON.parse(readFileSync98(committedPath, "utf8")).site : void 0;
     if (committedSite !== void 0 && overlay.site === void 0) {
       throw new Error(
         `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), and this overlay has none. Re-run \`himi site analyze --url <site> --shell ${shell}\` to derive the site's page map (edit \`site.pages\` in provisioning.overlay.json if needed), then --apply.`
@@ -171863,7 +172450,7 @@ async function applyOverlays(input) {
   let packageFaq = faq;
   let packageGalleries = galleries;
   if (existsSync78(pkgProv)) {
-    const cur = JSON.parse(readFileSync97(pkgProv, "utf8"));
+    const cur = JSON.parse(readFileSync98(pkgProv, "utf8"));
     if (galleries === void 0 && !sameKnownSite(cur, overlay)) overlay.galleries = [];
     const merged = deepMerge4(cur, overlay);
     packageFaq = merged.faq;
@@ -171881,7 +172468,7 @@ async function applyOverlays(input) {
   }
   const pkgTokens = join83(cwd, "tokens.json");
   if (existsSync78(pkgTokens) && (tokens2.colors || tokens2.typography)) {
-    const cur = JSON.parse(readFileSync97(pkgTokens, "utf8"));
+    const cur = JSON.parse(readFileSync98(pkgTokens, "utf8"));
     let tokensIn = tokens2;
     if (tokens2.typography) {
       const fonts = catalogTypography(tokens2.typography, cur.typography);
@@ -171908,7 +172495,7 @@ async function applyOverlays(input) {
   const homeAction = homeRefreshActionId(shell);
   const homeSrc = join83(cwd, "dev/index.ts");
   if (homeAction && existsSync78(homeSrc)) {
-    const prev = readFileSync97(homeSrc, "utf8");
+    const prev = readFileSync98(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
     if (!patched.foreign && faq?.length && prev.includes('"tier5.himiBrandedFaq.load"') && !prev.includes('"staticFaq"')) {
@@ -172907,7 +173494,7 @@ __export(cli_exports2, {
   runSiteAnalyze: () => runSiteAnalyze,
   runSiteFunctionCli: () => runSiteFunctionCli
 });
-import { existsSync as existsSync79, readFileSync as readFileSync98 } from "node:fs";
+import { existsSync as existsSync79, readFileSync as readFileSync99 } from "node:fs";
 import { resolve as resolve60 } from "node:path";
 function applyNeedsClient(shell) {
   if (shell === void 0 || !SHELL_NAMES2.includes(shell)) return true;
@@ -172966,7 +173553,7 @@ async function runSiteAnalyze(opts) {
       const prevOverlayPath = resolve60(outDir, "provisioning.overlay.json");
       const prevSite = existsSync79(prevOverlayPath) ? (() => {
         try {
-          return JSON.parse(readFileSync98(prevOverlayPath, "utf8")).site;
+          return JSON.parse(readFileSync99(prevOverlayPath, "utf8")).site;
         } catch {
           return void 0;
         }
@@ -172985,7 +173572,7 @@ async function runSiteAnalyze(opts) {
   }
   const previousOverlay = resolve60(outDir, "provisioning.overlay.json");
   carryOverGoals(
-    existsSync79(previousOverlay) ? readFileSync98(previousOverlay, "utf8") : void 0,
+    existsSync79(previousOverlay) ? readFileSync99(previousOverlay, "utf8") : void 0,
     result.provisioningOverlay
   );
   const ownerCall = ownerAuth ? ownerTransportFrom(fetchImpl, ownerAuth) : void 0;
@@ -173043,7 +173630,7 @@ async function runSiteFunctionCli(opts) {
   let source;
   if (opts.sourcePath) {
     const p2 = resolve60(opts.cwd ?? process.cwd(), opts.sourcePath);
-    source = readFileSync98(p2, "utf8");
+    source = readFileSync99(p2, "utf8");
   }
   let body;
   if (opts.bodyRaw != null) {
@@ -173073,7 +173660,7 @@ async function runSiteFunctionCli(opts) {
 function base44BookRoutes(bookPath, siteUrl) {
   if (!existsSync79(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync98(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync99(bookPath, "utf8"));
     if (book.kind !== "base44-app-book" || !Array.isArray(book.routes)) return void 0;
     const host = (u2) => {
       try {
@@ -173213,7 +173800,7 @@ function explainAuthFailure(err) {
   return `${err.status} from the \`wix token\` identity \u2014 your Wix user may not be allowed to provision on this account. Generate an API key with site-provisioning permission at ${API_KEYS_URL}, then export WIX_API_KEY and WIX_ACCOUNT_ID and retry.`;
 }
 var API_BASE2, API_KEYS_URL, TOKEN_RE2, TOKEN_MINT_TIMEOUT_MS2, cached2, DEFAULT_TIMEOUT_MS5;
-var init_wix_account = __esm({
+var init_wix_account2 = __esm({
   "src/wix-account.ts"() {
     init_wix_owner();
     API_BASE2 = "https://www.wixapis.com";
@@ -173328,7 +173915,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync80, readFileSync as readFileSync99, writeFileSync as writeFileSync37 } from "node:fs";
+import { existsSync as existsSync80, readFileSync as readFileSync100, writeFileSync as writeFileSync37 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -173477,7 +174064,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync80, readFileSync: readFileSync99, writeFileSync: writeFileSync37 }) {
+function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync80, readFileSync: readFileSync100, writeFileSync: writeFileSync37 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -173561,7 +174148,7 @@ var init_site_create = __esm({
   "src/site-create.ts"() {
     init_shell_quote();
     init_wix_owner();
-    init_wix_account();
+    init_wix_account2();
     init_wix_verticals();
     init_apply2();
     init_types2();
@@ -174174,11 +174761,11 @@ var init_context = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync100, mkdirSync as mkdirSync41, writeFileSync as writeFileSync38, existsSync as existsSync81, rmSync as rmSync22, readdirSync as readdirSync35, statSync as statSync23, lstatSync as lstatSync21, accessSync, constants as constants4, renameSync as renameSync12, cpSync as cpSync3 } from "node:fs";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync101, mkdirSync as mkdirSync41, writeFileSync as writeFileSync38, existsSync as existsSync81, rmSync as rmSync22, readdirSync as readdirSync35, statSync as statSync23, lstatSync as lstatSync21, accessSync, constants as constants4, renameSync as renameSync12, cpSync as cpSync3 } from "node:fs";
 import { execFile as execFile2, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-import { createHash as createHash41, randomUUID as randomUUID11 } from "node:crypto";
-import { tmpdir as tmpdir6, homedir as homedir12, hostname as hostname2 } from "node:os";
+import { createHash as createHash42, randomUUID as randomUUID11 } from "node:crypto";
+import { tmpdir as tmpdir6, homedir as homedir14, hostname as hostname2 } from "node:os";
 import { join as join84, resolve as resolve61, relative as relative15, basename as basename19, dirname as dirname45 } from "node:path";
 import { fileURLToPath as fileURLToPath29 } from "node:url";
 
@@ -176253,7 +176840,7 @@ var num3 = (v2) => typeof v2 === "string" && v2 !== "" && Number.isFinite(Number
 function embeddedTemplateCatalog() {
   return availableTemplates().map((name) => {
     const path2 = join84(templateSourceDir(name), TEMPLATE_META_FILE);
-    const meta = JSON.parse(readFileSync100(path2, "utf8"));
+    const meta = JSON.parse(readFileSync101(path2, "utf8"));
     if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
       throw new Error(`${path2} must be { title: string, description: string, tags: string[], category?: string }`);
     }
@@ -177131,7 +177718,7 @@ var COMMANDS2 = [
 ];
 function cliVersion() {
   try {
-    return JSON.parse(readFileSync100(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
+    return JSON.parse(readFileSync101(new URL("../package.json", import.meta.url), "utf8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
@@ -177169,7 +177756,7 @@ function createScopedRegistryResolver(exec = execNpmConfig) {
       const configured = async (key2) => {
         const timeout = deadline - Date.now();
         if (timeout <= 0) throw new Error("npm config: out of budget");
-        const raw = String(await exec("npm", ["config", "get", key2], { cwd: homedir12(), timeout })).trim();
+        const raw = String(await exec("npm", ["config", "get", key2], { cwd: homedir14(), timeout })).trim();
         return raw && raw !== "undefined" ? raw : void 0;
       };
       const effective = normalizeRegistry(await configured("@wix:registry") ?? await configured("registry"));
@@ -177256,7 +177843,7 @@ function ageInDays(publishedAt, now = Date.now()) {
 }
 function packageVersion(path2) {
   try {
-    const version4 = JSON.parse(readFileSync100(path2, "utf8")).version;
+    const version4 = JSON.parse(readFileSync101(path2, "utf8")).version;
     return typeof version4 === "string" && version4 ? version4 : void 0;
   } catch {
     return void 0;
@@ -177322,11 +177909,11 @@ var UPDATE_RETRY_AFTER_FAILURE_MS = 60 * 60 * 1e3;
 var UPDATE_SNOOZE_MS = 24 * 60 * 60 * 1e3;
 var UPDATE_REEXEC_ENV = "HIMI_UPDATED_ONCE";
 function updateCachePath(env = process.env) {
-  return env.HIMI_UPDATE_CACHE_FILE ?? join84(homedir12(), ".himalaya", "update-check.json");
+  return env.HIMI_UPDATE_CACHE_FILE ?? join84(homedir14(), ".himalaya", "update-check.json");
 }
 function readUpdateCache(path2) {
   try {
-    const parsed = JSON.parse(readFileSync100(path2, "utf8"));
+    const parsed = JSON.parse(readFileSync101(path2, "utf8"));
     return parsed && typeof parsed === "object" ? parsed : {};
   } catch {
     return {};
@@ -177388,7 +177975,7 @@ function createUpdateRunner(spawn8 = spawnSync5) {
         // parse — the agent case this whole feature exists for (#2985 review). And no stdin: an
         // install needs none, and must not consume input piped to the command we are about to re-run.
         stdio: ["ignore", 2, 2],
-        cwd: homedir12()
+        cwd: homedir14()
       });
       if (result.error) return { ok: false, detail: result.error.message };
       return result.status === 0 ? { ok: true } : { ok: false, detail: `npm exited ${result.status}` };
@@ -177447,7 +178034,7 @@ function staleUpdateLockFile(cachePath, now) {
   for (const path2 of [`${cachePath}.lock.break`, `${cachePath}.lock`]) {
     let content;
     try {
-      content = readFileSync100(path2, "utf8");
+      content = readFileSync101(path2, "utf8");
     } catch {
       continue;
     }
@@ -177470,7 +178057,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   const mine = lockStamp(now);
   const readLock = (path2) => {
     try {
-      return readFileSync100(path2, "utf8");
+      return readFileSync101(path2, "utf8");
     } catch {
       return void 0;
     }
@@ -177561,7 +178148,7 @@ function createUpdateRefreshSpawner(spawnFn = spawn7, execArgv = process.execArg
       const child = spawnFn(process.execPath, [...loaderArgs(execArgv), fileURLToPath29(import.meta.url), UPDATE_REFRESH_COMMAND], {
         detached: true,
         stdio: "ignore",
-        cwd: homedir12(),
+        cwd: homedir14(),
         env: process.env
       });
       child.on("error", () => {
@@ -178171,7 +178758,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths2(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync81(iosYmlPath) ? readFileSync100(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync81(iosYmlPath) ? readFileSync101(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -178185,7 +178772,7 @@ async function nativeConfigAdvisories(app, configSource) {
 }
 function readConfigSource(dir) {
   try {
-    return readFileSync100(join84(dir, "config.ts"), "utf8");
+    return readFileSync101(join84(dir, "config.ts"), "utf8");
   } catch {
     return null;
   }
@@ -178393,8 +178980,8 @@ function materializeForPreview(appDir3, slug, displayName2) {
 }
 async function appId(dir) {
   try {
-    const { readFileSync: readFileSync101 } = await import("node:fs");
-    const m2 = JSON.parse(readFileSync101(join84(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync102 } = await import("node:fs");
+    const m2 = JSON.parse(readFileSync102(join84(dir, "himalaya.content.json"), "utf8"));
     if (m2.name) return m2.name;
   } catch {
   }
@@ -178402,8 +178989,8 @@ async function appId(dir) {
 }
 async function contentVisibility(dir) {
   try {
-    const { readFileSync: readFileSync101 } = await import("node:fs");
-    const m2 = JSON.parse(readFileSync101(join84(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync102 } = await import("node:fs");
+    const m2 = JSON.parse(readFileSync102(join84(dir, "himalaya.content.json"), "utf8"));
     if (m2.visibility === "public" || m2.visibility === "unlisted") return m2.visibility;
   } catch {
   }
@@ -178897,7 +179484,7 @@ async function producedWidgetFamilies(dir) {
     let js2;
     for (const candidate of [`${name}.bundle.js`, `${name}.js`, name]) {
       try {
-        js2 = readFileSync100(join84(outDir, candidate), "utf8");
+        js2 = readFileSync101(join84(outDir, candidate), "utf8");
         break;
       } catch {
       }
@@ -179467,13 +180054,13 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
               if (adding) {
                 const from = str9(flags.from);
                 if (!from) throw new TrimRefusal2('--add <id> needs --from <file> holding the whole new SCREENS entry (`  "<id>": { "screenId": "<id>", \u2026 },`)');
-                print(adopt.addScreen(dir, adding, readFileSync100(from, "utf8"), { parent: str9(flags.parent), tab: str9(flags.tab), displayName: str9(flags["display-name"]) }));
+                print(adopt.addScreen(dir, adding, readFileSync101(from, "utf8"), { parent: str9(flags.parent), tab: str9(flags.tab), displayName: str9(flags["display-name"]) }));
                 return 0;
               }
               if (target) {
                 const from = str9(flags.from);
                 if (!from) throw new TrimRefusal2("--write <id> needs --from <file> holding the whole entry, as --show prints it");
-                print(adopt.replaceScreen(dir, target, readFileSync100(from, "utf8")));
+                print(adopt.replaceScreen(dir, target, readFileSync101(from, "utf8")));
                 return 0;
               }
               if (show) {
@@ -179625,7 +180212,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
             const sourceDir = resolve61(str9(flags["source-dir"]) ?? appDir3);
             let meta;
             try {
-              meta = JSON.parse(readFileSync100(join84(sourceDir, TEMPLATE_META_FILE), "utf8"));
+              meta = JSON.parse(readFileSync101(join84(sourceDir, TEMPLATE_META_FILE), "utf8"));
             } catch {
               io2.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
               return 2;
@@ -179635,7 +180222,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
               return 2;
             }
             try {
-              const appearance = extractTemplateAppearance(JSON.parse(readFileSync100(join84(sourceDir, "tokens.json"), "utf8")));
+              const appearance = extractTemplateAppearance(JSON.parse(readFileSync101(join84(sourceDir, "tokens.json"), "utf8")));
               meta = { ...appearance, ...meta };
             } catch {
             }
@@ -179714,9 +180301,9 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
             let iconHash;
             if (iconPath) {
               try {
-                const bytes2 = readFileSync100(iconPath);
+                const bytes2 = readFileSync101(iconPath);
                 payload.icon = bytes2.toString("base64");
-                iconHash = createHash41("sha256").update(bytes2).digest("hex");
+                iconHash = createHash42("sha256").update(bytes2).digest("hex");
               } catch {
               }
             }
@@ -179927,16 +180514,16 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
           return 2;
         }
         const { readdirSync: readdirSync36, existsSync: fileExists } = await import("node:fs");
-        const { join: pathJoin } = await import("node:path");
+        const { join: pathJoin3 } = await import("node:path");
         const targets = [];
-        const t5 = pathJoin(dir, "tier5-src");
+        const t5 = pathJoin3(dir, "tier5-src");
         if (fileExists(t5)) {
           for (const d2 of readdirSync36(t5, { withFileTypes: true })) {
-            if (d2.isDirectory()) targets.push(pathJoin(t5, d2.name, "index.ts"));
+            if (d2.isDirectory()) targets.push(pathJoin3(t5, d2.name, "index.ts"));
           }
         }
         for (const f2 of ["dev/index.ts", "dev/index.tsx"]) {
-          const c2 = pathJoin(dir, f2);
+          const c2 = pathJoin3(dir, f2);
           if (fileExists(c2)) targets.push(c2);
         }
         const res = ejectModule2({
@@ -180018,7 +180605,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
           const path2 = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync100(path2, "utf8");
+            raw = readFileSync101(path2, "utf8");
           } catch {
             throw new Error(`no DPX BO session at ${path2}; run dpx auth login, write dpx auth token to that path, then himi login --dpx --target bo`);
           }
@@ -180875,7 +181462,7 @@ ${[...afterRun.next, ...testReminder ? [testReminder] : []].join("\n")}`);
             return 2;
           }
           try {
-            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync100(stateArg.replace(/^@/, ""), "utf8");
+            const raw = stateArg.trim().startsWith("{") ? stateArg : readFileSync101(stateArg.replace(/^@/, ""), "utf8");
             injectedState = JSON.parse(raw);
           } catch (e2) {
             io2.error(JSON.stringify({ error: `--state must be inline JSON or a path to a .json file \u2014 ${e2.message}` }));
@@ -180890,7 +181477,7 @@ ${[...afterRun.next, ...testReminder ? [testReminder] : []].join("\n")}`);
             return 2;
           }
           try {
-            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync100(inputArg.replace(/^@/, ""), "utf8");
+            const raw = inputArg.trim().startsWith("{") ? inputArg : readFileSync101(inputArg.replace(/^@/, ""), "utf8");
             const parsed = JSON.parse(raw);
             if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error("must be a JSON object");
             injectedInput = parsed;
@@ -181575,7 +182162,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let localSourceHash;
           try {
             const { collectAppSource: collectAppSource2, zipAppSource: zipAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
-            localSourceHash = createHash41("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
+            localSourceHash = createHash42("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
           } catch {
           }
           return runReleasePatch({
@@ -182259,7 +182846,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             }));
             return 1;
           }
-          const archive = readFileSync100(resolve61(file2));
+          const archive = readFileSync101(resolve61(file2));
           const result = await client2().createPackageShare({
             app: opened.header.app,
             releaseId: opened.header.releaseId,
@@ -182465,7 +183052,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             if (watchKit && bus) {
               const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
               const live3 = join84(running.releaseRoot, running.app);
-              const manifestOf = (tree) => JSON.parse(readFileSync100(join84(tree, "release-manifest.json"), "utf8"));
+              const manifestOf = (tree) => JSON.parse(readFileSync101(join84(tree, "release-manifest.json"), "utf8"));
               let current = manifestOf(live3);
               const failed3 = async (message) => {
                 if (stopping) return;
@@ -183185,7 +183772,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           lintNote: "`himi patch` sends a raw file. Nothing here built or linted your app \u2014 `himi push --only <selector>` is the same edit with the full lint gate in front of it."
         };
         if (kind === "tokens" || kind === "app-config") {
-          const body = readFileSync100(file2, "utf8");
+          const body = readFileSync101(file2, "utf8");
           const patch2 = kind === "tokens" ? { tokens: body } : { appConfig: body };
           return runReleasePatch({
             ...common,
@@ -183200,7 +183787,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             io2.error(JSON.stringify({ error: "patch screen needs a <screenId>", usage: PATCH_USAGE }));
             return 2;
           }
-          const descriptor = readFileSync100(file2, "utf8");
+          const descriptor = readFileSync101(file2, "utf8");
           try {
             JSON.parse(descriptor);
           } catch (e2) {
@@ -183240,8 +183827,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             extra: { kind, screen: id, file: { path: file2, bytes: Buffer.byteLength(descriptor, "utf8") } }
           });
         }
-        const bytes2 = readFileSync100(file2);
-        const sha2 = createHash41("sha256").update(bytes2).digest("hex");
+        const bytes2 = readFileSync101(file2);
+        const sha2 = createHash42("sha256").update(bytes2).digest("hex");
         const forScreens = (str9(flags["for-screen"]) ?? "").split(",").map((s2) => s2.trim()).filter(Boolean);
         if (flags["no-rebind"] !== void 0 && flags["no-rebind"] !== true) {
           io2.error(JSON.stringify({ ok: false, error: "no_rebind_takes_no_value", message: "--no-rebind is a switch and takes no value; pass it bare.", usage: PATCH_USAGE }));
@@ -183384,7 +183971,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           }
           let def;
           try {
-            const parsed = JSON.parse(arg.startsWith("@") ? readFileSync100(arg.slice(1), "utf8") : arg);
+            const parsed = JSON.parse(arg.startsWith("@") ? readFileSync101(arg.slice(1), "utf8") : arg);
             if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
               io2.error(JSON.stringify({ error: "invalid_definition", problems: [`--definition must be a JSON object, got ${Array.isArray(parsed) ? "an array" : parsed === null ? "null" : typeof parsed}`] }));
               return 2;
@@ -184246,7 +184833,7 @@ ${label2}`);
           const dpxPath = dpxSessionTokenPath();
           let dpx;
           try {
-            dpx = readFileSync100(dpxPath, "utf8").trim();
+            dpx = readFileSync101(dpxPath, "utf8").trim();
           } catch {
             io2.error(JSON.stringify({ error: `no dpx session at ${dpxPath} \u2014 run \`dpx auth login\` then \`dpx auth token > ${dpxPath}\` (dpx 2.x keeps its own state in ~/.dpx/auth.json and does NOT write the legacy session file), or omit --dpx` }));
             return 1;
@@ -184709,7 +185296,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
           const path2 = dpxSessionTokenPath();
           let raw;
           try {
-            raw = readFileSync100(path2, "utf8");
+            raw = readFileSync101(path2, "utf8");
           } catch {
             io2.error(JSON.stringify({ error: `no DPX BO session at ${path2}` }));
             return 1;