@wix/himalaya-cli 0.1454.0 → 0.1455.0

package/dist/cli.mjs

@@ -4346,8 +4346,8 @@ function committedProvisioningPath(name) {
 function committedShellFor(path2) {
   const normalized = path2.replace(/\\/g, "/");
   return SHELL_NAMES2.find((name) => {
-    const relative17 = committedProvisioningPath(name);
-    return normalized === relative17 || normalized.endsWith(`/${relative17}`);
+    const relative18 = committedProvisioningPath(name);
+    return normalized === relative18 || normalized.endsWith(`/${relative18}`);
   });
 }
 function isBrandable(repoRoot2, name) {
@@ -7070,9 +7070,9 @@ function compileV2(html, profile, options) {
       if (!row) error(el2, "HHP-BINDING-SCOPE", "Item bindings require a keyed list template.");
       return raw;
     }
-    const relative17 = statePath(raw);
-    if (!info4?.paths.has(relative17)) error(el2, "HHP-BINDING-PATH", `Unknown controller state path ${relative17}.`);
-    return `$service:${serviceName}.${relative17}`;
+    const relative18 = statePath(raw);
+    if (!info4?.paths.has(relative18)) error(el2, "HHP-BINDING-PATH", `Unknown controller state path ${relative18}.`);
+    return `$service:${serviceName}.${relative18}`;
   }
   const read = (value, dotted) => dotted.split(".").reduce((current, key3) => current && typeof current === "object" && Object.hasOwn(current, key3) ? current[key3] : void 0, value);
   function rowValues(row, raw) {
@@ -8115,7 +8115,6 @@ function resolveTranslation(value, catalog3, sourceCatalog) {
 var BINDING_SIGILS, BINDING_SIGIL_RE, TRANSLATION_PREFIX, TRANSLATION_KEY_RE;
 var init_bindings = __esm({
   "../../core/ts/src/bindings.ts"() {
-    "use strict";
     BINDING_SIGILS = ["service", "flag", "item", "t"];
     BINDING_SIGIL_RE = new RegExp(
       `^\\$(?:${BINDING_SIGILS.filter((s2) => s2 !== "t").join("|")})\\b|^\\$t:`
@@ -14624,6 +14623,277 @@ var init_loader = __esm({
   }
 });
 
+// ../app-icons/pixels.ts
+var pixels_exports = {};
+__export(pixels_exports, {
+  LETTERBOX_ERROR_FRACTION: () => LETTERBOX_ERROR_FRACTION,
+  LETTERBOX_WARN_FRACTION: () => LETTERBOX_WARN_FRACTION,
+  NORMALIZE_FIT_FRACTION: () => NORMALIZE_FIT_FRACTION,
+  PIXEL_TOOLCHAIN_HINT: () => PIXEL_TOOLCHAIN_HINT,
+  PixelToolchainUnavailable: () => PixelToolchainUnavailable,
+  SVG_RASTER_MAX_EDGE: () => SVG_RASTER_MAX_EDGE,
+  appStoreIconPixelFindings: () => appStoreIconPixelFindings,
+  derivePlayListingIcon: () => derivePlayListingIcon,
+  inspectIconPixels: () => inspectIconPixels,
+  normalizeSourceIcon: () => normalizeSourceIcon,
+  pixelToolchainAvailable: () => pixelToolchainAvailable,
+  pixelToolchainProblem: () => pixelToolchainProblem,
+  rasterizeSvg: () => rasterizeSvg,
+  renderGlyphTile: () => renderGlyphTile
+});
+function isNotInstalled(e2) {
+  const code = e2?.code;
+  return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
+}
+function messageOf(e2) {
+  return e2 instanceof Error ? e2.message : String(e2);
+}
+async function loadSharp() {
+  if (cachedSharp) return cachedSharp;
+  const failures = [];
+  let presentButBroken = false;
+  try {
+    const { createRequire: createRequire4 } = await import("node:module");
+    cachedSharp = createRequire4(import.meta.url)("sharp");
+    lastProblem = null;
+    return cachedSharp;
+  } catch (e2) {
+    presentButBroken ||= !isNotInstalled(e2);
+    failures.push(`require: ${messageOf(e2)}`);
+  }
+  try {
+    cachedSharp = (await import("sharp")).default;
+    lastProblem = null;
+    return cachedSharp;
+  } catch (e2) {
+    presentButBroken ||= !isNotInstalled(e2);
+    failures.push(`import: ${messageOf(e2)}`);
+  }
+  lastProblem = presentButBroken ? `the image toolchain (sharp) is installed but could not be loaded \u2014 ${failures.join("; ")}` : PIXEL_TOOLCHAIN_HINT;
+  return null;
+}
+async function pixelToolchainAvailable() {
+  return await loadSharp() !== null;
+}
+async function pixelToolchainProblem() {
+  return await loadSharp() === null ? lastProblem ?? PIXEL_TOOLCHAIN_HINT : null;
+}
+async function sharpOrThrow() {
+  const s2 = await loadSharp();
+  if (!s2) throw new PixelToolchainUnavailable(lastProblem ?? PIXEL_TOOLCHAIN_HINT);
+  return s2;
+}
+async function inspectIconPixels(png) {
+  const sharp = await sharpOrThrow();
+  const { data, info: info4 } = await sharp(png).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+  const { width, height, channels: channels3 } = info4;
+  if (channels3 !== 4) throw new Error(`app-icons: expected RGBA after ensureAlpha, got ${channels3} channels`);
+  let minAlpha = 255;
+  let transparent = 0;
+  for (let i2 = 3; i2 < data.length; i2 += 4) {
+    const a2 = data[i2];
+    if (a2 < minAlpha) minAlpha = a2;
+    if (a2 <= ALPHA_OPAQUE) transparent++;
+  }
+  const probe = Math.max(1, Math.round(Math.min(width, height) * CORNER_PROBE));
+  let minCornerAlpha = 255;
+  for (const [x0, y0] of [
+    [0, 0],
+    [width - probe, 0],
+    [0, height - probe],
+    [width - probe, height - probe]
+  ]) {
+    for (let y2 = y0; y2 < y0 + probe; y2++) {
+      for (let x2 = x0; x2 < x0 + probe; x2++) {
+        const a2 = data[(y2 * width + x2) * 4 + 3];
+        if (a2 < minCornerAlpha) minCornerAlpha = a2;
+      }
+    }
+  }
+  const inset = Math.round(Math.min(width, height) * INTERIOR_INSET);
+  let interiorMinAlpha = 255;
+  for (let y2 = inset; y2 < height - inset; y2++) {
+    for (let x2 = inset; x2 < width - inset; x2++) {
+      const a2 = data[(y2 * width + x2) * 4 + 3];
+      if (a2 < interiorMinAlpha) interiorMinAlpha = a2;
+    }
+  }
+  return {
+    width,
+    height,
+    minAlpha,
+    transparentFraction: transparent / (width * height),
+    minCornerAlpha,
+    interiorMinAlpha,
+    // `minAlpha <= ALPHA_OPAQUE` IS "has transparency", and the caller has just computed
+    // it — contentBox used to re-derive it with a full extra sweep of the raster.
+    contentBox: contentBox(data, width, height, minAlpha <= ALPHA_OPAQUE)
+  };
+}
+function contentBox(data, width, height, hasTransparency) {
+  const at2 = (x2, y2) => (y2 * width + x2) * 4;
+  const bg = [data[at2(0, 0)], data[at2(0, 0) + 1], data[at2(0, 0) + 2]];
+  const isInk = (x2, y2) => {
+    const i2 = at2(x2, y2);
+    if (hasTransparency) return data[i2 + 3] > ALPHA_OPAQUE;
+    return Math.abs(data[i2] - bg[0]) > INK_TOLERANCE || Math.abs(data[i2 + 1] - bg[1]) > INK_TOLERANCE || Math.abs(data[i2 + 2] - bg[2]) > INK_TOLERANCE;
+  };
+  let minX = width, minY = height, maxX = -1, maxY = -1;
+  for (let y2 = 0; y2 < height; y2++) {
+    for (let x2 = 0; x2 < width; x2++) {
+      if (!isInk(x2, y2)) continue;
+      if (x2 < minX) minX = x2;
+      if (x2 > maxX) maxX = x2;
+      if (y2 < minY) minY = y2;
+      if (y2 > maxY) maxY = y2;
+    }
+  }
+  if (maxX < 0) return null;
+  return {
+    widthFraction: (maxX - minX + 1) / width,
+    heightFraction: (maxY - minY + 1) / height
+  };
+}
+function appStoreIconPixelFindings(f2) {
+  const out2 = [];
+  const preMasked = f2.interiorMinAlpha > ALPHA_OPAQUE && f2.minCornerAlpha <= ALPHA_OPAQUE && f2.transparentFraction <= PRE_MASK_MAX_TRANSPARENT_FRACTION;
+  if (preMasked) {
+    out2.push({
+      level: "error",
+      message: "App icon looks pre-masked: its corners are transparent while the middle is opaque. iOS and Play both apply their own corner mask, so rounded artwork is rounded twice and looks visibly wrong on device \u2014 and the transparency itself is an App Store rejection (ITMS-90717 / ITMS-90647). Ship a full-bleed square with 90-degree corners and no inset."
+    });
+  } else if (f2.minAlpha <= ALPHA_OPAQUE) {
+    out2.push({
+      level: "error",
+      message: `App icon has transparent pixels (${(f2.transparentFraction * 100).toFixed(1)}% of the canvas, lowest alpha ${f2.minAlpha}). An App Store icon may carry an alpha channel but no transparent regions \u2014 Apple rejects this as ITMS-90717 / ITMS-90647. Flatten it onto an opaque background (\`himi icon set <file>\` does this for you).`
+    });
+  }
+  if (f2.contentBox === null) {
+    out2.push({
+      level: "error",
+      message: "App icon is a single flat colour with no distinguishable artwork \u2014 the mark is not visible in it. Supply art that contrasts with the background, or use `himi icon generate` for a glyph tile."
+    });
+    return out2;
+  }
+  const shorter = Math.min(f2.contentBox.widthFraction, f2.contentBox.heightFraction);
+  if (shorter < LETTERBOX_ERROR_FRACTION) {
+    out2.push({
+      level: "error",
+      message: `App icon artwork fills only ${(shorter * 100).toFixed(0)}% of the canvas on its shorter side, so it reads as a speck on a home screen. This is what a wide wordmark centred in a square looks like \u2014 crop to the mark, or use a monogram/glyph instead of the wordmark.`
+    });
+  } else if (shorter < LETTERBOX_WARN_FRACTION) {
+    out2.push({
+      level: "warn",
+      message: `App icon artwork fills ${(shorter * 100).toFixed(0)}% of the canvas on its shorter side \u2014 it will read as a thin strip at home-screen size. Consider cropping to the mark.`
+    });
+  }
+  return out2;
+}
+function luminance([r2, g2, b2]) {
+  const lin = [r2, g2, b2].map((v2) => {
+    const c2 = v2 / 255;
+    return c2 <= 0.04045 ? c2 / 12.92 : ((c2 + 0.055) / 1.055) ** 2.4;
+  });
+  return 0.2126 * lin[0] + 0.7152 * lin[1] + 0.0722 * lin[2];
+}
+function contrastRatio(a2, b2) {
+  const [hi2, lo2] = [luminance(a2), luminance(b2)].sort((x2, y2) => y2 - x2);
+  return (hi2 + 0.05) / (lo2 + 0.05);
+}
+async function contrastingBackdrop(mark, requested) {
+  const sharp = await sharpOrThrow();
+  const { dominant } = await sharp(mark).stats();
+  const ink = [dominant.r, dominant.g, dominant.b];
+  const want = hexToRgb(requested);
+  if (!want || contrastRatio(ink, want) >= MIN_BACKDROP_CONTRAST) return requested;
+  const towardsWhite = luminance(ink) < 0.5;
+  for (const amount of [0.35, 0.55, 0.75, 0.9]) {
+    const candidate = mix(want, towardsWhite ? [255, 255, 255] : [0, 0, 0], amount);
+    if (contrastRatio(ink, candidate) >= MIN_BACKDROP_CONTRAST) return rgbToHex(candidate);
+  }
+  return towardsWhite ? "#FFFFFF" : "#000000";
+}
+function hexToRgb(hex2) {
+  const m2 = /^#([0-9a-fA-F]{6})$/.exec(hex2);
+  if (!m2) return null;
+  const n2 = parseInt(m2[1], 16);
+  return [n2 >> 16 & 255, n2 >> 8 & 255, n2 & 255];
+}
+function mix(a2, b2, t2) {
+  return [0, 1, 2].map((i2) => Math.round(a2[i2] + (b2[i2] - a2[i2]) * t2));
+}
+function rgbToHex([r2, g2, b2]) {
+  return `#${[r2, g2, b2].map((v2) => v2.toString(16).padStart(2, "0")).join("")}`.toUpperCase();
+}
+async function normalizeSourceIcon(input, opts) {
+  const sharp = await sharpOrThrow();
+  const size = opts.size ?? 1024;
+  const fit2 = opts.fit ?? NORMALIZE_FIT_FRACTION;
+  const inner = Math.max(1, Math.round(size * fit2));
+  const pad3 = Math.round((size - inner) / 2);
+  let trimmed;
+  try {
+    trimmed = await sharp(input).ensureAlpha().trim().png().toBuffer();
+  } catch {
+    trimmed = await sharp(input).ensureAlpha().png().toBuffer();
+  }
+  const mark = await sharp(trimmed).resize(inner, inner, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } }).png().toBuffer();
+  const background = await contrastingBackdrop(mark, opts.background);
+  return sharp({
+    create: {
+      width: size,
+      height: size,
+      channels: 4,
+      background: { r: 0, g: 0, b: 0, alpha: 0 }
+    }
+  }).composite([{ input: mark, top: pad3, left: pad3 }]).flatten({ background }).removeAlpha().png({ palette: false }).toBuffer();
+}
+async function derivePlayListingIcon(master, size = 512) {
+  const sharp = await sharpOrThrow();
+  return sharp(master).resize(size, size).ensureAlpha().png({ palette: false }).toBuffer();
+}
+async function renderGlyphTile(svg, background, size = 1024) {
+  const sharp = await sharpOrThrow();
+  return sharp(Buffer.from(svg)).resize(size, size).flatten({ background }).removeAlpha().png({ palette: false }).toBuffer();
+}
+async function rasterizeSvg(svg, scale = 3) {
+  const sharp = await loadSharp();
+  if (!sharp) return null;
+  const { width = 0, height = 0 } = await sharp(svg, { limitInputPixels: false }).metadata();
+  const edge = Math.max(width, height);
+  const density = edge > 0 ? Math.max(1, Math.min(72 * scale, 72 * SVG_RASTER_MAX_EDGE / edge)) : 72 * scale;
+  const decoded = width * density / 72 * (height * density / 72);
+  if (decoded > SHARP_INPUT_PIXEL_LIMIT) {
+    throw new Error(`SVG is too large to rasterize: ${width}x${height} intrinsic size; give it a width/height (or viewBox) under ${Math.floor(72 * Math.sqrt(SHARP_INPUT_PIXEL_LIMIT))}px per side`);
+  }
+  return sharp(svg, { density }).resize({ width: SVG_RASTER_MAX_EDGE, height: SVG_RASTER_MAX_EDGE, fit: "inside", withoutEnlargement: true }).png().toBuffer();
+}
+var cachedSharp, lastProblem, PIXEL_TOOLCHAIN_HINT, PixelToolchainUnavailable, ALPHA_OPAQUE, CORNER_PROBE, INTERIOR_INSET, INK_TOLERANCE, PRE_MASK_MAX_TRANSPARENT_FRACTION, LETTERBOX_WARN_FRACTION, LETTERBOX_ERROR_FRACTION, NORMALIZE_FIT_FRACTION, MIN_BACKDROP_CONTRAST, SVG_RASTER_MAX_EDGE, SHARP_INPUT_PIXEL_LIMIT;
+var init_pixels = __esm({
+  "../app-icons/pixels.ts"() {
+    cachedSharp = null;
+    lastProblem = null;
+    PIXEL_TOOLCHAIN_HINT = "the image toolchain (sharp) is not installed \u2014 run `npm i -g sharp` to enable transparency, pre-masked-corner and letterbox checks";
+    PixelToolchainUnavailable = class extends Error {
+      constructor(reason = PIXEL_TOOLCHAIN_HINT) {
+        super(`app-icons: ${reason}`);
+        this.name = "PixelToolchainUnavailable";
+      }
+    };
+    ALPHA_OPAQUE = 250;
+    CORNER_PROBE = 0.06;
+    INTERIOR_INSET = 0.2;
+    INK_TOLERANCE = 24;
+    PRE_MASK_MAX_TRANSPARENT_FRACTION = 0.1;
+    LETTERBOX_WARN_FRACTION = 0.35;
+    LETTERBOX_ERROR_FRACTION = 0.2;
+    NORMALIZE_FIT_FRACTION = 0.82;
+    MIN_BACKDROP_CONTRAST = 1.5;
+    SVG_RASTER_MAX_EDGE = 2048;
+    SHARP_INPUT_PIXEL_LIMIT = 16383 * 16383;
+  }
+});
+
 // ../../apps/himi-player/player-host-manifest.ts
 var PLAYER_HOST_MANIFEST;
 var init_player_host_manifest = __esm({
@@ -15011,8 +15281,8 @@ var init_hhp_command = __esm({
 
 // src/hhp.ts
 import { existsSync as existsSync15, readFileSync as readFileSync16, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7, renameSync, rmSync as rmSync4, lstatSync as lstatSync5, readdirSync as readdirSync12 } from "node:fs";
-import { dirname as dirname11, resolve as resolve17, relative as relative3, sep as sep6, join as join15 } from "node:path";
-import { randomUUID } from "node:crypto";
+import { basename as basename7, dirname as dirname11, resolve as resolve17, relative as relative3, sep as sep6, join as join15 } from "node:path";
+import { createHash as createHash8, randomUUID } from "node:crypto";
 import ts3 from "typescript";
 function localPath(root, path2, from = join15(root, "hhp.json")) {
   if (/^[a-z]+:|^\/\//i.test(path2)) throw new Error("HHP source dependencies must be local files.");
@@ -15082,7 +15352,7 @@ export function withHhpScreens<T extends { screens: { exact: Record<string, any>
   for (const id of Object.keys(descriptors)) if (Object.hasOwn(app.screens.exact, id)) throw new Error("HHP screen conflicts with authored screen: " + id);
   const exact = Object.fromEntries(Object.entries(descriptors).map(([id, descriptor]) => [id, (ctx: { serverBaseUrl: string; bundleIntegrity(name: string): string | null; asset(name: string): {url:string} | null }) => {
     const result = structuredClone(descriptor);
-    const resolveAssets = (value: any, field = ""): any => { if (["url", "imageUrl", "src"].includes(field) && typeof value === "string" && value.startsWith("asset:")) { const asset = ctx.asset(value.slice(6)); if (!asset) throw new Error("Missing HHP asset " + value); return asset.url; } if (Array.isArray(value)) return value.map((child) => resolveAssets(child, field)); if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, resolveAssets(child, key)])); return value; }; result.payload = resolveAssets(result.payload);
+    const resolveAssets = (value: any, field = ""): any => { if (["url", "imageUrl", "src"].includes(field) && typeof value === "string" && value.startsWith("asset:")) { const asset = ctx.asset(value.slice(6)); if (!asset) throw new Error("Missing HHP asset " + value); return asset.url.replace(/^[a-z][a-z0-9+.-]*:\\/\\/[^/?#]*/i, ""); } if (Array.isArray(value)) return value.map((child) => resolveAssets(child, field)); if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, child]) => [key, resolveAssets(child, key)])); return value; }; result.payload = resolveAssets(result.payload);
     if (result.logicBundle) { const name = result.logicBundle.url.split("/").pop()!; const sri = ctx.bundleIntegrity(name); if (!sri) return null; result.logicBundle.url = ctx.serverBaseUrl + result.logicBundle.url; result.logicBundle.integrity = sri; }
     return result;
   }]));
@@ -15097,9 +15367,18 @@ async function compileContentHhp(root, opts = {}) {
   const diagnostics = [], results = [];
   const outputs = /* @__PURE__ */ new Map();
   const assets = collectAssets(root);
+  const svgRefs = /* @__PURE__ */ new Map();
+  const directRasters = /* @__PURE__ */ new Set();
   const assetName = (path2, from) => {
     const hit = path2.startsWith("asset:") ? assets.find((asset) => asset.name === path2.slice(6)) : assets.find((asset) => asset.path === localPath(root, path2, from));
     if (!hit) throw new Error(`Local resource ${path2} must exist in the app's declared assets directory.`);
+    if (/\.svg$/i.test(hit.name) && !hit.name.startsWith(`${RASTER_DIR}/`)) {
+      const ref = svgRefs.get(hit.path) ?? { name: hit.name, raster: rasterName(hit.name, readFileSync16(hit.path)), files: /* @__PURE__ */ new Set() };
+      ref.files.add(from);
+      svgRefs.set(hit.path, ref);
+      return ref.raster;
+    }
+    if (hit.name.startsWith(`${RASTER_DIR}/`)) directRasters.add(hit.path);
     return hit.name;
   };
   const indexPath = localPath(root, "dev/index.ts"), originalIndex = readFileSync16(indexPath, "utf8"), wiredIndex = managedRegistry(originalIndex);
@@ -15146,6 +15425,28 @@ async function compileContentHhp(root, opts = {}) {
     const existing = (await loadContent(root, { fresh: true })).module.screens.exact;
     for (const id of Object.keys(manifest.screens)) if (Object.hasOwn(existing, id)) diagnostics.push({ code: "HHP-REGISTRY-CONFLICT", severity: "error", file: indexPath, line: 1, column: 1, message: `HHP screen ${id} conflicts with an authored screen.` });
   }
+  const rasters = /* @__PURE__ */ new Map();
+  for (const path2 of directRasters) rasters.set(path2, null);
+  const assetsDir = findAssetsDir(root);
+  for (const [path2, ref] of [...svgRefs].sort(([a2], [b2]) => a2.localeCompare(b2))) {
+    let png;
+    try {
+      png = await (opts.rasterizeSvg ?? rasterizeSvg)(readFileSync16(path2));
+    } catch (e2) {
+      for (const file2 of ref.files) diagnostics.push({ code: "HHP-ASSET-SVG", severity: "error", file: file2, line: 1, column: 1, message: `Could not rasterize ${ref.name} (${e2.message.split("\n")[0]}). Fix the SVG, or export it as PNG or WebP.` });
+      continue;
+    }
+    const target2 = assetsDir && join15(assetsDir, ref.raster);
+    if (!png && target2 && existsExact(target2)) {
+      rasters.set(target2, null);
+      continue;
+    }
+    if (!png || !target2) {
+      for (const file2 of ref.files) diagnostics.push({ code: "HHP-ASSET-SVG", severity: "error", file: file2, line: 1, column: 1, message: `${ref.name} is an SVG image, which iOS and Android cannot decode, and the image toolchain (sharp) that converts it to PNG is unavailable. Export it as PNG or WebP, or install sharp (\`npm i -g sharp\`).` });
+      continue;
+    }
+    rasters.set(target2, png);
+  }
   const ok2 = !diagnostics.some((d2) => d2.severity === "error");
   if (!ok2) return { ok: ok2, diagnostics, screens: Object.keys(manifest.screens), outputs: [] };
   outputs.set("dev/hhp/index.ts", registry(results));
@@ -15167,6 +15468,14 @@ async function compileContentHhp(root, opts = {}) {
     const path2 = localPath(root, rel);
     if (existsSync15(path2) && rel.endsWith(".ts") && !readFileSync16(path2, "utf8").startsWith(GENERATED.trim()) && !readFileSync16(path2, "utf8").startsWith("// GENERATED HHP v2 worker.")) throw new Error(`HHP output conflicts with authored file ${rel}.`);
   }
+  for (const [path2, png] of rasters) {
+    if (!png) continue;
+    if (existsExact(path2) && readFileSync16(path2).equals(png)) continue;
+    mkdirSync7(dirname11(path2), { recursive: true });
+    writeFileSync7(`${path2}.tmp`, png);
+    rmSync4(path2, { force: true });
+    renameSync(`${path2}.tmp`, path2);
+  }
   const target = localPath(root, "dev/hhp"), stage = localPath(root, `dev/.hhp-${randomUUID()}`), backup = `${stage}-old`;
   mkdirSync7(stage, { recursive: true });
   try {
@@ -15211,8 +15520,26 @@ async function compileContentHhp(root, opts = {}) {
   } finally {
     rmSync4(stage, { recursive: true, force: true });
   }
+  pruneRasters(root, rasters);
   return result;
 }
+function pruneRasters(root, rasters) {
+  const keep = new Set(rasters.keys());
+  const assetsDir = findAssetsDir(root);
+  const dir = assetsDir && join15(assetsDir, RASTER_DIR);
+  if (!dir || !existsSync15(dir)) return;
+  const walk2 = (abs) => {
+    for (const entry of readdirSync12(abs, { withFileTypes: true })) {
+      const child = join15(abs, entry.name);
+      if (entry.isDirectory()) {
+        walk2(child);
+        if (!readdirSync12(child).length) rmSync4(child, { recursive: true });
+      } else if (entry.isFile() && RASTER_FILE.test(entry.name) && !keep.has(child)) rmSync4(child);
+    }
+  };
+  walk2(dir);
+  if (!readdirSync12(dir).length) rmSync4(dir, { recursive: true });
+}
 async function initHhpScreen(root, id) {
   if (!/^[a-z][a-z0-9_]*$/.test(id)) throw new Error("Use a lowercase screen name with underscores.");
   const manifest = readHhpManifest(root) ?? { version: "hhp/2", screens: {} };
@@ -15270,7 +15597,7 @@ function hhpEditorSettings(source) {
   }
   return JSON.stringify(settings, null, 2) + "\n";
 }
-var GENERATED, BEGIN, END;
+var GENERATED, BEGIN, END, RASTER_DIR, existsExact, rasterName, RASTER_FILE;
 var init_hhp = __esm({
   "src/hhp.ts"() {
     init_catalog();
@@ -15279,9 +15606,14 @@ var init_hhp = __esm({
     init_loader();
     init_preview_surfaces();
     init_app_assets();
+    init_pixels();
     GENERATED = "// GENERATED HHP v2 \u2014 edit screens/, then run himi build.\n";
     BEGIN = "// himi:hhp:begin";
     END = "// himi:hhp:end";
+    RASTER_DIR = "hhp-raster";
+    existsExact = (path2) => existsSync15(path2) && readdirSync12(dirname11(path2)).includes(basename7(path2));
+    rasterName = (svgName, svg) => `${RASTER_DIR}/${svgName.split("/").join("__")}.${createHash8("sha256").update(svg).digest("hex").slice(0, 12)}.png`;
+    RASTER_FILE = /\.svg\.[0-9a-f]{12}\.png$/i;
   }
 });
 
@@ -17842,7 +18174,7 @@ function relativeLuminance(hex2) {
   const lin = [1, 3, 5].map((i2) => parseInt(hex2.slice(i2, i2 + 2), 16) / 255).map((v2) => v2 <= 0.03928 ? v2 / 12.92 : ((v2 + 0.055) / 1.055) ** 2.4);
   return 0.2126 * lin[0] + 0.7152 * lin[1] + 0.0722 * lin[2];
 }
-function contrastRatio(a2, b2) {
+function contrastRatio2(a2, b2) {
   const la2 = relativeLuminance(a2);
   const lb = relativeLuminance(b2);
   return (Math.max(la2, lb) + 0.05) / (Math.min(la2, lb) + 0.05);
@@ -17930,7 +18262,7 @@ function channel2(hex2, offset) {
 function toHex(r2, g2, b2) {
   return `#${[r2, g2, b2].map((value) => Math.round(value).toString(16).padStart(2, "0")).join("")}`.toUpperCase();
 }
-function mix(color, background, colorWeight) {
+function mix2(color, background, colorWeight) {
   const values = [1, 3, 5].map((offset) => channel2(color, offset) * colorWeight + channel2(background, offset) * (1 - colorWeight));
   return toHex(values[0], values[1], values[2]);
 }
@@ -17941,7 +18273,7 @@ function relativeLuminance2(color) {
   });
   return 0.2126 * linear[0] + 0.7152 * linear[1] + 0.0722 * linear[2];
 }
-function contrastRatio2(a2, b2) {
+function contrastRatio3(a2, b2) {
   const la2 = relativeLuminance2(a2);
   const lb = relativeLuminance2(b2);
   return (Math.max(la2, lb) + 0.05) / (Math.min(la2, lb) + 0.05);
@@ -17951,19 +18283,19 @@ function lstar(color) {
   return y2 <= 8856e-6 ? y2 * 903.3 : 116 * Math.cbrt(y2) - 16;
 }
 function deriveAccentSurface(accent, surface, weight) {
-  const tint = mix(accent, surface, weight);
-  if (contrastRatio2(tint, surface) >= ACCENT_SURFACE_MIN_DELTA) return tint;
+  const tint = mix2(accent, surface, weight);
+  if (contrastRatio3(tint, surface) >= ACCENT_SURFACE_MIN_DELTA) return tint;
   const away = relativeLuminance2(surface) < 0.5 ? "#FFFFFF" : "#000000";
   for (let w2 = 0.02; w2 <= 0.5; w2 += 0.02) {
-    const candidate = mix(away, surface, w2);
-    if (contrastRatio2(candidate, surface) >= ACCENT_SURFACE_MIN_DELTA) return candidate;
+    const candidate = mix2(away, surface, w2);
+    if (contrastRatio3(candidate, surface) >= ACCENT_SURFACE_MIN_DELTA) return candidate;
   }
   return tint;
 }
 function deriveSecondaryAccent(primary) {
-  const shade2 = mix(primary, "#000000", SECONDARY_SHADE_WEIGHT);
+  const shade2 = mix2(primary, "#000000", SECONDARY_SHADE_WEIGHT);
   if (lstar(shade2) >= SECONDARY_MIN_LSTAR) return shade2;
-  return mix(primary, "#FFFFFF", SECONDARY_SHADE_WEIGHT);
+  return mix2(primary, "#FFFFFF", SECONDARY_SHADE_WEIGHT);
 }
 function textOn(color) {
   const luminance2 = relativeLuminance2(color);
@@ -17973,42 +18305,42 @@ function textOn(color) {
 }
 function tuneDarkAccent(brand, darkSurface, lightSurface) {
   const kitInherentlyDark = lstar(lightSurface) < 50;
-  if (kitInherentlyDark && contrastRatio2(brand, darkSurface) >= DARK_ARM_TARGET_CONTRAST && lstar(brand) <= DARK_ARM_LSTAR_CAP) {
+  if (kitInherentlyDark && contrastRatio3(brand, darkSurface) >= DARK_ARM_TARGET_CONTRAST && lstar(brand) <= DARK_ARM_LSTAR_CAP) {
     return brand;
   }
   let lift = DARK_ARM_MIN_LIFT;
-  let candidate = mix(brand, "#FFFFFF", 1 - lift);
-  while (contrastRatio2(candidate, darkSurface) < DARK_ARM_TARGET_CONTRAST && lift < 0.6) {
+  let candidate = mix2(brand, "#FFFFFF", 1 - lift);
+  while (contrastRatio3(candidate, darkSurface) < DARK_ARM_TARGET_CONTRAST && lift < 0.6) {
     lift += 0.04;
-    candidate = mix(brand, "#FFFFFF", 1 - lift);
+    candidate = mix2(brand, "#FFFFFF", 1 - lift);
   }
   while (lstar(candidate) > DARK_ARM_LSTAR_CAP) {
-    const darker = mix(candidate, "#000000", 0.94);
-    if (contrastRatio2(darker, darkSurface) < DARK_ARM_FLOOR_CONTRAST) break;
+    const darker = mix2(candidate, "#000000", 0.94);
+    if (contrastRatio3(darker, darkSurface) < DARK_ARM_FLOOR_CONTRAST) break;
     candidate = darker;
   }
   return candidate;
 }
 function textOnArm(accent) {
-  return contrastRatio2("#FFFFFF", accent) >= 4.5 ? "#FFFFFF" : textOn(accent);
+  return contrastRatio3("#FFFFFF", accent) >= 4.5 ? "#FFFFFF" : textOn(accent);
 }
 function tuneHighContrastAccent(brand, surface) {
   const towards = relativeLuminance2(surface) < 0.5 ? "#FFFFFF" : "#000000";
   let candidate = brand;
-  for (let lift = 0; lift <= 0.9 && contrastRatio2(candidate, surface) < HIGH_CONTRAST_TARGET; lift += 0.04) {
-    candidate = mix(brand, towards, 1 - lift);
+  for (let lift = 0; lift <= 0.9 && contrastRatio3(candidate, surface) < HIGH_CONTRAST_TARGET; lift += 0.04) {
+    candidate = mix2(brand, towards, 1 - lift);
   }
   return candidate;
 }
 function deriveAccentText(accent, surfaces) {
   const all = (typeof surfaces === "string" ? [surfaces] : [...surfaces]).map((s2) => s2.slice(0, 7));
   const page = all[0];
-  const worst = (color) => Math.min(...all.map((s2) => contrastRatio2(color, s2)));
-  const opaque = accent.length === 9 ? mix(accent.slice(0, 7), page, channel2(accent, 7) / 255) : accent;
+  const worst = (color) => Math.min(...all.map((s2) => contrastRatio3(color, s2)));
+  const opaque = accent.length === 9 ? mix2(accent.slice(0, 7), page, channel2(accent, 7) / 255) : accent;
   if (worst(opaque) >= ACCENT_TEXT_MIN_CONTRAST) return opaque;
   const pole = worst("#FFFFFF") >= worst("#000000") ? "#FFFFFF" : "#000000";
   for (let step = 1; step <= 100; step++) {
-    const candidate = mix(pole, opaque, step / 100);
+    const candidate = mix2(pole, opaque, step / 100);
     if (worst(candidate) >= ACCENT_TEXT_MIN_CONTRAST) return candidate;
   }
   if (all.length > 1) {
@@ -18352,10 +18684,10 @@ function paintedOver(fg, bg) {
 function sameHueForContrast(fg, bg, target = AA_TEXT) {
   const base = fg.slice(0, 7);
   const opaqueBg = bg.slice(0, 7);
-  const pole = contrastRatio("#000000", opaqueBg) >= contrastRatio("#FFFFFF", opaqueBg) ? "#000000" : "#FFFFFF";
+  const pole = contrastRatio2("#000000", opaqueBg) >= contrastRatio2("#FFFFFF", opaqueBg) ? "#000000" : "#FFFFFF";
   for (let step = 0; step <= 100; step++) {
     const candidate = mixHex(base, pole, 1 - step / 100);
-    if (contrastRatio(candidate, opaqueBg) >= target) return candidate;
+    if (contrastRatio2(candidate, opaqueBg) >= target) return candidate;
   }
   return void 0;
 }
@@ -18377,7 +18709,7 @@ function contrastFindings(colors) {
       const painted2 = paintedOver(fg, bg);
       if (!painted2) continue;
       const opaqueBg = bg.slice(0, 7);
-      const ratio = contrastRatio(painted2, opaqueBg);
+      const ratio = contrastRatio2(painted2, opaqueBg);
       if (ratio >= AA_TEXT) continue;
       const key3 = `${fgName}|${pair.bg}|${fg}|${bg}`;
       const same3 = findings.get(key3);
@@ -18385,10 +18717,10 @@ function contrastFindings(colors) {
         same3.schemes.push(scheme);
         continue;
       }
-      const darker = contrastRatio("#000000", opaqueBg) >= contrastRatio("#FFFFFF", opaqueBg);
+      const darker = contrastRatio2("#000000", opaqueBg) >= contrastRatio2("#FFFFFF", opaqueBg);
       const ink = darker ? "#000000" : "#FFFFFF";
-      const suggestion = pair.suggest === "same-hue" ? sameHueForContrast(painted2, opaqueBg) : pair.suggest === "ink" && contrastRatio(ink, opaqueBg) >= AA_TEXT ? ink : void 0;
-      const fix = !suggestion ? ` Pick a ${fgName} that clears ${AA_TEXT}:1 against ${pair.bg}.` : pair.suggest === "same-hue" ? ` A ${darker ? "darker" : "lighter"} ${fgName} of the same hue that clears it is ${suggestion} (${contrastRatio(suggestion, opaqueBg).toFixed(2)}:1).` : ` ${suggestion} clears it (${contrastRatio(suggestion, opaqueBg).toFixed(2)}:1).`;
+      const suggestion = pair.suggest === "same-hue" ? sameHueForContrast(painted2, opaqueBg) : pair.suggest === "ink" && contrastRatio2(ink, opaqueBg) >= AA_TEXT ? ink : void 0;
+      const fix = !suggestion ? ` Pick a ${fgName} that clears ${AA_TEXT}:1 against ${pair.bg}.` : pair.suggest === "same-hue" ? ` A ${darker ? "darker" : "lighter"} ${fgName} of the same hue that clears it is ${suggestion} (${contrastRatio2(suggestion, opaqueBg).toFixed(2)}:1).` : ` ${suggestion} clears it (${contrastRatio2(suggestion, opaqueBg).toFixed(2)}:1).`;
       findings.set(key3, {
         key: key3,
         schemes: [scheme],
@@ -18405,7 +18737,7 @@ function sameHueClearingAll(fg, bgs, target = AA_TEXT) {
   for (let step = 0; step <= 100; step++) {
     for (const pole of poles) {
       const candidate = mixHex(base, pole, 1 - step / 100);
-      if (bgs.every((bg) => contrastRatio(candidate, bg) >= target)) return candidate;
+      if (bgs.every((bg) => contrastRatio2(candidate, bg) >= target)) return candidate;
     }
   }
   return void 0;
@@ -18432,8 +18764,8 @@ function accentOnSurfacesFor(fgName, role, colors, declared, findings) {
       const page = pageRaw && paintedOver(fg, pageRaw) ? pageRaw.slice(0, 7) : void 0;
       const opaqueBg = bg.slice(0, 7);
       if (page === opaqueBg) continue;
-      if (page && contrastRatio(paintedOver(fg, pageRaw), page) < AA_TEXT) continue;
-      const ratio = contrastRatio(painted2, opaqueBg);
+      if (page && contrastRatio2(paintedOver(fg, pageRaw), page) < AA_TEXT) continue;
+      const ratio = contrastRatio2(painted2, opaqueBg);
       if (ratio >= AA_TEXT) continue;
       const key3 = `${fgName}|${surface}|${fg}|${bg}|${page ?? ""}`;
       const same3 = findings.get(key3);
@@ -18442,9 +18774,9 @@ function accentOnSurfacesFor(fgName, role, colors, declared, findings) {
         continue;
       }
       const opposite = page !== void 0 && onLightSide(page) !== onLightSide(opaqueBg);
-      const noSingle = page !== void 0 && opposite && contrastRatio(page, opaqueBg) < AA_TEXT * AA_TEXT;
+      const noSingle = page !== void 0 && opposite && contrastRatio2(page, opaqueBg) < AA_TEXT * AA_TEXT;
       const suggestion = noSingle ? void 0 : sameHueClearingAll(painted2, page ? [page, opaqueBg] : [opaqueBg]);
-      const measured = (c2) => page ? `${contrastRatio(c2, opaqueBg).toFixed(2)}:1 on ${surface}, ${contrastRatio(c2, page).toFixed(2)}:1 on surfacePrimary` : `${contrastRatio(c2, opaqueBg).toFixed(2)}:1`;
+      const measured = (c2) => page ? `${contrastRatio2(c2, opaqueBg).toFixed(2)}:1 on ${surface}, ${contrastRatio2(c2, page).toFixed(2)}:1 on surfacePrimary` : `${contrastRatio2(c2, opaqueBg).toFixed(2)}:1`;
       const restructure = ` Move ${surface} to the page's side of mid-grey (a ${page && onLightSide(page) ? "light" : "dark"} ${surface} on this page), or scope an explicit accent for that section with \`modifiers.theme\` (e.g. { "colors": { "accentText": "#RRGGBB" } } on the card).`;
       const fix = noSingle ? ` surfacePrimary (${page}) and ${surface} (${opaqueBg}) sit on opposite sides of mid-grey, so no single accent text colour can clear ${AA_TEXT}:1 on both.${restructure}` : suggestion ? ` A same-hue ${fgName} that clears it${page ? " and the page" : ""} is ${suggestion} (${measured(suggestion)}).` + (opposite ? ` The page and ${surface} sit on opposite sides of mid-grey, so only a narrow mid-tone clears both.${restructure}` : "") : ` No ${fgName} of this hue clears ${AA_TEXT}:1 on ${surface}${page ? " and the page" : ""}.` + (opposite ? restructure : "");
       findings.set(key3, {
@@ -18487,7 +18819,7 @@ var init_token_lint = __esm({
       const [ca2, cb] = [channels(a2), channels(b2)];
       return toHex2(ca2.map((c2, i2) => c2 * w2 + cb[i2] * (1 - w2)));
     };
-    onLightSide = (hex2) => contrastRatio("#000000", hex2) >= contrastRatio("#FFFFFF", hex2);
+    onLightSide = (hex2) => contrastRatio2("#000000", hex2) >= contrastRatio2("#FFFFFF", hex2);
   }
 });
 
@@ -19085,261 +19417,6 @@ var init_app_icon = __esm({
   }
 });
 
-// ../app-icons/pixels.ts
-var pixels_exports = {};
-__export(pixels_exports, {
-  LETTERBOX_ERROR_FRACTION: () => LETTERBOX_ERROR_FRACTION,
-  LETTERBOX_WARN_FRACTION: () => LETTERBOX_WARN_FRACTION,
-  NORMALIZE_FIT_FRACTION: () => NORMALIZE_FIT_FRACTION,
-  PIXEL_TOOLCHAIN_HINT: () => PIXEL_TOOLCHAIN_HINT,
-  PixelToolchainUnavailable: () => PixelToolchainUnavailable,
-  appStoreIconPixelFindings: () => appStoreIconPixelFindings,
-  derivePlayListingIcon: () => derivePlayListingIcon,
-  inspectIconPixels: () => inspectIconPixels,
-  normalizeSourceIcon: () => normalizeSourceIcon,
-  pixelToolchainAvailable: () => pixelToolchainAvailable,
-  pixelToolchainProblem: () => pixelToolchainProblem,
-  renderGlyphTile: () => renderGlyphTile
-});
-function isNotInstalled(e2) {
-  const code = e2?.code;
-  return code === "MODULE_NOT_FOUND" || code === "ERR_MODULE_NOT_FOUND";
-}
-function messageOf(e2) {
-  return e2 instanceof Error ? e2.message : String(e2);
-}
-async function loadSharp() {
-  if (cachedSharp) return cachedSharp;
-  const failures = [];
-  let presentButBroken = false;
-  try {
-    const { createRequire: createRequire4 } = await import("node:module");
-    cachedSharp = createRequire4(import.meta.url)("sharp");
-    lastProblem = null;
-    return cachedSharp;
-  } catch (e2) {
-    presentButBroken ||= !isNotInstalled(e2);
-    failures.push(`require: ${messageOf(e2)}`);
-  }
-  try {
-    cachedSharp = (await import("sharp")).default;
-    lastProblem = null;
-    return cachedSharp;
-  } catch (e2) {
-    presentButBroken ||= !isNotInstalled(e2);
-    failures.push(`import: ${messageOf(e2)}`);
-  }
-  lastProblem = presentButBroken ? `the image toolchain (sharp) is installed but could not be loaded \u2014 ${failures.join("; ")}` : PIXEL_TOOLCHAIN_HINT;
-  return null;
-}
-async function pixelToolchainAvailable() {
-  return await loadSharp() !== null;
-}
-async function pixelToolchainProblem() {
-  return await loadSharp() === null ? lastProblem ?? PIXEL_TOOLCHAIN_HINT : null;
-}
-async function sharpOrThrow() {
-  const s2 = await loadSharp();
-  if (!s2) throw new PixelToolchainUnavailable(lastProblem ?? PIXEL_TOOLCHAIN_HINT);
-  return s2;
-}
-async function inspectIconPixels(png) {
-  const sharp = await sharpOrThrow();
-  const { data, info: info4 } = await sharp(png).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
-  const { width, height, channels: channels3 } = info4;
-  if (channels3 !== 4) throw new Error(`app-icons: expected RGBA after ensureAlpha, got ${channels3} channels`);
-  let minAlpha = 255;
-  let transparent = 0;
-  for (let i2 = 3; i2 < data.length; i2 += 4) {
-    const a2 = data[i2];
-    if (a2 < minAlpha) minAlpha = a2;
-    if (a2 <= ALPHA_OPAQUE) transparent++;
-  }
-  const probe = Math.max(1, Math.round(Math.min(width, height) * CORNER_PROBE));
-  let minCornerAlpha = 255;
-  for (const [x0, y0] of [
-    [0, 0],
-    [width - probe, 0],
-    [0, height - probe],
-    [width - probe, height - probe]
-  ]) {
-    for (let y2 = y0; y2 < y0 + probe; y2++) {
-      for (let x2 = x0; x2 < x0 + probe; x2++) {
-        const a2 = data[(y2 * width + x2) * 4 + 3];
-        if (a2 < minCornerAlpha) minCornerAlpha = a2;
-      }
-    }
-  }
-  const inset = Math.round(Math.min(width, height) * INTERIOR_INSET);
-  let interiorMinAlpha = 255;
-  for (let y2 = inset; y2 < height - inset; y2++) {
-    for (let x2 = inset; x2 < width - inset; x2++) {
-      const a2 = data[(y2 * width + x2) * 4 + 3];
-      if (a2 < interiorMinAlpha) interiorMinAlpha = a2;
-    }
-  }
-  return {
-    width,
-    height,
-    minAlpha,
-    transparentFraction: transparent / (width * height),
-    minCornerAlpha,
-    interiorMinAlpha,
-    // `minAlpha <= ALPHA_OPAQUE` IS "has transparency", and the caller has just computed
-    // it — contentBox used to re-derive it with a full extra sweep of the raster.
-    contentBox: contentBox(data, width, height, minAlpha <= ALPHA_OPAQUE)
-  };
-}
-function contentBox(data, width, height, hasTransparency) {
-  const at2 = (x2, y2) => (y2 * width + x2) * 4;
-  const bg = [data[at2(0, 0)], data[at2(0, 0) + 1], data[at2(0, 0) + 2]];
-  const isInk = (x2, y2) => {
-    const i2 = at2(x2, y2);
-    if (hasTransparency) return data[i2 + 3] > ALPHA_OPAQUE;
-    return Math.abs(data[i2] - bg[0]) > INK_TOLERANCE || Math.abs(data[i2 + 1] - bg[1]) > INK_TOLERANCE || Math.abs(data[i2 + 2] - bg[2]) > INK_TOLERANCE;
-  };
-  let minX = width, minY = height, maxX = -1, maxY = -1;
-  for (let y2 = 0; y2 < height; y2++) {
-    for (let x2 = 0; x2 < width; x2++) {
-      if (!isInk(x2, y2)) continue;
-      if (x2 < minX) minX = x2;
-      if (x2 > maxX) maxX = x2;
-      if (y2 < minY) minY = y2;
-      if (y2 > maxY) maxY = y2;
-    }
-  }
-  if (maxX < 0) return null;
-  return {
-    widthFraction: (maxX - minX + 1) / width,
-    heightFraction: (maxY - minY + 1) / height
-  };
-}
-function appStoreIconPixelFindings(f2) {
-  const out2 = [];
-  const preMasked = f2.interiorMinAlpha > ALPHA_OPAQUE && f2.minCornerAlpha <= ALPHA_OPAQUE && f2.transparentFraction <= PRE_MASK_MAX_TRANSPARENT_FRACTION;
-  if (preMasked) {
-    out2.push({
-      level: "error",
-      message: "App icon looks pre-masked: its corners are transparent while the middle is opaque. iOS and Play both apply their own corner mask, so rounded artwork is rounded twice and looks visibly wrong on device \u2014 and the transparency itself is an App Store rejection (ITMS-90717 / ITMS-90647). Ship a full-bleed square with 90-degree corners and no inset."
-    });
-  } else if (f2.minAlpha <= ALPHA_OPAQUE) {
-    out2.push({
-      level: "error",
-      message: `App icon has transparent pixels (${(f2.transparentFraction * 100).toFixed(1)}% of the canvas, lowest alpha ${f2.minAlpha}). An App Store icon may carry an alpha channel but no transparent regions \u2014 Apple rejects this as ITMS-90717 / ITMS-90647. Flatten it onto an opaque background (\`himi icon set <file>\` does this for you).`
-    });
-  }
-  if (f2.contentBox === null) {
-    out2.push({
-      level: "error",
-      message: "App icon is a single flat colour with no distinguishable artwork \u2014 the mark is not visible in it. Supply art that contrasts with the background, or use `himi icon generate` for a glyph tile."
-    });
-    return out2;
-  }
-  const shorter = Math.min(f2.contentBox.widthFraction, f2.contentBox.heightFraction);
-  if (shorter < LETTERBOX_ERROR_FRACTION) {
-    out2.push({
-      level: "error",
-      message: `App icon artwork fills only ${(shorter * 100).toFixed(0)}% of the canvas on its shorter side, so it reads as a speck on a home screen. This is what a wide wordmark centred in a square looks like \u2014 crop to the mark, or use a monogram/glyph instead of the wordmark.`
-    });
-  } else if (shorter < LETTERBOX_WARN_FRACTION) {
-    out2.push({
-      level: "warn",
-      message: `App icon artwork fills ${(shorter * 100).toFixed(0)}% of the canvas on its shorter side \u2014 it will read as a thin strip at home-screen size. Consider cropping to the mark.`
-    });
-  }
-  return out2;
-}
-function luminance([r2, g2, b2]) {
-  const lin = [r2, g2, b2].map((v2) => {
-    const c2 = v2 / 255;
-    return c2 <= 0.04045 ? c2 / 12.92 : ((c2 + 0.055) / 1.055) ** 2.4;
-  });
-  return 0.2126 * lin[0] + 0.7152 * lin[1] + 0.0722 * lin[2];
-}
-function contrastRatio3(a2, b2) {
-  const [hi2, lo2] = [luminance(a2), luminance(b2)].sort((x2, y2) => y2 - x2);
-  return (hi2 + 0.05) / (lo2 + 0.05);
-}
-async function contrastingBackdrop(mark, requested) {
-  const sharp = await sharpOrThrow();
-  const { dominant } = await sharp(mark).stats();
-  const ink = [dominant.r, dominant.g, dominant.b];
-  const want = hexToRgb(requested);
-  if (!want || contrastRatio3(ink, want) >= MIN_BACKDROP_CONTRAST) return requested;
-  const towardsWhite = luminance(ink) < 0.5;
-  for (const amount of [0.35, 0.55, 0.75, 0.9]) {
-    const candidate = mix2(want, towardsWhite ? [255, 255, 255] : [0, 0, 0], amount);
-    if (contrastRatio3(ink, candidate) >= MIN_BACKDROP_CONTRAST) return rgbToHex(candidate);
-  }
-  return towardsWhite ? "#FFFFFF" : "#000000";
-}
-function hexToRgb(hex2) {
-  const m2 = /^#([0-9a-fA-F]{6})$/.exec(hex2);
-  if (!m2) return null;
-  const n2 = parseInt(m2[1], 16);
-  return [n2 >> 16 & 255, n2 >> 8 & 255, n2 & 255];
-}
-function mix2(a2, b2, t2) {
-  return [0, 1, 2].map((i2) => Math.round(a2[i2] + (b2[i2] - a2[i2]) * t2));
-}
-function rgbToHex([r2, g2, b2]) {
-  return `#${[r2, g2, b2].map((v2) => v2.toString(16).padStart(2, "0")).join("")}`.toUpperCase();
-}
-async function normalizeSourceIcon(input, opts) {
-  const sharp = await sharpOrThrow();
-  const size = opts.size ?? 1024;
-  const fit2 = opts.fit ?? NORMALIZE_FIT_FRACTION;
-  const inner = Math.max(1, Math.round(size * fit2));
-  const pad3 = Math.round((size - inner) / 2);
-  let trimmed;
-  try {
-    trimmed = await sharp(input).ensureAlpha().trim().png().toBuffer();
-  } catch {
-    trimmed = await sharp(input).ensureAlpha().png().toBuffer();
-  }
-  const mark = await sharp(trimmed).resize(inner, inner, { fit: "contain", background: { r: 0, g: 0, b: 0, alpha: 0 } }).png().toBuffer();
-  const background = await contrastingBackdrop(mark, opts.background);
-  return sharp({
-    create: {
-      width: size,
-      height: size,
-      channels: 4,
-      background: { r: 0, g: 0, b: 0, alpha: 0 }
-    }
-  }).composite([{ input: mark, top: pad3, left: pad3 }]).flatten({ background }).removeAlpha().png({ palette: false }).toBuffer();
-}
-async function derivePlayListingIcon(master, size = 512) {
-  const sharp = await sharpOrThrow();
-  return sharp(master).resize(size, size).ensureAlpha().png({ palette: false }).toBuffer();
-}
-async function renderGlyphTile(svg, background, size = 1024) {
-  const sharp = await sharpOrThrow();
-  return sharp(Buffer.from(svg)).resize(size, size).flatten({ background }).removeAlpha().png({ palette: false }).toBuffer();
-}
-var cachedSharp, lastProblem, PIXEL_TOOLCHAIN_HINT, PixelToolchainUnavailable, ALPHA_OPAQUE, CORNER_PROBE, INTERIOR_INSET, INK_TOLERANCE, PRE_MASK_MAX_TRANSPARENT_FRACTION, LETTERBOX_WARN_FRACTION, LETTERBOX_ERROR_FRACTION, NORMALIZE_FIT_FRACTION, MIN_BACKDROP_CONTRAST;
-var init_pixels = __esm({
-  "../app-icons/pixels.ts"() {
-    cachedSharp = null;
-    lastProblem = null;
-    PIXEL_TOOLCHAIN_HINT = "the image toolchain (sharp) is not installed \u2014 run `npm i -g sharp` to enable transparency, pre-masked-corner and letterbox checks";
-    PixelToolchainUnavailable = class extends Error {
-      constructor(reason = PIXEL_TOOLCHAIN_HINT) {
-        super(`app-icons: ${reason}`);
-        this.name = "PixelToolchainUnavailable";
-      }
-    };
-    ALPHA_OPAQUE = 250;
-    CORNER_PROBE = 0.06;
-    INTERIOR_INSET = 0.2;
-    INK_TOLERANCE = 24;
-    PRE_MASK_MAX_TRANSPARENT_FRACTION = 0.1;
-    LETTERBOX_WARN_FRACTION = 0.35;
-    LETTERBOX_ERROR_FRACTION = 0.2;
-    NORMALIZE_FIT_FRACTION = 0.82;
-    MIN_BACKDROP_CONTRAST = 1.5;
-  }
-});
-
 // src/icon.ts
 var icon_exports = {};
 __export(icon_exports, {
@@ -19360,9 +19437,9 @@ __export(icon_exports, {
   siteLogoAbsence: () => siteLogoAbsence,
   summarize: () => summarize
 });
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync21, statSync as statSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import { basename as basename7, dirname as dirname15, join as join21, resolve as resolve21, sep as sep7 } from "node:path";
+import { basename as basename8, dirname as dirname15, join as join21, resolve as resolve21, sep as sep7 } from "node:path";
 function readManifest(dir) {
   try {
     return JSON.parse(readFileSync21(join21(dir, MANIFEST), "utf8"));
@@ -19449,7 +19526,7 @@ async function iconStatus(dir) {
     ...base,
     templateIcon: templateIconMatch(png),
     bytes: png.length,
-    sha256: createHash8("sha256").update(png).digest("hex"),
+    sha256: createHash9("sha256").update(png).digest("hex"),
     header: pngHeader(png),
     byteIssues
   };
@@ -19537,7 +19614,7 @@ async function installIcon(dir, sourcePath, opts = {}) {
     const issues = appStoreIconIssues(input);
     if (issues.length) {
       throw new Error(
-        `himi icon: ${basename7(src)} ${issues.join("; ")}. Normalizing it needs the image toolchain \u2014 ${await pixelToolchainProblem() ?? PIXEL_TOOLCHAIN_HINT} \u2014 or supply an opaque 1024x1024 PNG. The existing icon was left alone.`
+        `himi icon: ${basename8(src)} ${issues.join("; ")}. Normalizing it needs the image toolchain \u2014 ${await pixelToolchainProblem() ?? PIXEL_TOOLCHAIN_HINT} \u2014 or supply an opaque 1024x1024 PNG. The existing icon was left alone.`
       );
     }
   }
@@ -19843,17 +19920,17 @@ var init_plan_fonts = __esm({
 });
 
 // ../font-bake/face-source.ts
-import { createHash as createHash9 } from "node:crypto";
+import { createHash as createHash10 } from "node:crypto";
 import { existsSync as existsSync24, mkdirSync as mkdirSync11, readFileSync as readFileSync23, renameSync as renameSync2, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { basename as basename8, join as join24 } from "node:path";
+import { basename as basename9, join as join24 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function hasVendoredFloor() {
   return existsSync24(VENDORED_DIR);
 }
 function faceSource(file2, sha2567) {
-  const vendored = join24(VENDORED_DIR, basename8(file2));
-  if (existsSync24(vendored) && createHash9("sha256").update(readFileSync23(vendored)).digest("hex") === sha2567) {
+  const vendored = join24(VENDORED_DIR, basename9(file2));
+  if (existsSync24(vendored) && createHash10("sha256").update(readFileSync23(vendored)).digest("hex") === sha2567) {
     return vendored;
   }
   const cached3 = join24(CACHE_DIR, sha2567);
@@ -19987,7 +20064,7 @@ var init_face_source = __esm({
     REPO_ROOT5 = fileURLToPath11(new URL("../..", import.meta.url));
     VENDORED_DIR = process.env.HIMI_FONTS_VENDORED_DIR || join24(REPO_ROOT5, "stdlib", "fonts", "vendored", "wix-madefor");
     CACHE_DIR = join24(process.env.XDG_CACHE_HOME || join24(homedir3(), ".cache"), "himi", "fonts");
-    sha256Hex3 = (bytes2) => createHash9("sha256").update(bytes2).digest("hex");
+    sha256Hex3 = (bytes2) => createHash10("sha256").update(bytes2).digest("hex");
     RAW = ["https://", "raw.", "githubuser", "content.com"].join("");
     UPSTREAM_DIR = /^(ofl|apache|ufl)\/[a-z0-9_-]+$/;
     FETCH_TIMEOUT_MS = 2e4;
@@ -21193,7 +21270,7 @@ __export(catalog_cache_exports, {
   catalogCompatible: () => catalogCompatible,
   catalogManifestDigest: () => catalogManifestDigest
 });
-import { createHash as createHash10, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash11, randomUUID as randomUUID2 } from "node:crypto";
 import {
   existsSync as existsSync29,
   mkdirSync as mkdirSync13,
@@ -21289,7 +21366,7 @@ var init_catalog_cache = __esm({
         this.name = "CatalogError";
       }
     };
-    hash = (b2) => `sha256-${createHash10("sha256").update(b2).digest("hex")}`;
+    hash = (b2) => `sha256-${createHash11("sha256").update(b2).digest("hex")}`;
     CatalogCache = class {
       root;
       baseUrl;
@@ -21307,7 +21384,7 @@ var init_catalog_cache = __esm({
             homedir4(),
             ".himi",
             "authoring-cache",
-            createHash10("sha256").update(this.baseUrl).digest("hex").slice(0, 16)
+            createHash11("sha256").update(this.baseUrl).digest("hex").slice(0, 16)
           )
         );
         this.cliVersion = opts.cliVersion;
@@ -23547,7 +23624,7 @@ var init_src2 = __esm({
 
 // ../app-icons/plan.ts
 import { existsSync as existsSync31, readFileSync as readFileSync31, readdirSync as readdirSync18 } from "node:fs";
-import { createHash as createHash11 } from "node:crypto";
+import { createHash as createHash12 } from "node:crypto";
 import { dirname as dirname19, join as join32, resolve as resolve26 } from "node:path";
 function stripComments(src) {
   let out2 = "";
@@ -23634,7 +23711,7 @@ function parseIconConfig(configTs) {
   return out2;
 }
 function idHash(id) {
-  return createHash11("sha1").update(id).digest();
+  return createHash12("sha1").update(id).digest();
 }
 function deriveGlyph(id) {
   const h2 = idHash(id);
@@ -23812,7 +23889,7 @@ function placeholderHashes() {
 }
 function fileSha256(path2) {
   try {
-    return createHash11("sha256").update(readFileSync31(path2)).digest("hex");
+    return createHash12("sha256").update(readFileSync31(path2)).digest("hex");
   } catch {
     return null;
   }
@@ -25518,7 +25595,7 @@ __export(progress_exports, {
   writeFileAtomic: () => writeFileAtomic
 });
 import { spawn as spawn3 } from "node:child_process";
-import { createHash as createHash12 } from "node:crypto";
+import { createHash as createHash13 } from "node:crypto";
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { appendFileSync, closeSync, existsSync as existsSync35, lstatSync as lstatSync8, mkdirSync as mkdirSync16, openSync, readdirSync as readdirSync21, readFileSync as readFileSync35, readSync, renameSync as renameSync5, rmSync as rmSync8, statSync as statSync8, writeFileSync as writeFileSync14 } from "node:fs";
 import { isAbsolute as isAbsolute3, join as join36, relative as relative6, resolve as resolve28, sep as sep8 } from "node:path";
@@ -25604,7 +25681,7 @@ function isSymlink(file2) {
 function archiveBytes(dir, bytes2) {
   const ext = imageExtension(bytes2);
   if (!ext) return null;
-  const sha2567 = createHash12("sha256").update(bytes2).digest("hex");
+  const sha2567 = createHash13("sha256").update(bytes2).digest("hex");
   const rel = join36(HISTORY_DIR, `${sha2567}.${ext}`);
   const dest = join36(dir, rel);
   if (!realDirIn(dir, HISTORY_DIR)) throw new UnsafeHimiDirError(HISTORY_DIR);
@@ -25689,7 +25766,7 @@ function journalMilestone(dir, input) {
     const now = input.now ?? /* @__PURE__ */ new Date();
     const step = MILESTONE_STEP[input.milestone];
     const abs = input.image ? locateImage(dir, input.image) : null;
-    const images = abs ? [{ sha256: createHash12("sha256").update(readFileSync35(abs)).digest("hex") }] : [];
+    const images = abs ? [{ sha256: createHash13("sha256").update(readFileSync35(abs)).digest("hex") }] : [];
     let message = input.message;
     if (input.unlessUnchanged) {
       const latest = [...entries].reverse().find((e2) => isCliEntry(e2) && e2.milestone === input.milestone);
@@ -26608,7 +26685,7 @@ var init_claude_plugin = __esm({
 });
 
 // src/run-identity.ts
-import { createHash as createHash13 } from "node:crypto";
+import { createHash as createHash14 } from "node:crypto";
 import { realpathSync as realpathSync5 } from "node:fs";
 import { resolve as resolve29 } from "node:path";
 function runRootId(dir) {
@@ -26618,7 +26695,7 @@ function runRootId(dir) {
   } catch {
     real = resolve29(dir);
   }
-  return createHash13("sha256").update(real).digest("hex");
+  return createHash14("sha256").update(real).digest("hex");
 }
 function runIdentity(dir) {
   return { pid: process.pid, root: runRootId(dir) };
@@ -26634,7 +26711,7 @@ var init_run_identity = __esm({
 import { spawn as nodeSpawn } from "node:child_process";
 import { closeSync as closeSync2, constants as fsc, existsSync as existsSync36, lstatSync as lstatSync9, mkdirSync as mkdirSync17, openSync as openSync2, readFileSync as readFileSync36, rmSync as rmSync9 } from "node:fs";
 import { createServer as createServer2 } from "node:net";
-import { basename as basename9, join as join37 } from "node:path";
+import { basename as basename10, join as join37 } from "node:path";
 function previewPortFor(appName2) {
   let h2 = 2166136261;
   for (let i2 = 0; i2 < appName2.length; i2++) {
@@ -26649,7 +26726,7 @@ function previewKey(manifestText, dir) {
     if (typeof name === "string" && name) return name;
   } catch {
   }
-  return basename9(dir);
+  return basename10(dir);
 }
 function previewPortForDir(dir) {
   const p2 = join37(dir, "himalaya.content.json");
@@ -30799,7 +30876,7 @@ var init_wix_push_links = __esm({
 });
 
 // ../../core/dev-server/src/app-config.ts
-import { createHash as createHash14 } from "node:crypto";
+import { createHash as createHash15 } from "node:crypto";
 function deriveTelemetryConfig(app) {
   const cfg = { enabled: true, samplingRate: 1 };
   const prodTelemetry = app.environments?.prod?.telemetry;
@@ -30996,7 +31073,7 @@ function buildAppConfigDocument(req, meta, override, bundleCtx, devNetMocks) {
   const locale = pickLocale(typeof acceptLanguage === "string" ? acceptLanguage : null);
   const config = locale ? translate(JSON.parse(JSON.stringify(baseline)), locale) : baseline;
   const body = JSON.stringify(config);
-  const etag = `"${createHash14("sha1").update(`${locale ?? "en"}:${body}`).digest("hex")}"`;
+  const etag = `"${createHash15("sha1").update(`${locale ?? "en"}:${body}`).digest("hex")}"`;
   return { config, body, etag, locale };
 }
 function handleAppConfigRequest(req, res, meta, override, bundleCtx, devNetMocks) {
@@ -35540,7 +35617,7 @@ __export(wix_member_login_exports, {
   webWixCall: () => webWixCall,
   webWixStream: () => webWixStream
 });
-import { createHash as createHash15, randomBytes as randomBytes3 } from "node:crypto";
+import { createHash as createHash16, randomBytes as randomBytes3 } from "node:crypto";
 function b64url(buf) {
   return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
@@ -35579,7 +35656,7 @@ function authCodeFrom(url) {
 }
 async function exchangeSessionToken(clientId, redirectUri, visitorToken, sessionToken) {
   const verifier = b64url(randomBytes3(32));
-  const challenge = b64url(createHash15("sha256").update(verifier).digest());
+  const challenge = b64url(createHash16("sha256").update(verifier).digest());
   const state = b64url(randomBytes3(8));
   const rs2 = await postJson(
     "/_api/redirects-api/v1/redirect-session",
@@ -36430,7 +36507,7 @@ var init_person_session_auth = __esm({
 import { readFileSync as readFileSync45 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as pathJoin2 } from "node:path";
-import { createHash as createHash16 } from "node:crypto";
+import { createHash as createHash17 } from "node:crypto";
 function captureAccountSession(req, opts = {}) {
   const env = opts.env ?? process.env;
   const now = opts.now ?? Date.now();
@@ -36469,7 +36546,7 @@ async function accountPrincipal(cookie, fetchImpl = fetch) {
   const identity = await resolveWixAccounts(cookie, fetchImpl);
   if (!identity.ok) return { ok: false, reason: identity.reason };
   const ids = identity.accounts.map((a2) => a2.accountId).sort().join("\n");
-  return { ok: true, principal: `acct_${createHash16("sha256").update(ids).digest("hex").slice(0, 32)}` };
+  return { ok: true, principal: `acct_${createHash17("sha256").update(ids).digest("hex").slice(0, 32)}` };
 }
 function safeAccountReturn(raw, requestHost, requestProto = "http") {
   if (typeof raw !== "string" || !raw) return "/";
@@ -36579,9 +36656,9 @@ var init_flag_assignments = __esm({
 });
 
 // ../../core/dev-server/src/images.ts
-import { createHash as createHash17 } from "node:crypto";
+import { createHash as createHash18 } from "node:crypto";
 function svgFor(productId, title, sku) {
-  const seedHex = createHash17("sha1").update(productId + ":" + title).digest("hex");
+  const seedHex = createHash18("sha1").update(productId + ":" + title).digest("hex");
   const h2 = (n2) => parseInt(seedHex.slice(n2, n2 + 2), 16);
   const hue1 = h2(0) % 360;
   const hue2 = (hue1 + 30 + h2(2) % 60) % 360;
@@ -36613,7 +36690,7 @@ function escapeXml(s2) {
   return s2.replace(/[<>&"']/g, (c2) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c2] ?? c2);
 }
 function wixPhotoSvg(category, seed2) {
-  const seedHex = createHash17("sha1").update(category + ":" + seed2).digest("hex");
+  const seedHex = createHash18("sha1").update(category + ":" + seed2).digest("hex");
   const h2 = (n2) => parseInt(seedHex.slice(n2, n2 + 2), 16);
   const palette2 = paletteForCategory(category, h2);
   const glyph = glyphForCategory(category);
@@ -36738,7 +36815,7 @@ var init_stable_ids = __esm({
 
 // ../../core/dev-server/src/preview.ts
 import { spawn as spawn4 } from "node:child_process";
-import { createHash as createHash18 } from "node:crypto";
+import { createHash as createHash19 } from "node:crypto";
 import { existsSync as existsSync44, createReadStream, statSync as statSync11, readFileSync as readFileSync46, renameSync as renameSync9, unlinkSync as unlinkSync3 } from "node:fs";
 import { homedir as homedir7, tmpdir as tmpdir2 } from "node:os";
 import { resolve as resolvePath, dirname as dirname27 } from "node:path";
@@ -36754,7 +36831,7 @@ function macosWinlistBin() {
 }
 function macosWinlistSourceHash() {
   try {
-    return createHash18("sha1").update(readFileSync46(MACOS_WINLIST)).digest("hex").slice(0, 12);
+    return createHash19("sha1").update(readFileSync46(MACOS_WINLIST)).digest("hex").slice(0, 12);
   } catch {
     return "missing";
   }
@@ -37610,9 +37687,9 @@ var init_preview2 = __esm({
 });
 
 // ../../core/dev-server/src/tier4-integrity.ts
-import { createHash as createHash19 } from "node:crypto";
+import { createHash as createHash20 } from "node:crypto";
 function computeSri(bytes2) {
-  const digest2 = createHash19("sha384").update(bytes2).digest("base64");
+  const digest2 = createHash20("sha384").update(bytes2).digest("base64");
   return `sha384-${digest2}`;
 }
 function parseManifestIntegrity(manifest) {
@@ -131370,7 +131447,8 @@ function renderDescriptorToHtml(payload, tokens2, scheme = "light", provider = n
     ...typeof width === "number" && Number.isFinite(width) && width > 0 ? { sizeClass: sizeClassFromWidth(width), containerWidth: width } : {},
     ...rtl ? { isRTL: true } : {},
     ...opts?.idiomContext ? { idiomContext: opts.idiomContext } : {},
-    ...opts?.debugUnknownComponents ? { debugUnknownComponents: true } : {}
+    ...opts?.debugUnknownComponents ? { debugUnknownComponents: true } : {},
+    ...opts?.assetBaseUrl ? { assetBaseUrl: opts.assetBaseUrl } : {}
   });
   const FOCUS_STYLE_MARKUP = `<style data-himalaya-focus-ring>${FOCUS_RING_CSS}</style>`;
   const withFocusRing = (markup) => markup ? FOCUS_STYLE_MARKUP + markup : markup;
@@ -131791,7 +131869,7 @@ function composeStickyTree(payload, header, footer) {
   if (footer) children.push(footer);
   return { id: "screen", type: "ScreenChrome", children };
 }
-async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, services = null, width, isRTL, idiomContext) {
+async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, services = null, width, isRTL, idiomContext, assetBaseUrl) {
   const desc = descriptor;
   const tooDeep = rawJsonDepthFinding(descriptor);
   if (tooDeep) return { renderable: false, reason: `depth_budget_exceeded: ${tooDeep.message}` };
@@ -131832,7 +131910,7 @@ async function renderDescriptorWeb(descriptor, tokens2, scheme, wantPng, service
       stickyHeader || stickyFooter ? { stickyHeader, stickyFooter } : void 0,
       // #4497 — the agent fast loop is a dev tool: an unknown component type keeps its
       // developer label here (a shipped web app renders nothing for it).
-      { ...isRTL ? { isRTL: true } : {}, ...idiomContext ? { idiomContext } : {}, debugUnknownComponents: true }
+      { ...isRTL ? { isRTL: true } : {}, ...idiomContext ? { idiomContext } : {}, ...assetBaseUrl ? { assetBaseUrl } : {}, debugUnknownComponents: true }
     );
   } catch (err) {
     return {
@@ -132594,7 +132672,7 @@ __export(widgets_exports, {
   viewWidgetId: () => viewWidgetId,
   widgetRealm: () => widgetRealm
 });
-import { createHash as createHash20 } from "node:crypto";
+import { createHash as createHash21 } from "node:crypto";
 import { inspect } from "node:util";
 async function widgetRealm() {
   if (!realmPromise) {
@@ -132650,7 +132728,7 @@ function dropEntry(cache, key3) {
   cache.bytes -= entry.bytes;
 }
 function produceCacheKey(bundleJs, timeoutMs, clock) {
-  const digest2 = createHash20("sha256").update(bundleJs).digest("base64");
+  const digest2 = createHash21("sha256").update(bundleJs).digest("base64");
   return `${timeoutMs}|${clock === void 0 ? "live" : Math.trunc(clock)}|${digest2}`;
 }
 function cachedProduce(evaluator, key3) {
@@ -133040,7 +133118,7 @@ function contentEtag(snapshot2) {
     // Lever A — a timeline change must bump the etag (frame values/times are content).
     frames: snapshot2.frames ?? null
   });
-  return "sha256-" + createHash20("sha256").update(canonical6).digest("base64");
+  return "sha256-" + createHash21("sha256").update(canonical6).digest("base64");
 }
 async function buildWidgetSnapshot(bundleJs, widgetId, opts = {}) {
   const { widgets } = await extractWidgets(bundleJs, opts);
@@ -133543,8 +133621,8 @@ var init_config2 = __esm({
 import { createServer as createServer3 } from "node:http";
 import { readFile, stat } from "node:fs/promises";
 import { readFileSync as readFileSync53, existsSync as existsSync47, watch, mkdirSync as mkdirSync23, rmSync as rmSync11 } from "node:fs";
-import { basename as basename10, dirname as dirname30, extname as extname2, join as join47, relative as relative8, resolve as resolve38, normalize as normalize3, sep as sep10 } from "node:path";
-import { createHash as createHash21, randomUUID as randomUUID5 } from "node:crypto";
+import { basename as basename11, dirname as dirname30, extname as extname2, join as join47, relative as relative8, resolve as resolve38, normalize as normalize3, sep as sep10 } from "node:path";
+import { createHash as createHash22, randomUUID as randomUUID5 } from "node:crypto";
 import { fileURLToPath as fileURLToPath23, pathToFileURL as pathToFileURL6 } from "node:url";
 function readLogicBundle(read, tier5Dir, name) {
   return read(tier5Dir ?? TIER5_ROOT2, name) ?? (tier5Dir && tier5Dir !== TIER5_ROOT2 ? read(TIER5_ROOT2, name) : void 0);
@@ -133590,7 +133668,7 @@ async function readBody2(req) {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function makeEtag(body) {
-  return `"${createHash21("sha256").update(body).digest("hex").slice(0, 32)}"`;
+  return `"${createHash22("sha256").update(body).digest("hex").slice(0, 32)}"`;
 }
 function servedTokensPath(app) {
   return app.module.designTokensPath ?? resolve38(app.dir, uiConfig(app.module.config).designTokensPath ?? "tokens.json");
@@ -134121,7 +134199,7 @@ function bundleIntegritySync(name, dir) {
   for (const root of dir ? [dir, TIER5_ROOT2] : [TIER5_ROOT2]) {
     try {
       const bytes2 = readFileSync53(resolve38(root, `${name}.bundle.js`));
-      return "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
+      return "sha256-" + createHash22("sha256").update(bytes2).digest("base64");
     } catch {
     }
   }
@@ -134542,7 +134620,7 @@ function tokensAreDerived(state) {
 }
 function servedTokensHash(app) {
   try {
-    return createHash21("sha256").update(readFileSync53(servedTokensPath(app))).digest("hex");
+    return createHash22("sha256").update(readFileSync53(servedTokensPath(app))).digest("hex");
   } catch {
     return "";
   }
@@ -134570,7 +134648,7 @@ function syncAppDependencyWatchers(state, inputs) {
   for (const file2 of appDependencyFiles(inputs, state.app.dir)) {
     const dir = dirname30(file2);
     if (!byDir.has(dir)) byDir.set(dir, /* @__PURE__ */ new Set());
-    byDir.get(dir).add(basename10(file2));
+    byDir.get(dir).add(basename11(file2));
   }
   let timer;
   const changed = /* @__PURE__ */ new Set();
@@ -135292,7 +135370,7 @@ async function handleWebWix(req, res, state) {
       userId: userId ?? session.email ?? null,
       email: session.email ?? "",
       preferenceContext: preferenceIdentity ? {
-        accountId: `m_${createHash21("sha256").update(preferenceIdentity).digest("hex")}`,
+        accountId: `m_${createHash22("sha256").update(preferenceIdentity).digest("hex")}`,
         // Headless client IDs are site-bound and come from the server's app
         // configuration, never the URL's user-supplied business parameter.
         businessId: auth.clientId
@@ -135392,7 +135470,10 @@ async function handleDev(req, res, state) {
       body.services ?? null,
       width,
       body.rtl === true,
-      idiomContext
+      idiomContext,
+      // #4595 — HHP package images arrive host-less (`/v1/asset/<sha>?app=`); a PNG page loads at
+      // about:blank, so resolve them against this server, as a device resolves them against its origin.
+      state.serverBaseUrl
     );
     const legacy = { screenId, scheme, ...render, diagnostics };
     const report3 = foldLegacyReport(legacy, {
@@ -136032,7 +136113,7 @@ async function readBundleFile(name, dir) {
     if (!roots.some((root) => path2.startsWith(root))) continue;
     try {
       const bytes2 = await readFile(path2);
-      const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
+      const integrity2 = "sha256-" + createHash22("sha256").update(bytes2).digest("base64");
       return { bytes: bytes2, integrity: integrity2 };
     } catch {
     }
@@ -136202,7 +136283,7 @@ function readActionHandlerManifest(app) {
   } catch {
     return { handlers: [] };
   }
-  const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
+  const integrity2 = "sha256-" + createHash22("sha256").update(bytes2).digest("base64");
   const bundleUrl = `/v1/action-handler-bundles/${app}`;
   return { handlers: decls.map((d2) => ({ id: d2.id, policy: d2.policy, description: d2.description, bundleUrl, integrity: integrity2 })) };
 }
@@ -136215,7 +136296,7 @@ async function handleActionHandlerBundleGet(res, app) {
   if (!path2.startsWith(ACTION_HANDLERS_ROOT)) return sendJson(res, 404, { error: "not_found" });
   try {
     const bytes2 = await readFile(path2);
-    const integrity2 = "sha256-" + createHash21("sha256").update(bytes2).digest("base64");
+    const integrity2 = "sha256-" + createHash22("sha256").update(bytes2).digest("base64");
     res.setHeader("content-type", "application/javascript; charset=utf-8");
     res.setHeader("cache-control", "max-age=300");
     res.setHeader("x-himalaya-bundle-integrity", integrity2);
@@ -136228,8 +136309,8 @@ async function handleActionHandlerBundleGet(res, app) {
 }
 async function serveStatic(req, res, root, prefix) {
   const requested = decodeURIComponent((req.url ?? "").split("?")[0]);
-  const relative17 = requested.replace(prefix, "").replace(/^\//, "");
-  const safe = normalize3(relative17).replace(/^(\.\.[\/\\])+/, "");
+  const relative18 = requested.replace(prefix, "").replace(/^\//, "");
+  const safe = normalize3(relative18).replace(/^(\.\.[\/\\])+/, "");
   const fullPath = resolve38(root, safe);
   if (!fullPath.startsWith(root)) {
     return send(res, 403, "forbidden");
@@ -137010,9 +137091,9 @@ var init_src6 = __esm({
 });
 
 // ../../core/serve-storage/src/release-patch.ts
-import { createHash as createHash22 } from "node:crypto";
+import { createHash as createHash23 } from "node:crypto";
 function sha256hex(b2) {
-  return createHash22("sha256").update(b2).digest("hex");
+  return createHash23("sha256").update(b2).digest("hex");
 }
 function stableStringify(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
@@ -140045,11 +140126,11 @@ var init_dependencies = __esm({
 });
 
 // ../../core/functions-build/src/sbom.ts
-import { createHash as createHash23 } from "node:crypto";
+import { createHash as createHash24 } from "node:crypto";
 function createFunctionSbom(packages) {
   const components2 = [...packages].sort((a2, b2) => a2.name.localeCompare(b2.name)).map(({ name, version: version4, integrity: integrity2, license }) => ({ name, version: version4, integrity: integrity2, license }));
   const body = JSON.stringify({ format: "himalaya-sbom-v1", components: components2 });
-  return { format: "himalaya-sbom-v1", components: components2, hash: createHash23("sha256").update(body).digest("hex") };
+  return { format: "himalaya-sbom-v1", components: components2, hash: createHash24("sha256").update(body).digest("hex") };
 }
 var init_sbom = __esm({
   "../../core/functions-build/src/sbom.ts"() {
@@ -140057,12 +140138,12 @@ var init_sbom = __esm({
 });
 
 // ../../core/functions-build/src/build.ts
-import { createHash as createHash24 } from "node:crypto";
+import { createHash as createHash25 } from "node:crypto";
 function sha2563(value) {
-  return createHash24("sha256").update(value).digest("hex");
+  return createHash25("sha256").update(value).digest("hex");
 }
 function sri(value) {
-  return `sha256-${createHash24("sha256").update(value).digest("base64")}`;
+  return `sha256-${createHash25("sha256").update(value).digest("base64")}`;
 }
 function schemaHash(schema) {
   if (!schema) return "";
@@ -140257,7 +140338,7 @@ __export(build_exports2, {
   withStoreNavBundle: () => withStoreNavBundle,
   withoutDevOnlyAppConfig: () => withoutDevOnlyAppConfig
 });
-import { createHash as createHash25 } from "node:crypto";
+import { createHash as createHash26 } from "node:crypto";
 import { readFileSync as readFileSync54, readdirSync as readdirSync25, existsSync as existsSync48 } from "node:fs";
 import { dirname as dirname31, join as join48, resolve as resolve39 } from "node:path";
 import { fileURLToPath as fileURLToPath24 } from "node:url";
@@ -140340,10 +140421,10 @@ function servesMessages(text9) {
   }
 }
 function sha2564(buf) {
-  return createHash25("sha256").update(buf).digest("hex");
+  return createHash26("sha256").update(buf).digest("hex");
 }
 function sri2(buf) {
-  return "sha256-" + createHash25("sha256").update(buf).digest("base64");
+  return "sha256-" + createHash26("sha256").update(buf).digest("base64");
 }
 async function widgetFailureDetail(res) {
   try {
@@ -140771,7 +140852,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const compareScheme = collect2?.render?.compareScheme;
   const renderCompare = async (descriptor, services) => {
     if (!compareScheme || compareScheme === renderScheme) return {};
-    const rr2 = await renderDescriptorWeb(descriptor, renderTokens, compareScheme, false, services, collect2?.render?.width, collect2?.render?.rtl === true);
+    const rr2 = await renderDescriptorWeb(descriptor, renderTokens, compareScheme, false, services, collect2?.render?.width, collect2?.render?.rtl === true, void 0, base);
     return { compare: { scheme: compareScheme, renderable: rr2.renderable, ...rr2.html ? { html: rr2.html } : {}, ...rr2.reason ? { reason: rr2.reason } : {} } };
   };
   const LIVE_LOAD_BUDGET_MS = 3e4;
@@ -141213,7 +141294,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       }
       if (collect2?.render && (!collect2.render.screenId || collect2.render.screenId === screenId)) {
         const { services, liveCalls, liveReturned, liveErrors, mockCalls, mockUnserved, mockBootFailed, liveFailed } = await renderServicesFor(bundleName, descriptor, screenId);
-        const rr2 = await renderDescriptorWeb(descriptor, renderTokens, renderScheme, collect2.render.png === true, services, collect2.render.width, collect2.render.rtl === true);
+        const rr2 = await renderDescriptorWeb(descriptor, renderTokens, renderScheme, collect2.render.png === true, services, collect2.render.width, collect2.render.rtl === true, void 0, base);
         renders.push({ screenId, scheme: renderScheme, ...rr2, ...await renderCompare(descriptor, services), ...collect2.render.dumpState && services ? { serviceState: services } : {}, ...liveCalls ? { liveCalls } : {}, ...liveReturned !== void 0 ? { liveReturned } : {}, ...liveFailed ? { liveFailed } : {}, ...liveErrors ? { liveErrors } : {}, ...mockCalls ? { mockCalls, mockUnserved } : {}, ...mockBootFailed ? { mockBootFailed } : {} });
       }
     }
@@ -141241,7 +141322,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
           lint.push({ screenId: wantedRender, ok: report3.ok, issues: report3.issues });
         }
         const { services, liveCalls, liveReturned, liveErrors, mockCalls, mockUnserved, mockBootFailed, liveFailed } = await renderServicesFor(bundleName, descriptor, wantedRender);
-        const rr2 = await renderDescriptorWeb(descriptor, renderTokens, renderScheme, collect2.render.png === true, services, collect2.render.width, collect2.render.rtl === true);
+        const rr2 = await renderDescriptorWeb(descriptor, renderTokens, renderScheme, collect2.render.png === true, services, collect2.render.width, collect2.render.rtl === true, void 0, base);
         renders.push({ screenId: wantedRender, scheme: renderScheme, ...rr2, ...await renderCompare(descriptor, services), ...collect2.render.dumpState && services ? { serviceState: services } : {}, ...liveCalls ? { liveCalls } : {}, ...liveReturned !== void 0 ? { liveReturned } : {}, ...liveFailed ? { liveFailed } : {}, ...liveErrors ? { liveErrors } : {}, ...mockCalls ? { mockCalls, mockUnserved } : {}, ...mockBootFailed ? { mockBootFailed } : {} });
       } else if (res.status === 422) {
         const finding = await depthRefusalOf(res);
@@ -142555,9 +142636,9 @@ __export(studio_exports, {
   renderStudioHtml: () => renderStudioHtml,
   writeStudioRecord: () => writeStudioRecord
 });
-import { createHash as createHash26 } from "node:crypto";
+import { createHash as createHash27 } from "node:crypto";
 import { existsSync as existsSync51, readdirSync as readdirSync27, readFileSync as readFileSync57, realpathSync as realpathSync8, statSync as statSync12 } from "node:fs";
-import { basename as basename11, extname as extname3, join as join51, relative as relative9, resolve as resolve40, sep as sep11 } from "node:path";
+import { basename as basename12, extname as extname3, join as join51, relative as relative9, resolve as resolve40, sep as sep11 } from "node:path";
 import { pathToFileURL as pathToFileURL7 } from "node:url";
 function realInside(dir, abs) {
   try {
@@ -142605,7 +142686,7 @@ function observeShots(dir, memory, now) {
   const seen = /* @__PURE__ */ new Set();
   const files = existsSync51(shotsDir) ? readdirSync27(shotsDir).filter((f2) => /\.(png|jpe?g)$/i.test(f2)).sort() : [];
   for (const f2 of files) {
-    const id = basename11(f2, extname3(f2));
+    const id = basename12(f2, extname3(f2));
     const archived = archiveFile(dir, memory, join51(shotsDir, f2));
     if (!archived) continue;
     seen.add(id);
@@ -142639,7 +142720,7 @@ function palette(dir) {
 }
 function appIdentity(dir) {
   const manifest = obj(readJson4(join51(dir, "himalaya.content.json")));
-  const name = text(manifest?.name) ?? basename11(resolve40(dir));
+  const name = text(manifest?.name) ?? basename12(resolve40(dir));
   const icon = text(manifest?.icon)?.trim();
   const iconPath = icon ? resolve40(dir, icon) : null;
   const real = iconPath ? realInside(dir, iconPath) : null;
@@ -142818,7 +142899,7 @@ function buildView(dir, memory, now) {
       message: e2.message,
       step: isCliEntry(e2) ? null : e2.step ?? null,
       stepNumber: isCliEntry(e2) ? null : e2.stepNumber ?? null,
-      images: (e2.images ?? []).map((i2) => historyUrl(basename11(i2.file))),
+      images: (e2.images ?? []).map((i2) => historyUrl(basename12(i2.file))),
       by: isCliEntry(e2) ? CLI_AUTHOR : null
     })),
     screens,
@@ -142837,7 +142918,7 @@ function buildView(dir, memory, now) {
     reveal: memory.reveal ?? null
   };
   const { generatedAt: _ignored, timelineFrames: _count, ...stable } = view;
-  const v2 = createHash26("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
+  const v2 = createHash27("sha256").update(JSON.stringify(stable)).digest("hex").slice(0, 16);
   return { v: v2, ...view };
 }
 function writeAtomic(file2, content) {
@@ -149687,7 +149768,7 @@ var init_fxp = __esm({
 });
 
 // ../../packages/serve/src/pkcs12.ts
-import { X509Certificate, createHash as createHash27, createPrivateKey as createPrivateKey2, createPublicKey, pbkdf2Sync, createDecipheriv } from "node:crypto";
+import { X509Certificate, createHash as createHash28, createPrivateKey as createPrivateKey2, createPublicKey, pbkdf2Sync, createDecipheriv } from "node:crypto";
 function decodePkcs12(der, password) {
   try {
     const pfx = readSequence(der, 0);
@@ -149961,7 +150042,7 @@ function expand(src, v2) {
   return out2;
 }
 function sha12(data) {
-  return createHash27("sha1").update(data).digest();
+  return createHash28("sha1").update(data).digest();
 }
 function readAt(buf, i2) {
   if (i2 >= buf.length) return void 0;
@@ -150050,7 +150131,7 @@ var init_pkcs12 = __esm({
 });
 
 // ../../packages/serve/src/customer-signing-assets.ts
-import { createHash as createHash28 } from "node:crypto";
+import { createHash as createHash29 } from "node:crypto";
 function readValue(node) {
   const [tag, children] = Object.entries(node)[0] ?? [];
   if (!tag || !Array.isArray(children)) return refuse3("customer_profile_invalid");
@@ -150128,7 +150209,7 @@ function toBundle(assets, expected, decoded, profileType, apns, deviceCount) {
     provisioningProfile: Buffer.from(assets.provisioningProfile).toString("base64"),
     profileSha256: sha2565(assets.provisioningProfile),
     certificateSha256: sha2565(decoded.cert.raw),
-    certificateSha1: createHash28("sha1").update(decoded.cert.raw).digest("hex").toUpperCase(),
+    certificateSha1: createHash29("sha1").update(decoded.cert.raw).digest("hex").toUpperCase(),
     expiresAt: new Date(Math.min(decoded.expiration, Date.parse(decoded.cert.validTo))).toISOString(),
     ...apns ? { apnsEnvironment: apns } : {},
     deviceCount
@@ -150179,7 +150260,7 @@ var init_customer_signing_assets = __esm({
     init_fxp();
     init_pkcs12();
     init_customer_dist_signing();
-    sha2565 = (bytes2) => createHash28("sha256").update(bytes2).digest("hex");
+    sha2565 = (bytes2) => createHash29("sha256").update(bytes2).digest("hex");
     refuse3 = (code) => {
       throw new CustomerSigningError(code);
     };
@@ -150347,7 +150428,7 @@ var init_customer_signing_inspect = __esm({
 
 // src/push-onboarding.ts
 import { existsSync as existsSync53, mkdirSync as mkdirSync24, readFileSync as readFileSync60, statSync as statSync13, writeFileSync as writeFileSync20, chmodSync as chmodSync2 } from "node:fs";
-import { basename as basename12, dirname as dirname32, join as join52, resolve as resolve43 } from "node:path";
+import { basename as basename13, dirname as dirname32, join as join52, resolve as resolve43 } from "node:path";
 function readJson5(path2) {
   try {
     const parsed = JSON.parse(readFileSync60(path2, "utf8"));
@@ -150368,7 +150449,7 @@ function pushInputsFromContent(dir) {
     // autoClaimSlug's docblock describes as the project-declared slug. Without the fallback a
     // package with no `name` sent a body missing `app` and earned `400 invalid_app_id` with both
     // private keys already on the wire.
-    app: text3(content.name) ?? basename12(root),
+    app: text3(content.name) ?? basename13(root),
     ...text3(provisioning.siteId) ? { site: text3(provisioning.siteId) } : {},
     ...text3(native.iosBundleId) ? { bundleId: text3(native.iosBundleId) } : {},
     ...text3(native.androidApplicationId) ? { androidApplicationId: text3(native.androidApplicationId) } : {}
@@ -150978,7 +151059,7 @@ __export(config_push_edit_exports, {
   previewPushConfigEdit: () => previewPushConfigEdit
 });
 import { readFileSync as readFileSync62 } from "node:fs";
-import { basename as basename13 } from "node:path";
+import { basename as basename14 } from "node:path";
 import ts6 from "typescript";
 function enablePushInConfig(source, options) {
   const pingAppName = DEFAULT_PING_APP_NAME;
@@ -151097,13 +151178,13 @@ function noLiteralInstruction(pingAppName) {
 function previewPushConfigEdit(dir, options) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
-  const { applied, instructions } = enablePushInConfig(readFileSync62(path2, "utf8"), { ...options, fileName: basename13(path2) });
+  const { applied, instructions } = enablePushInConfig(readFileSync62(path2, "utf8"), { ...options, fileName: basename14(path2) });
   return { wouldApply: applied, instructions };
 }
 async function applyPushConfigEdit(dir, options, validate5) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
-  const fileName = basename13(path2);
+  const fileName = basename14(path2);
   const refuse7 = (why) => ({ changed: false, pushOn: false, applied: [], instructions: [why] });
   if (isSymlink2(path2)) return refuse7(`${fileName} is a symlink, so it was not edited: turn push on in the file it points to.`);
   const original = readFileSync62(path2, "utf8");
@@ -151424,7 +151505,7 @@ __export(pack_exports, {
   unpackTo: () => unpackTo,
   writeZip: () => writeZip
 });
-import { createHash as createHash29 } from "node:crypto";
+import { createHash as createHash30 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
 import { existsSync as existsSync55, mkdirSync as mkdirSync25, readFileSync as readFileSync63, readdirSync as readdirSync28, rmSync as rmSync12, statSync as statSync15, writeFileSync as writeFileSync21 } from "node:fs";
 import { dirname as dirname33, join as join54, resolve as resolve46 } from "node:path";
@@ -151574,11 +151655,11 @@ function gatherReleaseEntries(appDir3) {
   return { entries, manifest, skipped };
 }
 function sha256Hex4(bytes2) {
-  return createHash29("sha256").update(bytes2).digest("hex");
+  return createHash30("sha256").update(bytes2).digest("hex");
 }
 function computeContentHash(entries) {
   const input = packageHashInput(entries.map((e2) => ({ path: e2.path, hash: sha256Hex4(e2.bytes) })));
-  return "sha256-" + createHash29("sha256").update(input).digest("base64");
+  return "sha256-" + createHash30("sha256").update(input).digest("base64");
 }
 function buildEntries(appDir3, app, opts) {
   const { entries: released, manifest, skipped } = gatherReleaseEntries(appDir3);
@@ -151769,7 +151850,7 @@ __export(app_source_exports, {
   writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { createHash as createHash30 } from "node:crypto";
+import { createHash as createHash31 } from "node:crypto";
 import { readdirSync as readdirSync29, lstatSync as lstatSync15, readFileSync as readFileSync64, mkdirSync as mkdirSync26, writeFileSync as writeFileSync22, existsSync as existsSync56, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync4 } from "node:fs";
 import { join as join55, resolve as resolve47, sep as sep13 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
@@ -151885,13 +151966,13 @@ function sourceFingerprint(dir) {
     dir,
     (archivePath, hostRel) => {
       if (/\.md$/i.test(archivePath)) return;
-      files.push(`${archivePath}\0${createHash30("sha256").update(readFileSync64(join55(dir, hostRel))).digest("hex")}`);
+      files.push(`${archivePath}\0${createHash31("sha256").update(readFileSync64(join55(dir, hostRel))).digest("hex")}`);
     },
     () => {
     }
   );
   files.sort();
-  return createHash30("sha256").update(files.join("\n")).digest("hex");
+  return createHash31("sha256").update(files.join("\n")).digest("hex");
 }
 function largestEntries(entries, limit = 5) {
   return entries.map((e2) => ({
@@ -152085,6 +152166,7 @@ __export(run_watch_exports, {
   ReloadBus: () => ReloadBus,
   boardFile: () => boardFile,
   diffReleases: () => diffReleases,
+  hhpRasterDir: () => hhpRasterDir,
   himiDir: () => himiDir,
   ignoredChange: () => ignoredChange,
   isEmptyDiff: () => isEmptyDiff,
@@ -152100,7 +152182,7 @@ __export(run_watch_exports, {
 });
 import { closeSync as closeSync4, constants as constants2, existsSync as existsSync57, fstatSync, lstatSync as lstatSync16, statSync as statSync16, readdirSync as readdirSync30, mkdirSync as mkdirSync27, openSync as openSync4, readFileSync as readFileSync65, realpathSync as realpathSync9, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync23, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { extname as extname4, join as join56, resolve as resolve48, sep as sep14 } from "node:path";
+import { extname as extname4, join as join56, relative as relative11, resolve as resolve48, sep as sep14 } from "node:path";
 function diffReleases(prev, next) {
   const bundles = Object.keys(next.bundles).filter((b2) => prev.bundles[b2]?.sha256 !== next.bundles[b2].sha256).sort();
   const changedBundles = new Set(bundles);
@@ -152125,10 +152207,20 @@ function reloadEvents(d2) {
   if (d2.config) out2.push(["config.invalidated", {}]);
   return out2;
 }
-function ignoredChange(relPath, isDirectory = () => false) {
+function hhpRasterDir(dir) {
+  const assets = findAssetsDir(dir);
+  if (!assets) return null;
+  const rel = relative11(dir, assets).split(sep14).join("/");
+  return rel ? `${rel}/hhp-raster` : "hhp-raster";
+}
+function ignoredChange(relPath, isDirectory = () => false, rasterDir = "assets/hhp-raster") {
   const parts = relPath.split(/[\\/]/).filter(Boolean);
   if (parts[0] === "dev" && (parts[1] === "hhp" || parts[1]?.startsWith(".hhp-"))) return true;
   if (parts[0] === "tier5-src" && parts[1]?.startsWith("hhp-")) return true;
+  if (rasterDir) {
+    const rel = parts.join("/");
+    if (rel === rasterDir || rel.startsWith(`${rasterDir}/`)) return true;
+  }
   if (!parts.length) return true;
   const [top] = parts;
   if ([".himi", "dist", "node_modules", ".git", ".build", ...AGENT_TOOLING_DIRS].includes(top)) return true;
@@ -152139,11 +152231,12 @@ function ignoredChange(relPath, isDirectory = () => false) {
 }
 function watchContent(dir, onChange, opts = {}) {
   const debounceMs = opts.debounceMs ?? 200;
+  const rasterDir = hhpRasterDir(dir);
   const watch2 = opts.watch ?? ((p2, o2, l2) => fsWatch(p2, o2, (event, file2) => l2(event, file2 === null ? null : String(file2))));
   let timer = null;
   const pending = /* @__PURE__ */ new Set();
   const changed = (_event, file2) => {
-    if (!file2 || ignoredChange(file2, (rel) => isDir(join56(dir, rel)))) return;
+    if (!file2 || ignoredChange(file2, (rel) => isDir(join56(dir, rel)), rasterDir)) return;
     pending.add(file2);
     if (timer) clearTimeout(timer);
     timer = setTimeout(() => {
@@ -152167,7 +152260,7 @@ function watchContent(dir, onChange, opts = {}) {
         const path2 = join56(directory, String(name)), rel = prefix ? `${prefix}/${name}` : String(name);
         try {
           const stat2 = lstatSync16(path2);
-          if (stat2.isSymbolicLink() || ignoredChange(rel, () => stat2.isDirectory())) continue;
+          if (stat2.isSymbolicLink() || ignoredChange(rel, () => stat2.isDirectory(), rasterDir)) continue;
           if (stat2.isDirectory()) visit(path2, rel);
           else if (stat2.isFile()) files.set(rel, `${stat2.mtimeMs}:${stat2.ctimeMs}:${stat2.size}`);
         } catch {
@@ -152369,6 +152462,7 @@ var init_run_watch = __esm({
   "src/run-watch.ts"() {
     init_source_deny();
     init_run_identity();
+    init_app_assets();
     isEmptyDiff = (d2) => !d2.screens.length && !d2.bundles.length && !d2.tokens && !d2.config;
     ReloadBus = class {
       subscribers = /* @__PURE__ */ new Set();
@@ -152413,7 +152507,7 @@ __export(screen_state_exports, {
   shotStateFor: () => shotStateFor,
   withHomeCaveat: () => withHomeCaveat
 });
-import { createHash as createHash31 } from "node:crypto";
+import { createHash as createHash32 } from "node:crypto";
 import { lstatSync as lstatSync17, readFileSync as readFileSync66 } from "node:fs";
 import { join as join57 } from "node:path";
 function quotableLine(text9) {
@@ -152533,7 +152627,7 @@ var init_screen_state = __esm({
     KEEP = 40;
     LINE_MAX = 120;
     str3 = (v2) => typeof v2 === "string" && v2.trim() ? v2 : void 0;
-    sha256Of = (file2) => createHash31("sha256").update(readFileSync66(file2)).digest("hex");
+    sha256Of = (file2) => createHash32("sha256").update(readFileSync66(file2)).digest("hex");
   }
 });
 
@@ -152548,9 +152642,9 @@ __export(studio_reel_exports, {
   thin: () => thin,
   utcDay: () => utcDay
 });
-import { createHash as createHash32 } from "node:crypto";
+import { createHash as createHash33 } from "node:crypto";
 import { lstatSync as lstatSync18, readFileSync as readFileSync67 } from "node:fs";
-import { basename as basename14, join as join58 } from "node:path";
+import { basename as basename15, join as join58 } from "node:path";
 function loadMemory2(dir) {
   const m2 = readJson6(join58(dir, ".himi", "studio", "memory.json"));
   if (!isObj3(m2) || m2.version !== 1 || !isObj3(m2.shots) || !Array.isArray(m2.timeline)) return null;
@@ -152606,13 +152700,13 @@ function planReel(dir) {
     message: e2.message,
     step: isCliEntry(e2) ? null : str4(e2.step),
     by: isCliEntry(e2) ? CLI_AUTHOR : null,
-    files: (Array.isArray(e2.images) ? e2.images : []).map((i2) => isObj3(i2) && typeof i2.file === "string" ? basename14(i2.file) : "").filter((f2) => HISTORY_NAME.test(f2))
+    files: (Array.isArray(e2.images) ? e2.images : []).map((i2) => isObj3(i2) && typeof i2.file === "string" ? basename15(i2.file) : "").filter((f2) => HISTORY_NAME.test(f2))
   }));
   const times = [summary2.startedAt, ...timeline.map((t2) => t2.ts), memory?.createdAt].filter((x2) => !!x2).sort();
   const startedAt = times[0] ?? null;
   const endedAt = [summary2.lastAt, ...timeline.map((t2) => t2.ts)].filter((x2) => !!x2).sort().pop() ?? null;
   return {
-    app: typeof manifest?.name === "string" && manifest.name ? manifest.name : basename14(dir),
+    app: typeof manifest?.name === "string" && manifest.name ? manifest.name : basename15(dir),
     accent,
     startedAt,
     endedAt,
@@ -152637,7 +152731,7 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
       const st2 = lstatSync18(path2);
       if (!st2.isFile() || st2.nlink !== 1) return null;
       const bytes2 = readFileSync67(path2);
-      return createHash32("sha256").update(bytes2).digest("hex") === f2.slice(0, 64) && imageExtension(bytes2) === f2.slice(65) ? bytes2 : null;
+      return createHash33("sha256").update(bytes2).digest("hex") === f2.slice(0, 64) && imageExtension(bytes2) === f2.slice(65) ? bytes2 : null;
     } catch {
       return null;
     }
@@ -152858,11 +152952,11 @@ __export(milestones_exports, {
   watchUrlFor: () => watchUrlFor,
   writeHandoverReel: () => writeHandoverReel
 });
-import { createHash as createHash33, randomUUID as randomUUID7 } from "node:crypto";
+import { createHash as createHash34, randomUUID as randomUUID7 } from "node:crypto";
 import { spawn as spawn5 } from "node:child_process";
 import { closeSync as closeSync5, existsSync as existsSync58, lstatSync as lstatSync19, readFileSync as readFileSync69, statSync as statSync17 } from "node:fs";
 import { createServer as createServer4 } from "node:net";
-import { basename as basename15, dirname as dirname34, isAbsolute as isAbsolute6, join as join60, relative as relative11, resolve as resolve49, sep as sep15 } from "node:path";
+import { basename as basename16, dirname as dirname34, isAbsolute as isAbsolute6, join as join60, relative as relative12, resolve as resolve49, sep as sep15 } from "node:path";
 function homeShotPath(dir, home) {
   const root = resolve49(dir);
   const base = resolve49(root, ".himi", "shots");
@@ -152877,7 +152971,7 @@ function homeShotPath(dir, home) {
   return shot;
 }
 function displayPath(p2, cwd = process.cwd()) {
-  const rel = relative11(cwd, p2);
+  const rel = relative12(cwd, p2);
   return rel && !rel.startsWith("..") && !isAbsolute6(rel) ? rel : p2;
 }
 function progressCommand(opts) {
@@ -153018,7 +153112,7 @@ async function openBoardForSession(dir, cwd = process.cwd()) {
   try {
     const { openStudio: openStudio2 } = await Promise.resolve().then(() => (init_studio(), studio_exports));
     const { page, url } = openStudio2(dir);
-    const rel = relative11(cwd, page);
+    const rel = relative12(cwd, page);
     return { page: rel && !rel.startsWith("..") && !isAbsolute6(rel) ? rel : page, url, opened: false };
   } catch (e2) {
     return { opened: false, error: `the build board was not created: ${e2.message} \u2014 \`himi studio --no-open\` in the app retries it` };
@@ -153502,7 +153596,7 @@ function writeHandoverReel(dir) {
     const { html } = buildReel(dir);
     const file2 = join60(dir, ".himi", "making-of.html");
     writeFileAtomic(file2, html);
-    return { file: file2, hint: `hand ${basename15(file2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` };
+    return { file: file2, hint: `hand ${basename16(file2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` };
   } catch (e2) {
     return { skipped: `the making-of was not written: ${e2.message.split("\n")[0]} \u2014 \`himi studio reel\` retries it` };
   }
@@ -153516,7 +153610,7 @@ function afterHandoverPostcard(dir, opts = {}) {
   } catch {
     fresh = false;
   }
-  const makingOf = fresh ? { file: file2, hint: `hand ${basename15(file2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` } : writeHandoverReel(dir);
+  const makingOf = fresh ? { file: file2, hint: `hand ${basename16(file2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` } : writeHandoverReel(dir);
   const next = "file" in makingOf ? [`hand the owner the making-of, ${shellQuote(displayPath(makingOf.file))}, beside the preview link \u2014 in your final message and report, never instead of the link`] : [`\`himi studio reel${contentArg(opts.content)}\` writes the making-of to hand the owner beside the preview link (${makingOf.skipped})`];
   return { makingOf, next };
 }
@@ -153539,7 +153633,7 @@ var init_milestones = __esm({
     FIRST_LOOK_BUDGET_MS = 9e4;
     VALIDATE_PICTURE_BUDGET_MS = 3e4;
     plural2 = (n2, one, many = `${one}s`) => `${n2} ${n2 === 1 ? one : many}`;
-    appName = (dir) => appLabel(dir) ?? basename15(dir);
+    appName = (dir) => appLabel(dir) ?? basename16(dir);
     STILL_BUILDING_AFTER_MS = 10 * 60 * 1e3;
     STILL_BUILDING_MESSAGE = "Still building: here's the home screen now.";
     yourFirstLookMessage = (dir) => `First look at your app: ${appName(dir)}'s home screen, with your changes.`;
@@ -153548,7 +153642,7 @@ var init_milestones = __esm({
     INIT_SOURCE_FILE = join60(".himi", "init-source.json");
     STARTING_POINT_REF = "starting-point";
     TEMPLATE_NAME = /^[A-Za-z0-9._-]{1,64}$/;
-    sha256Of2 = (file2) => createHash33("sha256").update(readFileSync69(file2)).digest("hex");
+    sha256Of2 = (file2) => createHash34("sha256").update(readFileSync69(file2)).digest("hex");
     WATCH_REMINDER_EVERY_MS = 10 * 60 * 1e3;
     REMINDERS_FILE = join60(".himi", "reminders.json");
     pidAlive = (pid) => {
@@ -154598,7 +154692,7 @@ __export(eject_exports, {
   ejectModule: () => ejectModule
 });
 import { existsSync as existsSync61, mkdirSync as mkdirSync29, readFileSync as readFileSync73, writeFileSync as writeFileSync26 } from "node:fs";
-import { dirname as dirname36, join as join64, relative as relative12, resolve as resolve50, sep as sep16 } from "node:path";
+import { dirname as dirname36, join as join64, relative as relative13, resolve as resolve50, sep as sep16 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve50(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
   if (existsSync61(inRepo)) return { path: inRepo, form: "source" };
@@ -154651,7 +154745,7 @@ function ejectModule(opts) {
     if (!existsSync61(f2)) continue;
     const before = readFileSync73(f2, "utf8");
     let after = before;
-    let rel = relative12(dirname36(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative13(dirname36(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q2 = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -156613,10 +156707,10 @@ var init_calls = __esm({
 });
 
 // ../../core/functions-runtime/src/queue.ts
-import { createHash as createHash34 } from "node:crypto";
+import { createHash as createHash35 } from "node:crypto";
 function inputSchemaHash(definition) {
   const schema = definition.input;
-  return schema ? createHash34("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
+  return schema ? createHash35("sha256").update(JSON.stringify(schema.descriptor ?? { kind: schema.kind, optional: schema.optional === true })).digest("hex") : "";
 }
 function createFunctionEnqueueCapability(options) {
   return {
@@ -156682,14 +156776,14 @@ var init_queue = __esm({
 });
 
 // ../../core/data-resources/src/plan.ts
-import { createHash as createHash35 } from "node:crypto";
+import { createHash as createHash36 } from "node:crypto";
 function canonical3(value) {
   if (Array.isArray(value)) return `[${value.map(canonical3).join(",")}]`;
   if (value && typeof value === "object") return `{${Object.entries(value).sort(([a2], [b2]) => a2.localeCompare(b2)).map(([key3, item]) => `${JSON.stringify(key3)}:${canonical3(item)}`).join(",")}}`;
   return JSON.stringify(value);
 }
 function hashResourcePlan(plan) {
-  return createHash35("sha256").update(canonical3(plan)).digest("hex");
+  return createHash36("sha256").update(canonical3(plan)).digest("hex");
 }
 function finalize(input) {
   return { ...input, hash: hashResourcePlan(input) };
@@ -157656,7 +157750,7 @@ var init_cli_bridge = __esm({
 // src/mcp/file-tools.ts
 import { closeSync as closeSync6, constants as constants3, lstatSync as lstatSync20, mkdirSync as mkdirSync31, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync78, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync15, statSync as statSync18, writeSync, existsSync as existsSync66 } from "node:fs";
 import { randomBytes as randomBytes4 } from "node:crypto";
-import { dirname as dirname37, isAbsolute as isAbsolute7, join as join69, relative as relative13, resolve as resolve53, sep as sep17 } from "node:path";
+import { dirname as dirname37, isAbsolute as isAbsolute7, join as join69, relative as relative14, resolve as resolve53, sep as sep17 } from "node:path";
 import * as z2 from "zod";
 function within(root, p2) {
   return p2 === root || p2.startsWith(root.endsWith(sep17) ? root : root + sep17);
@@ -157674,10 +157768,10 @@ function realish(p2) {
 }
 function symlinkComponent(base, abs) {
   let cur = base;
-  for (const part3 of relative13(base, abs).split(sep17).filter(Boolean)) {
+  for (const part3 of relative14(base, abs).split(sep17).filter(Boolean)) {
     cur = join69(cur, part3);
     try {
-      if (lstatSync20(cur).isSymbolicLink()) return relative13(base, cur);
+      if (lstatSync20(cur).isSymbolicLink()) return relative14(base, cur);
     } catch {
       return void 0;
     }
@@ -157700,7 +157794,7 @@ async function confinedAppDir(args, deps) {
   if (!within(root, dir) || !within(realpathSync10(root), realish(dir))) return refuse5("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
   const link = symlinkComponent(root, dir);
   if (link) return refuse5("outside_workspace", `"${link}" is a symlink \u2014 the app folder must be a real folder in the workspace`);
-  const rel = relative13(root, dir);
+  const rel = relative14(root, dir);
   if (rel && (isDeniedSourcePath(`${rel}/x`) || isDeniedSourcePath(`${rel.toLowerCase()}/x`))) return refuse5("denied", `"${rel}" is a folder this tool does not touch`);
   if (!existsSync66(join69(dir, CONTENT_MARKER))) {
     return refuse5("not_an_app", `"${rel || "."}" is not an app folder (no ${CONTENT_MARKER}) \u2014 see himi_list_apps, or create one with himi_init`);
@@ -157719,10 +157813,10 @@ function onDiskSpelling(abs) {
   return join69(realpathSync10.native(cur), ...tail);
 }
 function denied(appDir3, abs) {
-  const rel = relative13(appDir3, abs);
+  const rel = relative14(appDir3, abs);
   if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) return true;
   try {
-    return isDeniedSourcePath(relative13(realpathSync10.native(appDir3), onDiskSpelling(abs)));
+    return isDeniedSourcePath(relative14(realpathSync10.native(appDir3), onDiskSpelling(abs)));
   } catch {
     return true;
   }
@@ -157755,14 +157849,14 @@ function writeNoFollow2(appDir3, abs, content) {
   const link = symlinkComponent(appDir3, abs);
   if (link || !within(realpathSync10(appDir3), realpathSync10(dirname37(abs)))) {
     rmSync15(tmp, { force: true });
-    throw new Error(`"${link ?? relative13(appDir3, dirname37(abs))}" changed into a link while writing`);
+    throw new Error(`"${link ?? relative14(appDir3, dirname37(abs))}" changed into a link while writing`);
   }
   renameSync11(tmp, abs);
 }
 function listFiles(appDir3) {
   const files = [];
   const walk2 = (d2) => {
-    const parentRel = relative13(appDir3, d2);
+    const parentRel = relative14(appDir3, d2);
     for (const e2 of readdirSync31(d2, { withFileTypes: true }).sort((a2, b2) => a2.name.localeCompare(b2.name))) {
       if (e2.isSymbolicLink()) continue;
       const p2 = join69(d2, e2.name);
@@ -157770,7 +157864,7 @@ function listFiles(appDir3) {
         if (isDeniedSourceDir(e2.name, parentRel) || isDeniedSourceDir(e2.name.toLowerCase(), parentRel)) continue;
         if (!walk2(p2)) return false;
       } else if (e2.isFile()) {
-        const rel = relative13(appDir3, p2);
+        const rel = relative14(appDir3, p2);
         if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) continue;
         if (files.length >= MAX_LISTED) return false;
         files.push({ path: rel.split(sep17).join("/"), bytes: statSync18(p2).size });
@@ -158866,9 +158960,9 @@ __export(browser_authoring_exports, {
   sdkSubpathReader: () => sdkSubpathReader
 });
 import { createServer as createServer5 } from "node:http";
-import { createHash as createHash36, randomBytes as randomBytes5 } from "node:crypto";
+import { createHash as createHash37, randomBytes as randomBytes5 } from "node:crypto";
 import { existsSync as existsSync68, readdirSync as readdirSync32, readFileSync as readFileSync81, realpathSync as realpathSync11, statSync as statSync19 } from "node:fs";
-import { join as join71, posix as posix3, relative as relative14, sep as sep18 } from "node:path";
+import { join as join71, posix as posix3, relative as relative15, sep as sep18 } from "node:path";
 function humanMs(ms2) {
   return ms2 < 1e3 ? `${ms2}ms` : `${Math.round(ms2 / 1e3)}s`;
 }
@@ -158918,7 +159012,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       ];
       for (const abs of candidates) {
         if (!existsSync68(abs) || statSync19(abs).isDirectory()) continue;
-        const key3 = `/tier5-src/${relative14(tier5SrcDir, abs).split(sep18).join(posix3.sep)}`;
+        const key3 = `/tier5-src/${relative15(tier5SrcDir, abs).split(sep18).join(posix3.sep)}`;
         if (key3 in files) break;
         files[key3] = readFileSync81(abs, "utf8");
         queue.push(key3);
@@ -158965,7 +159059,7 @@ function encodeJob(job) {
   return Buffer.from(JSON.stringify(job), "utf8").toString("base64");
 }
 function mintToken2(payload, nonce = randomBytes5(16).toString("hex")) {
-  const digest2 = createHash36("sha256").update(payload, "utf8").digest("base64url");
+  const digest2 = createHash37("sha256").update(payload, "utf8").digest("base64url");
   return `${nonce}.${digest2}`;
 }
 function defaultOpenBrowser2(url) {
@@ -159417,7 +159511,7 @@ __export(design_kits_exports, {
   listKits: () => listKits2
 });
 import { existsSync as existsSync70, readFileSync as readFileSync83, readdirSync as readdirSync33 } from "node:fs";
-import { join as join73, basename as basename16 } from "node:path";
+import { join as join73, basename as basename17 } from "node:path";
 import { fileURLToPath as fileURLToPath27 } from "node:url";
 function kitsDir() {
   return KIT_DIR_CANDIDATES.find((p2) => existsSync70(p2));
@@ -159425,7 +159519,7 @@ function kitsDir() {
 function listKits2() {
   const dir = kitsDir();
   if (!dir) return [];
-  return readdirSync33(dir).filter((f2) => f2.endsWith(".json")).map((f2) => basename16(f2, ".json")).sort();
+  return readdirSync33(dir).filter((f2) => f2.endsWith(".json")).map((f2) => basename17(f2, ".json")).sort();
 }
 function kitReport(name) {
   const dir = kitsDir();
@@ -159485,7 +159579,7 @@ __export(assets_exports, {
   verifyReport: () => verifyReport
 });
 import { readFileSync as readFileSync84 } from "node:fs";
-import { basename as basename17 } from "node:path";
+import { basename as basename18 } from "node:path";
 function declaredAssets(dir) {
   return collectAssets(dir).map((a2) => {
     const bytes2 = readFileSync84(a2.path);
@@ -159566,7 +159660,7 @@ function verifyReport(dir, app, manifest) {
 }
 function addAssetPayload(manifest, filePath, opts) {
   const bytes2 = readFileSync84(filePath);
-  const name = opts.name ?? basename17(filePath);
+  const name = opts.name ?? basename18(filePath);
   const sha2567 = assetSha256(bytes2);
   const record2 = {
     sha256: sha2567,
@@ -162691,7 +162785,7 @@ var init_iap_api = __esm({
 });
 
 // ../store-release/iap-manifest.ts
-import { createHash as createHash37 } from "node:crypto";
+import { createHash as createHash38 } from "node:crypto";
 function readTarget(reader, value) {
   const obj4 = reader.object(value, "target", TARGET_KEYS);
   return {
@@ -162837,7 +162931,7 @@ function canonicalJson(value) {
   return JSON.stringify(sortKeys(value));
 }
 function sha256Digest(value) {
-  return `sha256:${createHash37("sha256").update(canonicalJson(value)).digest("hex")}`;
+  return `sha256:${createHash38("sha256").update(canonicalJson(value)).digest("hex")}`;
 }
 function manifestDigest(manifest) {
   return sha256Digest(manifest);
@@ -163028,7 +163122,7 @@ var init_iap_pricing = __esm({
 });
 
 // ../store-release/iap-result.ts
-import { basename as basename18 } from "node:path";
+import { basename as basename19 } from "node:path";
 function missingMetadataRequirement(screenshotState, itemNamesFile) {
   if (screenshotState === void 0) return MISSING_SCREENSHOT;
   const leftover = LEFTOVER_STATES[screenshotState];
@@ -163060,7 +163154,7 @@ function metadataVersion(observed) {
 }
 function screenshotReport(path2, observed) {
   const held = observed?.reviewScreenshot;
-  return { requested: basename18(path2), ...held ? { observed: { fileName: held.fileName, state: held.state } } : {} };
+  return { requested: basename19(path2), ...held ? { observed: { fileName: held.fileName, state: held.state } } : {} };
 }
 function itemResult(input) {
   const { target, item, observed } = input;
@@ -163192,8 +163286,8 @@ var init_screenshot_display_types = __esm({
 });
 
 // ../store-release/iap-review-screenshot.ts
-import { createHash as createHash38 } from "node:crypto";
-import { basename as basename19, resolve as resolve56 } from "node:path";
+import { createHash as createHash39 } from "node:crypto";
+import { basename as basename20, resolve as resolve56 } from "node:path";
 function pngSize(bytes2) {
   const signed = PNG_SIGNATURE.every((b2, i2) => bytes2[i2] === b2);
   if (!signed || bytes2.length < 24 || bytes2.toString("ascii", 12, 16) !== "IHDR") return void 0;
@@ -163211,7 +163305,7 @@ function readImageSize(bytes2) {
   return pngSize(buffer) ?? jpegSize(buffer);
 }
 function md5Hex(bytes2) {
-  return createHash38("md5").update(bytes2).digest("hex");
+  return createHash39("md5").update(bytes2).digest("hex");
 }
 function isAppStoreScreenshotSize(file2) {
   return displayTypeForSize(file2.width, file2.height) !== null;
@@ -163233,7 +163327,7 @@ function readReviewScreenshot(path2, source) {
   }
   const size = readImageSize(bytes2);
   if (!size) throw new Error(`${absolute} is not a PNG or JPEG image`);
-  return { ...size, path: absolute, fileName: basename19(absolute), bytes: bytes2, checksum: md5Hex(bytes2) };
+  return { ...size, path: absolute, fileName: basename20(absolute), bytes: bytes2, checksum: md5Hex(bytes2) };
 }
 function loadReviewScreenshots(manifest, source, indices = manifest.items.map((_2, i2) => i2)) {
   const files = /* @__PURE__ */ new Map();
@@ -164144,11 +164238,11 @@ var init_credential_profile = __esm({
 });
 
 // ../store-release/iap-credentials.ts
-import { createHash as createHash39 } from "node:crypto";
+import { createHash as createHash40 } from "node:crypto";
 import { existsSync as existsSync75, readFileSync as readFileSync90, realpathSync as realpathSync12 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 function accountFingerprint(keyId, issuerId) {
-  return `sha256:${createHash39("sha256").update(`${issuerId}:${keyId}`).digest("hex").slice(0, 16)}`;
+  return `sha256:${createHash40("sha256").update(`${issuerId}:${keyId}`).digest("hex").slice(0, 16)}`;
 }
 function requireExplicitProfile(profileFlag, target) {
   const profile = profileFlag?.trim();
@@ -164235,7 +164329,7 @@ var init_wix_payments_contract = __esm({
 });
 
 // ../store-release/iap-draft.ts
-import { createHash as createHash40 } from "node:crypto";
+import { createHash as createHash41 } from "node:crypto";
 function fit(text9, max) {
   const chars = [...text9];
   return chars.length <= max ? text9 : `${chars.slice(0, max - 1).join("").trimEnd()}${ELLIPSIS}`;
@@ -164385,7 +164479,7 @@ var init_iap_draft = __esm({
     TIER_DESCRIPTION = "Unlocks one item in the app";
     ELLIPSIS = "\u2026";
     entityKey = (entityType, entityId) => `${entityType}:${entityId}`;
-    sha = (text9) => createHash40("sha256").update(text9).digest("hex");
+    sha = (text9) => createHash41("sha256").update(text9).digest("hex");
     ENTITIES = { "&amp;": "&", "&nbsp;": " ", "&lt;": "<", "&gt;": ">", "&quot;": '"', "&#39;": "'" };
     MAX_SUFFIX = 24;
     ReferenceNames = class {
@@ -164711,7 +164805,7 @@ var init_store_spec = __esm({
 
 // src/iap-config-edit.ts
 import { existsSync as existsSync76, readFileSync as readFileSync92 } from "node:fs";
-import { basename as basename20, join as join77 } from "node:path";
+import { basename as basename21, join as join77 } from "node:path";
 import ts8 from "typescript";
 function bindPurchasesAppInConfig(source, options) {
   const fileName = options.fileName ?? "config.ts";
@@ -164798,14 +164892,14 @@ function withStoreBundle(dir, options) {
 function previewIapConfigEdit(dir, options) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
-  if (isSymlink2(path2)) return { path: path2, changed: false, applied: [], conflicts: [], instructions: [`${basename20(path2)} is a symlink, so it would not be edited: add the purchases app in the file it points to.`] };
-  const { changed, applied, conflicts, instructions } = bindPurchasesAppInConfig(readFileSync92(path2, "utf8"), { ...withStoreBundle(dir, options), fileName: basename20(path2) });
+  if (isSymlink2(path2)) return { path: path2, changed: false, applied: [], conflicts: [], instructions: [`${basename21(path2)} is a symlink, so it would not be edited: add the purchases app in the file it points to.`] };
+  const { changed, applied, conflicts, instructions } = bindPurchasesAppInConfig(readFileSync92(path2, "utf8"), { ...withStoreBundle(dir, options), fileName: basename21(path2) });
   return { path: path2, changed, applied, conflicts, instructions };
 }
 async function applyIapConfigEdit(dir, options, validate5) {
   const path2 = configEntry(dir);
   if (!path2) return void 0;
-  const fileName = basename20(path2);
+  const fileName = basename21(path2);
   const refuse7 = (why) => ({ path: path2, changed: false, applied: [], conflicts: [], instructions: [why] });
   if (isSymlink2(path2)) return refuse7(`${fileName} is a symlink, so it was not edited: add the purchases app in the file it points to.`);
   const original = readFileSync92(path2, "utf8");
@@ -165265,7 +165359,7 @@ var init_store_iap_connect = __esm({
 });
 
 // src/store-iap-screenshots.ts
-import { dirname as dirname41, join as join78, relative as relative15 } from "node:path";
+import { dirname as dirname41, join as join78, relative as relative16 } from "node:path";
 function purchaseScreensFor(item) {
   const screen = item.wix && PURCHASE_SCREENS[item.wix.entityType];
   if (!screen || !item.wix) return [];
@@ -165393,7 +165487,7 @@ async function shoot(selected, run2, outDir) {
   } catch (e2) {
     return { ...report3, skipped: `could not save the screenshot: ${e2.message}` };
   }
-  return { ...report3, screenshot: relative15(dirname41(run2.manifestPath), path2) };
+  return { ...report3, screenshot: relative16(dirname41(run2.manifestPath), path2) };
 }
 function visibleText2(html) {
   return html.replace(/&nbsp;|&#160;|&#xa0;/gi, "\xA0").replace(/&amp;/g, "&");
@@ -166669,7 +166763,7 @@ __export(preflight_app_exports, {
   readXcconfigVars: () => readXcconfigVars
 });
 import { readFileSync as readFileSync95, existsSync as existsSync78, readdirSync as readdirSync34, statSync as statSync21 } from "node:fs";
-import { createHash as createHash41 } from "node:crypto";
+import { createHash as createHash42 } from "node:crypto";
 import { dirname as dirname43, join as join81 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
   const f2 = [];
@@ -167050,7 +167144,7 @@ function placeholderHashes2() {
     const p2 = join81(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
       if (!statSync21(p2).isFile()) continue;
-      return [LEGACY_PLACEHOLDER_SHA2562, createHash41("sha256").update(readFileSync95(p2)).digest("hex")];
+      return [LEGACY_PLACEHOLDER_SHA2562, createHash42("sha256").update(readFileSync95(p2)).digest("hex")];
     } catch {
     }
   }
@@ -167087,7 +167181,7 @@ async function appIconState(iosDir) {
     try {
       if (!statSync21(p2).isFile()) continue;
       const bytes2 = readFileSync95(p2);
-      const hash2 = createHash41("sha256").update(bytes2).digest("hex");
+      const hash2 = createHash42("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
       return {
         exists: true,
@@ -167690,7 +167784,7 @@ var init_site_member = __esm({
 });
 
 // src/notify-ping-all.ts
-import { createHash as createHash42 } from "node:crypto";
+import { createHash as createHash43 } from "node:crypto";
 async function listApprovedMembers(input) {
   const first = await scanMembers(input);
   const second = await scanMembers(input);
@@ -167744,7 +167838,7 @@ async function scanMembers(input) {
   }
 }
 function campaignRequestId(campaignId, memberId) {
-  const bytes2 = createHash42("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
+  const bytes2 = createHash43("sha256").update(JSON.stringify(["himi-push-campaign", campaignId, memberId])).digest().subarray(0, 16);
   bytes2[6] = bytes2[6] & 15 | 80;
   bytes2[8] = bytes2[8] & 63 | 128;
   const hex2 = bytes2.toString("hex");
@@ -168728,7 +168822,7 @@ __export(generate_exports, {
   withHeader: () => withHeader,
   writeGenerated: () => writeGenerated
 });
-import { createHash as createHash43 } from "node:crypto";
+import { createHash as createHash44 } from "node:crypto";
 import { existsSync as existsSync80, mkdirSync as mkdirSync38, readdirSync as readdirSync35, readFileSync as readFileSync100, writeFileSync as writeFileSync34 } from "node:fs";
 import { dirname as dirname46, join as join84 } from "node:path";
 function withHeader(body) {
@@ -168894,7 +168988,7 @@ var init_generate = __esm({
     GENERATED_HEADER = "// @generated by himi base44 screens \u2014 sha256:";
     HEADER_RE = /^\/\/ @generated by himi base44 screens — sha256:([0-9a-f]{64})\n/;
     ENGINE_FILES = ["tier5-src/_shared/entity-list.ts", "tier5-src/_shared/entity-detail.ts", "tier5-src/_shared/entity-plan.ts", "dev/entity-screens.ts"];
-    sha2566 = (s2) => createHash43("sha256").update(s2).digest("hex");
+    sha2566 = (s2) => createHash44("sha256").update(s2).digest("hex");
     planFile = (p2) => `${p2.ids.bundleDetail}-plan`;
     ident = (p2) => `plan_${p2.ids.detail.replace(/^b44_/, "")}`;
     json7 = (v2) => JSON.stringify(v2, null, 2);
@@ -172272,9 +172366,9 @@ function tokensFromWst(wst) {
   if (surface2) colors.surfaceSecondary = { light: surface2 };
   const opaque = (c2) => c2 && c2.length === 7 ? c2 : void 0;
   const surface = opaque(usableCssColor(wst["--wst-color-fill-base-1"]));
-  const ramp = !surface ? [] : ["--wst-color-fill-base-shade-1", "--wst-color-fill-base-shade-2", "--wst-color-fill-base-shade-3"].map((v2) => opaque(usableCssColor(wst[v2]))).filter((c2) => !!c2).map((c2) => ({ c: c2, ratio: contrastRatio(c2, surface) }));
+  const ramp = !surface ? [] : ["--wst-color-fill-base-shade-1", "--wst-color-fill-base-shade-2", "--wst-color-fill-base-shade-3"].map((v2) => opaque(usableCssColor(wst[v2]))).filter((c2) => !!c2).map((c2) => ({ c: c2, ratio: contrastRatio2(c2, surface) }));
   const primary = surface ? opaque(usableCssColor(wst["--wst-color-text-primary"])) : void 0;
-  const primaryRatio = primary && surface ? contrastRatio(primary, surface) : void 0;
+  const primaryRatio = primary && surface ? contrastRatio2(primary, surface) : void 0;
   const tertiary = primaryRatio === void 0 ? void 0 : ramp.filter((x2) => x2.ratio >= 4.5 && x2.ratio < primaryRatio).sort((a2, b2) => a2.ratio - b2.ratio)[0];
   if (tertiary) colors.textTertiary = { light: tertiary.c };
   const border = ramp.filter((x2) => x2.ratio >= 1.3 && x2.ratio <= 3).sort((a2, b2) => a2.ratio - b2.ratio)[0];
@@ -177074,7 +177168,7 @@ var init_errors2 = __esm({
 });
 
 // src/one-app/collect.ts
-import { createHash as createHash44 } from "node:crypto";
+import { createHash as createHash45 } from "node:crypto";
 function isObject2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -177146,7 +177240,7 @@ function semanticFingerprint(structure) {
     }
     return JSON.stringify(value);
   };
-  return createHash44("sha256").update(canonical6(structure, true)).digest("hex");
+  return createHash45("sha256").update(canonical6(structure, true)).digest("hex");
 }
 async function collectOneApp(input, deps = {}) {
   if (typeof input.metaSiteId !== "string" || !UUID.test(input.metaSiteId)) {
@@ -177358,7 +177452,7 @@ var init_collect = __esm({
 });
 
 // src/one-app/validate-topbar.ts
-import { createHash as createHash45 } from "node:crypto";
+import { createHash as createHash46 } from "node:crypto";
 import { readFileSync as readFileSync105, statSync as statSync22 } from "node:fs";
 import { resolve as resolve62, join as join92 } from "node:path";
 import ts9 from "typescript";
@@ -177516,7 +177610,7 @@ function validate4(evidenceDir, contentDir2) {
     if (typeof expectedHash !== "string" || !/^[a-f0-9]{64}$/i.test(expectedHash)) {
       throw new Error("manifest.json is missing a valid raw-structure.json hash.");
     }
-    if (createHash45("sha256").update(rawBytes).digest("hex") !== expectedHash) {
+    if (createHash46("sha256").update(rawBytes).digest("hex") !== expectedHash) {
       throw new Error("raw-structure.json does not match the hash recorded in manifest.json.");
     }
     source = authoredControls(JSON.parse(rawBytes.toString("utf8")));
@@ -177993,7 +178087,7 @@ __export(cli_exports2, {
   runOneAppCommand: () => runOneAppCommand
 });
 import { closeSync as closeSync7, constants as constants4, lstatSync as lstatSync22, mkdirSync as mkdirSync43, openSync as openSync6, readFileSync as readFileSync106, realpathSync as realpathSync14, writeFileSync as writeFileSync41 } from "node:fs";
-import { createHash as createHash46 } from "node:crypto";
+import { createHash as createHash47 } from "node:crypto";
 import { dirname as dirname49, join as join93, parse as parse3, resolve as resolve63 } from "node:path";
 function readOptions(argv, cwd, commandIncluded) {
   let cursor = 0;
@@ -178134,7 +178228,7 @@ validate-topbar checks authored source top-bar controls against the migrated con
       throw new OneAppError("artifact_write_failed", "Could not save the migration evidence. Existing files were kept.", { stage });
     }
     artifacts[name] = path2;
-    hashes[name] = createHash46("sha256").update(content).digest("hex");
+    hashes[name] = createHash47("sha256").update(content).digest("hex");
     return path2;
   };
   const progress = (nextStage) => {
@@ -182933,9 +183027,9 @@ var init_context = __esm({
 import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync110, mkdirSync as mkdirSync45, writeFileSync as writeFileSync44, existsSync as existsSync89, rmSync as rmSync24, readdirSync as readdirSync36, statSync as statSync24, lstatSync as lstatSync23, accessSync, constants as constants5, renameSync as renameSync13, cpSync as cpSync3 } from "node:fs";
 import { execFile as execFile2, execFileSync as execFileSync7, spawnSync as spawnSync5, spawn as spawn7 } from "node:child_process";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
-import { createHash as createHash47, randomUUID as randomUUID11 } from "node:crypto";
+import { createHash as createHash48, randomUUID as randomUUID11 } from "node:crypto";
 import { tmpdir as tmpdir7, homedir as homedir15, hostname as hostname2 } from "node:os";
-import { join as join95, resolve as resolve66, relative as relative16, basename as basename21, dirname as dirname51 } from "node:path";
+import { join as join95, resolve as resolve66, relative as relative17, basename as basename22, dirname as dirname51 } from "node:path";
 import { fileURLToPath as fileURLToPath30 } from "node:url";
 
 // ../serve-cli/src/client.ts
@@ -187164,7 +187258,7 @@ function shellShaDivergenceWarnings(jobs) {
 }
 async function templatePublishName(sourceDir) {
   const id = await appId(sourceDir);
-  return IDENTITY_SENTINELS.some((s2) => id.includes(s2)) ? basename21(sourceDir) : id;
+  return IDENTITY_SENTINELS.some((s2) => id.includes(s2)) ? basename22(sourceDir) : id;
 }
 function templateNameError(name, from) {
   if (name.startsWith(TEMPLATE_APP_PREFIX)) {
@@ -187224,7 +187318,7 @@ async function appId(dir) {
     if (m2.name) return m2.name;
   } catch {
   }
-  return basename21(dir);
+  return basename22(dir);
 }
 async function contentVisibility(dir) {
   try {
@@ -188547,7 +188641,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
               try {
                 const bytes2 = readFileSync110(iconPath);
                 payload.icon = bytes2.toString("base64");
-                iconHash = createHash47("sha256").update(bytes2).digest("hex");
+                iconHash = createHash48("sha256").update(bytes2).digest("hex");
               } catch {
               }
             }
@@ -189031,7 +189125,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
             const { openUrl: openUrl2 } = await Promise.resolve().then(() => (init_open_url(), open_url_exports));
             openUrl2(url2);
           }
-          const handover = { file: out2, hint: `hand ${basename21(out2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` };
+          const handover = { file: out2, hint: `hand ${basename22(out2)} to the owner at the handover \u2014 one self-contained page of their app taking shape; send it beside the preview link, never instead of it` };
           const report3 = {
             ok: true,
             file: out2,
@@ -190364,7 +190458,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const manifest = outcome.manifest;
         const payload = await loadReleaseFromDir(declared, out2);
         const { shellQuote: shellQuote3 } = await Promise.resolve().then(() => (init_shell_quote(), shell_quote_exports));
-        const contentRel = relative16(process.cwd(), dir) || ".";
+        const contentRel = relative17(process.cwd(), dir) || ".";
         const contentArg2 = shellQuote3(contentRel);
         if (onlyRaw !== void 0) {
           const onlyDraft = flags.draft === true;
@@ -190426,7 +190520,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let localSourceHash;
           try {
             const { collectAppSource: collectAppSource2, zipAppSource: zipAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
-            localSourceHash = createHash47("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
+            localSourceHash = createHash48("sha256").update(zipAppSource2(collectAppSource2(dir).entries).toString("base64")).digest("hex");
           } catch {
           }
           return runReleasePatch({
@@ -192115,7 +192209,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           });
         }
         const bytes2 = readFileSync110(file2);
-        const sha2 = createHash47("sha256").update(bytes2).digest("hex");
+        const sha2 = createHash48("sha256").update(bytes2).digest("hex");
         const forScreens = (str10(flags["for-screen"]) ?? "").split(",").map((s2) => s2.trim()).filter(Boolean);
         if (flags["no-rebind"] !== void 0 && flags["no-rebind"] !== true) {
           io2.error(JSON.stringify({ ok: false, error: "no_rebind_takes_no_value", message: "--no-rebind is a switch and takes no value; pass it bare.", usage: PATCH_USAGE }));