@wix/himalaya-cli 0.1507.0 → 0.1508.0

package/dist/cli.mjs

@@ -1013,7 +1013,8 @@ var init_compiler_options = __esm({
 
 // src/scaffold.ts
 import { mkdirSync as mkdirSync2, writeFileSync as writeFileSync2, existsSync, readdirSync, readFileSync as readFileSync2, statSync, lstatSync, copyFileSync } from "node:fs";
-import { resolve, join as join2, dirname as dirname2 } from "node:path";
+import { spawnSync } from "node:child_process";
+import { resolve, join as join2, dirname as dirname2, sep as sep2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function keptPlanNote(kept) {
   if (!kept?.length) return void 0;
@@ -1056,6 +1057,20 @@ function defaultWorkerTsconfig() {
 function offRepoImports(body) {
   return body.replace(/(["'])@himalaya\/([^"']+)\1/g, "$1@wix/himalaya/$2$1");
 }
+function checkoutHead() {
+  const r3 = spawnSync("git", ["rev-parse", "HEAD"], { cwd: dirname2(TEMPLATES_DIR), encoding: "utf8" });
+  return r3.status === 0 ? r3.stdout.trim() : "";
+}
+function ensureCheckoutTemplates(run2 = spawnSync, headOf = checkoutHead) {
+  if (process.env.HIMI_TEMPLATES_FRESH || !existsSync(resolve(ENSURE_TEMPLATES, "../gen-templates.mts"))) return;
+  const head = headOf();
+  if (templatesEnsuredAt !== null && templatesEnsuredAt === head) return;
+  const r3 = run2(process.execPath, [ENSURE_TEMPLATES], { stdio: ["ignore", 2, 2] });
+  if (r3.status !== 0) {
+    throw new Error(`could not generate the starter templates (node ${ENSURE_TEMPLATES} exited ${r3.status ?? r3.signal})`);
+  }
+  templatesEnsuredAt = head;
+}
 function templateTakesBase44AppId(template) {
   if (!availableTemplates().includes(template)) return void 0;
   const config = join2(templateSourceDir(template), "config.ts");
@@ -1106,13 +1121,22 @@ function extractTemplateAppearance(tokens2) {
   const palette2 = [...new Set(slots.map((c2) => c2.toUpperCase()))].map((u2) => slots.find((c2) => c2.toUpperCase() === u2));
   return { ...accent ? { accent } : {}, ...slots.length >= 3 && palette2.length >= 2 ? { palette: palette2 } : {} };
 }
+function ensureTemplatesFor(...dirs) {
+  if (dirs.some((d2) => resolve(d2) === TEMPLATES_DIR || resolve(d2).startsWith(TEMPLATES_DIR + sep2))) ensureCheckoutTemplates();
+}
+function canonicalCatalogFiles(files, separator = sep2) {
+  const posix5 = (rel) => separator === "/" ? rel : rel.split(separator).join("/");
+  return Object.fromEntries(Object.entries(files).map(([rel, body]) => [posix5(rel), body]).sort(([a2], [b2]) => a2 < b2 ? -1 : a2 > b2 ? 1 : 0));
+}
 function availableTemplates() {
+  ensureCheckoutTemplates();
   const generated = existsSync(TEMPLATES_DIR) ? readdirSync(TEMPLATES_DIR).filter((d2) => !d2.includes(".build-") && statSync(join2(TEMPLATES_DIR, d2)).isDirectory()).filter((d2) => existsSync(join2(TEMPLATES_DIR, d2, "himalaya.content.json"))) : [];
   const showcase = SHOWCASE_TEMPLATE_NAMES.filter((name) => existsSync(join2(SHOWCASE_TEMPLATES_DIR, name, "himalaya.content.json")));
   return [.../* @__PURE__ */ new Set([...generated, ...showcase])].sort();
 }
 function templateSourceDir(template) {
   if (SHOWCASE_TEMPLATE_NAMES.includes(template)) return join2(SHOWCASE_TEMPLATES_DIR, template);
+  ensureCheckoutTemplates();
   return join2(TEMPLATES_DIR, template);
 }
 function idSegOf(name) {
@@ -1154,7 +1178,7 @@ function sentinelizeIdentity(body, identity) {
   }
   if (identity.name) {
     const re2 = new RegExp(`\\b(${NAME_FIELDS.join("|")})(["']?\\s*[:=]\\s*)(["'])${escapeRe(identity.name)}\\3`, "g");
-    out2 = out2.replace(re2, (_m, key3, sep21, q2) => `${key3}${sep21}${q2}__HIMI_APP_NAME__${q2}`);
+    out2 = out2.replace(re2, (_m, key3, sep22, q2) => `${key3}${sep22}${q2}__HIMI_APP_NAME__${q2}`);
   }
   return out2;
 }
@@ -1481,7 +1505,7 @@ A per-app \`npm i @wix/himalaya\` is optional and only buys your editor local ty
   );
   return finishScaffold({ dir, files, ...kept.length ? { kept: kept.sort() } : {} });
 }
-var PLAN_FILES, PACKAGE_GITIGNORE, MODULE_SOURCE_FILE, TEMPLATES_DIR, SHOWCASE_TEMPLATES_DIR, SHOWCASE_TEMPLATE_NAMES, BASE44_APP_ID_PLACEHOLDER, BASE44_APP_ID_RE, TEMPLATE_META_FILE, TEMPLATE_ICONS_DIR, HEX_COLOR, PALETTE_KEYS, IDENTITY_SENTINELS, SENTINEL_RE, escapeRe, NAME_FIELDS, IDENTITY_FILES, DOTID_RE, BINARY_EXTENSIONS, extOf;
+var PLAN_FILES, PACKAGE_GITIGNORE, MODULE_SOURCE_FILE, TEMPLATES_DIR, ENSURE_TEMPLATES, templatesEnsuredAt, SHOWCASE_TEMPLATES_DIR, SHOWCASE_TEMPLATE_NAMES, BASE44_APP_ID_PLACEHOLDER, BASE44_APP_ID_RE, TEMPLATE_META_FILE, TEMPLATE_ICONS_DIR, HEX_COLOR, PALETTE_KEYS, IDENTITY_SENTINELS, SENTINEL_RE, escapeRe, NAME_FIELDS, IDENTITY_FILES, DOTID_RE, BINARY_EXTENSIONS, extOf;
 var init_scaffold = __esm({
   "src/scaffold.ts"() {
     init_source_deny();
@@ -1491,6 +1515,8 @@ var init_scaffold = __esm({
     PACKAGE_GITIGNORE = [".himi/", "dist/", "node_modules/"];
     MODULE_SOURCE_FILE = /\.(?:[cm]?[jt]sx?)$/i;
     TEMPLATES_DIR = resolve(dirname2(fileURLToPath(import.meta.url)), "../templates");
+    ENSURE_TEMPLATES = resolve(TEMPLATES_DIR, "../../authoring-kit/ensure-templates.mjs");
+    templatesEnsuredAt = null;
     SHOWCASE_TEMPLATES_DIR = resolve(dirname2(fileURLToPath(import.meta.url)), "../showcase-apps");
     SHOWCASE_TEMPLATE_NAMES = ["video-courses", "base44-starter", "base44-booking", "base44-inspections", "base44-fitness", "base44-podcast"];
     BASE44_APP_ID_PLACEHOLDER = "ReplaceWithYourBase44AppId";
@@ -5910,7 +5936,7 @@ import { spawn } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { appendFileSync, closeSync, existsSync as existsSync6, lstatSync as lstatSync4, mkdirSync as mkdirSync5, openSync, readdirSync as readdirSync5, readFileSync as readFileSync7, readSync, renameSync as renameSync3, rmSync as rmSync2, statSync as statSync2, writeFileSync as writeFileSync5 } from "node:fs";
-import { isAbsolute, join as join8, relative, resolve as resolve5, sep as sep2 } from "node:path";
+import { isAbsolute, join as join8, relative, resolve as resolve5, sep as sep3 } from "node:path";
 function agentCovers(agent, cli) {
   if (isCliEntry(agent)) return false;
   const agentShas = shasOf(agent.images);
@@ -6223,7 +6249,7 @@ function formatBrief(input) {
   const who = `himi \u2014 ${input.appName ?? "this folder"}`;
   const lines = [];
   if (!summary2.count) {
-    lines.push(`${who}: no journey journal yet (${PROGRESS_FILE.split(sep2).join("/")}).`);
+    lines.push(`${who}: no journey journal yet (${PROGRESS_FILE.split(sep3).join("/")}).`);
     lines.push(
       'A new app starts with discovery (step 1). An app built before journaling existed continues from its current state instead: confirm with the customer that its SPEC.md was approved rather than re-running discovery. Either way, journal each milestone with `himi progress "<what changed>" --step <n>` so the next session can pick up from it.'
     );
@@ -6338,7 +6364,7 @@ var init_progress = __esm({
         this.code = code;
       }
     };
-    toPosix = (p2) => p2.split(sep2).join("/");
+    toPosix = (p2) => p2.split(sep3).join("/");
     UnsafeHimiDirError = class extends Error {
       constructor(rel) {
         super(`${rel} is not a real directory inside the content package (a symlink?) \u2014 refusing to write through it`);
@@ -7245,7 +7271,7 @@ var init_preview = __esm({
 });
 
 // src/mcp/client-configs.ts
-import { dirname as dirname7, relative as relative2, resolve as resolve7, sep as sep3 } from "node:path";
+import { dirname as dirname7, relative as relative2, resolve as resolve7, sep as sep4 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function sourceCheckout(moduleUrl = import.meta.url) {
   if (!moduleUrl.endsWith(".ts")) return null;
@@ -7343,7 +7369,7 @@ var init_client_configs = __esm({
     HERE = dirname7(fileURLToPath4(import.meta.url));
     inside = (child, parent) => {
       const rel = relative2(parent, child);
-      return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep3) && !/^[A-Za-z]:/.test(rel);
+      return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep4) && !/^[A-Za-z]:/.test(rel);
     };
     same = (a2, b2) => JSON.stringify(a2) === JSON.stringify(b2);
     out = (o2) => `${JSON.stringify(o2, null, 2)}
@@ -7721,7 +7747,7 @@ __export(build_lib_exports, {
   umbrellaRewritePlugin: () => umbrellaRewritePlugin
 });
 import { fileURLToPath as fileURLToPath5, pathToFileURL } from "node:url";
-import { basename as basename3, dirname as dirname9, join as join11, resolve as resolve8, sep as sep4 } from "node:path";
+import { basename as basename3, dirname as dirname9, join as join11, resolve as resolve8, sep as sep5 } from "node:path";
 import { readdirSync as readdirSync6, existsSync as existsSync9, readFileSync as readFileSync10, realpathSync as realpathSync3, statSync as statSync3 } from "node:fs";
 async function loadCompiler() {
   try {
@@ -7769,7 +7795,7 @@ function realpathOrSelf(p2) {
   }
 }
 function isUnder(p2, root) {
-  return p2 === root || p2.startsWith(root + sep4);
+  return p2 === root || p2.startsWith(root + sep5);
 }
 function confinementRoots(contentRoot2) {
   const roots2 = /* @__PURE__ */ new Set();
@@ -8059,7 +8085,7 @@ function tsExtResolvePlugin() {
 }
 function importMetaUrlPlugin({ scope: scope2 } = {}) {
   const scopes = scope2 ? [.../* @__PURE__ */ new Set([realpathOrSelf(scope2), resolve8(scope2)])] : [];
-  const inScope = (p2) => scopes.some((r3) => p2 === r3 || p2.startsWith(r3 + sep4));
+  const inScope = (p2) => scopes.some((r3) => p2 === r3 || p2.startsWith(r3 + sep5));
   return {
     name: "himalaya-import-meta-url",
     setup(b2) {
@@ -8747,7 +8773,7 @@ var init_tier5_dir = __esm({
 
 // src/tier5-typecheck.ts
 import { existsSync as existsSync10, readFileSync as readFileSync11 } from "node:fs";
-import { relative as relative3, resolve as resolve10, sep as sep5 } from "node:path";
+import { relative as relative3, resolve as resolve10, sep as sep6 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadTypeScript() {
   const runtime = process.env.HIMI_AUTHORING_RUNTIME_DIR;
@@ -8786,7 +8812,7 @@ function pathsFor(options) {
   return declarationPaths(options.umbrellaDir);
 }
 function relativeFile(contentDir2, fileName) {
-  return relative3(contentDir2, fileName).split(sep5).join("/");
+  return relative3(contentDir2, fileName).split(sep6).join("/");
 }
 function belongsToContentWorkers(contentDir2, diagnostic) {
   if (!diagnostic.file) return true;
@@ -8964,7 +8990,7 @@ var init_provisioning_facts = __esm({
 // ../../core/dev-server/src/app-assets.ts
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync11, lstatSync as lstatSync7, readFileSync as readFileSync13, readdirSync as readdirSync8, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
-import { join as join12, resolve as resolve12, sep as sep6 } from "node:path";
+import { join as join12, resolve as resolve12, sep as sep7 } from "node:path";
 function contentTypeFor(name) {
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
   return CONTENT_TYPES[ext] ?? "application/octet-stream";
@@ -8985,7 +9011,7 @@ function findAssetsDir(appDir3) {
   const rel = typeof declared === "string" && declared ? declared : "assets";
   const abs = resolve12(appDir3, rel);
   const base = resolve12(appDir3);
-  if (abs !== base && !abs.startsWith(base + sep6)) return null;
+  if (abs !== base && !abs.startsWith(base + sep7)) return null;
   return existsSync11(abs) && statSync4(abs).isDirectory() ? abs : null;
 }
 function readOtaOnlyPatterns(appDir3) {
@@ -9043,7 +9069,7 @@ function collectBrandFonts(appDir3) {
     try {
       if (!lstatSync7(path2).isFile()) continue;
       const root = realpathSync4(appDir3);
-      if (!realpathSync4(path2).startsWith(root + sep6)) continue;
+      if (!realpathSync4(path2).startsWith(root + sep7)) continue;
     } catch {
       continue;
     }
@@ -12521,8 +12547,8 @@ function textOf(node) {
 function plainText(node) {
   if (typeOf2(node) === "TEXT") return str(at(node, "textData", "text"));
   const children = kids(node).filter(isObj);
-  const sep21 = children.every((c2) => typeOf2(c2) === "TEXT") ? "" : "\n";
-  return children.map(plainText).join(sep21);
+  const sep22 = children.every((c2) => typeOf2(c2) === "TEXT") ? "" : "\n";
+  return children.map(plainText).join(sep22);
 }
 function alignOf(v2) {
   switch (v2) {
@@ -17908,14 +17934,14 @@ var init_hhp_command = __esm({
 
 // src/hhp.ts
 import { existsSync as existsSync16, readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync10, renameSync as renameSync4, rmSync as rmSync5, lstatSync as lstatSync8, readdirSync as readdirSync12 } from "node:fs";
-import { basename as basename6, dirname as dirname13, resolve as resolve18, relative as relative4, sep as sep7, join as join15 } from "node:path";
+import { basename as basename6, dirname as dirname13, resolve as resolve18, relative as relative4, sep as sep8, join as join15 } from "node:path";
 import { createHash as createHash7, randomUUID as randomUUID3 } from "node:crypto";
 import ts3 from "typescript";
 function localPath(root, path2, from = join15(root, "hhp.json")) {
   if (/^[a-z]+:|^\/\//i.test(path2)) throw new Error("HHP source dependencies must be local files.");
   const target = resolve18(dirname13(from), path2), rel = relative4(resolve18(root), target);
-  if (rel.startsWith(`..${sep7}`) || rel === ".." || !rel || target === resolve18(root)) throw new Error("HHP source path escapes the app.");
-  const components2 = rel.split(sep7);
+  if (rel.startsWith(`..${sep8}`) || rel === ".." || !rel || target === resolve18(root)) throw new Error("HHP source path escapes the app.");
+  const components2 = rel.split(sep8);
   let current = resolve18(root);
   for (const component of components2) {
     current = join15(current, component);
@@ -18038,13 +18064,13 @@ async function compileContentHhp(root, opts = {}) {
     for (const dependency of result2.dependencies.filter((f2) => /\.tsx?$/.test(f2))) inspect2(dependency);
     result2.manifest.requiredCapabilities = [...requiredCapabilities2].sort();
     outputs.set(`dev/hhp/${id}.descriptor.json`, JSON.stringify(result2.descriptor, null, 2) + "\n");
-    outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative4(root, node.file).split(sep7).join("/") }])) }, null, 2) + "\n");
+    outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative4(root, node.file).split(sep8).join("/") }])) }, null, 2) + "\n");
     if (result2.worker && result2.bundleName) {
       if (results.some((r3) => r3 !== result2 && r3.bundleName === result2.bundleName)) diagnostics.push({ code: "HHP-BUNDLE-ID", severity: "error", file: file2, line: 1, column: 1, message: "Screen ids normalize to the same bundle name." });
       const workerRel = `tier5-src/${result2.bundleName}/index.ts`;
       let worker = result2.worker;
       for (const dependency of result2.dependencies.filter((f2) => /\.(controller|service)\.tsx?$/.test(f2)))
-        worker = worker.replace(JSON.stringify(dependency), JSON.stringify(relative4(dirname13(join15(root, workerRel)), dependency).split(sep7).join("/").replace(/\.tsx?$/, ".js")));
+        worker = worker.replace(JSON.stringify(dependency), JSON.stringify(relative4(dirname13(join15(root, workerRel)), dependency).split(sep8).join("/").replace(/\.tsx?$/, ".js")));
       outputs.set(workerRel, worker);
     }
   }
@@ -22150,7 +22176,6 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
-    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -27549,7 +27574,7 @@ function redactBodyString(body) {
     } catch {
     }
   }
-  return body.replace(FORM_ASSIGNMENT_RE, (m2, name) => isSensitiveBodyName(name) ? `${name}=${REDACTED}` : m2).replace(JSON_FIELD_RE, (m2, name, sep21) => isSensitiveBodyName(name) ? `"${name}"${sep21}"${REDACTED}"` : m2).replace(JSON_FIELD_UNTERMINATED_RE, (m2, name, sep21) => isSensitiveBodyName(name) ? `"${name}"${sep21}"${REDACTED}` : m2).replace(BEARER_RE, (_m, s2) => `${s2} ${REDACTED}`);
+  return body.replace(FORM_ASSIGNMENT_RE, (m2, name) => isSensitiveBodyName(name) ? `${name}=${REDACTED}` : m2).replace(JSON_FIELD_RE, (m2, name, sep22) => isSensitiveBodyName(name) ? `"${name}"${sep22}"${REDACTED}"` : m2).replace(JSON_FIELD_UNTERMINATED_RE, (m2, name, sep22) => isSensitiveBodyName(name) ? `"${name}"${sep22}"${REDACTED}` : m2).replace(BEARER_RE, (_m, s2) => `${s2} ${REDACTED}`);
 }
 function createWixGatewayState() {
   return { mode: "record", rules: [], traffic: [], clients: /* @__PURE__ */ new Set(), seq: 0, ruleSeq: 0 };
@@ -32008,10 +32033,10 @@ async function runRicosImageUpload(o2) {
     } catch {
       return fail6("read");
     }
-    const sep21 = entry.uploadUrl.includes("?") ? "&" : "?";
+    const sep22 = entry.uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
-      res = await deps.fetch(`${entry.uploadUrl}${sep21}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
+      res = await deps.fetch(`${entry.uploadUrl}${sep22}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
     } catch {
       return fail6("put");
     }
@@ -32649,10 +32674,10 @@ async function runMediaFieldUpload(o2) {
     } catch (e2) {
       return { ok: false, reason: e2 instanceof Deadline ? "timeout" : "read" };
     }
-    const sep21 = uploadUrl.includes("?") ? "&" : "?";
+    const sep22 = uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
-      res = await bounded2(deps.fetch(`${uploadUrl}${sep21}filename=${encodeURIComponent(file2.fileName)}`, {
+      res = await bounded2(deps.fetch(`${uploadUrl}${sep22}filename=${encodeURIComponent(file2.fileName)}`, {
         method: "PUT",
         headers: { "Content-Type": file2.mimeType },
         body,
@@ -115774,8 +115799,8 @@ function ensureCountUpRuntime() {
     const neg = fixed.startsWith("-");
     const body = neg ? fixed.slice(1) : fixed;
     const [int2, frac] = body.split(".");
-    const sep21 = int2.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-    return (neg ? "-" : "") + sep21 + (frac ? "." + frac : "");
+    const sep22 = int2.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+    return (neg ? "-" : "") + sep22 + (frac ? "." + frac : "");
   };
   const animateEl = (el2) => {
     const node = el2;
@@ -126441,7 +126466,7 @@ var init_widgets = __esm({
 import { createServer as createServer2 } from "node:http";
 import { readFile, stat } from "node:fs/promises";
 import { readFileSync as readFileSync32, existsSync as existsSync28, watch, mkdirSync as mkdirSync15, rmSync as rmSync7 } from "node:fs";
-import { basename as basename8, dirname as dirname20, extname as extname2, join as join24, relative as relative5, resolve as resolve28, normalize as normalize3, sep as sep8 } from "node:path";
+import { basename as basename8, dirname as dirname20, extname as extname2, join as join24, relative as relative5, resolve as resolve28, normalize as normalize3, sep as sep9 } from "node:path";
 import { createHash as createHash16, randomUUID as randomUUID4 } from "node:crypto";
 import { fileURLToPath as fileURLToPath19, pathToFileURL as pathToFileURL5 } from "node:url";
 function readLogicBundle(read, tier5Dir, name) {
@@ -127310,7 +127335,7 @@ function startBundleSourceWatcher(state) {
   try {
     const watcher2 = watch(TIER5_SRC_ROOT, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename || !/\.(ts|tsx)$/.test(filename)) return;
-      const name = filename.split(sep8)[0];
+      const name = filename.split(sep9)[0];
       if (!name || name.startsWith(".")) return;
       pending.add(name);
       if (timer) clearTimeout(timer);
@@ -127458,12 +127483,12 @@ function servedTokensHash(app) {
   }
 }
 function appDependencyFiles(inputs, appDir3) {
-  const inside2 = (root, p2) => p2 === root || p2.startsWith(root + sep8);
+  const inside2 = (root, p2) => p2 === root || p2.startsWith(root + sep9);
   const out2 = /* @__PURE__ */ new Set();
   for (const raw of inputs) {
     const p2 = resolve28(raw);
     if (!inside2(ROOT6, p2) || inside2(resolve28(appDir3), p2) || inside2(HMR_TMP_DIR, p2)) continue;
-    if (p2.split(sep8).includes("node_modules")) continue;
+    if (p2.split(sep9).includes("node_modules")) continue;
     out2.add(p2);
   }
   return [...out2].sort();
@@ -127581,7 +127606,7 @@ function startAppSourceWatcher(state) {
   try {
     const watcher2 = watch(appDir3, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename) return;
-      const rel = String(filename).split(sep8).join("/");
+      const rel = String(filename).split(sep9).join("/");
       if (!classifyAppPath(rel)) return;
       pending.add(rel);
       if (timer) clearTimeout(timer);
@@ -129925,7 +129950,7 @@ var init_src5 = __esm({
 
 // ../../core/serve-storage/src/file-store.ts
 import { mkdirSync as mkdirSync16, readFileSync as readFileSync33, rmSync as rmSync8, writeFileSync as writeFileSync10, readdirSync as readdirSync16, existsSync as existsSync29 } from "node:fs";
-import { join as join25, resolve as resolve29, sep as sep9 } from "node:path";
+import { join as join25, resolve as resolve29, sep as sep10 } from "node:path";
 var FileReleaseStore;
 var init_file_store = __esm({
   "../../core/serve-storage/src/file-store.ts"() {
@@ -129962,7 +129987,7 @@ var init_file_store = __esm({
        */
       appDir(app) {
         const dir = resolve29(this.root, this.safe(app));
-        if (!dir.startsWith(this.root + sep9)) {
+        if (!dir.startsWith(this.root + sep10)) {
           throw new Error(`unsafe app id ${JSON.stringify(app)}: ${dir} is not inside the store root`);
         }
         return dir;
@@ -133738,8 +133763,8 @@ async function crawlScreenInner(opts) {
       if (linkable.has(target)) return true;
       for (const base of linkable) {
         if (target.length > base.length + 1 && target.startsWith(base)) {
-          const sep21 = target[base.length];
-          if (sep21 === "_" || sep21 === "/") return true;
+          const sep22 = target[base.length];
+          if (sep22 === "_" || sep22 === "/") return true;
         }
       }
       return false;
@@ -137604,13 +137629,13 @@ __export(studio_exports, {
 });
 import { createHash as createHash21 } from "node:crypto";
 import { existsSync as existsSync33, readdirSync as readdirSync19, readFileSync as readFileSync37, realpathSync as realpathSync6, statSync as statSync7 } from "node:fs";
-import { basename as basename9, extname as extname3, join as join29, relative as relative6, resolve as resolve31, sep as sep10 } from "node:path";
+import { basename as basename9, extname as extname3, join as join29, relative as relative6, resolve as resolve31, sep as sep11 } from "node:path";
 import { pathToFileURL as pathToFileURL6 } from "node:url";
 function realInside(dir, abs) {
   try {
     const root = realpathSync6(dir);
     const real = realpathSync6(abs);
-    return real.startsWith(root + sep10) ? real : null;
+    return real.startsWith(root + sep11) ? real : null;
   } catch {
     return null;
   }
@@ -141907,21 +141932,21 @@ var init_Matcher = __esm({
        * @returns {string}
        */
       toString(separator, includeNamespace = true) {
-        const sep21 = separator || this.separator;
-        const isDefault = sep21 === this.separator && includeNamespace === true;
+        const sep22 = separator || this.separator;
+        const isDefault = sep22 === this.separator && includeNamespace === true;
         if (isDefault) {
           if (this._pathStringCache !== null) {
             return this._pathStringCache;
           }
           const result = this.path.map(
             (n2) => n2.namespace ? `${n2.namespace}:${n2.tag}` : n2.tag
-          ).join(sep21);
+          ).join(sep22);
           this._pathStringCache = result;
           return result;
         }
         return this.path.map(
           (n2) => includeNamespace && n2.namespace ? `${n2.namespace}:${n2.tag}` : n2.tag
-        ).join(sep21);
+        ).join(sep22);
       }
       /**
        * Get path as array of tag names.
@@ -142623,76 +142648,76 @@ var init_redos = __esm({
 });
 
 // ../../node_modules/is-unsafe/src/contexts/nosql.js
-var sep11, NOSQL_PATTERNS, nosql_default;
+var sep12, NOSQL_PATTERNS, nosql_default;
 var init_nosql = __esm({
   "../../node_modules/is-unsafe/src/contexts/nosql.js"() {
-    sep11 = `["'\\s]*:`;
+    sep12 = `["'\\s]*:`;
     NOSQL_PATTERNS = [
       // ─── MongoDB $ operator injection ────────────────────────────────────────
       {
         id: "nosql-where-operator",
         description: "$where \u2014 executes arbitrary JavaScript server-side in MongoDB",
-        pattern: new RegExp(`\\$where${sep11}`, "i")
+        pattern: new RegExp(`\\$where${sep12}`, "i")
       },
       {
         id: "nosql-ne-operator",
         description: '$ne \u2014 "not equal" operator used to bypass equality checks',
-        pattern: new RegExp(`\\$ne${sep11}`, "i")
+        pattern: new RegExp(`\\$ne${sep12}`, "i")
       },
       {
         id: "nosql-gt-operator",
         description: '$gt \u2014 "greater than" used to bypass password/value checks',
-        pattern: new RegExp(`\\$gte?${sep11}`, "i")
+        pattern: new RegExp(`\\$gte?${sep12}`, "i")
       },
       {
         id: "nosql-lt-operator",
         description: '$lt / $lte \u2014 "less than" bypass variants',
-        pattern: new RegExp(`\\$lte?${sep11}`, "i")
+        pattern: new RegExp(`\\$lte?${sep12}`, "i")
       },
       {
         id: "nosql-regex-operator",
         description: "$regex \u2014 can be used to extract data character by character (blind injection)",
-        pattern: new RegExp(`\\$regex${sep11}`, "i")
+        pattern: new RegExp(`\\$regex${sep12}`, "i")
       },
       {
         id: "nosql-or-operator",
         description: "$or \u2014 logical OR; used to create always-true conditions",
-        pattern: new RegExp(`\\$or${sep11}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$or${sep12}\\s*\\[`, "i")
       },
       {
         id: "nosql-and-operator",
         description: "$and \u2014 logical AND operator injection",
-        pattern: new RegExp(`\\$and${sep11}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$and${sep12}\\s*\\[`, "i")
       },
       {
         id: "nosql-nor-operator",
         description: "$nor \u2014 logical NOR operator injection",
-        pattern: new RegExp(`\\$nor${sep11}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$nor${sep12}\\s*\\[`, "i")
       },
       {
         id: "nosql-exists-operator",
         description: "$exists \u2014 can enumerate fields to determine schema",
-        pattern: new RegExp(`\\$exists${sep11}`, "i")
+        pattern: new RegExp(`\\$exists${sep12}`, "i")
       },
       {
         id: "nosql-in-operator",
         description: "$in \u2014 matches any value in a list; can enumerate values",
-        pattern: new RegExp(`\\$in${sep11}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$in${sep12}\\s*\\[`, "i")
       },
       {
         id: "nosql-expr-operator",
         description: "$expr \u2014 allows aggregation expressions in queries (MongoDB 3.6+)",
-        pattern: new RegExp(`\\$expr${sep11}`, "i")
+        pattern: new RegExp(`\\$expr${sep12}`, "i")
       },
       {
         id: "nosql-function-operator",
         description: "$function \u2014 executes arbitrary JavaScript in MongoDB 4.4+",
-        pattern: new RegExp(`\\$function${sep11}`, "i")
+        pattern: new RegExp(`\\$function${sep12}`, "i")
       },
       {
         id: "nosql-accumulator-operator",
         description: "$accumulator \u2014 custom aggregation with arbitrary JS execution",
-        pattern: new RegExp(`\\$accumulator${sep11}`, "i")
+        pattern: new RegExp(`\\$accumulator${sep12}`, "i")
       },
       // ─── Prototype pollution ─────────────────────────────────────────────────
       {
@@ -148536,7 +148561,7 @@ __export(app_source_exports, {
 });
 import { createHash as createHash25 } from "node:crypto";
 import { readdirSync as readdirSync24, lstatSync as lstatSync13, readFileSync as readFileSync49, mkdirSync as mkdirSync23, writeFileSync as writeFileSync18, existsSync as existsSync42, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join38, resolve as resolve40, sep as sep12 } from "node:path";
+import { join as join38, resolve as resolve40, sep as sep13 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
 function walkSourceTree(dir, file2, skip, enter = () => {
@@ -148559,7 +148584,7 @@ function walkSourceTree(dir, file2, skip, enter = () => {
         skip(rel);
         continue;
       }
-      file2(rel.split(sep12).join("/"), rel);
+      file2(rel.split(sep13).join("/"), rel);
     }
   };
   walk2("");
@@ -148619,8 +148644,8 @@ function renderInputRootDirs(dir) {
 }
 function newestSourceChangeMs(dir) {
   const roots2 = renderInputRootDirs(dir);
-  const inRead = (hostRel) => !roots2 || roots2.has(hostRel.split(sep12)[0]);
-  const counts = (hostRel) => !hostRel.includes(sep12) || inRead(hostRel);
+  const inRead = (hostRel) => !roots2 || roots2.has(hostRel.split(sep13)[0]);
+  const counts = (hostRel) => !hostRel.includes(sep13) || inRead(hostRel);
   let newest = 0;
   walkSourceTree(
     dir,
@@ -148782,7 +148807,7 @@ function pruneEmptyDirs(root, rel, needed, removed) {
   let empty2 = true;
   for (const name of readdirSync24(rel ? join38(root, rel) : root)) {
     const childRel = rel ? join38(rel, name) : name;
-    const posix5 = childRel.split(sep12).join("/");
+    const posix5 = childRel.split(sep13).join("/");
     const kind = lstatSync13(join38(root, childRel));
     if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name, rel)) {
       empty2 = false;
@@ -148866,7 +148891,7 @@ __export(run_watch_exports, {
 });
 import { closeSync as closeSync4, constants as constants3, existsSync as existsSync43, fstatSync, lstatSync as lstatSync14, statSync as statSync14, readdirSync as readdirSync25, mkdirSync as mkdirSync24, openSync as openSync4, readFileSync as readFileSync50, realpathSync as realpathSync8, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync19, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID7 } from "node:crypto";
-import { extname as extname4, join as join39, relative as relative8, resolve as resolve41, sep as sep13 } from "node:path";
+import { extname as extname4, join as join39, relative as relative8, resolve as resolve41, sep as sep14 } from "node:path";
 function diffReleases(prev, next) {
   const bundles = Object.keys(next.bundles).filter((b2) => prev.bundles[b2]?.sha256 !== next.bundles[b2].sha256).sort();
   const changedBundles = new Set(bundles);
@@ -148894,7 +148919,7 @@ function reloadEvents(d2) {
 function hhpRasterDir(dir) {
   const assets = findAssetsDir(dir);
   if (!assets) return null;
-  const rel = relative8(dir, assets).split(sep13).join("/");
+  const rel = relative8(dir, assets).split(sep14).join("/");
   return rel ? `${rel}/hhp-raster` : "hhp-raster";
 }
 function ignoredChange(relPath, isDirectory = () => false, rasterDir = "assets/hhp-raster") {
@@ -149121,7 +149146,7 @@ function boardFile(dir, pathname) {
 function readConfined(root, rel) {
   try {
     if (!lstatSync14(root).isDirectory()) return null;
-    const parts = rel.split(sep13);
+    const parts = rel.split(sep14);
     let at2 = root;
     for (let i2 = 0; i2 < parts.length; i2++) {
       at2 = join39(at2, parts[i2]);
@@ -149129,7 +149154,7 @@ function readConfined(root, rel) {
       if (st2.isSymbolicLink() || !(i2 === parts.length - 1 ? st2.isFile() : st2.isDirectory())) return null;
     }
     const canonicalRoot = realpathSync8(root);
-    if (!realpathSync8(at2).startsWith(canonicalRoot + sep13)) return null;
+    if (!realpathSync8(at2).startsWith(canonicalRoot + sep14)) return null;
     const fd = openSync4(at2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
@@ -149640,13 +149665,13 @@ import { createHash as createHash28, randomUUID as randomUUID8 } from "node:cryp
 import { spawn as spawn4 } from "node:child_process";
 import { closeSync as closeSync5, existsSync as existsSync44, lstatSync as lstatSync17, readFileSync as readFileSync54, statSync as statSync15 } from "node:fs";
 import { createServer as createServer3 } from "node:net";
-import { basename as basename14, dirname as dirname28, isAbsolute as isAbsolute4, join as join43, relative as relative9, resolve as resolve42, sep as sep14 } from "node:path";
+import { basename as basename14, dirname as dirname28, isAbsolute as isAbsolute4, join as join43, relative as relative9, resolve as resolve42, sep as sep15 } from "node:path";
 function homeShotPath(dir, home) {
   const root = resolve42(dir);
   const base = resolve42(root, ".himi", "shots");
   const shot = resolve42(base, `${home}.png`);
-  if (!shot.startsWith(base + sep14)) return null;
-  for (let p2 = shot; p2 !== root && p2.startsWith(root + sep14); p2 = dirname28(p2)) {
+  if (!shot.startsWith(base + sep15)) return null;
+  for (let p2 = shot; p2 !== root && p2.startsWith(root + sep15); p2 = dirname28(p2)) {
     try {
       if (lstatSync17(p2).isSymbolicLink()) return null;
     } catch {
@@ -155069,7 +155094,7 @@ __export(eject_exports, {
   ejectModule: () => ejectModule
 });
 import { existsSync as existsSync58, mkdirSync as mkdirSync27, readFileSync as readFileSync68, writeFileSync as writeFileSync23 } from "node:fs";
-import { dirname as dirname33, join as join58, relative as relative10, resolve as resolve47, sep as sep15 } from "node:path";
+import { dirname as dirname33, join as join58, relative as relative10, resolve as resolve47, sep as sep16 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve47(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
   if (existsSync58(inRepo)) return { path: inRepo, form: "source" };
@@ -155122,7 +155147,7 @@ function ejectModule(opts) {
     if (!existsSync58(f2)) continue;
     const before = readFileSync68(f2, "utf8");
     let after = before;
-    let rel = relative10(dirname33(f2), target).split(sep15).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative10(dirname33(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q2 = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -155299,7 +155324,7 @@ __export(icon_exports, {
 });
 import { createHash as createHash31 } from "node:crypto";
 import { existsSync as existsSync59, mkdirSync as mkdirSync28, readFileSync as readFileSync69, statSync as statSync18, writeFileSync as writeFileSync24 } from "node:fs";
-import { basename as basename16, dirname as dirname34, join as join59, resolve as resolve48, sep as sep16 } from "node:path";
+import { basename as basename16, dirname as dirname34, join as join59, resolve as resolve48, sep as sep17 } from "node:path";
 function readManifest(dir) {
   try {
     return JSON.parse(readFileSync69(join59(dir, MANIFEST), "utf8"));
@@ -155316,7 +155341,7 @@ function declaredIconName(dir) {
 function iconDest(dir, name) {
   const base = resolve48(dir);
   const abs = resolve48(base, name);
-  if (!abs.startsWith(base + sep16)) {
+  if (!abs.startsWith(base + sep17)) {
     throw new Error(
       `himi icon: himalaya.content.json declares "icon": "${name}", which resolves outside the package (${abs}). Declare a path inside it, e.g. "${DEFAULT_CONTENT_ICON}".`
     );
@@ -155663,8 +155688,8 @@ function baseOf(target, linkable, known) {
   let best = null;
   for (const base of linkable ?? []) {
     if (!known.has(base) || target.length <= base.length + 1 || !target.startsWith(base)) continue;
-    const sep21 = target[base.length];
-    if ((sep21 === "_" || sep21 === "/") && (!best || base.length > best.length)) best = base;
+    const sep22 = target[base.length];
+    if ((sep22 === "_" || sep22 === "/") && (!best || base.length > best.length)) best = base;
   }
   return best;
 }
@@ -159654,10 +159679,10 @@ var init_cli_bridge = __esm({
 // src/mcp/file-tools.ts
 import { closeSync as closeSync6, constants as constants4, lstatSync as lstatSync21, mkdirSync as mkdirSync33, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync81, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync18, statSync as statSync19, writeSync, existsSync as existsSync69 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { dirname as dirname39, isAbsolute as isAbsolute7, join as join72, relative as relative13, resolve as resolve56, sep as sep17 } from "node:path";
+import { dirname as dirname39, isAbsolute as isAbsolute7, join as join72, relative as relative13, resolve as resolve56, sep as sep18 } from "node:path";
 import * as z2 from "zod";
 function within(root, p2) {
-  return p2 === root || p2.startsWith(root.endsWith(sep17) ? root : root + sep17);
+  return p2 === root || p2.startsWith(root.endsWith(sep18) ? root : root + sep18);
 }
 function realish(p2) {
   let cur = p2;
@@ -159665,14 +159690,14 @@ function realish(p2) {
   while (!existsSync69(cur)) {
     const up = dirname39(cur);
     if (up === cur) break;
-    tail.unshift(cur.slice(up.length + (up.endsWith(sep17) ? 0 : 1)));
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
     cur = up;
   }
   return join72(realpathSync10(cur), ...tail);
 }
 function symlinkComponent(base, abs) {
   let cur = base;
-  for (const part3 of relative13(base, abs).split(sep17).filter(Boolean)) {
+  for (const part3 of relative13(base, abs).split(sep18).filter(Boolean)) {
     cur = join72(cur, part3);
     try {
       if (lstatSync21(cur).isSymbolicLink()) return relative13(base, cur);
@@ -159711,7 +159736,7 @@ function onDiskSpelling(abs) {
   while (!existsSync69(cur)) {
     const up = dirname39(cur);
     if (up === cur) break;
-    tail.unshift(cur.slice(up.length + (up.endsWith(sep17) ? 0 : 1)));
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
     cur = up;
   }
   return join72(realpathSync10.native(cur), ...tail);
@@ -159771,7 +159796,7 @@ function listFiles(appDir3) {
         const rel = relative13(appDir3, p2);
         if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) continue;
         if (files.length >= MAX_LISTED) return false;
-        files.push({ path: rel.split(sep17).join("/"), bytes: statSync19(p2).size });
+        files.push({ path: rel.split(sep18).join("/"), bytes: statSync19(p2).size });
       }
     }
     return true;
@@ -160571,7 +160596,7 @@ __export(native_decode_exports, {
   runAndroidNativeDecode: () => runAndroidNativeDecode,
   runNativeDecode: () => runNativeDecode
 });
-import { execFileSync as execFileSync6, spawnSync as spawnSync3 } from "node:child_process";
+import { execFileSync as execFileSync6, spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync73, mkdirSync as mkdirSync37, mkdtempSync as mkdtempSync5, readFileSync as readFileSync84, rmSync as rmSync20, writeFileSync as writeFileSync31 } from "node:fs";
 import { homedir as homedir10, tmpdir as tmpdir6 } from "node:os";
 import { join as join78 } from "node:path";
@@ -160591,7 +160616,7 @@ function nativeOracleShipped() {
 function detectNativeDecode(options = {}) {
   const hostPlatform = options.hostPlatform ?? process.platform;
   const packageDir = options.packageDir ?? nativeDecodePackageDir();
-  const swiftAvailable = options.swiftAvailable ?? spawnSync3("swift", ["--version"], { stdio: "ignore" }).status === 0;
+  const swiftAvailable = options.swiftAvailable ?? spawnSync4("swift", ["--version"], { stdio: "ignore" }).status === 0;
   if (hostPlatform !== "darwin") {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
@@ -160893,7 +160918,7 @@ __export(browser_authoring_exports, {
 import { createServer as createServer4 } from "node:http";
 import { createHash as createHash38, randomBytes as randomBytes4 } from "node:crypto";
 import { existsSync as existsSync74, readdirSync as readdirSync33, readFileSync as readFileSync85, realpathSync as realpathSync11, statSync as statSync20 } from "node:fs";
-import { join as join79, posix as posix3, relative as relative15, sep as sep18 } from "node:path";
+import { join as join79, posix as posix3, relative as relative15, sep as sep19 } from "node:path";
 function humanMs(ms2) {
   return ms2 < 1e3 ? `${ms2}ms` : `${Math.round(ms2 / 1e3)}s`;
 }
@@ -160943,7 +160968,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       ];
       for (const abs of candidates) {
         if (!existsSync74(abs) || statSync20(abs).isDirectory()) continue;
-        const key3 = `/tier5-src/${relative15(tier5SrcDir, abs).split(sep18).join(posix3.sep)}`;
+        const key3 = `/tier5-src/${relative15(tier5SrcDir, abs).split(sep19).join(posix3.sep)}`;
         if (key3 in files) break;
         files[key3] = readFileSync85(abs, "utf8");
         queue.push(key3);
@@ -164280,6 +164305,11 @@ ${releaseId}`;
             ...m2.templateMeta.accent ? { accent: m2.templateMeta.accent } : {},
             ...m2.templateMeta.palette?.length ? { palette: m2.templateMeta.palette } : {},
             releaseId: m2.releaseId,
+            // The content address of the catalog view (`/v1/template-source`), which serve-control
+            // stamps as sha256(JSON.stringify(source)). Public so tools/ci/check-published-templates.mjs
+            // can tell a stale template from a current one without the source or a credential:
+            // `himi template publish --source-hash` computes the same hash from a checkout.
+            ...m2.sourceHash ? { sourceHash: m2.sourceHash } : {},
             minBinaryVersion: m2.minBinaryVersion,
             ...iconUrl ? { iconUrl } : {}
           });
@@ -165387,7 +165417,7 @@ __export(run_browser_exports, {
 });
 import { createServer as createServer6 } from "node:http";
 import { existsSync as existsSync84, readFileSync as readFileSync94 } from "node:fs";
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 import { dirname as dirname44, resolve as resolve68 } from "node:path";
 import { fileURLToPath as fileURLToPath30 } from "node:url";
 function stagedDir() {
@@ -165398,7 +165428,7 @@ function missingStaged() {
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
-  const r3 = spawnSync4(process.execPath, [resolve68(REPO2, "core/serve/scripts/stage-browser-plane.mjs")], {
+  const r3 = spawnSync5(process.execPath, [resolve68(REPO2, "core/serve/scripts/stage-browser-plane.mjs")], {
     cwd: REPO2,
     encoding: "utf8"
   });
@@ -177494,7 +177524,7 @@ var init_analyze = __esm({
 
 // src/base44-analyze/write-artifacts.ts
 import { existsSync as existsSync101, mkdirSync as mkdirSync45, readFileSync as readFileSync119, rmSync as rmSync29, writeFileSync as writeFileSync44 } from "node:fs";
-import { dirname as dirname52, join as join111, resolve as resolve74, sep as sep19 } from "node:path";
+import { dirname as dirname52, join as join111, resolve as resolve74, sep as sep20 } from "node:path";
 function isBookFolder(dir) {
   try {
     return JSON.parse(readFileSync119(join111(dir, "book.json"), "utf8")).kind === "base44-app-book";
@@ -177602,7 +177632,7 @@ function writeBase44Book(result, outDir, opts = {}) {
   for (const f2 of result.sourceFiles) {
     if (!safeRel(f2.path)) continue;
     const dest = join111(sourceRoot, ...f2.path.split("/"));
-    if (!dest.startsWith(sourceRoot + sep19)) continue;
+    if (!dest.startsWith(sourceRoot + sep20)) continue;
     mkdirSync45(dirname52(dest), { recursive: true });
     writeFileSync44(dest, f2.bytes);
   }
@@ -184117,8 +184147,8 @@ var init_customer_build = __esm({
 
 // src/site-analyze/apply.ts
 import { existsSync as existsSync103, readFileSync as readFileSync121, writeFileSync as writeFileSync47, copyFileSync as copyFileSync2, mkdirSync as mkdirSync48, realpathSync as realpathSync15, statSync as statSync27 } from "node:fs";
-import { dirname as dirname54, isAbsolute as isAbsolute9, join as join115, resolve as resolve78, sep as sep20 } from "node:path";
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { dirname as dirname54, isAbsolute as isAbsolute9, join as join115, resolve as resolve78, sep as sep21 } from "node:path";
+import { spawnSync as spawnSync6 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
   return `no OAuth redirect paired with client ${overlay.wix.clientId} \u2014 the app (and prepare:customer) will refuse to start until one is set. Register it with \`himi site client ensure --site ${overlay.siteId?.trim() || "<msid>"} --redirect-uri <uri> --yes\`, then re-run analyze with \`--redirect-uri <uri>\` (or export HIMI_BRANDED_LITE_WIX_REDIRECT_URI)`;
@@ -184247,7 +184277,7 @@ function buildMergedContract(options) {
   const contained = (root, rel) => {
     if (isAbsolute9(rel)) return void 0;
     const full = resolve78(root, rel);
-    return full.startsWith(resolve78(root) + sep20) ? full : void 0;
+    return full.startsWith(resolve78(root) + sep21) ? full : void 0;
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
@@ -184261,7 +184291,7 @@ function buildMergedContract(options) {
     } catch {
       return void 0;
     }
-    if (!real.startsWith(realRoot + sep20)) return void 0;
+    if (!real.startsWith(realRoot + sep21)) return void 0;
     try {
       if (!statSync27(real).isFile()) return void 0;
       mkdirSync48(dirname54(to2), { recursive: true });
@@ -184397,7 +184427,7 @@ async function applyOverlays(input) {
     const packageDir = dirname54(resolve78(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir3, packageDir, overlay });
     wrote.push(...staged);
-    const r3 = spawnSync5("npm", ["run", "prepare:customer", "--", "--contract", contract], {
+    const r3 = spawnSync6("npm", ["run", "prepare:customer", "--", "--contract", contract], {
       cwd: appDir3,
       encoding: "utf8"
     });
@@ -187471,7 +187501,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "refresh-wix",
   "empty-app-ok",
   "aab",
-  "managed"
+  "managed",
+  "source-hash"
 ]);
 var SWITCH_FLAGS = new Set([...BOOLEAN_FLAGS].filter((name) => name !== "deep"));
 var SWITCH_CONSEQUENCE = {
@@ -187481,6 +187512,7 @@ var SWITCH_CONSEQUENCE = {
   record: "silently ignored, it would leave you believing the fixture was refreshed",
   "no-oauth-app": "silently ignored, it would mint an OAuth client you asked to skip",
   "dry-run": "silently ignored, it would perform the real writes you asked to rehearse",
+  "source-hash": "silently ignored, it would PUBLISH the template instead of printing its source hash",
   "allow-destructive": "silently ignored, it would refuse the destructive step you opted into",
   static: "silently ignored, it would render HYDRATED when you asked for static",
   // `--wait=false` is the one spelling where "pass it bare" is the WRONG advice: bare `--wait`
@@ -188244,7 +188276,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            else skips it: outside CI it starts, and watch.note says why
   himi template list [--remote]            list starter templates + metadata (title/description/tags) + each one's start prompt
   himi template prompt <name>              print the prompt that starts an app from that template
-  himi template publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--visibility public|unlisted]
+  himi template publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--visibility public|unlisted] [--source-hash]
                                            publish an app AS a himi init --template on the serve plane
   himi template trim --keep <id,id,\u2026> | --from-spec [SPEC.md] [--content <dir>] [--links follow|drop] [--dry-run] [--force]
                                            cut a scaffolded template to the screens you keep (the home and
@@ -188992,7 +189024,7 @@ var COMMANDS = [
   { name: "hhp", summary: "author responsive HTML/CSS/TypeScript screens compiled to native SDUI and T5 workers; scaffold, inspect the app profile, lint or compile declared sources", required: "init <screen> | profile | lint | compile [--app <name>|--content <dir>] [--json] [--dry-run]" },
   { name: "captcha", summary: "create and store native CAPTCHA keys in Serve, or inspect setup status; customer setup verifies Wix site ownership; does not enable member CAPTCHA SDKs", required: "setup|status --app <app> [--content <dir>] [--site <msid>] [--ios-bundle-id <id>] [--android-package-name <id>] [--target <t>]" },
   { name: "init", summary: "scaffold a starter content package (OTA-only; no native shells). --template <t> starts from a full reference app (branded-lite = consumer storefront over a Wix site; owner-lite = owner CRUD/management) instead of the minimal counter; --templates lists bundled ones; --remote fetches the template off the serve plane (falls back to the bundled copy offline). The new app also gets its agent files (the same set `himi agent-init` writes: AGENTS.md, CLAUDE.md, the himalaya skill, HIMALAYA.md, a SessionStart hook) so the next session started inside it picks the work up; --no-agent skips them. It also makes the build board (.himi/studio/, exactly as `himi studio --no-open` does \u2014 it never opens a browser), so every later render, test, validate, push and progress entry refreshes it; and, for a template bundled with this CLI, it makes the FIRST PICTURE itself (never for a --remote one: that is its publisher's code, and a render runs it on this machine, so next[] leaves the render to the agent after it has read the code): exactly `himi render <homeScreenId> --png --mocks --device iphone` (offline \u2014 no request; never --live; --mocks loads the app's recorded data when it has any), run as a child it kills after a time budget, writing .himi/shots/<home>.png and journaling it (by: himi) as the STARTING POINT (\"Starting point: the <template> template, before any of your changes\") so the board and the journal hold a picture when init returns. init also records the source it wrote (.himi/init-source.json: a content fingerprint, Markdown left out), and the first home PNG render after the source diverges from it is journaled once as \"First look at your app\" \u2014 reported as `firstLook: {image}` or `{skipped: <reason>}`, never a failed init; `--no-first-look` skips it (for scripts and CI that render themselves). For a bundled template (never a --remote one \u2014 the preview would build and serve its publisher's code) init also STARTS the live preview itself: `himi run --watch --content <dir> --port <p> --no-open --idle-exit 30`, detached in its own process group with its output in .himi/watch.log, never waited for (the url is chosen before it builds), recorded in .himi/watch.json, and reported as `watch: {started, pid, url, board, log}` \u2014 or `{skipped: <reason>}` for a `CI` environment, a test runner, a watch already running, or a start that failed (never a failed init). Nothing else skips it: outside CI it is started, and `watch.note` says an opt-out was ignored. The envelope LEADS with `doNow`: three lines to run now (the consent preflight, the live preview \u2014 its url and board when init started it, else `himi run --watch --content <dir> &` with the board's path \u2014 and the postcard line), and ENDS with the same lines as `doNowAgain`, so an agent that reads only the head or only the tail (`| tail`) gets them; at a terminal they are also printed as plain text on stderr, before the JSON and again after it. Its `next[]` LEADS with the steps for THIS session, in this order for every app \u2014 the offline first render and that picture's `himi progress` postcard (only when init could not make the picture), the skill's consent preflight (authorize or mock any Wix or external startup request; with none, go straight on), and only then the live preview (the running one's url, or `himi run --watch &` when init did not start it) \u2014 ahead of the next-session guidance", required: "<name> [--dir] [--template <t>] [--remote] [--base44-app-id <id>] [--base44-app-url <https://tenant>] [--no-agent] [--no-first-look] | --templates" },
-  { name: "template", summary: "starter-template catalog + publishing. Every template is a SHOWCASE APP \u2014 a real published release you can open running before you start from it. `list` prints available templates with metadata (title/description/tags) plus each one's start prompt \u2014 pass --remote to include the serve-plane catalog so an agent can pick one; `prompt <name>` prints just that sentence for one template (the skill URL is the public door, or the plane named by --target/--serve-url); `publish` publishes an app AS a `himi init --template` (needs a himalaya.template.json; builds a previewable release + attaches the scaffold source; --source-dir overrides which tree becomes the source, --name sets the template name; bakes a launcher icon \u2014 --icon <png>, or the committed template-icons/<name>.png \u2014 and extracts accent/palette gallery meta from the scaffold's tokens.json; --visibility unlisted keeps it out of the /v1/templates catalog \u2014 templates default to public); `trim --keep <ids>` cuts an app scaffolded from a template down to those screens (the home, and any screen the navigation pins such as a drawer body, always stays) \u2014 it deletes the other SCREENS/TEMPLATED entries whole, prunes navigation (linkableScreens, tabBar, drawer, deep links, surfaces) and drops tier5-src workers no kept screen uses, then runs validate --strict and rolls everything back if it fails (--force keeps it, --dry-run writes nothing). A kept screen that links to a removed one is refused unless --links follow (keep those too) or --links drop (remove the taps). Adopting one: `inspect` writes the adoption inventory (.himi/adopt.json: screens, workers, which screens can call Wix/network on appear \u2014 bootsOffline \u2014 placeholder and sample copy, proposed Data access rows, typed-journey stubs); `screens` lists, shows, rewrites or adds ONE dev/index.ts entry; `sweep` replaces sample identity/copy inside string literals; `recommend` ranks the catalog for a business description or a site's verticals; `trim --from-spec` takes the kept screens from SPEC.md's Screen catalogue", required: "list [--remote] | prompt <name> | publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--visibility public|unlisted] [--target <t>] | trim --keep <id,id,\u2026>|--from-spec [SPEC.md] [--content <dir>] [--links follow|drop] [--dry-run] [--force] | inspect [--content <dir>] [--dry-run] | screens [--show <id>] [--write <id> --from <file>] [--add <id> --from <file>] | sweep --set 'Old=>New' | --map <file> [--dry-run] | recommend [--text <t>] [--verticals a,b] [--book <dir>] [--remote]" },
+  { name: "template", summary: "starter-template catalog + publishing. Every template is a SHOWCASE APP \u2014 a real published release you can open running before you start from it. `list` prints available templates with metadata (title/description/tags) plus each one's start prompt \u2014 pass --remote to include the serve-plane catalog so an agent can pick one; `prompt <name>` prints just that sentence for one template (the skill URL is the public door, or the plane named by --target/--serve-url); `publish` publishes an app AS a `himi init --template` (needs a himalaya.template.json; builds a previewable release + attaches the scaffold source; --source-dir overrides which tree becomes the source, --name sets the template name; bakes a launcher icon \u2014 --icon <png>, or the committed template-icons/<name>.png \u2014 and extracts accent/palette gallery meta from the scaffold's tokens.json; --visibility unlisted keeps it out of the /v1/templates catalog \u2014 templates default to public; --source-hash prints the sourceHash and iconHash a publish would be stored under, with no build or network, and exits); `trim --keep <ids>` cuts an app scaffolded from a template down to those screens (the home, and any screen the navigation pins such as a drawer body, always stays) \u2014 it deletes the other SCREENS/TEMPLATED entries whole, prunes navigation (linkableScreens, tabBar, drawer, deep links, surfaces) and drops tier5-src workers no kept screen uses, then runs validate --strict and rolls everything back if it fails (--force keeps it, --dry-run writes nothing). A kept screen that links to a removed one is refused unless --links follow (keep those too) or --links drop (remove the taps). Adopting one: `inspect` writes the adoption inventory (.himi/adopt.json: screens, workers, which screens can call Wix/network on appear \u2014 bootsOffline \u2014 placeholder and sample copy, proposed Data access rows, typed-journey stubs); `screens` lists, shows, rewrites or adds ONE dev/index.ts entry; `sweep` replaces sample identity/copy inside string literals; `recommend` ranks the catalog for a business description or a site's verticals; `trim --from-spec` takes the kept screens from SPEC.md's Screen catalogue", required: "list [--remote] | prompt <name> | publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--visibility public|unlisted] [--target <t>] [--source-hash] | trim --keep <id,id,\u2026>|--from-spec [SPEC.md] [--content <dir>] [--links follow|drop] [--dry-run] [--force] | inspect [--content <dir>] [--dry-run] | screens [--show <id>] [--write <id> --from <file>] [--add <id> --from <file>] | sweep --set 'Old=>New' | --map <file> [--dry-run] | recommend [--text <t>] [--verticals a,b] [--book <dir>] [--remote]" },
   { name: "build", summary: "compile tier5-src/<name>/index.ts -> dist/bundles/<name>.bundle.js with esbuild (--binary = resolve published @himalaya/*); semantic TypeScript checking belongs to himi validate", required: "[--content <dir>] [--binary]" },
   { name: "functions", summary: "inspect/invoke server functions and operate durable jobs or schedules", required: "list|describe|openapi|invoke | jobs list|get|cancel|retry|dlq | schedule describe|invoke [--app <a>] [--environment preview|production] [--release <id>]" },
   { name: "eject", summary: "take ownership of a shared flow module (auth|checkout|screens): copies its source into tier5-src/_ejected/ and repoints this package's imports at the copy. The ladder's escape hatch \u2014 for when the factory options cannot express what you need. AFTER EJECTING, CENTRAL FIXES NO LONGER REACH THIS APP, including future corrections to the fail-closed entitlement and confirm-the-session rules. The floor is unaffected: credentials still go only through the native auth actions and money only through the cashier rail.", required: "<auth|checkout|screens> [--content <dir>]" },
@@ -189072,7 +189104,7 @@ function helpJson() {
 
 // src/self-update.ts
 import { readFileSync as readFileSync39, mkdirSync as mkdirSync18, writeFileSync as writeFileSync12, existsSync as existsSync35, rmSync as rmSync10, statSync as statSync8, accessSync, constants } from "node:fs";
-import { execFile, execFileSync as execFileSync3, spawnSync } from "node:child_process";
+import { execFile, execFileSync as execFileSync3, spawnSync as spawnSync2 } from "node:child_process";
 import { randomUUID as randomUUID5 } from "node:crypto";
 import { homedir as homedir8, hostname } from "node:os";
 import { join as join31, resolve as resolve33, dirname as dirname23 } from "node:path";
@@ -189317,7 +189349,7 @@ function npmInstallArgs(registry2, version5) {
   return ["i", "-g", `${CLI_PACKAGE}@${version5}`, `--registry=${pinned}`, `--@wix:registry=${pinned}`];
 }
 var INSTALLABLE_SPEC = /^(?:latest|\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
-function createUpdateRunner(spawn8 = spawnSync) {
+function createUpdateRunner(spawn8 = spawnSync2) {
   return {
     install: async (registry2, version5) => {
       if (!isTrustedRegistry(registry2)) return { ok: false, detail: `refusing untrusted registry ${registry2}` };
@@ -189341,7 +189373,7 @@ function createUpdateRunner(spawn8 = spawnSync) {
       const root = globalNodeModulesRoot();
       const entry = root ? join31(root, "@wix", "himalaya-cli", "dist", "cli.mjs") : void 0;
       if (!entry || !existsSync35(entry)) return void 0;
-      const result = spawnSync(process.execPath, [entry, ...argv], {
+      const result = spawnSync2(process.execPath, [entry, ...argv], {
         // inherit keeps PIPED STDIN working — commands that read stdin must survive a re-exec.
         stdio: "inherit",
         env: { ...process.env, [UPDATE_REEXEC_ENV]: "1" }
@@ -190345,6 +190377,7 @@ async function templateCommand(ctx) {
       }
       const appDir3 = resolve46(str3(flags.dir) ?? process.cwd());
       const sourceDir = resolve46(str3(flags["source-dir"]) ?? appDir3);
+      ensureTemplatesFor(appDir3, sourceDir);
       let meta;
       try {
         meta = JSON.parse(readFileSync67(join57(sourceDir, TEMPLATE_META_FILE), "utf8"));
@@ -190375,6 +190408,28 @@ async function templateCommand(ctx) {
       const buildDir = materializeForPreview(appDir3, name, meta.title);
       if (buildDir !== appDir3) publishScratch.push(buildDir);
       const app = await appId(buildDir);
+      const catalogView = () => ({ files: canonicalCatalogFiles(sentinelizeArchive(readTemplateFiles(sourceDir), app)), meta });
+      const launcherIcon = () => {
+        const iconPath = str3(flags.icon) ? resolve46(str3(flags.icon)) : templateIconPath(name);
+        if (!iconPath) return void 0;
+        try {
+          const bytes2 = readFileSync67(iconPath);
+          return { bytes: bytes2, hash: createHash30("sha256").update(bytes2).digest("hex") };
+        } catch {
+          return void 0;
+        }
+      };
+      if (flags["source-hash"] === true) {
+        print({
+          ok: true,
+          template: name,
+          app: templateAppId,
+          published: false,
+          sourceHash: createHash30("sha256").update(JSON.stringify(catalogView())).digest("hex"),
+          iconHash: launcherIcon()?.hash ?? null
+        });
+        return 0;
+      }
       const strict = flags.strict === true;
       const force = flags.force === true;
       const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
@@ -190437,25 +190492,18 @@ async function templateCommand(ctx) {
         }));
         return 1;
       }
-      const iconPath = str3(flags.icon) ? resolve46(str3(flags.icon)) : templateIconPath(name);
-      let iconHash;
-      if (iconPath) {
-        try {
-          const bytes2 = readFileSync67(iconPath);
-          payload.icon = bytes2.toString("base64");
-          iconHash = createHash30("sha256").update(bytes2).digest("hex");
-        } catch {
-        }
-      }
+      const icon = launcherIcon();
+      const iconHash = icon?.hash;
+      if (icon) payload.icon = icon.bytes.toString("base64");
       payload.app = templateAppId;
       const { rebindReleaseId: rebindReleaseId2 } = await Promise.resolve().then(() => (init_build3(), build_exports2));
       payload.manifest = rebindReleaseId2({ ...payload.manifest, app: templateAppId, ...iconHash ? { iconHash } : {} });
-      const files = sentinelizeArchive(readTemplateFiles(sourceDir), app);
-      if (Object.keys(files).length === 0) {
+      const source = catalogView();
+      if (Object.keys(source.files).length === 0) {
         io2.error(JSON.stringify({ error: `no source files collected from ${sourceDir}` }));
         return 1;
       }
-      payload.source = { files, meta };
+      payload.source = source;
       const { collectAppSource: collectAppSource2, secretFindings: secretFindings2, zipAppSource: zipAppSource2, largestEntries: largestEntries2, MAX_APP_SOURCE_BYTES: MAX_APP_SOURCE_BYTES2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
       const templateArchive = collectAppSource2(sourceDir);
       const templateSecrets = secretFindings2(templateArchive.entries);
@@ -190611,7 +190659,7 @@ async function templateCommand(ctx) {
         icon: Boolean(iconHash),
         ...meta.accent ? { accent: meta.accent } : {},
         ...meta.palette ? { palette: meta.palette } : {},
-        sourceFiles: Object.keys(files).length,
+        sourceFiles: Object.keys(source.files).length,
         ...hasErrors && force ? { forcedPastErrors: true } : {},
         initWith: `himi init <new-app-name> --template ${name} --remote${targetFlag}`
       });
@@ -190626,7 +190674,7 @@ async function templateCommand(ctx) {
       }
     }
   }
-  io2.error(JSON.stringify({ error: "template needs a subcommand", usage: "himi template list [--remote] | himi template prompt <name> | himi template publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--target <t>] | himi template trim --keep <id,id,\u2026>|--from-spec [SPEC.md] [--content <dir>] [--links follow|drop] [--dry-run] [--force] | himi template inspect | himi template screens [--show <id>] [--write <id> --from <file>] | himi template sweep --set 'Old=>New' | himi template recommend --text <description>" }));
+  io2.error(JSON.stringify({ error: "template needs a subcommand", usage: "himi template list [--remote] | himi template prompt <name> | himi template publish [--dir <app>] [--source-dir <dir>] [--name <n>] [--icon <png>] [--target <t>] [--source-hash] | himi template trim --keep <id,id,\u2026>|--from-spec [SPEC.md] [--content <dir>] [--links follow|drop] [--dry-run] [--force] | himi template inspect | himi template screens [--show <id>] [--write <id> --from <file>] | himi template sweep --set 'Old=>New' | himi template recommend --text <description>" }));
   return 2;
 }
 
@@ -190844,7 +190892,7 @@ async function validateCommand(ctx) {
 import { readFileSync as readFileSync80 } from "node:fs";
 
 // src/dpx.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync67, readFileSync as readFileSync78 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { join as join70 } from "node:path";
@@ -190889,7 +190937,7 @@ function parseDpxAuthStatusIdentity(stdout) {
   return stdout.split("\n").map((l2) => l2.trim()).find(Boolean) || void 0;
 }
 var defaultRunner2 = (cmd, args) => {
-  const r3 = spawnSync2(cmd, args, { encoding: "utf8" });
+  const r3 = spawnSync3(cmd, args, { encoding: "utf8" });
   return { status: r3.status, stdout: r3.stdout ?? "", stderr: r3.stderr ?? "", error: r3.error };
 };
 function dpxAuthStatus(opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1507.0",
+  "version": "0.1508.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "9dc5e59ce68dd5d91e8e4618f90faf1cbb7ddb11ef0532104b244413"
+  "falconPackageHash": "1dcc0a1ea79af010948564037a6ea00f3df198f1a6cf8c8b37d42e86"
 }