@wix/himalaya-cli 0.1533.0 → 0.1535.0

package/dist/cli.mjs

@@ -2380,11 +2380,446 @@ var init_app_link = __esm({
 });
 
 // ../../core/serve-control/src/dist-jobs.ts
-var TOKEN_TTL_MS, CUSTOMER_UPLOAD_LEASE_MS, DIST_SHELLS, DEFAULT_DIST_SHELL, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES;
+var dist_jobs_exports = {};
+__export(dist_jobs_exports, {
+  ANDROID_FORMATS: () => ANDROID_FORMATS,
+  ANDROID_FORMAT_NOT_BUILT: () => ANDROID_FORMAT_NOT_BUILT,
+  ANDROID_FORMAT_NOT_REQUESTED: () => ANDROID_FORMAT_NOT_REQUESTED,
+  ANDROID_FORMAT_WRONG_SIGNER: () => ANDROID_FORMAT_WRONG_SIGNER,
+  ANDROID_SIGNING_ALIASES: () => ANDROID_SIGNING_ALIASES,
+  ANDROID_SIGNING_POLICIES: () => ANDROID_SIGNING_POLICIES,
+  CUSTOMER_UPLOAD_LEASE_MS: () => CUSTOMER_UPLOAD_LEASE_MS,
+  DEFAULT_ANDROID_FORMAT: () => DEFAULT_ANDROID_FORMAT,
+  DEFAULT_ANDROID_SIGNING: () => DEFAULT_ANDROID_SIGNING,
+  DEFAULT_BORROWABLE_IOS_IDS: () => DEFAULT_BORROWABLE_IOS_IDS,
+  DEFAULT_DIST_SHELL: () => DEFAULT_DIST_SHELL,
+  DEFAULT_DIST_SIGNING: () => DEFAULT_DIST_SIGNING,
+  DEFAULT_GIT_URL: () => DEFAULT_GIT_URL,
+  DIST_PACKAGE_NAME: () => DIST_PACKAGE_NAME,
+  DIST_PARAMS_FLAG: () => DIST_PARAMS_FLAG,
+  DIST_SHELLS: () => DIST_SHELLS,
+  JobServiceBroker: () => JobServiceBroker,
+  JobServiceError: () => JobServiceError,
+  MAX_MEASURABLE_IDENTITY_WINDOW: () => MAX_MEASURABLE_IDENTITY_WINDOW,
+  SCOPE_CANCEL: () => SCOPE_CANCEL,
+  SCOPE_CREATE: () => SCOPE_CREATE,
+  SCOPE_READ: () => SCOPE_READ,
+  WIX_MANAGED_SIGNING_ALIASES: () => WIX_MANAGED_SIGNING_ALIASES,
+  androidFormatSkewFailed: () => androidFormatSkewFailed,
+  borrowableIosIds: () => borrowableIosIds,
+  credsFromConfig: () => credsFromConfig,
+  customerUploadClaimable: () => customerUploadClaimable,
+  distJobSpec: () => distJobSpec,
+  encodeDistParams: () => encodeDistParams,
+  isBorrowableIosId: () => isBorrowableIosId,
+  isSuccess: () => isSuccess,
+  isTerminal: () => isTerminal,
+  isTerminalTestflightStatus: () => isTerminalTestflightStatus,
+  isValidDistAttemptId: () => isValidDistAttemptId,
+  nextCustomerUploadClaim: () => nextCustomerUploadClaim,
+  nextCustomerUploadSettlement: () => nextCustomerUploadSettlement,
+  resolveAndroidFormat: () => resolveAndroidFormat,
+  resolveAndroidSigning: () => resolveAndroidSigning,
+  resolveBorrowedIosId: () => resolveBorrowedIosId,
+  resolveDistSigning: () => resolveDistSigning,
+  testflightStatusRank: () => testflightStatusRank
+});
+function isTerminal(status) {
+  return !!status && !IN_FLIGHT.has(status);
+}
+function isSuccess(status) {
+  return status === "SUCCESS";
+}
+function snapshot(job) {
+  return {
+    id: String(job.id),
+    status: job.status ?? "STATUS_UNKNOWN",
+    ...job.buildUrl ? { buildUrl: String(job.buildUrl) } : {},
+    ...job.output ? { output: String(job.output) } : {},
+    ...typeof job.attemptNumber === "number" ? { attemptNumber: job.attemptNumber } : {}
+  };
+}
+function truncate(s2, max = 400) {
+  return s2.length > max ? `${s2.slice(0, max)}\u2026` : s2;
+}
+function credsFromConfig(cfg) {
+  const appDefId = cfg("POCO_APP_DEF_ID")?.trim();
+  const appSecret = cfg("POCO_APP_SECRET")?.trim();
+  if (!appDefId || !appSecret) return void 0;
+  return { appDefId, appSecret };
+}
+function isValidDistAttemptId(value2) {
+  return typeof value2 === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value2);
+}
+function customerUploadClaimable(pending, now) {
+  if (!pending) return false;
+  if (pending.status === "READY_FOR_UPLOAD") return true;
+  if (pending.status !== "UPLOADING") return false;
+  if (!pending.claimedAt) return true;
+  const claimedAt = Date.parse(pending.claimedAt);
+  const at2 = Date.parse(now);
+  return Number.isFinite(claimedAt) && Number.isFinite(at2) && at2 - claimedAt >= CUSTOMER_UPLOAD_LEASE_MS;
+}
+function nextCustomerUploadClaim(record2, now) {
+  if (!record2 || record2.status !== "SUCCESS" || !customerUploadClaimable(record2.customerAppStore, now)) return void 0;
+  return {
+    ...record2,
+    customerAppStore: { ...record2.customerAppStore, status: "UPLOADING", claimedAt: now },
+    updatedAt: now
+  };
+}
+function nextCustomerUploadSettlement(record2, claimedAt, update, now) {
+  const pending = record2?.customerAppStore;
+  if (!record2 || pending?.status !== "UPLOADING" || pending.claimedAt !== claimedAt) return void 0;
+  return {
+    ...record2,
+    customerAppStore: {
+      version: pending.version,
+      mode: pending.mode,
+      claimedAt: pending.claimedAt,
+      status: update.status,
+      ...update.error ? { error: update.error } : {},
+      ...update.delivery ? { delivery: update.delivery } : {}
+    },
+    updatedAt: now
+  };
+}
+function isTerminalTestflightStatus(status) {
+  return /(?:^|_)(?:COMPLETED|FAILED|NOT_FOUND)$/.test(status?.toUpperCase() ?? "");
+}
+function testflightStatusRank(status) {
+  const normalized = status?.toUpperCase() ?? "";
+  if (isTerminalTestflightStatus(normalized)) return 3;
+  if (/(?:^|_)UPLOADING$/.test(normalized)) return 2;
+  if (/(?:^|_)PENDING$/.test(normalized)) return 1;
+  return 0;
+}
+function borrowableIosIds(raw) {
+  const parsed = (raw ?? "").split(",").map((s2) => s2.trim().toLowerCase()).filter(Boolean);
+  return parsed.length > 0 ? parsed : DEFAULT_BORROWABLE_IOS_IDS;
+}
+function isBorrowableIosId(id, allowed2 = DEFAULT_BORROWABLE_IOS_IDS) {
+  const candidate = id.toLowerCase();
+  return allowed2.some(
+    (pattern) => pattern.endsWith("*") ? candidate.startsWith(pattern.slice(0, -1)) : candidate === pattern
+  );
+}
+function resolveBorrowedIosId(opts) {
+  const { requested, platform } = opts;
+  if (requested === void 0 || requested === null || requested === "") return {};
+  if (opts.selfServe || opts.role === "owner") {
+    return {
+      error: {
+        error: "operator_only_borrow_id",
+        message: "borrowIosBundleId is not available to self-serve credentials",
+        hint: "Ship the change over-the-air instead \u2014 OTA needs no rebuild and no borrowed signing identity."
+      }
+    };
+  }
+  if (typeof requested !== "string") {
+    return { error: { error: "invalid_borrow_id", message: "borrowIosBundleId must be a string" } };
+  }
+  const id = requested.trim().toLowerCase();
+  if (platform !== "ios") {
+    return {
+      error: {
+        error: "borrow_id_ios_only",
+        message: `borrowIosBundleId applies to iOS signing only (got platform "${platform}")`,
+        hint: "Android needs no provisioning profile \u2014 drop the flag for android builds."
+      }
+    };
+  }
+  if (!BUNDLE_ID_RE.test(id)) {
+    return {
+      error: {
+        error: "invalid_borrow_id",
+        message: `"${requested}" is not a valid reverse-DNS bundle id`
+      }
+    };
+  }
+  const allowed2 = opts.allowed ?? DEFAULT_BORROWABLE_IOS_IDS;
+  if (!isBorrowableIosId(id, allowed2)) {
+    return {
+      error: {
+        error: "borrow_id_not_allowed",
+        message: `"${id}" is not borrowable; allowed: ${allowed2.join(", ")}`,
+        hint: "Only internal enterprise ids may be borrowed \u2014 a store id would replace the real App Store app on the device. An operator can change this with HIMI_DIST_BORROWABLE_IOS_IDS."
+      }
+    };
+  }
+  return { bundleId: id };
+}
+function resolveDistSigning(requested) {
+  if (requested === void 0 || requested === null || requested === "") {
+    return { policy: DEFAULT_DIST_SIGNING };
+  }
+  if (typeof requested !== "string") {
+    return { error: { status: 400, body: { error: "invalid_signing", message: "signing must be a string" } } };
+  }
+  const want = requested.trim().toLowerCase();
+  if (WIX_MANAGED_SIGNING_ALIASES.includes(want)) return { policy: "wix-managed" };
+  if (want === "byo") return { policy: "byo" };
+  return {
+    error: {
+      status: 501,
+      body: {
+        error: "dist_signing_unsupported",
+        message: `signing "${requested}" is not implemented`,
+        supported: [DEFAULT_DIST_SIGNING, "byo"]
+      }
+    }
+  };
+}
+function resolveAndroidSigning(requested) {
+  if (requested === void 0 || requested === null || requested === "") {
+    return { policy: DEFAULT_ANDROID_SIGNING };
+  }
+  if (typeof requested !== "string") {
+    return { error: { status: 400, body: { error: "invalid_android_signing", message: "androidSigning must be a string" } } };
+  }
+  const want = requested.trim().toLowerCase();
+  const policy = Object.hasOwn(ANDROID_SIGNING_ALIASES, want) ? ANDROID_SIGNING_ALIASES[want] : void 0;
+  if (policy) return { policy };
+  return {
+    error: {
+      status: 400,
+      body: {
+        error: "invalid_android_signing",
+        message: `androidSigning "${requested}" is not a known policy`,
+        supported: ["qa-keystore", "wix-keystore", "debug"]
+      }
+    }
+  };
+}
+function androidFormatSkewFailed(record2) {
+  return record2.platform === "android" && typeof record2.error === "string" && [ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED].some((code) => record2.error.includes(`${code}:`));
+}
+function resolveAndroidFormat(requested) {
+  if (requested === void 0 || requested === null || requested === "") return { format: DEFAULT_ANDROID_FORMAT };
+  if (typeof requested === "string" && ANDROID_FORMATS.includes(requested)) {
+    return { format: requested };
+  }
+  return {
+    error: {
+      status: 400,
+      body: {
+        error: "invalid_android_format",
+        message: `androidFormat ${typeof requested === "string" ? `"${requested.slice(0, 40)}"` : `of type ${typeof requested}`} is not a known format`,
+        supported: [...ANDROID_FORMATS]
+      }
+    }
+  };
+}
+function encodeDistParams(env) {
+  return Buffer.from(JSON.stringify(env), "utf8").toString("base64url");
+}
+function distJobSpec(req) {
+  const envVars = {
+    APP_DIR: req.appDir,
+    // WHICH APP this binary is FOR, as distinct from which shell builds it. Without it the pool
+    // can only infer an app from APP_DIR — i.e. the shell — so it baked the SHELL's content and
+    // resolved the SHELL's OTA app id. A device-verified consequence: `himi dist --app demo-app`
+    // produced a binary rendering himi_branded_home. The shell is the container; this is the app.
+    HIMI_DIST_APP: req.app,
+    // (HIMI_DIST_PROVISIONING_ENV is set at the END of this object, after `req.env` — see there.)
+    // run-dist gates iOS on DIST_ENABLE_IOS / DIST_PROVISIONING_PROFILE / an explicit
+    // `[dist:ios]` IN THE COMMIT MESSAGE. A serve-brokered job has no commit by design, and
+    // `--force` only bypasses the `[dist]` tag gate — so without this an `--platform ios`
+    // request would skip the build and finish as SUCCESS with no install link. Asking for iOS
+    // through the API IS the explicit opt-in that `[dist:ios]` represents.
+    ...req.platform === "ios" ? { DIST_ENABLE_IOS: "1" } : {},
+    ...req.release ? { HIMI_DIST_RELEASE_PIN: req.release } : {},
+    ...req.contractUrl ? { HIMI_DIST_CONTRACT_URL: req.contractUrl } : {},
+    // Where the pool fetches the RELEASE to bake its offline seed from. Its absence is what makes
+    // the classic Falcon `[dist]` path fall back to building the seed from repo source.
+    ...req.seedUrl ? { HIMI_DIST_SEED_URL: req.seedUrl } : {},
+    ...req.platform === "android" && req.androidConfigUrl ? { HIMI_DIST_ANDROID_CONFIG_URL: req.androidConfigUrl } : {},
+    // Where the pool fetches its SIGNING IDENTITY (profile + p12 + password). A URL, not the
+    // bytes: the envelope is ~20KB of base64 and `command` is capped at MAX_COMMAND_CHARS — the
+    // same reason the brand contract travels this way. It also keeps key material out of the
+    // job params, which the pool echoes into its log.
+    ...req.signingUrl ? { HIMI_DIST_SIGNING_URL: req.signingUrl } : {},
+    // WHICH KEYSTORE the Android build signs with. Android only — on an iOS job this would be a
+    // variable nothing reads, and dispatching one implies a decision that was never made.
+    // A bundle dispatches the QA key BY NAME, never `wix-keystore`. `--aab` always means the Wix
+    // production key, and the new run-dist derives that from DIST_ANDROID_FORMAT itself, overriding
+    // this. Naming `wix-keystore` here would reach a run-dist OLDER than `--aab` too (the pool builds
+    // the release's own commit): it ignores the format, builds an installable APK, signs it with the
+    // Wix production key and uploads and announces it — the exact artifact the self-serve 403
+    // withholds. Naming NOTHING is not safe either: a pool machine with DIST_ANDROID_USE_WIX_KEYSTORE=1
+    // then hands that old runner the Wix key anyway. A named QA key outranks that machine setting, so
+    // an old runner signs an ordinary QA APK and the job fails as `android_format_not_built`.
+    ...req.platform === "android" && req.androidSigning ? { DIST_ANDROID_SIGNING: req.androidFormat === "aab" ? "qa-keystore" : req.androidSigning } : {},
+    // A Play bundle instead of an APK. Only when asked: the APK default needs no parameter, and a
+    // runner that predates the variable ignores it — which the result callback catches.
+    ...req.platform === "android" && req.androidFormat === "aab" ? { DIST_ANDROID_FORMAT: "aab" } : {},
+    ...req.previewRoute ? { HIMI_DIST_PREVIEW_ROUTE: req.previewRoute } : {},
+    ...req.callbackUrl ? { HIMI_DIST_CALLBACK_URL: req.callbackUrl } : {},
+    ...req.callbackToken ? { HIMI_DIST_CALLBACK_TOKEN: req.callbackToken } : {},
+    // The per-job artifact path component. Without it two concurrent jobs for one
+    // app+shell+platform+commit wrote the same ipa, manifest.plist and install.html, and the
+    // loser's install page then handed a tester the other build's binary.
+    ...req.jobNonce ? { HIMI_DIST_JOB_NONCE: req.jobNonce } : {},
+    // Who to DM the install link to. See DistJobRequest.requestedBy: the git-history guess the pool
+    // falls back to misroutes brokered builds to an unrelated colleague.
+    ...req.requestedBy ? { HIMI_DIST_REQUESTED_BY: req.requestedBy } : {},
+    ...req.env,
+    ...req.buildOrigin ? { HIMI_DIST_BUILD_ORIGIN: req.buildOrigin } : {},
+    // AFTER `req.env`, deliberately. This one field is the SHELL's declared answer, and it is the
+    // only thing standing between owner-lite and a build that reads the fetched contract under
+    // branded-lite's key — i.e. ignores it and ships unbranded while reporting success. `req.env`
+    // is operator config (`deps.env`), so a stray HIMI_DIST_PROVISIONING_ENV there is a plausible
+    // misconfiguration, and it would silently unbrand EVERY shell at once. Generic overrides do
+    // not get to answer a per-shell question.
+    ...req.provisioningEnv ? { HIMI_DIST_PROVISIONING_ENV: req.provisioningEnv } : {}
+  };
+  const command = `dist:${req.platform} ${DIST_PARAMS_FLAG} ${encodeDistParams(envVars)}`;
+  if (command.length > MAX_COMMAND_CHARS) {
+    throw new Error(
+      `dist command is ${command.length} chars (cap ${MAX_COMMAND_CHARS}); shrink the job env \u2014 pass large values as a URL the Mac job fetches, as the brand contract does`
+    );
+  }
+  return {
+    gitUrl: req.gitUrl ?? DEFAULT_GIT_URL,
+    gitCommitSha: req.gitCommitSha,
+    packageName: DIST_PACKAGE_NAME,
+    command,
+    // Job Service renders this metadata in Buildkite's job label. User labels are sanitized,
+    // and the runner also carries buildOrigin so it does not treat them as GitHub PR refs.
+    branchName: req.buildLabel ?? req.branchName ?? "master",
+    envVars,
+    ...req.xcodeVersion ? { xcodeVersion: req.xcodeVersion } : {}
+  };
+}
+var IN_FLIGHT, SCOPE_CREATE, SCOPE_READ, SCOPE_CANCEL, DEFAULT_BASE_URL, DEFAULT_OAUTH_URL, TOKEN_TTL_MS, JobServiceError, JobServiceBroker, CUSTOMER_UPLOAD_LEASE_MS, MAX_MEASURABLE_IDENTITY_WINDOW, DIST_SHELLS, DEFAULT_DIST_SHELL, DEFAULT_BORROWABLE_IOS_IDS, BUNDLE_ID_RE, DEFAULT_DIST_SIGNING, WIX_MANAGED_SIGNING_ALIASES, DEFAULT_ANDROID_SIGNING, ANDROID_SIGNING_POLICIES, ANDROID_SIGNING_ALIASES, DEFAULT_ANDROID_FORMAT, ANDROID_FORMATS, ANDROID_FORMAT_NOT_BUILT, ANDROID_FORMAT_WRONG_SIGNER, ANDROID_FORMAT_NOT_REQUESTED, DEFAULT_GIT_URL, DIST_PACKAGE_NAME, DIST_PARAMS_FLAG, MAX_COMMAND_CHARS;
 var init_dist_jobs = __esm({
   "../../core/serve-control/src/dist-jobs.ts"() {
+    IN_FLIGHT = /* @__PURE__ */ new Set(["CREATED", "QUEUED", "WORKING"]);
+    SCOPE_CREATE = "MRE.JOB_CREATE";
+    SCOPE_READ = "MRE.JOB_READ";
+    SCOPE_CANCEL = "MRE.CANCEL_JOB";
+    DEFAULT_BASE_URL = "https://bo.wix.com/job-service";
+    DEFAULT_OAUTH_URL = "https://www.wixapis.com/oauth/access";
     TOKEN_TTL_MS = 5 * 60 * 1e3;
+    JobServiceError = class extends Error {
+      constructor(message2, status, body) {
+        super(message2);
+        this.status = status;
+        this.body = body;
+        this.name = "JobServiceError";
+      }
+    };
+    JobServiceBroker = class {
+      baseUrl;
+      oauthUrl;
+      fetchImpl;
+      now;
+      creds;
+      /** scope -> { token, expiresAt } */
+      tokens = /* @__PURE__ */ new Map();
+      constructor(opts) {
+        if (!opts.creds?.appDefId || !opts.creds?.appSecret) {
+          throw new JobServiceError("job service credentials missing (POCO_APP_DEF_ID / POCO_APP_SECRET)");
+        }
+        this.creds = opts.creds;
+        this.baseUrl = (opts.baseUrl ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+        this.oauthUrl = opts.oauthUrl ?? DEFAULT_OAUTH_URL;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+        this.now = opts.now ?? Date.now;
+      }
+      /** Mint (or reuse) a token for one MRE scope. */
+      async token(scope2) {
+        const cached3 = this.tokens.get(scope2);
+        if (cached3 && cached3.expiresAt > this.now()) return cached3.token;
+        const res = await this.fetchImpl(this.oauthUrl, {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            grant_type: "client_credentials",
+            client_id: this.creds.appDefId,
+            client_secret: this.creds.appSecret,
+            scope: scope2
+          })
+        });
+        const text11 = await res.text();
+        if (!res.ok) {
+          throw new JobServiceError(`oauth failed for scope ${scope2}`, res.status, truncate(text11));
+        }
+        let token;
+        try {
+          token = JSON.parse(text11).access_token;
+        } catch {
+          throw new JobServiceError(`oauth returned non-JSON for scope ${scope2}`, res.status, truncate(text11));
+        }
+        if (!token) throw new JobServiceError(`oauth returned no access_token for scope ${scope2}`, res.status);
+        this.tokens.set(scope2, { token, expiresAt: this.now() + TOKEN_TTL_MS });
+        return token;
+      }
+      async call(scope2, method, path2, body) {
+        const token = await this.token(scope2);
+        const res = await this.fetchImpl(`${this.baseUrl}${path2}`, {
+          method,
+          // BARE token, not `Bearer <token>` — matches jobServiceApi's own header.
+          headers: { Authorization: token, ...body ? { "content-type": "application/json" } : {} },
+          ...body ? { body: JSON.stringify(body) } : {}
+        });
+        const text11 = await res.text();
+        if (!res.ok) {
+          throw new JobServiceError(`job service ${method} ${path2} failed`, res.status, truncate(text11));
+        }
+        if (!text11) return {};
+        try {
+          return JSON.parse(text11);
+        } catch {
+          throw new JobServiceError(`job service ${method} ${path2} returned non-JSON`, res.status, truncate(text11));
+        }
+      }
+      /**
+       * Create a NODE_COMMAND job on the Mac (or Linux) pool. Returns as soon as Job Service has
+       * queued it — this never waits for the build.
+       */
+      async createNodeCommand(spec, os2 = "mac", notify) {
+        for (const key3 of ["gitUrl", "gitCommitSha", "packageName", "command", "branchName"]) {
+          if (!spec[key3]) throw new JobServiceError(`createNodeCommand: missing ${key3}`);
+        }
+        const optionsKey = os2 === "linux" ? "linuxNodeCommandOptions" : "nodeCommandOptions";
+        const type = os2 === "linux" ? "LINUX_NODE_COMMAND" : "NODE_COMMAND";
+        const options = {
+          packageManager: "YARN",
+          // the only value Job Service accepts
+          gitUrl: spec.gitUrl,
+          gitCommitSha: spec.gitCommitSha,
+          packageName: spec.packageName,
+          command: spec.command,
+          branchName: spec.branchName,
+          ...spec.envVars ? { envVars: spec.envVars } : {}
+        };
+        if (os2 === "mac" && spec.xcodeVersion) options.xcodeVersion = spec.xcodeVersion;
+        const subscriptions = {
+          ...notify?.ownershipTags?.length ? { subscribedOwnershipTags: notify.ownershipTags } : {},
+          ...notify?.userIds?.length ? { subscribedUserIds: notify.userIds } : {}
+        };
+        const data = await this.call(SCOPE_CREATE, "POST", "/v1/job", {
+          job: { type, [optionsKey]: options, ...subscriptions }
+        });
+        const job = data?.job;
+        if (!job?.id) throw new JobServiceError("job service create returned no job id");
+        return snapshot(job);
+      }
+      /** Current state of a job. */
+      async read(jobId) {
+        const data = await this.call(SCOPE_READ, "GET", `/v1/job/${encodeURIComponent(jobId)}`);
+        const job = data?.job;
+        if (!job) throw new JobServiceError(`job service read returned no job for ${jobId}`);
+        return snapshot({ id: jobId, ...job });
+      }
+      /** Ask Job Service to cancel a queued/running job. */
+      async cancel(jobId) {
+        await this.call(SCOPE_CANCEL, "POST", `/v1/job/${encodeURIComponent(jobId)}/cancel`);
+      }
+    };
     CUSTOMER_UPLOAD_LEASE_MS = 15 * 60 * 1e3;
+    MAX_MEASURABLE_IDENTITY_WINDOW = 100;
     DIST_SHELLS = {
       "branded-lite": {
         appDir: "apps/himi-branded-lite",
@@ -2437,6 +2872,11 @@ var init_dist_jobs = __esm({
       }
     };
     DEFAULT_DIST_SHELL = "branded-lite";
+    DEFAULT_BORROWABLE_IOS_IDS = ["ent.*"];
+    BUNDLE_ID_RE = /^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*)+$/;
+    DEFAULT_DIST_SIGNING = "wix-managed";
+    WIX_MANAGED_SIGNING_ALIASES = ["wix-managed", "wix", "pool-enterprise"];
+    DEFAULT_ANDROID_SIGNING = "qa-keystore";
     ANDROID_SIGNING_POLICIES = ["qa-keystore", "wix-keystore", "debug"];
     ANDROID_SIGNING_ALIASES = {
       // The canonical spellings, derived so the two lists cannot drift apart.
@@ -2446,6 +2886,15 @@ var init_dist_jobs = __esm({
       wix: "wix-keystore",
       oneapp: "wix-keystore"
     };
+    DEFAULT_ANDROID_FORMAT = "apk";
+    ANDROID_FORMATS = ["apk", "aab"];
+    ANDROID_FORMAT_NOT_BUILT = "android_format_not_built";
+    ANDROID_FORMAT_WRONG_SIGNER = "android_format_wrong_signer";
+    ANDROID_FORMAT_NOT_REQUESTED = "android_format_not_requested";
+    DEFAULT_GIT_URL = "https://github.com/wix-private/himalaya";
+    DIST_PACKAGE_NAME = "@himalaya/native-ci";
+    DIST_PARAMS_FLAG = "--himi-dist";
+    MAX_COMMAND_CHARS = 2e3;
   }
 });
 
@@ -9873,16 +10322,16 @@ function scanWidgetPayload(node, family, path2, bindings, disallowed, timeRefs,
     scanWidgetPayload(v2, family, `${path2}.${k2}`, bindings, disallowed, timeRefs, intents, actionSites2);
   }
 }
-function validateWidget(snapshot2) {
+function validateWidget(snapshot3) {
   const validate5 = compileWidgetSchema();
-  const schemaOk = validate5(snapshot2);
+  const schemaOk = validate5(snapshot3);
   const schemaErrors = schemaOk ? [] : validate5.errors ?? [];
   const bindingViolations = [];
   const disallowedComponents = [];
   const timeRefViolations = [];
   const intentViolations = [];
   const actionSites2 = [];
-  const snap = snapshot2 ?? {};
+  const snap = snapshot3 ?? {};
   const family = snap.family;
   scanWidgetPayload(snap.payload, family, "$.payload", bindingViolations, disallowedComponents, timeRefViolations, intentViolations, actionSites2);
   if (snap.placeholderWhenStale !== void 0) {
@@ -13556,12 +14005,12 @@ function responseBytes(value2) {
     return 0;
   }
 }
-function restoredState(def, snapshot2) {
+function restoredState(def, snapshot3) {
   const declared = def?.state ?? {};
-  if (!snapshot2 || typeof snapshot2 !== "object" || Array.isArray(snapshot2)) return declared;
+  if (!snapshot3 || typeof snapshot3 !== "object" || Array.isArray(snapshot3)) return declared;
   const fresh = [def?.notHydrated, def?.perVisit].flatMap((keys) => Array.isArray(keys) ? keys : []);
   const merged = { ...declared };
-  for (const [key3, value2] of Object.entries(snapshot2)) {
+  for (const [key3, value2] of Object.entries(snapshot3)) {
     if (key3 !== "_error" && !fresh.includes(key3)) merged[key3] = value2;
   }
   return merged;
@@ -22600,6 +23049,7 @@ function resolveIdiom(tokens2, ctx = {}) {
 var IDIOM_CONTEXTS, UNSAFE_KEYS;
 var init_idiom = __esm({
   "../../core/ts/src/idiom.ts"() {
+    "use strict";
     IDIOM_CONTEXTS = {
       ios: { native: ["ios"] },
       android: { native: ["material"] },
@@ -28061,7 +28511,7 @@ function json(res, status, obj5) {
   res.setHeader("content-type", "application/json; charset=utf-8");
   res.end(body);
 }
-function truncate(s2) {
+function truncate2(s2) {
   if (s2 === void 0) return void 0;
   return s2.length > BODY_CAP ? s2.slice(0, BODY_CAP) + `\u2026[+${s2.length - BODY_CAP}B]` : s2;
 }
@@ -28076,8 +28526,8 @@ function redactHeaders(h2) {
 }
 function recordWixTraffic(gw, app, adminUrl, ev) {
   const full = { ...ev, id: ++gw.seq, app };
-  full.reqBody = truncate(redactBodyString(full.reqBody));
-  full.respBody = truncate(redactBodyString(full.respBody));
+  full.reqBody = truncate2(redactBodyString(full.reqBody));
+  full.respBody = truncate2(redactBodyString(full.respBody));
   gw.traffic.push(full);
   if (gw.traffic.length > TRAFFIC_CAP) gw.traffic.splice(0, gw.traffic.length - TRAFFIC_CAP);
   const text11 = `event: wix.traffic
@@ -116688,7 +117138,7 @@ function ensureListAnimateRuntime() {
   listAnimateRuntimeInstalled = true;
   const prevRects = /* @__PURE__ */ new WeakMap();
   const rowKey = (c2) => c2.dataset?.componentId ?? c2.querySelector("[data-component-id]")?.dataset?.componentId;
-  const snapshot2 = (host) => {
+  const snapshot3 = (host) => {
     const m2 = /* @__PURE__ */ new Map();
     Array.from(host.children).forEach((c2) => {
       const id = rowKey(c2);
@@ -116700,7 +117150,7 @@ function ensureListAnimateRuntime() {
   const flip = (host) => {
     const prev = prevRects.get(host);
     if (!prev) {
-      snapshot2(host);
+      snapshot3(host);
       return;
     }
     const next = /* @__PURE__ */ new Map();
@@ -116743,7 +117193,7 @@ function ensureListAnimateRuntime() {
   const scan = () => {
     document.querySelectorAll(hostSel).forEach((h2) => {
       if (!prevRects.has(h2)) {
-        snapshot2(h2);
+        snapshot3(h2);
         childObs.observe(h2, { childList: true });
       }
     });
@@ -121243,7 +121693,7 @@ var init_renderNode = __esm({
       }, [startPositionPath, boundStartPosition, status]);
       const emit = React12.useCallback((action, extra = {}) => {
         if (!action || !ctx.onAction) return;
-        const snapshot2 = {
+        const snapshot3 = {
           sessionId,
           state: status,
           status,
@@ -121258,7 +121708,7 @@ var init_renderNode = __esm({
           artist: String(item?.artist ?? ""),
           error
         };
-        ctx.onAction({ ...action, args: { ...action.args ?? {}, ...snapshot2, ...extra }, params: { ...action.params ?? {}, sessionId, index: String(index), ...Object.fromEntries(Object.entries(extra).map(([k2, v2]) => [k2, String(v2)])) } });
+        ctx.onAction({ ...action, args: { ...action.args ?? {}, ...snapshot3, ...extra }, params: { ...action.params ?? {}, sessionId, index: String(index), ...Object.fromEntries(Object.entries(extra).map(([k2, v2]) => [k2, String(v2)])) } });
       }, [ctx.onAction, sessionId, status, index, position, duration2, item, buffered, rate, props.muted, fullscreen, error]);
       React12.useEffect(() => {
         if (!isUnsupportedProvider || status === "error") return;
@@ -127551,15 +128001,15 @@ function interpretProduce(services, parsed) {
   }
   return { services, widgets, views };
 }
-function contentEtag(snapshot2) {
+function contentEtag(snapshot3) {
   const canonical7 = JSON.stringify({
-    widgetId: snapshot2.widgetId,
-    family: snapshot2.family,
-    size: snapshot2.size,
-    payload: snapshot2.payload,
-    deepLink: snapshot2.deepLink,
+    widgetId: snapshot3.widgetId,
+    family: snapshot3.family,
+    size: snapshot3.size,
+    payload: snapshot3.payload,
+    deepLink: snapshot3.deepLink,
     // Lever A — a timeline change must bump the etag (frame values/times are content).
-    frames: snapshot2.frames ?? null
+    frames: snapshot3.frames ?? null
   });
   return "sha256-" + createHash15("sha256").update(canonical7).digest("base64");
 }
@@ -127602,8 +128052,8 @@ function freezeCaptured(def, widgetId, opts = {}) {
     generatedAt: opts.generatedAt ?? Math.floor(Date.now() / 1e3),
     ...frames ? { frames } : {}
   };
-  const snapshot2 = { ...base, contentEtag: contentEtag(base) };
-  const result = validateWidget(snapshot2);
+  const snapshot3 = { ...base, contentEtag: contentEtag(base) };
+  const result = validateWidget(snapshot3);
   if (!result.ok) {
     const reasons = [];
     if (result.bindingViolations.length) {
@@ -127625,7 +128075,7 @@ function freezeCaptured(def, widgetId, opts = {}) {
     }
     throw new Error(`widget "${widgetId}" produced an invalid snapshot \u2014 ${reasons.join(" | ")}`);
   }
-  return snapshot2;
+  return snapshot3;
 }
 function viewWidgetId(viewId, family) {
   return `${viewId}.${family}`;
@@ -127725,8 +128175,8 @@ function freezeOverrideSnapshot(input, opts = {}) {
     ...input.placeholderWhenStale !== void 0 ? { placeholderWhenStale: input.placeholderWhenStale } : {},
     ...input.frames !== void 0 ? { frames: input.frames } : {}
   };
-  const snapshot2 = { ...base, contentEtag: contentEtag(base) };
-  const result = validateWidget(snapshot2);
+  const snapshot3 = { ...base, contentEtag: contentEtag(base) };
+  const result = validateWidget(snapshot3);
   if (!result.ok) {
     const reasons = [];
     if (result.bindingViolations.length) {
@@ -127748,7 +128198,7 @@ function freezeOverrideSnapshot(input, opts = {}) {
     }
     throw new Error(`override snapshot for "${input.widgetId}" is invalid \u2014 ${reasons.join(" | ")}`);
   }
-  return snapshot2;
+  return snapshot3;
 }
 var MAX_TIMELINE_FRAMES, WIDGET_BUDGET_MS, realmPromise, WidgetRealmUnavailableError, PRODUCE_CACHE_TTL_MS, MAX_PRODUCE_CACHE_ENTRIES, MAX_PRODUCE_ENTRY_BYTES, MAX_PRODUCE_CACHE_BYTES, produceCache, produceCacheGeneration, CAPTURE_SLOT, READBACK_SERVICE;
 var init_widgets = __esm({
@@ -130386,9 +130836,9 @@ async function buildSnapshotForId(widgetId, dir) {
   try {
     const js2 = loaded.bytes.toString("utf8");
     if (entry.view) {
-      const snapshot2 = await buildViewSnapshot(js2, entry.view.viewId, entry.view.surfaceId);
-      if (!snapshot2) return { ok: false, status: 404, error: "widget_not_found" };
-      return { ok: true, snapshot: snapshot2 };
+      const snapshot3 = await buildViewSnapshot(js2, entry.view.viewId, entry.view.surfaceId);
+      if (!snapshot3) return { ok: false, status: 404, error: "widget_not_found" };
+      return { ok: true, snapshot: snapshot3 };
     }
     return { ok: true, snapshot: await buildWidgetSnapshot(js2, widgetId) };
   } catch (err) {
@@ -133649,7 +134099,7 @@ __export(screen_crawl_exports, {
   recordScreenTraffic: () => recordScreenTraffic,
   renderedNameGaps: () => renderedNameGaps,
   rootOnAppear: () => rootOnAppear,
-  snapshot: () => snapshot,
+  snapshot: () => snapshot2,
   structuralSignature: () => structuralSignature,
   unverifiableNodes: () => unverifiableNodes,
   workerArgs: () => workerArgs
@@ -134387,7 +134837,7 @@ function hasOwnError(state) {
   }
   return false;
 }
-function snapshot(w2) {
+function snapshot2(w2) {
   const state = {};
   const defects = {};
   for (const [name, h2] of Object.entries(w2.handles)) {
@@ -134453,7 +134903,7 @@ async function bootScreenWorker(opts) {
     }
   }
   for (let i2 = 0; i2 < 20; i2++) await yieldMacrotask();
-  const { state, defects } = snapshot(w2);
+  const { state, defects } = snapshot2(w2);
   return { ...w2, hostCalls, deniedCapabilities, state: Object.keys(state).length ? state : w2.services, defects, ...deadLifecycle ? { deadLifecycle } : {} };
 }
 function effectSince(w2, mark, action, componentId) {
@@ -134575,7 +135025,7 @@ async function crawlScreenJourney(opts) {
         fail6(`journey "${opts.journey.name}" cannot find ${step.component ? `${step.component} \u2192 ` : ""}${step.action} in this screen`, step);
         continue;
       }
-      const state = snapshot(worker).state;
+      const state = snapshot2(worker).state;
       const site = effectiveSiteFor(declared, state);
       if (!site) {
         fail6(`journey "${opts.journey.name}" cannot dispatch ${step.action}: its list has no rendered row`, step);
@@ -134602,7 +135052,7 @@ async function crawlScreenJourney(opts) {
       const stepEffect = effectSince(worker, mark, site.actionId, site.componentId);
       if (stepEffect) effects.push(stepEffect);
     }
-    const settled = snapshot(worker);
+    const settled = snapshot2(worker);
     if (worker.errors.length) {
       for (const error of worker.errors) fail6(`journey "${opts.journey.name}" worker error: ${error.service}: ${error.message}`);
     }
@@ -135023,7 +135473,7 @@ async function crawlScreenInner(opts) {
         continue;
       }
       const trigger = { tap: site.componentId, key: site.key, action: site.actionId };
-      const preState = snapshot(w2).state;
+      const preState = snapshot2(w2).state;
       const effective = effectiveSiteFor(site, preState);
       if (!effective) {
         actionsSkipped.push({ action: site.actionId, why: "no-row-value" });
@@ -135042,7 +135492,7 @@ async function crawlScreenInner(opts) {
         errors.push({ service: parsed.service, message: `${parsed.action}: ${errText(e2)}`, ...e2.stack ? { stack: e2.stack } : {}, argless: workerArgs(dispatched).length === 0 });
       }
       exercised += 1;
-      const { state, defects } = snapshot(w2);
+      const { state, defects } = snapshot2(w2);
       check(trigger, state, errors, defects);
       reportDenied(w2.deniedCapabilities.slice(deniedBefore), trigger);
       const navCountBefore = navEdges.length;
@@ -135301,7 +135751,7 @@ async function bootAndSnapshotState(opts) {
     }
     try {
       for (let i2 = 0; i2 < 20; i2++) await yieldMacrotask();
-      return snapshot(w2).state;
+      return snapshot2(w2).state;
     } finally {
       w2.dispose();
     }
@@ -135376,7 +135826,7 @@ async function crawlScreenDeep(opts, deep) {
             threwAt = "unreachable";
             break;
           }
-          const effective = effectiveSiteFor(site, snapshot(w2).state);
+          const effective = effectiveSiteFor(site, snapshot2(w2).state);
           if (!effective) {
             threwAt = "unreachable";
             break;
@@ -135415,7 +135865,7 @@ async function crawlScreenDeep(opts, deep) {
         }
         for (let i2 = 0; i2 < 20; i2++) await yieldMacrotask();
         flushStep();
-        const { state, defects } = snapshot(w2);
+        const { state, defects } = snapshot2(w2);
         const hash2 = deepStateSignature(state, defects);
         if (visited.has(hash2)) continue;
         visited.add(hash2);
@@ -135549,7 +135999,7 @@ async function crawlScreenRelations(opts) {
       const w2 = await boot();
       try {
         if (w2.errors.length) return null;
-        let prev = snapshot(w2).state;
+        let prev = snapshot2(w2).state;
         const bootState = prev;
         for (const [i2, site] of path2.entries()) {
           const parsed = parseWorkerAction(site.actionId);
@@ -135566,7 +136016,7 @@ async function crawlScreenRelations(opts) {
           }
           for (let k2 = 0; k2 < 20; k2++) await yieldMacrotask();
           if (w2.errors.length) return null;
-          prev = snapshot(w2).state;
+          prev = snapshot2(w2).state;
         }
         return prev;
       } finally {
@@ -136773,7 +137223,7 @@ async function liveRenderServices(bundleJs, opts) {
         }
       }
       if (opts.host) await settleUnawaitedWork();
-      return { services: snapshot(w2).state, calls: w2.calls, errors: w2.errors };
+      return { services: snapshot2(w2).state, calls: w2.calls, errors: w2.errors };
     } finally {
       w2.dispose();
     }
@@ -136788,7 +137238,7 @@ async function loadAndSettle(bundleJs, options) {
   const w2 = await bootBundleWorker(bundleJs, options);
   try {
     await settleUnawaitedWork();
-    return { services: snapshot(w2).state, calls: w2.calls, errors: w2.errors };
+    return { services: snapshot2(w2).state, calls: w2.calls, errors: w2.errors };
   } finally {
     w2.dispose();
   }
@@ -137492,7 +137942,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
         }
       }
     }
-    const snapshot2 = await snapshotTokens(
+    const snapshot3 = await snapshotTokens(
       app,
       base,
       async () => {
@@ -137522,10 +137972,10 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
       },
       (text11) => store.putTokens(app, text11)
     );
-    if (snapshot2.hash) tokensHash = snapshot2.hash;
-    if (snapshot2.failure) {
-      tokensSnapshotFailure = snapshot2.failure;
-      console.error(snapshot2.failure.message);
+    if (snapshot3.hash) tokensHash = snapshot3.hash;
+    if (snapshot3.failure) {
+      tokensSnapshotFailure = snapshot3.failure;
+      console.error(snapshot3.failure.message);
     }
     Object.assign(catalogs, await bakeCatalogs(
       app,
@@ -140159,13 +140609,237 @@ var init_wix_owner = __esm({
   }
 });
 
+// src/captcha-auth.ts
+function captchaAuthFinding(auth, siteId, platforms) {
+  const login = auth;
+  if (login?.providerId !== "wix-consumer") return void 0;
+  const inline = login.config?.captcha;
+  const hasInline = typeof inline === "object" && inline !== null;
+  const inlineFor = (platform) => hasInline && !!inline[platform];
+  const inlineKeys = platforms?.length ? platforms.every(inlineFor) : inlineFor("ios") || inlineFor("android");
+  const site = siteId?.trim().toLowerCase();
+  const bound2 = typeof login.config?.siteId === "string" ? login.config.siteId : "";
+  const uncovered = hasInline ? (platforms ?? []).filter((platform) => !inlineFor(platform)) : [];
+  if (bound2 && uncovered.length) return {
+    code: "captcha_auth_inline_key_missing",
+    keyless: true,
+    message: `auth (WixConsumerAuthProvider) declares inline captcha keys but none for ${uncovered.join(" and ")}, and the inline block replaces the baked key file on device \u2014 a native ${uncovered.join("/")} build ships with no member CAPTCHA key. Add captcha.${uncovered[0]} (or remove the captcha block to use the baked key), push a new release, and build from it.`
+  };
+  if (!bound2) return {
+    code: "captcha_auth_site_missing",
+    keyless: true,
+    message: `auth (WixConsumerAuthProvider) names no siteId, so a native build cannot carry a member CAPTCHA key: the build drops the key file and the device refuses the key \u2014 member sign-in on a CAPTCHA-protected site fails with "Complete verification to continue". Add siteId: "${site ?? "<the site's metaSiteId, lower case>"}" to WixConsumerAuthProvider in config.ts, push a new release, and build from it.`
+  };
+  if (bound2 !== bound2.trim().toLowerCase() && !inlineKeys) return {
+    code: "captcha_auth_site_case",
+    keyless: true,
+    message: `auth (WixConsumerAuthProvider) names siteId "${bound2}", but member CAPTCHA keys are stored and matched under the lower-case id, exactly, so a native build would ship without one. Write siteId: "${bound2.trim().toLowerCase()}", push a new release, and build from it.`
+  };
+  if (site && bound2.trim().toLowerCase() !== site) return {
+    code: "captcha_auth_site_mismatch",
+    keyless: false,
+    message: `auth (WixConsumerAuthProvider) names siteId "${bound2}", not ${site}, so a member CAPTCHA key for ${site} cannot bind to this app's login and native member sign-in on a CAPTCHA-protected site fails. Bind the login and the build to the same site.`
+  };
+  return void 0;
+}
+var init_captcha_auth = __esm({
+  "src/captcha-auth.ts"() {
+  }
+});
+
+// ../../stdlib/auth-providers/wix/src/member-captcha-policy.ts
+function acceptsClientSiteKeyToken(option) {
+  return CLIENT_SITE_KEY_OPTIONS.includes(option);
+}
+function asOption(value2) {
+  return value2 === "ALWAYS" || value2 === "SUSPECTED_BOTS_ONLY" || value2 === "NEVER" ? value2 : "UNKNOWN";
+}
+function parseMemberCaptchaPolicy(raw) {
+  const settings = raw?.settings ?? {};
+  return {
+    login: asOption(settings.loginRecaptchaOption),
+    signup: asOption(settings.signupRecaptchaOption)
+  };
+}
+var MEMBER_SITE_SETTINGS_URL, CLIENT_SITE_KEY_OPTIONS;
+var init_member_captcha_policy = __esm({
+  "../../stdlib/auth-providers/wix/src/member-captcha-policy.ts"() {
+    MEMBER_SITE_SETTINGS_URL = "https://manage.wix.com/_api/wix-sm-webapp/v1/collection/settings";
+    CLIENT_SITE_KEY_OPTIONS = ["ALWAYS", "SUSPECTED_BOTS_ONLY"];
+  }
+});
+
+// src/site-analyze/rest.ts
+var rest_exports = {};
+__export(rest_exports, {
+  WIX_API: () => WIX_API2,
+  WixApiError: () => WixApiError2,
+  classifyHttp: () => classifyHttp,
+  compactWixstaticUrl: () => compactWixstaticUrl,
+  isGenericWixFavicon: () => isGenericWixFavicon,
+  makeTransport: () => makeTransport,
+  mediaUrlFromLogo: () => mediaUrlFromLogo,
+  ownerTransportFrom: () => ownerTransportFrom,
+  probeCall: () => probeCall,
+  resolveWixUrl: () => resolveWixUrl,
+  uploadMediaBytes: () => uploadMediaBytes,
+  visitorTransportFrom: () => visitorTransportFrom,
+  wixMediaFileId: () => wixMediaFileId
+});
+function resolveWixUrl(path2) {
+  if (/^https?:\/\//i.test(path2)) return path2;
+  return `${WIX_API2}${path2}`;
+}
+function classifyHttp(status, count2) {
+  if (status === 428) return "not-installed";
+  if (status === 404) return "wrong-path";
+  if (status && status >= 400) return "error";
+  return count2 > 0 ? "ok" : "empty";
+}
+function makeTransport(fetchImpl, auth, timeoutMs = DEFAULT_TIMEOUT_MS2) {
+  return async (method, path2, body) => {
+    const headers2 = { Accept: "application/json" };
+    if (auth?.token) headers2.Authorization = auth.token;
+    if (auth?.msid) headers2["wix-site-id"] = auth.msid;
+    if (body !== void 0) headers2["Content-Type"] = "application/json";
+    const res = await fetchImpl(resolveWixUrl(path2), {
+      method,
+      headers: headers2,
+      body: body === void 0 ? void 0 : JSON.stringify(body),
+      signal: AbortSignal.timeout(timeoutMs)
+    });
+    const text11 = await res.text();
+    let parsed = text11;
+    try {
+      parsed = text11 ? JSON.parse(text11) : null;
+    } catch {
+    }
+    if (!res.ok) throw new WixApiError2(res.status, method, path2, parsed);
+    return parsed;
+  };
+}
+function ownerTransportFrom(fetchImpl, owner) {
+  return makeTransport(fetchImpl, { token: owner.token, msid: owner.msid });
+}
+function visitorTransportFrom(fetchImpl, token, msid) {
+  return makeTransport(fetchImpl, { token, msid });
+}
+async function probeCall(call, method, path2, body) {
+  try {
+    return { data: await call(method, path2, body), err: null };
+  } catch (e2) {
+    if (e2 instanceof WixApiError2) return { data: null, err: e2 };
+    throw e2;
+  }
+}
+function mediaUrlFromLogo(logo) {
+  const s2 = (logo ?? "").trim();
+  if (!s2) return null;
+  if (/^https?:\/\//i.test(s2)) return s2;
+  const id = s2.replace(/^wix:image:\/\/v1\//, "").split("/")[0].split("#")[0];
+  if (!id) return null;
+  if (/^https?:\/\//i.test(id)) return id;
+  return `https://static.wixstatic.com/media/${id}`;
+}
+function isGenericWixFavicon(url) {
+  try {
+    const h2 = new URL(url).hostname.toLowerCase();
+    return h2 === "wix.com" || h2.endsWith(".wix.com");
+  } catch {
+    return false;
+  }
+}
+function wixMediaFileId(url) {
+  const m2 = url.match(/static\.wixstatic\.com\/media\/([^/?#]+)/i);
+  return m2?.[1] ? decodeURIComponent(m2[1]) : void 0;
+}
+function compactWixstaticUrl(url, maxEdge = 800) {
+  if (!/static\.wixstatic\.com\/media\//i.test(url)) return url;
+  if (/\.(svg|ico)(\?|#|$)/i.test(url.split("?")[0] ?? url)) return url;
+  const w2 = url.match(/(?:\/|,)w_(\d+)/)?.[1];
+  if (w2 && Number(w2) <= maxEdge) return url;
+  const id = wixMediaFileId(url);
+  if (!id) return url;
+  return `https://static.wixstatic.com/media/${id}/v1/fill/w_${maxEdge},h_${maxEdge},al_c,q_80,enc_auto/file.jpg`;
+}
+async function uploadMediaBytes(call, fetchImpl, bytes2, fileName, mimeType) {
+  const { uploadUrl } = await call(
+    "POST",
+    "/site-media/v1/files/generate-upload-url",
+    { mimeType, fileName: `himi-business-book/${fileName}` }
+  );
+  const put = await fetchImpl(`${uploadUrl}?filename=${encodeURIComponent(fileName)}`, {
+    method: "PUT",
+    headers: { "Content-Type": mimeType },
+    body: bytes2,
+    signal: AbortSignal.timeout(12e4)
+  });
+  if (!put.ok) throw new Error(`media upload PUT failed: ${put.status}`);
+  const payload = await put.json();
+  const file2 = payload.file ?? payload;
+  const id = file2?.id ?? file2?.fileId;
+  const url = file2?.url ?? (id ? `https://static.wixstatic.com/media/${id}` : void 0);
+  if (!id || !url) throw new Error("media upload returned no file id");
+  return { id, url };
+}
+var WIX_API2, DEFAULT_TIMEOUT_MS2, WixApiError2;
+var init_rest = __esm({
+  "src/site-analyze/rest.ts"() {
+    WIX_API2 = "https://www.wixapis.com";
+    DEFAULT_TIMEOUT_MS2 = 8e3;
+    WixApiError2 = class extends Error {
+      constructor(status, method, path2, body) {
+        super(`${method} ${path2} \u2192 ${status}`);
+        this.status = status;
+        this.method = method;
+        this.path = path2;
+        this.body = body;
+        this.name = "WixApiError";
+      }
+    };
+  }
+});
+
+// src/site-analyze/visitor-auth.ts
+var visitor_auth_exports = {};
+__export(visitor_auth_exports, {
+  mintVisitorToken: () => mintVisitorToken
+});
+async function mintVisitorToken(fetchImpl, clientId) {
+  const res = await fetchImpl(`${WIX_API2}/oauth2/token`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({ clientId, grantType: "anonymous" }),
+    signal: AbortSignal.timeout(8e3)
+  });
+  const text11 = await res.text();
+  let parsed = text11;
+  try {
+    parsed = text11 ? JSON.parse(text11) : null;
+  } catch {
+  }
+  if (!res.ok) throw new WixApiError2(res.status, "POST", "/oauth2/token", parsed);
+  const token = parsed?.access_token ?? parsed?.accessToken;
+  if (!token) throw new Error("visitor mint returned no access_token");
+  return token;
+}
+var init_visitor_auth = __esm({
+  "src/site-analyze/visitor-auth.ts"() {
+    init_rest();
+  }
+});
+
 // src/captcha.ts
 var captcha_exports = {};
 __export(captcha_exports, {
+  captchaAuthFinding: () => captchaAuthFinding,
   captchaContentInput: () => captchaContentInput,
-  runCaptcha: () => runCaptcha
+  captchaDistGate: () => captchaDistGate,
+  contentCaptchaAuthFinding: () => contentCaptchaAuthFinding,
+  runCaptcha: () => runCaptcha,
+  siteMemberCaptchaPolicy: () => siteMemberCaptchaPolicy
 });
-import { readFileSync as readFileSync40 } from "node:fs";
+import { existsSync as existsSync36, readFileSync as readFileSync40 } from "node:fs";
 import { resolve as resolve34 } from "node:path";
 function readObject(path2) {
   try {
@@ -140184,6 +140858,64 @@ function captchaContentInput(dir) {
     androidApplicationId: text2(provisioning.native?.androidApplicationId)
   };
 }
+async function contentAuth(dir, app) {
+  if (!existsSync36(resolve34(dir, "himalaya.content.json"))) return void 0;
+  if (app !== void 0 && captchaContentInput(dir).app !== app) return void 0;
+  try {
+    const { loadAppConfigModule: loadAppConfigModule2 } = await Promise.resolve().then(() => (init_app_config_loader(), app_config_loader_exports));
+    return (await loadAppConfigModule2(dir))?.auth;
+  } catch {
+    return void 0;
+  }
+}
+async function contentCaptchaAuthFinding(dir, siteId, app, platforms) {
+  const auth = await contentAuth(dir, app);
+  return auth === void 0 ? void 0 : captchaAuthFinding(auth, siteId, platforms);
+}
+async function siteMemberCaptchaPolicy(clientId, fetchImpl = fetch) {
+  const { mintVisitorToken: mintVisitorToken2 } = await Promise.resolve().then(() => (init_visitor_auth(), visitor_auth_exports));
+  const token = await mintVisitorToken2(fetchImpl, clientId);
+  const res = await fetchImpl(MEMBER_SITE_SETTINGS_URL, {
+    headers: { Authorization: token, Accept: "application/json" },
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) throw new Error(`the member settings read answered HTTP ${res.status}`);
+  return parseMemberCaptchaPolicy(await res.json());
+}
+async function releaseAuth(client2, app, release2) {
+  try {
+    let previewToken;
+    if (release2) {
+      const minted = await client2.previewToken(app, release2);
+      previewToken = minted.json?.previewToken;
+      if (!minted.ok || typeof previewToken !== "string") return { error: `no preview token for release ${release2} (HTTP ${minted.status})` };
+    }
+    const read = await client2.fetchAppConfig(app, release2, previewToken);
+    if (!read.ok) return { error: `its app-config read answered HTTP ${read.status}` };
+    return { auth: read.json?.authConfig ?? null };
+  } catch (error) {
+    return { error: error?.message ?? String(error) };
+  }
+}
+async function captchaDistGate(options) {
+  const { auth, error } = await releaseAuth(options.client, options.app, options.release);
+  if (error) return { advisory: `member CAPTCHA check skipped: the release's login could not be read (${error}). If the login names no siteId and the site requires a member CAPTCHA, member sign-in in this build will fail.` };
+  const finding2 = captchaAuthFinding(auth, options.requestedSite, options.platforms);
+  if (!finding2) return {};
+  if (!finding2.keyless) return { advisory: `${finding2.code}: ${finding2.message}` };
+  const clientId = auth.config?.clientId;
+  const unasked = (why) => ({ advisory: `${finding2.code}: ${finding2.message} Not refused: ${why}, so whether the site requires a member CAPTCHA is unknown \u2014 if it does, member sign-in in this build will fail.` });
+  if (typeof clientId !== "string" || !clientId || clientId === PLACEHOLDER_CLIENT_ID) return unasked("the login has no Wix client to ask with");
+  let policy;
+  try {
+    policy = await siteMemberCaptchaPolicy(clientId, options.fetchImpl ?? fetch);
+  } catch (error2) {
+    return unasked(`the site's member settings could not be read (${error2?.message ?? String(error2)})`);
+  }
+  const demands = ["login", "signup"].filter((source) => acceptsClientSiteKeyToken(policy[source]));
+  if (demands.length === 0) return {};
+  return { refuse: { code: finding2.code, captchaPolicy: policy, message: `${finding2.message} The site requires a CAPTCHA for member ${demands.map((source) => `${source} (${policy[source]})`).join(" and ")}. The key is baked only for a build bound to the site (--site, provisioning.json, or the app's own site binding).` } };
+}
 async function runCaptcha(pos, flags, io2, deps = {}) {
   const operation = pos[1];
   if (operation !== "setup" && operation !== "status") {
@@ -140213,6 +140945,14 @@ async function runCaptcha(pos, flags, io2, deps = {}) {
       fetchImpl: deps.fetchImpl
     });
     io2.log(JSON.stringify(result.body));
+    const anyReady = (result.body.records ?? []).some((record2) => record2?.status === "ready");
+    const finding2 = operation === "setup" && anyReady ? await contentCaptchaAuthFinding(
+      text2(flags.content) ?? process.cwd(),
+      input.siteId,
+      input.app,
+      [...input.iosBundleId ? ["ios"] : [], ...input.androidApplicationId ? ["android"] : []]
+    ) : void 0;
+    if (finding2) io2.error(`\u26A0 ${finding2.code}: ${finding2.message}`);
     return result.ok ? 0 : 1;
   } catch {
     io2.error(JSON.stringify({ error: "captcha_service_unavailable", complete: false }));
@@ -140226,6 +140966,9 @@ var init_captcha2 = __esm({
     init_captcha();
     init_captcha_service();
     init_wix_owner();
+    init_captcha_auth();
+    init_wix_placeholders();
+    init_member_captcha_policy();
     text2 = (value2) => typeof value2 === "string" ? value2 : void 0;
   }
 });
@@ -140239,7 +140982,7 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync36, readFileSync as readFileSync41 } from "node:fs";
+import { existsSync as existsSync37, readFileSync as readFileSync41 } from "node:fs";
 import { isAbsolute as isAbsolute2, relative as relative7, resolve as resolve35 } from "node:path";
 function isInsideRepo(p2) {
   const rel = relative7(REPO_ROOT, resolve35(p2));
@@ -140296,7 +141039,7 @@ function parseStoreConfig(text11) {
 }
 function loadStoreConfig(app) {
   const p2 = storeConfigPath(app);
-  if (!existsSync36(p2)) {
+  if (!existsSync37(p2)) {
     throw new Error(`No store config at ${p2}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
   return parseStoreConfig(readFileSync41(p2, "utf8"));
@@ -143987,10 +144730,10 @@ var init_Matcher = __esm({
        * Restore state from snapshot.
        * @param {Object} snapshot
        */
-      restore(snapshot2) {
+      restore(snapshot3) {
         this._pathStringCache = null;
-        this.path = snapshot2.path.map((node) => ({ ...node }));
-        this.siblingStacks = snapshot2.siblingStacks.map((map) => new Map(map));
+        this.path = snapshot3.path.map((node) => ({ ...node }));
+        this.siblingStacks = snapshot3.siblingStacks.map((map) => new Map(map));
       }
       /**
        * Return the read-only {@link MatcherView} for this matcher.
@@ -147028,7 +147771,7 @@ var init_customer_signing_inspect = __esm({
 });
 
 // src/push-onboarding.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync19, readFileSync as readFileSync42, statSync as statSync9, writeFileSync as writeFileSync13, chmodSync as chmodSync2 } from "node:fs";
+import { existsSync as existsSync38, mkdirSync as mkdirSync19, readFileSync as readFileSync42, statSync as statSync9, writeFileSync as writeFileSync13, chmodSync as chmodSync2 } from "node:fs";
 import { basename as basename11, dirname as dirname24, join as join32, resolve as resolve36 } from "node:path";
 function readJson4(path2) {
   try {
@@ -147040,7 +147783,7 @@ function readJson4(path2) {
 }
 function pushInputsFromContent(dir) {
   const root = resolve36(dir);
-  if (!existsSync37(join32(root, "himalaya.content.json"))) return { initialized: false };
+  if (!existsSync38(join32(root, "himalaya.content.json"))) return { initialized: false };
   const content = readJson4(join32(root, "himalaya.content.json"));
   const provisioning = readJson4(join32(root, "provisioning.json"));
   const native = provisioning.native ?? {};
@@ -147172,7 +147915,7 @@ function buildPushSetupBody(i2, keys) {
 }
 function readPushOnboarding(dir) {
   const path2 = join32(resolve36(dir), PUSH_ONBOARDING_PATH);
-  if (!existsSync37(path2)) return { version: 1 };
+  if (!existsSync38(path2)) return { version: 1 };
   const parsed = readJson4(path2);
   return { version: 1, ...parsed };
 }
@@ -147207,7 +147950,7 @@ function recordPushDeferral(dir, d2) {
 }
 function clearPushDeferral(dir) {
   const path2 = join32(resolve36(dir), PUSH_ONBOARDING_PATH);
-  if (!existsSync37(path2)) return;
+  if (!existsSync38(path2)) return;
   const { push: _dropped, ...rest } = readPushOnboarding(dir);
   writeFile(dir, { ...rest, version: 1 });
 }
@@ -147275,7 +148018,7 @@ var signing_inspect_exports = {};
 __export(signing_inspect_exports, {
   runSigningInspect: () => runSigningInspect
 });
-import { existsSync as existsSync38, readFileSync as readFileSync43, statSync as statSync10 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync43, statSync as statSync10 } from "node:fs";
 import { isAbsolute as isAbsolute3, resolve as resolve37 } from "node:path";
 function fail4(io2, code, fields = {}) {
   io2.error(JSON.stringify({ ok: false, code, ...fields }));
@@ -147365,7 +148108,7 @@ async function runSigningInspect(pos, flags, io2, deps = {}) {
     } catch (error) {
       return fail4(io2, "signing_inspect_key_inside_repo", { error: error.message });
     }
-    if (!existsSync38(certPath) || !existsSync38(profilePath2)) {
+    if (!existsSync39(certPath) || !existsSync39(profilePath2)) {
       return fail4(io2, "signing_inspect_local_assets_unreadable", { error: "cannot read --cert-file or --profile-file" });
     }
     if (statSync10(certPath).size > 1048576 || statSync10(profilePath2).size > 1048576) {
@@ -147899,7 +148642,7 @@ __export(template_trim_exports, {
   routeMatcher: () => routeMatcher,
   runTemplateTrim: () => runTemplateTrim
 });
-import { cpSync, existsSync as existsSync39, mkdirSync as mkdirSync20, readdirSync as readdirSync21, readFileSync as readFileSync45, renameSync as renameSync8, rmSync as rmSync11, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
+import { cpSync, existsSync as existsSync40, mkdirSync as mkdirSync20, readdirSync as readdirSync21, readFileSync as readFileSync45, renameSync as renameSync8, rmSync as rmSync11, statSync as statSync11, writeFileSync as writeFileSync15 } from "node:fs";
 import { dirname as dirname25, join as join34 } from "node:path";
 function routeMatcher(pattern) {
   const detail = /^\^([A-Za-z0-9_]+)\(\?:\[_\/\]\(\.\+\)\)\?\$$/.exec(pattern);
@@ -148644,7 +149387,7 @@ function homeModulesPass(app, kept, edited) {
 }
 function listWorkers(dir) {
   const root = join34(dir, "tier5-src");
-  if (!existsSync39(root)) return { dirs: [], files: {} };
+  if (!existsSync40(root)) return { dirs: [], files: {} };
   const dirs = readdirSync21(root).filter((n2) => statSync11(join34(root, n2)).isDirectory()).sort();
   const files = {};
   const walk2 = (abs, rel) => {
@@ -148681,7 +149424,7 @@ async function runTemplateTrim(req, deps) {
   const dir = req.dir;
   const devPath = join34(dir, "dev/index.ts");
   const configPath = join34(dir, "config.ts");
-  if (!existsSync39(devPath) || !existsSync39(configPath)) {
+  if (!existsSync40(devPath) || !existsSync40(configPath)) {
     return refuse3(new TrimRefusal(`${dir} has no dev/index.ts + config.ts \u2014 point --content at an app scaffolded with \`himi init --template\``));
   }
   if (isTemplateSourceTree(dir)) {
@@ -148728,7 +149471,7 @@ async function runTemplateTrim(req, deps) {
     }
   }
   if (req.dryRun) return { code: 0, result: { ok: true, dryRun: true, ...plan.report, validate: null } };
-  const hadHimi = existsSync39(join34(dir, ".himi"));
+  const hadHimi = existsSync40(join34(dir, ".himi"));
   const backupRel = join34(".himi", "trim-backup", (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-"));
   const backup = join34(dir, backupRel);
   const originals = [[devPath, "dev/index.ts"], [configPath, "config.ts"], ...trimmedContent !== void 0 ? [[contentPath, "himalaya.content.json"]] : []];
@@ -148737,7 +149480,7 @@ async function runTemplateTrim(req, deps) {
     for (const [path2, rel] of originals) {
       if (rel === "himalaya.content.json") contentManifestPath(dir);
       const original = readFileSync45(join34(backup, rel));
-      if (!existsSync39(path2) || !readFileSync45(path2).equals(original)) {
+      if (!existsSync40(path2) || !readFileSync45(path2).equals(original)) {
         if (rel === "himalaya.content.json") writeContentManifest(dir, original);
         else writeFileSync15(path2, original);
       }
@@ -149094,17 +149837,17 @@ __export(template_adopt_exports, {
   workerReach: () => workerReach,
   writeInventory: () => writeInventory
 });
-import { existsSync as existsSync40, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readdirSync as readdirSync22, readFileSync as readFileSync46, renameSync as renameSync9, statSync as statSync12, writeFileSync as writeFileSync16 } from "node:fs";
+import { existsSync as existsSync41, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readdirSync as readdirSync22, readFileSync as readFileSync46, renameSync as renameSync9, statSync as statSync12, writeFileSync as writeFileSync16 } from "node:fs";
 import { dirname as dirname26, join as join35, posix as posix2 } from "node:path";
 function readAppSources(dir) {
   const devPath = join35(dir, "dev", "index.ts");
   const configPath = join35(dir, "config.ts");
-  if (!existsSync40(devPath) || !existsSync40(configPath)) {
+  if (!existsSync41(devPath) || !existsSync41(configPath)) {
     throw new TrimRefusal(`no dev/index.ts + config.ts under ${dir} \u2014 run this in (or point --content at) an app \`himi init --template\` scaffolded`);
   }
   const workers = /* @__PURE__ */ new Map();
   const root = join35(dir, "tier5-src");
-  if (existsSync40(root)) {
+  if (existsSync41(root)) {
     for (const name of readdirSync22(root).sort()) {
       const abs = join35(root, name);
       if (!statSync12(abs).isDirectory()) continue;
@@ -149344,7 +150087,7 @@ function inventoryOf(dir, src, app) {
     sampleCopy: copyHits(dir, SAMPLE_COPY, 50),
     matrix,
     journeys,
-    netMocks: existsSync40(join35(dir, "dev", "net-mocks.json"))
+    netMocks: existsSync41(join35(dir, "dev", "net-mocks.json"))
   };
 }
 function matrixMarkdown(rows) {
@@ -149380,9 +150123,9 @@ function inventorySummary(inv) {
 function writeNoFollow(dir, rel, body) {
   const p2 = join35(dir, rel);
   const parent = dirname26(p2);
-  if (existsSync40(parent) && lstatSync11(parent).isSymbolicLink()) throw new TrimRefusal(`${dirname26(rel)} is a symlink \u2014 refusing to write through it`);
+  if (existsSync41(parent) && lstatSync11(parent).isSymbolicLink()) throw new TrimRefusal(`${dirname26(rel)} is a symlink \u2014 refusing to write through it`);
   mkdirSync21(parent, { recursive: true });
-  if (existsSync40(p2) && lstatSync11(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it`);
+  if (existsSync41(p2) && lstatSync11(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it`);
   const tmp = `${p2}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync16(tmp, body, { flag: "wx" });
   renameSync9(tmp, p2);
@@ -149391,7 +150134,7 @@ function writeInventory(dir, inv, opts = {}) {
   const written = [];
   const keep = opts.companions === "if-missing";
   const put = (rel, body, companion) => {
-    if (companion && keep && existsSync40(join35(dir, rel))) return;
+    if (companion && keep && existsSync41(join35(dir, rel))) return;
     writeNoFollow(dir, rel, body);
     written.push(rel);
   };
@@ -149497,7 +150240,7 @@ function addScreen(dir, id, entry, opts = {}) {
   }
   for (const rel of ["dev", "dev/index.ts", ...config !== src.config ? ["config.ts"] : [], ...contentWithView !== void 0 ? ["himalaya.content.json"] : []]) {
     const p2 = join35(dir, rel);
-    if (existsSync40(p2) && lstatSync11(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (nothing written)`);
+    if (existsSync41(p2) && lstatSync11(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (nothing written)`);
   }
   writeNoFollow(dir, "dev/index.ts", dev);
   if (config !== src.config) writeNoFollow(dir, "config.ts", config);
@@ -149520,7 +150263,7 @@ function specScreens(spec) {
   return [...new Set(out2)];
 }
 function keepFromSpec(dir, specPath) {
-  if (!existsSync40(specPath)) throw new TrimRefusal(`no ${specPath} \u2014 --from-spec reads the approved plan's \`## Screen catalogue\``);
+  if (!existsSync41(specPath)) throw new TrimRefusal(`no ${specPath} \u2014 --from-spec reads the approved plan's \`## Screen catalogue\``);
   const ids = specScreens(readFileSync46(specPath, "utf8"));
   if (!ids.length) {
     throw new TrimRefusal("SPEC.md's `## Screen catalogue` names no screen ids \u2014 put each screen's id (`himi template screens` lists them) in the first column, in backticks");
@@ -150273,7 +151016,7 @@ __export(pack_exports, {
 });
 import { createHash as createHash24 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync41, mkdirSync as mkdirSync22, readFileSync as readFileSync48, readdirSync as readdirSync23, rmSync as rmSync12, statSync as statSync13, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync22, readFileSync as readFileSync48, readdirSync as readdirSync23, rmSync as rmSync12, statSync as statSync13, writeFileSync as writeFileSync17 } from "node:fs";
 import { dirname as dirname27, join as join37, resolve as resolve39 } from "node:path";
 function writeZip(entries) {
   const sorted2 = entries.slice().sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
@@ -150368,10 +151111,10 @@ function inflateEntry(buf, entry) {
   return bytes2;
 }
 function readIf(path2) {
-  return existsSync41(path2) && statSync13(path2).isFile() ? readFileSync48(path2) : null;
+  return existsSync42(path2) && statSync13(path2).isFile() ? readFileSync48(path2) : null;
 }
 function listDir(dir) {
-  return existsSync41(dir) ? readdirSync23(dir).filter((f2) => statSync13(join37(dir, f2)).isFile()) : [];
+  return existsSync42(dir) ? readdirSync23(dir).filter((f2) => statSync13(join37(dir, f2)).isFile()) : [];
 }
 function gatherReleaseEntries(appDir3) {
   const manifestPath = join37(appDir3, HIMI_PACKAGE_MANIFEST_PATH);
@@ -150450,7 +151193,7 @@ function packRelease(releaseRoot, app, out2, opts = {}) {
   const appDir3 = join37(resolve39(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir3, app, opts);
   const buf = writeZip(all);
-  const isDir2 = existsSync41(out2) && statSync13(out2).isDirectory();
+  const isDir2 = existsSync42(out2) && statSync13(out2).isDirectory();
   const outFile = isDir2 ? join37(resolve39(out2), packageFileName(app, header.releaseId)) : resolve39(out2);
   mkdirSync22(dirname27(outFile), { recursive: true });
   writeFileSync17(outFile, buf);
@@ -150467,11 +151210,11 @@ function resolvePackageDirDest(outDir, app, releaseId) {
     }
   };
   const replaceable = (dir) => {
-    if (!existsSync41(dir)) return true;
+    if (!existsSync42(dir)) return true;
     if (!statSync13(dir).isDirectory()) return false;
     return readdirSync23(dir).length === 0 || packagedApp(dir) === app;
   };
-  if (existsSync41(outDir) && !statSync13(outDir).isDirectory()) {
+  if (existsSync42(outDir) && !statSync13(outDir).isDirectory()) {
     throw new Error(`refusing to write a package tree over ${outDir} \u2014 it is a file, not a directory`);
   }
   if (replaceable(outDir)) return outDir;
@@ -150532,7 +151275,7 @@ function openPackageDir(dir) {
       else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync48(childAbs));
     }
   };
-  if (!existsSync41(root)) throw new Error(`no such package directory: ${root}`);
+  if (!existsSync42(root)) throw new Error(`no such package directory: ${root}`);
   walk2("");
   const manifestBytes = entries.get(HIMI_PACKAGE_MANIFEST_PATH);
   if (manifestBytes) {
@@ -150617,7 +151360,7 @@ __export(app_source_exports, {
   zipAppSource: () => zipAppSource
 });
 import { createHash as createHash25 } from "node:crypto";
-import { readdirSync as readdirSync24, lstatSync as lstatSync13, readFileSync as readFileSync49, mkdirSync as mkdirSync23, writeFileSync as writeFileSync18, existsSync as existsSync42, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3 } from "node:fs";
+import { readdirSync as readdirSync24, lstatSync as lstatSync13, readFileSync as readFileSync49, mkdirSync as mkdirSync23, writeFileSync as writeFileSync18, existsSync as existsSync43, rmSync as rmSync13, rmdirSync as rmdirSync2, unlinkSync as unlinkSync3 } from "node:fs";
 import { join as join38, resolve as resolve40, sep as sep13 } from "node:path";
 import { createRequire as createRequire3 } from "node:module";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
@@ -150633,7 +151376,7 @@ function walkSourceTree(dir, file2, skip, enter = () => {
         continue;
       }
       if (st2.isDirectory()) {
-        if (isDeniedSourceDir(name, relDir) || existsSync42(join38(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
+        if (isDeniedSourceDir(name, relDir) || existsSync43(join38(dir, rel, PACKAGE_DIR_MARKER))) skip(rel);
         else walk2(rel);
         continue;
       }
@@ -150801,7 +151544,7 @@ function writeAppSource(entries, destDir) {
   return written;
 }
 function staleSourcePaths(entries, destDir) {
-  if (!existsSync42(destDir)) return [];
+  if (!existsSync43(destDir)) return [];
   const archived = new Set(entries.map((e2) => e2.path));
   const stale = [];
   walkSourceTree(destDir, (archivePath) => {
@@ -150857,7 +151600,7 @@ function removeStaleSource(entries, destDir) {
     const segments = entry.path.split("/");
     for (let i2 = 1; i2 < segments.length; i2++) needed.add(segments.slice(0, i2).join("/"));
   }
-  if (existsSync42(root)) pruneEmptyDirs(root, "", needed, removed);
+  if (existsSync43(root)) pruneEmptyDirs(root, "", needed, removed);
   return removed.sort();
 }
 function pruneEmptyDirs(root, rel, needed, removed) {
@@ -150946,7 +151689,7 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync4, constants as constants3, existsSync as existsSync43, fstatSync, lstatSync as lstatSync14, statSync as statSync14, readdirSync as readdirSync25, mkdirSync as mkdirSync24, openSync as openSync4, readFileSync as readFileSync50, realpathSync as realpathSync8, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync19, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync4, constants as constants3, existsSync as existsSync44, fstatSync, lstatSync as lstatSync14, statSync as statSync14, readdirSync as readdirSync25, mkdirSync as mkdirSync24, openSync as openSync4, readFileSync as readFileSync50, realpathSync as realpathSync8, renameSync as renameSync10, rmSync as rmSync14, writeFileSync as writeFileSync19, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { extname as extname4, join as join39, relative as relative8, resolve as resolve41, sep as sep14 } from "node:path";
 function diffReleases(prev, next) {
@@ -151014,7 +151757,7 @@ function watchContent(dir, onChange, opts = {}) {
     }, debounceMs);
   };
   let watcher2, polling;
-  const snapshot2 = () => {
+  const snapshot3 = () => {
     const files = /* @__PURE__ */ new Map();
     const visit = (directory, prefix = "") => {
       let entries;
@@ -151037,12 +151780,12 @@ function watchContent(dir, onChange, opts = {}) {
     visit(dir);
     return files;
   };
-  let before = snapshot2();
+  let before = snapshot3();
   const fallback = () => {
     if (polling) return;
     watcher2?.close();
     polling = setInterval(() => {
-      const after = snapshot2();
+      const after = snapshot3();
       for (const path2 of /* @__PURE__ */ new Set([...before.keys(), ...after.keys()])) if (before.get(path2) !== after.get(path2)) changed("change", path2);
       before = after;
     }, opts.pollMs ?? 500);
@@ -151065,7 +151808,7 @@ function watchedContentDir(source) {
   if (!source || /^https?:\/\//i.test(source)) return null;
   const dir = resolve41(source);
   try {
-    return statSync14(dir).isDirectory() && existsSync43(join39(dir, "himalaya.content.json")) ? dir : null;
+    return statSync14(dir).isDirectory() && existsSync44(join39(dir, "himalaya.content.json")) ? dir : null;
   } catch {
     return null;
   }
@@ -151721,7 +152464,7 @@ __export(milestones_exports, {
 });
 import { createHash as createHash28, randomUUID as randomUUID8 } from "node:crypto";
 import { spawn as spawn4 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync44, lstatSync as lstatSync17, readFileSync as readFileSync54, statSync as statSync15 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync45, lstatSync as lstatSync17, readFileSync as readFileSync54, statSync as statSync15 } from "node:fs";
 import { createServer as createServer3 } from "node:net";
 import { basename as basename14, dirname as dirname28, isAbsolute as isAbsolute4, join as join43, relative as relative9, resolve as resolve42, sep as sep15 } from "node:path";
 function homeShotPath(dir, home) {
@@ -151834,7 +152577,7 @@ function autoPictureGate(dir) {
 }
 async function homePictureAtValidate(dir, opts) {
   if (!opts.ok) return { skipped: "validate found errors, so the picture was left as it is" };
-  if (!existsSync44(join43(dir, "himalaya.content.json"))) return { skipped: "not a content package" };
+  if (!existsSync45(join43(dir, "himalaya.content.json"))) return { skipped: "not a content package" };
   const env = opts.env ?? process.env;
   if (ciSet(env)) return { skipped: "the CI environment variable is set" };
   if (env.NODE_TEST_CONTEXT) return { skipped: "running under `node --test`" };
@@ -151904,7 +152647,7 @@ function stillBuilding(dir, image, now) {
   }
 }
 function firstLookBeforeOwnPostcard(dir, image, now) {
-  if (!image || !existsSync44(image) || initDivergence(dir).state !== "diverged") return void 0;
+  if (!image || !existsSync45(image) || initDivergence(dir).state !== "diverged") return void 0;
   return journal(dir, "first-look", withHomeCaveat(yourFirstLookMessage(dir), homeCaveat(dir, image)), { image, ...now ? { now } : {} });
 }
 function afterRenderPng(dir, input) {
@@ -151969,13 +152712,13 @@ function testChangeNote(headline2, change) {
 }
 function afterTestRun(dir, input) {
   const firstLook = firstLookBeforeOwnPostcard(dir, input.homeShot, input.now);
-  const shot = input.homeShot && existsSync44(input.homeShot) ? input.homeShot : void 0;
+  const shot = input.homeShot && existsSync45(input.homeShot) ? input.homeShot : void 0;
   const caveat = shot ? homeCaveat(dir, shot) : void 0;
   const counts = testPostcardMessage(input);
   const headline2 = caveat ? `${counts} But ${caveat}.` : counts;
   const postcard = journal(dir, "test", headline2, {
     ref: input.runId,
-    ...input.homeShot && existsSync44(input.homeShot) ? { image: input.homeShot } : {},
+    ...input.homeShot && existsSync45(input.homeShot) ? { image: input.homeShot } : {},
     ...input.now ? { now: input.now } : {},
     unlessUnchanged: true,
     changeNote: (change) => testChangeNote(headline2, change)
@@ -152018,7 +152761,7 @@ function draftPictureGap(input) {
   if (!input.home) return { reason: "the app's dev/index.ts names no literal homeScreenId, so there is no home screen to picture" };
   if (!input.homeShot) return { reason: "the homeScreenId does not name a file under .himi/shots" };
   const render = `himi render ${shellQuote(input.home)} --png${contentArg(input.content)}`;
-  if (!existsSync44(input.homeShot)) return { reason: "there is no home shot yet", render };
+  if (!existsSync45(input.homeShot)) return { reason: "there is no home shot yet", render };
   if (input.sourceChangedAtMs === void 0) return { reason: "the source's last change could not be read, so the home shot cannot be shown to be current", render };
   if (!shotIsCurrent(input.homeShot, input.sourceChangedAtMs)) return { reason: "the home shot is older than the last source edit, so it is not a picture of this draft", render };
   return null;
@@ -152096,7 +152839,7 @@ function draftChangeNote(dir, input) {
       if (!previous) return void 0;
       const shaOf = (i2) => i2 && typeof i2 === "object" && typeof i2.sha256 === "string" ? i2.sha256 : void 0;
       const had = Array.isArray(previous.images) ? previous.images.map(shaOf).find(Boolean) : void 0;
-      const has = input.picture && existsSync44(input.picture) ? sha256Of2(input.picture) : void 0;
+      const has = input.picture && existsSync45(input.picture) ? sha256Of2(input.picture) : void 0;
       if (had && has) parts.push(had === has ? "the home screen looks the same" : "the home screen changed");
       else if (has) parts.push("a home picture this time");
       else return void 0;
@@ -152162,7 +152905,7 @@ function homeShotForPostcard(dir, opts = {}) {
   const shot = homeShotPath(dir, home);
   if (!shot) return { skipped: "the homeScreenId does not name a file under .himi/shots" };
   const render = `\`himi render ${shellQuote(home)} --png\``;
-  if (!existsSync44(shot)) return { skipped: `no home shot yet \u2014 ${render} makes one, and the next postcard carries it` };
+  if (!existsSync45(shot)) return { skipped: `no home shot yet \u2014 ${render} makes one, and the next postcard carries it` };
   let changed;
   try {
     changed = newestSourceChangeMs(dir);
@@ -152242,7 +152985,7 @@ function liveWatchRunning(dir, isAlive = pidAlive, now) {
 }
 function watchReminder(dir, opts = {}) {
   try {
-    if (!existsSync44(join43(dir, "himalaya.content.json"))) return void 0;
+    if (!existsSync45(join43(dir, "himalaya.content.json"))) return void 0;
     const nowDate = opts.now ?? /* @__PURE__ */ new Date();
     const live3 = liveWatch(dir, opts.isAlive, nowDate);
     const now = nowDate.getTime();
@@ -152917,12 +153660,12 @@ var init_brand_color_math = __esm({
 });
 
 // src/token-lint.ts
-import { existsSync as existsSync47, readFileSync as readFileSync56 } from "node:fs";
+import { existsSync as existsSync48, readFileSync as readFileSync56 } from "node:fs";
 import { join as join46 } from "node:path";
 function configuredTokensPath(dir) {
   for (const name of ["config.ts", "config.js", "himi.config.ts"]) {
     const f2 = join46(dir, name);
-    if (!existsSync47(f2)) continue;
+    if (!existsSync48(f2)) continue;
     const src = readFileSync56(f2, "utf8");
     const m2 = /designTokensPath\s*:\s*["'`]([^"'`]+)["'`]/.exec(src);
     if (m2) return { path: m2[1].replace(/^\.\//, "") };
@@ -153000,7 +153743,7 @@ function tokenColorIssues(dir, tokensPathOverride) {
   }
   const tokensPath = configured.path ?? "tokens.json";
   const p2 = join46(dir, tokensPath);
-  if (!existsSync47(p2)) {
+  if (!existsSync48(p2)) {
     if (tokensPath !== "tokens.json") {
       warn3(`config designTokensPath points at ${tokensPath}, which does not exist -- colour tokens were not checked`);
     }
@@ -153322,7 +154065,7 @@ __export(fonts_exports, {
   listReport: () => listReport,
   resolveFamilyName: () => resolveFamilyName
 });
-import { existsSync as existsSync48, readFileSync as readFileSync57 } from "node:fs";
+import { existsSync as existsSync49, readFileSync as readFileSync57 } from "node:fs";
 import { join as join47 } from "node:path";
 function readJson6(path2, fallback) {
   try {
@@ -153356,7 +154099,7 @@ function listReport(opts = {}) {
 }
 async function fontFindings(appDir3, opts = {}) {
   const tokensPath = join47(appDir3, configuredTokensPath(appDir3).path ?? "tokens.json");
-  if (!existsSync48(tokensPath)) return null;
+  if (!existsSync49(tokensPath)) return null;
   const catalog4 = loadCatalog2();
   const tokens2 = readJson6(tokensPath, {});
   const policy = readJson6(join47(appDir3, "fonts.json"), {});
@@ -153864,17 +154607,17 @@ __export(template_recommend_exports, {
   recommendTemplates: () => recommendTemplates,
   verticalsFromBook: () => verticalsFromBook
 });
-import { existsSync as existsSync50, readFileSync as readFileSync60 } from "node:fs";
+import { existsSync as existsSync51, readFileSync as readFileSync60 } from "node:fs";
 import { join as join50 } from "node:path";
 function verticalsFromBook(path2) {
-  const dir = existsSync50(join50(path2, "book.json")) || existsSync50(join50(path2, "provisioning.overlay.json")) ? path2 : join50(path2, ".himi", "business-book");
+  const dir = existsSync51(join50(path2, "book.json")) || existsSync51(join50(path2, "provisioning.overlay.json")) ? path2 : join50(path2, ".himi", "business-book");
   const overlay = join50(dir, "provisioning.overlay.json");
-  if (existsSync50(overlay)) {
+  if (existsSync51(overlay)) {
     const v2 = JSON.parse(readFileSync60(overlay, "utf8")).installedVerticals;
     if (Array.isArray(v2) && v2.length) return v2.filter((x2) => typeof x2 === "string");
   }
   const book = join50(dir, "book.json");
-  if (existsSync50(book)) {
+  if (existsSync51(book)) {
     const probes = JSON.parse(readFileSync60(book, "utf8")).probes;
     if (Array.isArray(probes)) return installedFromProbes(probes);
   }
@@ -154489,7 +155232,7 @@ var init_glyphs = __esm({
 });
 
 // ../app-icons/plan.ts
-import { existsSync as existsSync51, readFileSync as readFileSync61, readdirSync as readdirSync27 } from "node:fs";
+import { existsSync as existsSync52, readFileSync as readFileSync61, readdirSync as readdirSync27 } from "node:fs";
 import { createHash as createHash29 } from "node:crypto";
 import { dirname as dirname29, join as join51, resolve as resolve44 } from "node:path";
 function stripComments(src) {
@@ -154625,7 +155368,7 @@ function resolveTokensPath(app, configTs) {
 }
 function resolveToken(app, token, tokensPathOverride) {
   const tokensPath = tokensPathOverride ?? join51(appDir(app), "tokens.json");
-  if (!existsSync51(tokensPath)) {
+  if (!existsSync52(tokensPath)) {
     throw new Error(`app-icons: ${app} has no tokens.json at ${tokensPath} (needed to resolve "${token}").`);
   }
   const tokens2 = JSON.parse(readFileSync61(tokensPath, "utf8"));
@@ -154670,7 +155413,7 @@ function iconSpec(app, configTs, id, tokensPathOverride) {
   const tokens2 = tokensPathOverride ?? resolveTokensPath(app, configTs).path;
   if (cfg.source) {
     const abs = resolve44(appDir(app), cfg.source);
-    if (!existsSync51(abs)) {
+    if (!existsSync52(abs)) {
       throw new Error(`app-icons: ${app} declares icon.source "${cfg.source}" but ${abs} does not exist.`);
     }
     return {
@@ -154710,9 +155453,9 @@ function iosAssetCatalog2(app) {
   return assetCatalogIn(join51(appDir(app), "ios"));
 }
 function assetCatalogIn(platformDir) {
-  if (!existsSync51(platformDir)) return void 0;
+  if (!existsSync52(platformDir)) return void 0;
   const children = readdirSync27(platformDir).filter((c2) => !c2.startsWith("build")).sort();
-  const catalogs = children.map((c2) => join51(platformDir, c2, "Assets.xcassets")).filter(existsSync51);
+  const catalogs = children.map((c2) => join51(platformDir, c2, "Assets.xcassets")).filter(existsSync52);
   if (catalogs.length === 1) return catalogs[0];
   if (catalogs.length > 1) return void 0;
   const targets = [];
@@ -154735,14 +155478,14 @@ function androidResDir2(manifestPath) {
 }
 function androidManifestPath(app) {
   const androidDir = join51(appDir(app), "android");
-  if (!existsSync51(androidDir)) return void 0;
+  if (!existsSync52(androidDir)) return void 0;
   const preferred = join51(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
-  if (existsSync51(preferred)) return preferred;
-  const candidates = readdirSync27(androidDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && d2.name.endsWith("-app")).map((d2) => join51(androidDir, d2.name, "src", "main", "AndroidManifest.xml")).filter(existsSync51);
+  if (existsSync52(preferred)) return preferred;
+  const candidates = readdirSync27(androidDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && d2.name.endsWith("-app")).map((d2) => join51(androidDir, d2.name, "src", "main", "AndroidManifest.xml")).filter(existsSync52);
   return candidates.length === 1 ? candidates[0] : void 0;
 }
 function androidOptedIn2(manifestPath) {
-  if (!manifestPath || !existsSync51(manifestPath)) return false;
+  if (!manifestPath || !existsSync52(manifestPath)) return false;
   return readFileSync61(manifestPath, "utf8").includes("@mipmap/ic_launcher");
 }
 function templateIconSha256() {
@@ -154767,7 +155510,7 @@ function generationAllowed(app, configTs, opts = {}) {
   }
   const iosCat = iosAssetCatalog2(app);
   const iosIcon = iosCat ? join51(iosCat, "AppIcon.appiconset", "icon_1024.png") : void 0;
-  if (!iosIcon || !existsSync51(iosIcon)) return { allowed: true, reason: "no icon yet" };
+  if (!iosIcon || !existsSync52(iosIcon)) return { allowed: true, reason: "no icon yet" };
   const hash2 = fileSha256(iosIcon);
   const placeholders = opts.placeholderHashes ?? placeholderHashes();
   if (app === "_template") return { allowed: true, reason: "the template itself" };
@@ -154791,7 +155534,7 @@ var init_plan2 = __esm({
 });
 
 // ../native-config/icon.ts
-import { existsSync as existsSync52, readFileSync as readFileSync62 } from "node:fs";
+import { existsSync as existsSync53, readFileSync as readFileSync62 } from "node:fs";
 import { join as join52 } from "node:path";
 function androidAdaptiveIconXml() {
   return [
@@ -154820,7 +155563,7 @@ function androidIconArtifacts(app, configTs) {
   if (!generationAllowed(app, configTs).allowed) return [];
   const res = androidResDir2(manifest2);
   const foreground = join52(res, "mipmap-mdpi", "ic_launcher_foreground.png");
-  if (!existsSync52(foreground)) {
+  if (!existsSync53(foreground)) {
     throw new Error(
       `native-config icon: ${app} opts into @mipmap/ic_launcher but has no mipmap-*/ic_launcher_foreground.png. Run \`npm run app-icons -- ${app}\` first \u2014 the XML emitted here points at those rasters.`
     );
@@ -155122,7 +155865,7 @@ var init_localweb = __esm({
 });
 
 // ../native-config/capability-registrations.ts
-import { existsSync as existsSync53, readdirSync as readdirSync28, readFileSync as readFileSync63, statSync as statSync16 } from "node:fs";
+import { existsSync as existsSync54, readdirSync as readdirSync28, readFileSync as readFileSync63, statSync as statSync16 } from "node:fs";
 import { dirname as dirname30, join as join53, resolve as resolve45 } from "node:path";
 import { fileURLToPath as fileURLToPath22 } from "node:url";
 function registrarClasses(path2, re2) {
@@ -155166,7 +155909,7 @@ function renderKotlinRegistrations(ids, appIdExpr = "APP_NAME", classes = androi
   ];
 }
 function filesWithRegisterMarkers(root, ext) {
-  if (!existsSync53(root)) return [];
+  if (!existsSync54(root)) return [];
   const out2 = [];
   const stack = [[root, 0, ext === ".kt" ? "project" : "main"]];
   while (stack.length) {
@@ -155358,7 +156101,7 @@ __export(gen_native_config_exports, {
   xmlAttr: () => xmlAttr,
   yamlScalar: () => yamlScalar
 });
-import { existsSync as existsSync54, mkdirSync as mkdirSync25, readFileSync as readFileSync64, readdirSync as readdirSync29, rmSync as rmSync15, statSync as statSync17, writeFileSync as writeFileSync21 } from "node:fs";
+import { existsSync as existsSync55, mkdirSync as mkdirSync25, readFileSync as readFileSync64, readdirSync as readdirSync29, rmSync as rmSync15, statSync as statSync17, writeFileSync as writeFileSync21 } from "node:fs";
 import { dirname as dirname31, join as join54 } from "node:path";
 import { fileURLToPath as fileURLToPath23 } from "node:url";
 function parseStringArray(configTs, field) {
@@ -155436,7 +156179,7 @@ function buildSet(capabilities, envelope = []) {
 }
 function loadOverrides(app) {
   const p2 = join54(appDir(app), "native-config.overrides.json");
-  if (!existsSync54(p2)) return {};
+  if (!existsSync55(p2)) return {};
   return JSON.parse(readFileSync64(p2, "utf8"));
 }
 function needsQuote(s2) {
@@ -155663,7 +156406,7 @@ function genCoreModuleInstallers(check) {
 }
 function swiftFilesWithModuleMarkers(app) {
   const root = join54(appDir(app), "ios");
-  if (!existsSync54(root)) return [];
+  if (!existsSync55(root)) return [];
   const out2 = [];
   const stack = [root];
   while (stack.length) {
@@ -155685,7 +156428,7 @@ function kotlinFilesWithModuleInstall(app) {
   return kotlinBootSourcesUnder(join54(appDir(app), "android"));
 }
 function kotlinBootSourcesUnder(root) {
-  if (!existsSync54(root)) return [];
+  if (!existsSync55(root)) return [];
   const out2 = [];
   const stack = [[root, 0, "project"]];
   while (stack.length) {
@@ -155756,7 +156499,7 @@ function endText(kind, label3, indent) {
 }
 function hostAppliesDeferredWidgetActions(app) {
   const root = join54(appDir(app), "ios");
-  if (!existsSync54(root)) return false;
+  if (!existsSync55(root)) return false;
   const stack = [root];
   while (stack.length) {
     const dir = stack.pop();
@@ -155814,15 +156557,15 @@ function androidAppGradle(app) {
 function androidManifestPath2(app) {
   const androidDir = join54(appDir(app), "android");
   const preferred = join54(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
-  if (existsSync54(preferred)) return preferred;
-  const candidates = existsSync54(androidDir) ? readdirSync29(androidDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && d2.name.endsWith("-app")).map((d2) => join54(androidDir, d2.name, "src", "main", "AndroidManifest.xml")).filter(existsSync54) : [];
+  if (existsSync55(preferred)) return preferred;
+  const candidates = existsSync55(androidDir) ? readdirSync29(androidDir, { withFileTypes: true }).filter((d2) => d2.isDirectory() && d2.name.endsWith("-app")).map((d2) => join54(androidDir, d2.name, "src", "main", "AndroidManifest.xml")).filter(existsSync55) : [];
   return candidates.length === 1 ? candidates[0] : preferred;
 }
 function automotiveAppDescPath(app) {
   return join54(dirname31(androidManifestPath2(app)), "res", "xml", "automotive_app_desc.xml");
 }
 function applyToFile(path2, kind, label3, render, check) {
-  if (!existsSync54(path2)) return { path: path2, outcome: "skipped" };
+  if (!existsSync55(path2)) return { path: path2, outcome: "skipped" };
   const before = readFileSync64(path2, "utf8");
   assertSingleMarkerPair(before, kind, label3, path2);
   if (!hasMarkers(before, kind, label3)) return { path: path2, outcome: "skipped" };
@@ -155834,7 +156577,7 @@ function applyToFile(path2, kind, label3, render, check) {
 }
 function assertModuleFlagsMarkers(paths2) {
   for (const path2 of paths2) {
-    if (!existsSync54(path2)) continue;
+    if (!existsSync55(path2)) continue;
     const text11 = readFileSync64(path2, "utf8");
     if (hasMarkers(text11, "yaml", LABEL_MODULES_IOS_LINK) && !hasMarkers(text11, "yaml", LABEL_MODULES_IOS_FLAGS)) {
       throw new Error(`${path2} links modules (${LABEL_MODULES_IOS_LINK}) but has no ${LABEL_MODULES_IOS_FLAGS} block under its project-level settings:, so no module would install. Add the markers (see apps/_template).`);
@@ -155846,7 +156589,7 @@ function applyModuleFlags(path2, products, check) {
   return applyToFile(path2, "yaml", LABEL_MODULES_IOS_FLAGS, (i2) => renderModulesIosFlags(products, i2), check);
 }
 function applyWholeFile(path2, content, check) {
-  const current = existsSync54(path2) ? readFileSync64(path2, "utf8") : null;
+  const current = existsSync55(path2) ? readFileSync64(path2, "utf8") : null;
   if (current === content) return { path: path2, outcome: "unchanged" };
   if (check) return { path: path2, outcome: "drift" };
   mkdirSync25(dirname31(path2), { recursive: true });
@@ -155854,7 +156597,7 @@ function applyWholeFile(path2, content, check) {
   return { path: path2, outcome: "written" };
 }
 function removeWholeFile(path2, check) {
-  if (!existsSync54(path2)) return { path: path2, outcome: "skipped" };
+  if (!existsSync55(path2)) return { path: path2, outcome: "skipped" };
   if (check) return { path: path2, outcome: "drift" };
   rmSync15(path2);
   return { path: path2, outcome: "removed" };
@@ -155893,7 +156636,7 @@ function genCapabilityRegistrations(root, declared, check) {
 }
 function buildSetOfAppDir(root) {
   const configPath = join54(root, "config.ts");
-  const configTs = existsSync54(configPath) ? readFileSync64(configPath, "utf8") : "";
+  const configTs = existsSync55(configPath) ? readFileSync64(configPath, "utf8") : "";
   return buildSet(parseStringArray(configTs, "capabilities"), parseStringArray(configTs, "capabilityEnvelope"));
 }
 function genNativeConfig(app, opts = {}) {
@@ -155902,7 +156645,7 @@ function genNativeConfig(app, opts = {}) {
   assertSingleModuleInstall(app, kotlinFilesWithModuleInstall(app));
   assertModuleFlagsMarkers([iosProjectYml(app), macosProjectYml(app)]);
   const configPath = appConfigTs(app);
-  const configTs = existsSync54(configPath) ? readFileSync64(configPath, "utf8") : "";
+  const configTs = existsSync55(configPath) ? readFileSync64(configPath, "utf8") : "";
   const capabilities = parseStringArray(configTs, "capabilities");
   const envelope = parseStringArray(configTs, "capabilityEnvelope");
   const ownIds = buildSet(capabilities, envelope);
@@ -155911,7 +156654,7 @@ function genNativeConfig(app, opts = {}) {
   const ids = dist ? dist.build : ownIds;
   const healthLinked = ids.includes("health");
   const distJsonPath = join54(appDir(app), "distribution.json");
-  const distJsonText = existsSync54(distJsonPath) ? readFileSync64(distJsonPath, "utf8") : void 0;
+  const distJsonText = existsSync55(distJsonPath) ? readFileSync64(distJsonPath, "utf8") : void 0;
   const optIns = distributionOptIns(distJsonText);
   const binaryCore = isBinaryCore(configTs, distJsonText);
   const modules = modulesFor(ids, optIns);
@@ -155927,7 +156670,7 @@ function genNativeConfig(app, opts = {}) {
         if (!v2) throw new Error(`${app}: a binary-core app that links native modules (${modules.gradle.join(", ")}) needs distribution.json coreVersion`);
         return v2;
       },
-      corePackage: () => existsSync54(iosProjectYml(app)) ? binaryCorePackage(readFileSync64(iosProjectYml(app), "utf8")) : void 0
+      corePackage: () => existsSync55(iosProjectYml(app)) ? binaryCorePackage(readFileSync64(iosProjectYml(app), "utf8")) : void 0
     } : void 0
   );
   if (binaryCore) {
@@ -155946,9 +156689,9 @@ function genNativeConfig(app, opts = {}) {
   const iosBundleId = watchConfig.iosBundleId ?? parseIosBundleId(configTs);
   const watch2 = watchInfoPlan(watchConfig, iosBundleId);
   const watchYml = watchosProjectYml(app);
-  const watchYmlText = existsSync54(watchYml) ? readFileSync64(watchYml, "utf8") : "";
+  const watchYmlText = existsSync55(watchYml) ? readFileSync64(watchYml, "utf8") : "";
   const watchSettings = watchSettingsPlan(watchMode(watchConfig.mode), iosBundleId, watchTargetBundleId(watchYmlText));
-  const watchName = existsSync54(watchYml) ? watchProjectName(readFileSync64(watchYml, "utf8")) : void 0;
+  const watchName = existsSync55(watchYml) ? watchProjectName(readFileSync64(watchYml, "utf8")) : void 0;
   const watchEmbedFor = (lines) => (indent) => {
     const mode = watchMode(watchConfig.mode);
     if (mode === "standalone") return [];
@@ -155962,7 +156705,7 @@ function genNativeConfig(app, opts = {}) {
   const carBlock = applyToFile(carManifestPath, "xml", LABEL_CAR, (i2) => renderCarManifestXml(carCategory, i2), check);
   assertCarBlockLanded(app, carCategory, carManifestPath, carBlock.outcome, LABEL_CAR);
   const iosYml = iosProjectYml(app);
-  const project = existsSync54(iosYml) ? readFileSync64(iosYml, "utf8") : "";
+  const project = existsSync55(iosYml) ? readFileSync64(iosYml, "utf8") : "";
   const targetManaged = hasMarkers(project, "yaml", LABEL_LIVE_TARGET);
   const embedManaged = hasMarkers(project, "yaml", LABEL_LIVE_EMBED);
   if (targetManaged !== embedManaged) throw new Error(`${app}: Live Activity target and embedding markers must be installed together`);
@@ -156046,7 +156789,7 @@ function genNativeConfig(app, opts = {}) {
   ];
   if (dist) {
     const manifestPath = androidManifestPath2(app);
-    const marked = (path2, kind, label3) => !existsSync54(path2) || hasMarkers(readFileSync64(path2, "utf8"), kind, label3);
+    const marked = (path2, kind, label3) => !existsSync55(path2) || hasMarkers(readFileSync64(path2, "utf8"), kind, label3);
     if (!marked(iosYml, "yaml", LABEL_IOS_INFO)) throw new Error(`${app}: dist capabilities need the ${LABEL_IOS_INFO} markers in ${iosYml}`);
     if (!marked(manifestPath, "xml", LABEL_ANDROID_SERVICES)) {
       throw new Error(`${app}: dist capabilities need the ${LABEL_ANDROID_SERVICES} markers inside <application> in ${manifestPath}`);
@@ -156057,7 +156800,7 @@ function genNativeConfig(app, opts = {}) {
     const addsGradle = added.gradle.some((p2) => !ownModules.gradle.includes(p2));
     if (addsSpm || addsGradle) {
       const requireMarkers = (path2, kind, label3) => {
-        if (!existsSync54(path2) || !hasMarkers(readFileSync64(path2, "utf8"), kind, label3)) {
+        if (!existsSync55(path2) || !hasMarkers(readFileSync64(path2, "utf8"), kind, label3)) {
           throw new Error(`${app}: dist added ${dist.added.join(", ")} but ${path2} has no ${label3} markers \u2014 the module would stay unlinked and every verb would answer module_not_linked`);
         }
       };
@@ -156082,9 +156825,9 @@ function genNativeConfig(app, opts = {}) {
   files.push(...genCapabilityRegistrations(appDir(app), ids, check));
   const rce = declaresRichContentEditor(configTs);
   for (const yml of [iosYml, macosProjectYml(app)]) {
-    const text11 = existsSync54(yml) ? readFileSync64(yml, "utf8") : "";
+    const text11 = existsSync55(yml) ? readFileSync64(yml, "utf8") : "";
     const r3 = applyToFile(yml, "yaml", LABEL_LOCALWEB, renderLocalWebYaml(resourcesDirOf(text11), rce), check);
-    if (existsSync54(yml)) assertLocalWebBlockLanded(app, rce, yml, r3.outcome);
+    if (existsSync55(yml)) assertLocalWebBlockLanded(app, rce, yml, r3.outcome);
     files.push(r3);
   }
   if (targetManaged) {
@@ -156096,7 +156839,7 @@ function genNativeConfig(app, opts = {}) {
     const entitlements = join54(dirname31(iosYml), LIVE_ENTITLEMENTS_PATH);
     files.push(plan.entitlements ? applyWholeFile(entitlements, plan.entitlements, check) : removeWholeFile(entitlements, check));
   }
-  const iosSplashManaged = existsSync54(iosYml) && hasMarkers(readFileSync64(iosYml, "utf8"), "yaml", LABEL_IOS_SPLASH);
+  const iosSplashManaged = existsSync55(iosYml) && hasMarkers(readFileSync64(iosYml, "utf8"), "yaml", LABEL_IOS_SPLASH);
   const manifest2 = androidManifestPath2(app);
   const splash = splashPlan(app, configTs, manifest2, iosSplashManaged);
   for (const artifact of splash.artifacts) files.push(applyWholeFile(artifact.path, artifact.content, check));
@@ -156189,7 +156932,7 @@ __export(capabilities_exports, {
   shellSupport: () => shellSupport,
   writeLastDist: () => writeLastDist
 });
-import { existsSync as existsSync55, lstatSync as lstatSync18, readFileSync as readFileSync65 } from "node:fs";
+import { existsSync as existsSync56, lstatSync as lstatSync18, readFileSync as readFileSync65 } from "node:fs";
 import { join as join55 } from "node:path";
 function declareHintFor(id) {
   return catalogKey(id) === "app_services" ? "each calling screen's `logicBundle.declaredCapabilities` (the runtime gate) \u2014 an app need not list app_services in config.ts `capabilities`, which only a shell that hosts app services must (an HHP app declares it there, since HHP copies that list onto every screen)" : DECLARE_HINT;
@@ -156271,7 +157014,7 @@ function allCapabilities(sdkRef = []) {
 function contentShell(dir, flag) {
   if (flag) return flag;
   const path2 = join55(dir, "himalaya.content.json");
-  if (!existsSync55(path2)) return null;
+  if (!existsSync56(path2)) return null;
   try {
     const shell = JSON.parse(readFileSync65(path2, "utf8")).shell;
     return typeof shell === "string" && shell ? shell : null;
@@ -156569,7 +157312,7 @@ function envelopeSubsetIssues(app, envelope) {
 function capabilityConfigFindings(sourceDir, builtDir) {
   const out2 = [];
   const configPath = join55(sourceDir, "config.ts");
-  if (existsSync55(configPath)) {
+  if (existsSync56(configPath)) {
     const configSrc = readFileSync65(configPath, "utf8");
     const declared = parseStringArray(configSrc, "capabilities");
     for (const id of new Set(declared)) {
@@ -156738,6 +157481,9 @@ async function navIssues(dir, strict) {
   pushScreenMapIssues(cfg.push, provisioning, warn3);
   pushAuthIssues(cfg.push, cfg.auth, provisioning, warn3);
   pushFamilyIssues(cfg.push, warn3);
+  const captcha = provisioning.siteId && !placeholderLogin(cfg.auth) ? captchaAuthFinding(cfg.auth, provisioning.siteId) : void 0;
+  if (captcha && captcha.code !== "captcha_auth_site_case" && !issues.some((i2) => i2.ruleCode === "push-auth-site"))
+    push("warning", "auth-captcha-site", captcha.message);
   if (nav === void 0 || nav === null) return issues;
   if (!isPlainObject2(nav)) {
     error("nav-not-an-object", `navigation must be an object (got ${Array.isArray(nav) ? "array" : typeof nav}).`);
@@ -156875,6 +157621,9 @@ function pushAuthIssues(push, auth, provisioning, warn3) {
     `push.registrar is "wix-ping", which registers a signed-in member's device with Wix Ping, but ${problem}. Use auth: WixConsumerAuthProvider({ siteId: "${provisioning.siteId ?? "<metaSiteId>"}", \u2026 }).`
   );
 }
+function placeholderLogin(auth) {
+  return isPlainObject2(auth) && isPlainObject2(auth.config) && auth.config.clientId === PLACEHOLDER_CLIENT_ID;
+}
 function pushFamilyIssues(push, warn3) {
   if (!isPlainObject2(push) || push.registrar !== "wix-ping" || typeof push.pingAppName !== "string") return;
   const replacement = replacementPingFamily(push.pingAppName);
@@ -156937,6 +157686,8 @@ var init_nav_lint = __esm({
     init_nav_slots();
     init_home_screen_id();
     init_wix_push_links();
+    init_captcha_auth();
+    init_wix_placeholders();
     NAVIGATION_KEYS = /* @__PURE__ */ new Set([
       "tabBar",
       "drawer",
@@ -157017,7 +157768,7 @@ __export(base44_types_exports, {
   renderBase44Types: () => renderBase44Types,
   writeBase44Types: () => writeBase44Types
 });
-import { existsSync as existsSync56, mkdirSync as mkdirSync26, readFileSync as readFileSync66, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync57, mkdirSync as mkdirSync26, readFileSync as readFileSync66, writeFileSync as writeFileSync22 } from "node:fs";
 import { dirname as dirname32, join as join56 } from "node:path";
 function logicalName(spec) {
   return (isAdoptedEntity(spec) ? spec.base44Name : spec.name) ?? "";
@@ -157097,7 +157848,7 @@ async function writeBase44Types(dir, app) {
   if (!list2?.length) throw new Base44TypesError("no_base44_entities", "config.ts declares no base44.entities \u2014 nothing to type. Declare them (or run `himi base44 adopt`) first.");
   const text11 = renderBase44Types(list2, app);
   const path2 = join56(dir, BASE44_TYPES_PATH);
-  const changed = !existsSync56(path2) || readFileSync66(path2, "utf8") !== text11;
+  const changed = !existsSync57(path2) || readFileSync66(path2, "utf8") !== text11;
   if (changed) {
     mkdirSync26(dirname32(path2), { recursive: true });
     writeFileSync22(path2, text11);
@@ -157106,7 +157857,7 @@ async function writeBase44Types(dir, app) {
 }
 async function base44TypesIssues(dir, app, strict) {
   const path2 = join56(dir, BASE44_TYPES_PATH);
-  if (!existsSync56(path2)) return [];
+  if (!existsSync57(path2)) return [];
   let list2;
   try {
     list2 = await declaredEntities(dir);
@@ -157249,13 +158000,13 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync58, mkdirSync as mkdirSync27, readFileSync as readFileSync68, writeFileSync as writeFileSync23 } from "node:fs";
+import { existsSync as existsSync59, mkdirSync as mkdirSync27, readFileSync as readFileSync68, writeFileSync as writeFileSync23 } from "node:fs";
 import { dirname as dirname33, join as join58, relative as relative10, resolve as resolve47, sep as sep16 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve47(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
-  if (existsSync58(inRepo)) return { path: inRepo, form: "source" };
+  if (existsSync59(inRepo)) return { path: inRepo, form: "source" };
   const dist = resolve47(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
-  if (existsSync58(dist)) return { path: dist, form: "bundle" };
+  if (existsSync59(dist)) return { path: dist, form: "bundle" };
   return null;
 }
 function specifiersFor(mod) {
@@ -157300,7 +158051,7 @@ function ejectModule(opts) {
   writeFileSync23(target, banner + normalized);
   const rewired = [];
   for (const f2 of files) {
-    if (!existsSync58(f2)) continue;
+    if (!existsSync59(f2)) continue;
     const before = readFileSync68(f2, "utf8");
     let after = before;
     let rel = relative10(dirname33(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
@@ -157479,7 +158230,7 @@ __export(icon_exports, {
   summarize: () => summarize3
 });
 import { createHash as createHash31 } from "node:crypto";
-import { existsSync as existsSync59, mkdirSync as mkdirSync28, readFileSync as readFileSync69, statSync as statSync18, writeFileSync as writeFileSync24 } from "node:fs";
+import { existsSync as existsSync60, mkdirSync as mkdirSync28, readFileSync as readFileSync69, statSync as statSync18, writeFileSync as writeFileSync24 } from "node:fs";
 import { basename as basename16, dirname as dirname34, join as join59, resolve as resolve48, sep as sep17 } from "node:path";
 function readManifest(dir) {
   try {
@@ -157518,7 +158269,7 @@ function templateIconMatch(png) {
 }
 function playState(dir) {
   const p2 = join59(resolve48(dir), PLAY_LISTING_ICON);
-  if (!existsSync59(p2)) return null;
+  if (!existsSync60(p2)) return null;
   try {
     if (!statSync18(p2).isFile()) return { path: p2, issues: ["is a directory, not a PNG file"] };
     return { path: p2, issues: playListingIconIssues(readFileSync69(p2)) };
@@ -157544,7 +158295,7 @@ async function iconStatus(dir) {
     verdict: "missing",
     policyChecklist: POLICY_CHECKLIST
   };
-  if (!path2 || !existsSync59(path2)) return base;
+  if (!path2 || !existsSync60(path2)) return base;
   let png;
   try {
     if (!statSync18(path2).isFile()) {
@@ -157634,7 +158385,7 @@ function backdropFromTokens(dir, fallback = "#1F2933") {
 }
 async function installIcon(dir, sourcePath, opts = {}) {
   const src = resolve48(sourcePath);
-  if (!existsSync59(src)) throw new Error(`himi icon: no such file: ${src}`);
+  if (!existsSync60(src)) throw new Error(`himi icon: no such file: ${src}`);
   const name = declaredIconName(dir) ?? DEFAULT_CONTENT_ICON;
   const dest = iconDest(dir, name);
   const wrote = [];
@@ -157688,11 +158439,11 @@ function declareIcon(dir, name) {
 }
 function siteBookIcon(bookDir) {
   const p2 = join59(resolve48(bookDir), SITE_BOOK_ICON_REL);
-  return existsSync59(p2) ? p2 : null;
+  return existsSync60(p2) ? p2 : null;
 }
 function siteLogoAbsence(bookDir) {
   const bookJson = join59(resolve48(bookDir), "book.json");
-  if (!existsSync59(bookJson)) {
+  if (!existsSync60(bookJson)) {
     return { reason: "no-book", hint: `no business book at ${bookDir} \u2014 run \`himi site analyze --out <dir>\` first, or pass --book <dir>` };
   }
   let logoUrl;
@@ -157976,7 +158727,7 @@ var init_crawl_layers = __esm({
 });
 
 // src/wix-writes.ts
-import { existsSync as existsSync61, readFileSync as readFileSync71 } from "node:fs";
+import { existsSync as existsSync62, readFileSync as readFileSync71 } from "node:fs";
 import { join as join62 } from "node:path";
 function isProvenRead(method, path2) {
   if (/[#\x00-\x1F\x7F]/.test(path2)) return false;
@@ -158096,7 +158847,7 @@ function parseDataAccess(text11, from) {
 function readDataAccess(dir) {
   for (const name of ["SPEC.md", "MOBILE-UX.md"]) {
     const p2 = join62(dir, name);
-    if (!existsSync61(p2)) continue;
+    if (!existsSync62(p2)) continue;
     let text11;
     try {
       text11 = readFileSync71(p2, "utf8");
@@ -158215,11 +158966,11 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync62, mkdirSync as mkdirSync29, readFileSync as readFileSync72, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync63, mkdirSync as mkdirSync29, readFileSync as readFileSync72, writeFileSync as writeFileSync25 } from "node:fs";
 import { join as join63, resolve as resolve49 } from "node:path";
 function readTestConfig(dir) {
   const p2 = resolve49(dir, TEST_CONFIG_FILE);
-  if (!existsSync62(p2)) return {};
+  if (!existsSync63(p2)) return {};
   let parsed;
   try {
     parsed = JSON.parse(readFileSync72(p2, "utf8"));
@@ -158290,7 +159041,7 @@ function readNetRules(path2) {
 function defaultNetRules(dir) {
   for (const rel of ["dev/net-mocks.json", "tests/net-mocks.json"]) {
     const p2 = resolve49(dir, rel);
-    if (existsSync62(p2)) {
+    if (existsSync63(p2)) {
       const rules = readNetRules(p2);
       if (rules.length) return { rules, from: rel };
     }
@@ -159382,7 +160133,7 @@ var init_release_payload_hash = __esm({
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash35, randomBytes as randomBytes2 } from "node:crypto";
 import {
-  existsSync as existsSync63,
+  existsSync as existsSync64,
   lstatSync as lstatSync20,
   mkdirSync as mkdirSync31,
   realpathSync as realpathSync9,
@@ -159512,7 +160263,7 @@ function readLatestAttestation(contentDir2) {
 }
 function readRetainedAttestations(contentDir2) {
   const dir = join66(resolve53(contentDir2), ".himi", "attestations");
-  if (!existsSync63(dir)) return { runs: [], errors: [] };
+  if (!existsSync64(dir)) return { runs: [], errors: [] };
   try {
     const names2 = readdirSync30(dir).filter((name) => name.endsWith(".json") && name !== "latest.json");
     const parsedRuns = [];
@@ -159529,7 +160280,7 @@ function readRetainedAttestations(contentDir2) {
       } else errors.push(`attestation history contains malformed retained run ${name}`);
     }
     const latest = readLatestAttestation(contentDir2);
-    if (existsSync63(join66(dir, "latest.json")) && !latest) errors.push("attestation history has no valid latest.json");
+    if (existsSync64(join66(dir, "latest.json")) && !latest) errors.push("attestation history has no valid latest.json");
     else if (names2.length > 0 && !latest) errors.push("attestation history has no latest.json");
     const byHash = new Map(parsedRuns.map((run2) => [run2.selfHash, run2]));
     if (byHash.size !== parsedRuns.length) errors.push("attestation history contains duplicate self hashes");
@@ -159537,7 +160288,7 @@ function readRetainedAttestations(contentDir2) {
       if (selfHashFor(run2) !== run2.selfHash) errors.push(`selfHash does not match retained run ${run2.runId}`);
       for (const expected of Object.values(run2.screenshots)) {
         const path2 = screenshotArtifactPath(contentDir2, expected);
-        if (!existsSync63(path2)) errors.push(`missing screenshot for retained run ${run2.runId}: ${basename18(path2)}`);
+        if (!existsSync64(path2)) errors.push(`missing screenshot for retained run ${run2.runId}: ${basename18(path2)}`);
         else if (sha2565(readFileSync74(path2)) !== expected) errors.push(`screenshot hash does not match retained run ${run2.runId}: ${basename18(path2)}`);
       }
     }
@@ -159608,7 +160359,7 @@ function writeAttestation(input, opts = {}) {
   const descriptorHashes = Object.fromEntries(
     Object.entries(input.descriptors).sort(([a2], [b2]) => a2.localeCompare(b2)).map(([screen, bytes2]) => [screen, sha2565(bytes2)])
   );
-  const screenshotEntries = Object.entries(input.screenshots ?? {}).sort(([a2], [b2]) => a2.localeCompare(b2)).filter(([, path2]) => existsSync63(path2)).map(([screen, path2]) => {
+  const screenshotEntries = Object.entries(input.screenshots ?? {}).sort(([a2], [b2]) => a2.localeCompare(b2)).filter(([, path2]) => existsSync64(path2)).map(([screen, path2]) => {
     const bytes2 = readFileSync74(path2);
     return { screen, bytes: bytes2, hash: sha2565(bytes2) };
   });
@@ -159616,7 +160367,7 @@ function writeAttestation(input, opts = {}) {
   for (const { bytes: bytes2, hash: hash2 } of screenshotEntries) {
     const artifact = screenshotArtifactPath(contentDir2, hash2);
     mkdirSync31(join66(dir, "artifacts"), { recursive: true });
-    if (!existsSync63(artifact)) writeFileSync27(artifact, bytes2);
+    if (!existsSync64(artifact)) writeFileSync27(artifact, bytes2);
   }
   const unsigned = {
     attestation: 2,
@@ -159661,7 +160412,7 @@ function writeAttestation(input, opts = {}) {
       retainedRuns.flatMap((run2) => Object.values(run2.screenshots))
     );
     const artifactDir = join66(dir, "artifacts");
-    if (existsSync63(artifactDir)) {
+    if (existsSync64(artifactDir)) {
       for (const name of readdirSync30(artifactDir).filter((candidate) => candidate.endsWith(".png"))) {
         if (!retainedScreenshotHashes.has(name.slice(0, -4))) unlinkSync4(join66(artifactDir, name));
       }
@@ -159737,7 +160488,7 @@ function verifyAttestation(attestation, contentDir2, descriptors, expectedApp, r
   }
   for (const [screen, expected] of Object.entries(attestation.screenshots)) {
     const path2 = screenshotArtifactPath(contentDir2, expected);
-    if (!existsSync63(path2)) {
+    if (!existsSync64(path2)) {
       errors.push(`missing screenshot for ${screen}: ${basename18(path2)}`);
       continue;
     }
@@ -159761,7 +160512,7 @@ var init_attestation = __esm({
 });
 
 // src/ux-evidence.ts
-import { existsSync as existsSync64, mkdirSync as mkdirSync32, readFileSync as readFileSync75, writeFileSync as writeFileSync28 } from "node:fs";
+import { existsSync as existsSync65, mkdirSync as mkdirSync32, readFileSync as readFileSync75, writeFileSync as writeFileSync28 } from "node:fs";
 import { dirname as dirname38, isAbsolute as isAbsolute6, join as join67, relative as relative12, resolve as resolve54 } from "node:path";
 function isNativePlatform(value2) {
   return typeof value2 === "string" && NATIVE_PLATFORMS.includes(value2);
@@ -159771,7 +160522,7 @@ function isNativeAuditStatus(value2) {
 }
 function readText(path2) {
   try {
-    return existsSync64(path2) ? readFileSync75(path2, "utf8") : null;
+    return existsSync65(path2) ? readFileSync75(path2, "utf8") : null;
   } catch {
     return null;
   }
@@ -159873,7 +160624,7 @@ function uxEvidenceForRelease(content, release2) {
     inheritedScreens: [],
     malformed: []
   };
-  if (!existsSync64(path2)) return { ...base, state: "absent" };
+  if (!existsSync65(path2)) return { ...base, state: "absent" };
   const parsed = parseEvidence(path2);
   if (parsed.error) return { ...base, state: "unreadable", error: parsed.error };
   if (!parsed.evidence) return { ...base, state: "absent" };
@@ -159944,11 +160695,11 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync65, readFileSync as readFileSync76 } from "node:fs";
+import { existsSync as existsSync66, readFileSync as readFileSync76 } from "node:fs";
 import { join as join68 } from "node:path";
 function mobileUxIssues(dir, strict) {
   const file2 = join68(dir, "MOBILE-UX.md");
-  if (!existsSync65(file2)) return [];
+  if (!existsSync66(file2)) return [];
   let text11;
   try {
     text11 = readFileSync76(file2, "utf8");
@@ -161632,7 +162383,7 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync79, existsSync as existsSync68 } from "node:fs";
+import { readFileSync as readFileSync79, existsSync as existsSync69 } from "node:fs";
 import { join as join71, resolve as resolve55 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
@@ -161652,7 +162403,7 @@ async function loadFunctionsApp(dir) {
   }
   const sources = {};
   for (const definition of config.functions.functions) {
-    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join71(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync68);
+    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join71(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync69);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
     sources[definition.name] = readFileSync79(source, "utf8");
   }
@@ -161842,7 +162593,7 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { closeSync as closeSync6, constants as constants4, lstatSync as lstatSync21, mkdirSync as mkdirSync33, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync81, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync18, statSync as statSync19, writeSync, existsSync as existsSync69 } from "node:fs";
+import { closeSync as closeSync6, constants as constants4, lstatSync as lstatSync21, mkdirSync as mkdirSync33, openSync as openSync5, readdirSync as readdirSync31, readFileSync as readFileSync81, realpathSync as realpathSync10, renameSync as renameSync11, rmSync as rmSync18, statSync as statSync19, writeSync, existsSync as existsSync70 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { dirname as dirname39, isAbsolute as isAbsolute7, join as join72, relative as relative13, resolve as resolve56, sep as sep18 } from "node:path";
 import * as z2 from "zod";
@@ -161852,7 +162603,7 @@ function within(root, p2) {
 function realish(p2) {
   let cur = p2;
   const tail = [];
-  while (!existsSync69(cur)) {
+  while (!existsSync70(cur)) {
     const up = dirname39(cur);
     if (up === cur) break;
     tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
@@ -161875,7 +162626,7 @@ function symlinkComponent(base, abs) {
 function workspaceRefusal(root, target) {
   const r3 = resolve56(root);
   const t2 = resolve56(r3, target);
-  if (!existsSync69(r3)) return `the workspace folder ${r3} does not exist`;
+  if (!existsSync70(r3)) return `the workspace folder ${r3} does not exist`;
   if (!within(r3, t2) || !within(realpathSync10(r3), realish(t2))) return `"${target}" is outside the workspace folder ${r3}`;
   const link = symlinkComponent(r3, t2);
   if (link) return `"${link}" is a symlink \u2014 paths must stay in real folders inside the workspace`;
@@ -161884,13 +162635,13 @@ function workspaceRefusal(root, target) {
 async function confinedAppDir(args, deps) {
   const root = resolve56(await deps.defaultDir());
   const dir = typeof args.dir === "string" && args.dir ? resolve56(root, args.dir) : root;
-  if (!existsSync69(root)) return refuse5("no_workspace", `the workspace folder ${root} does not exist`);
+  if (!existsSync70(root)) return refuse5("no_workspace", `the workspace folder ${root} does not exist`);
   if (!within(root, dir) || !within(realpathSync10(root), realish(dir))) return refuse5("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
   const link = symlinkComponent(root, dir);
   if (link) return refuse5("outside_workspace", `"${link}" is a symlink \u2014 the app folder must be a real folder in the workspace`);
   const rel = relative13(root, dir);
   if (rel && (isDeniedSourcePath(`${rel}/x`) || isDeniedSourcePath(`${rel.toLowerCase()}/x`))) return refuse5("denied", `"${rel}" is a folder this tool does not touch`);
-  if (!existsSync69(join72(dir, CONTENT_MARKER))) {
+  if (!existsSync70(join72(dir, CONTENT_MARKER))) {
     return refuse5("not_an_app", `"${rel || "."}" is not an app folder (no ${CONTENT_MARKER}) \u2014 see himi_list_apps, or create one with himi_init`);
   }
   return dir;
@@ -161898,7 +162649,7 @@ async function confinedAppDir(args, deps) {
 function onDiskSpelling(abs) {
   let cur = abs;
   const tail = [];
-  while (!existsSync69(cur)) {
+  while (!existsSync70(cur)) {
     const up = dirname39(cur);
     if (up === cur) break;
     tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
@@ -161922,7 +162673,7 @@ function confinedPath(appDir3, rel) {
   const abs = resolve56(appDir3, rel);
   if (!within(appDir3, abs) || abs === appDir3) return { error: `"${rel}" is outside the app folder` };
   const real = realish(abs);
-  const base = existsSync69(appDir3) ? realpathSync10(appDir3) : realish(appDir3);
+  const base = existsSync70(appDir3) ? realpathSync10(appDir3) : realish(appDir3);
   if (!within(base, real) || real === base) return { error: `"${rel}" is outside the app folder` };
   const link = symlinkComponent(appDir3, abs);
   if (link) return { error: `"${link}" is a symlink, which this tool does not follow` };
@@ -161979,11 +162730,11 @@ function fileTools() {
       inputSchema: z2.object({}),
       handler: async (_a3, d2) => {
         const root = resolve56(await d2.defaultDir());
-        if (!existsSync69(root)) return ok({ ok: true, workspace: root, apps: [] });
+        if (!existsSync70(root)) return ok({ ok: true, workspace: root, apps: [] });
         const apps = [];
-        if (existsSync69(join72(root, CONTENT_MARKER))) apps.push(".");
+        if (existsSync70(join72(root, CONTENT_MARKER))) apps.push(".");
         for (const e2 of readdirSync31(root, { withFileTypes: true })) {
-          if (e2.isDirectory() && !e2.name.startsWith(".") && existsSync69(join72(root, e2.name, CONTENT_MARKER))) apps.push(e2.name);
+          if (e2.isDirectory() && !e2.name.startsWith(".") && existsSync70(join72(root, e2.name, CONTENT_MARKER))) apps.push(e2.name);
         }
         return ok({ ok: true, workspace: root, apps: apps.sort() });
       }
@@ -161997,7 +162748,7 @@ function fileTools() {
       handler: async (a2, d2) => {
         const app = await confinedAppDir(a2, d2);
         if (typeof app !== "string") return app;
-        if (!existsSync69(app) || !statSync19(app).isDirectory()) return refuse5("no_app", `no folder at ${app}`);
+        if (!existsSync70(app) || !statSync19(app).isDirectory()) return refuse5("no_app", `no folder at ${app}`);
         return ok({ ok: true, dir: app, ...listFiles(app) });
       }
     },
@@ -162012,7 +162763,7 @@ function fileTools() {
         if (typeof app !== "string") return app;
         const p2 = confinedPath(app, a2.path);
         if (typeof p2 !== "string") return refuse5("bad_path", p2.error);
-        if (!existsSync69(p2) || !lstatSync21(p2).isFile()) return refuse5("not_found", `no file "${String(a2.path)}"`);
+        if (!existsSync70(p2) || !lstatSync21(p2).isFile()) return refuse5("not_found", `no file "${String(a2.path)}"`);
         const size = statSync19(p2).size;
         if (size > MAX_FILE_BYTES) return refuse5("too_large", `"${String(a2.path)}" is ${size} bytes \u2014 over the ${MAX_FILE_BYTES}-byte read limit`);
         return ok({ ok: true, path: a2.path, bytes: size, content: readFileSync81(p2, "utf8") });
@@ -162039,7 +162790,7 @@ function fileTools() {
           if (typeof p2 !== "string") refused2.push({ path: f2.path, error: p2.error });
           else if (typeof f2.content !== "string") refused2.push({ path: f2.path, error: "content must be text" });
           else if (Buffer.byteLength(f2.content) > MAX_FILE_BYTES) refused2.push({ path: f2.path, error: `over the ${MAX_FILE_BYTES}-byte limit` });
-          else if (existsSync69(p2) && !lstatSync21(p2).isFile()) refused2.push({ path: f2.path, error: "not a regular file" });
+          else if (existsSync70(p2) && !lstatSync21(p2).isFile()) refused2.push({ path: f2.path, error: "not a regular file" });
           else if (planned2.some((q2) => q2.abs === p2)) refused2.push({ path: f2.path, error: "the same file twice in one call" });
           else planned2.push({ abs: p2, rel: String(f2.path), content: f2.content });
         }
@@ -162072,7 +162823,7 @@ function fileTools() {
         for (const rel of paths2) {
           const p2 = confinedPath(app, rel);
           if (typeof p2 !== "string") refused2.push({ path: rel, error: p2.error });
-          else if (!existsSync69(p2)) refused2.push({ path: rel, error: "no such file" });
+          else if (!existsSync70(p2)) refused2.push({ path: rel, error: "no such file" });
           else if (!lstatSync21(p2).isFile()) refused2.push({ path: rel, error: "not a regular file" });
           else if (!planned2.includes(p2)) {
             planned2.push(p2);
@@ -162867,14 +163618,14 @@ var init_open_url = __esm({
 });
 
 // src/ux-audit.ts
-import { existsSync as existsSync72, readFileSync as readFileSync83, readdirSync as readdirSync32 } from "node:fs";
+import { existsSync as existsSync73, readFileSync as readFileSync83, readdirSync as readdirSync32 } from "node:fs";
 import { join as join76, relative as relative15, resolve as resolve61 } from "node:path";
 function issue(issues, strict, code, message2, path2) {
   issues.push({ code, message: message2, ...path2 ? { path: path2 } : {}, severity: strict ? "error" : "warning" });
 }
 function readText2(path2) {
   try {
-    return existsSync72(path2) ? readFileSync83(path2, "utf8") : null;
+    return existsSync73(path2) ? readFileSync83(path2, "utf8") : null;
   } catch {
     return null;
   }
@@ -162974,7 +163725,7 @@ function auditUx(content, strict = false) {
   }
   if (usesAppNetwork(source)) {
     const mocksPath = join76(dir, "dev", "net-mocks.json");
-    if (!existsSync72(mocksPath)) {
+    if (!existsSync73(mocksPath)) {
       issue(issues, strict, "missing-app-mocks", "This package uses a Wix/network client but has no app-specific dev/net-mocks.json. `himi test --record` writes one from the live responses it sees; then add fixtures for dynamic, entitlement, or recovery flows.", "dev/net-mocks.json");
     } else {
       try {
@@ -163022,7 +163773,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync6, spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync73, mkdirSync as mkdirSync37, mkdtempSync as mkdtempSync5, readFileSync as readFileSync84, rmSync as rmSync20, writeFileSync as writeFileSync31 } from "node:fs";
+import { existsSync as existsSync74, mkdirSync as mkdirSync37, mkdtempSync as mkdtempSync5, readFileSync as readFileSync84, rmSync as rmSync20, writeFileSync as writeFileSync31 } from "node:fs";
 import { homedir as homedir10, tmpdir as tmpdir6 } from "node:os";
 import { join as join78 } from "node:path";
 import { fileURLToPath as fileURLToPath27 } from "node:url";
@@ -163034,8 +163785,8 @@ function nativeDecodeAndroidHarnessDir() {
 }
 function nativeOracleShipped() {
   return {
-    ios: existsSync73(join78(nativeDecodePackageDir(), "Package.swift")),
-    android: existsSync73(join78(nativeDecodeAndroidHarnessDir(), "gradlew"))
+    ios: existsSync74(join78(nativeDecodePackageDir(), "Package.swift")),
+    android: existsSync74(join78(nativeDecodeAndroidHarnessDir(), "gradlew"))
   };
 }
 function detectNativeDecode(options = {}) {
@@ -163046,7 +163797,7 @@ function detectNativeDecode(options = {}) {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
   if (!swiftAvailable) return { platform: "ios", available: false, reason: "swift is not on PATH" };
-  const packageAvailable = options.packageAvailable ?? existsSync73(join78(packageDir, "Package.swift"));
+  const packageAvailable = options.packageAvailable ?? existsSync74(join78(packageDir, "Package.swift"));
   if (!packageAvailable) {
     return {
       platform: "ios",
@@ -163072,7 +163823,7 @@ function defaultAndroidSdkDir(hostPlatform, home) {
 function detectAndroidNativeDecode(options = {}) {
   const harnessDir = options.harnessDir ?? nativeDecodeAndroidHarnessDir();
   const gradlew = join78(harnessDir, "gradlew");
-  const gradlewAvailable = options.gradlewAvailable ?? existsSync73(gradlew);
+  const gradlewAvailable = options.gradlewAvailable ?? existsSync74(gradlew);
   if (!gradlewAvailable) {
     return {
       platform: "android",
@@ -163080,7 +163831,7 @@ function detectAndroidNativeDecode(options = {}) {
       reason: "the in-repo Android Gradle harness is unavailable (off-repo installs do not ship the decoder oracle)"
     };
   }
-  const exists = typeof options.sdkAvailable === "function" ? options.sdkAvailable : typeof options.sdkAvailable === "boolean" ? /* @__PURE__ */ ((answer) => () => answer)(options.sdkAvailable) : existsSync73;
+  const exists = typeof options.sdkAvailable === "function" ? options.sdkAvailable : typeof options.sdkAvailable === "boolean" ? /* @__PURE__ */ ((answer) => () => answer)(options.sdkAvailable) : existsSync74;
   const defaultDir = defaultAndroidSdkDir(options.hostPlatform ?? process.platform, options.homeDir ?? homedir10());
   const candidates = [
     options.androidHome ?? process.env.ANDROID_HOME,
@@ -163342,7 +164093,7 @@ __export(browser_authoring_exports, {
 });
 import { createServer as createServer4 } from "node:http";
 import { createHash as createHash38, randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync74, readdirSync as readdirSync33, readFileSync as readFileSync85, realpathSync as realpathSync11, statSync as statSync20 } from "node:fs";
+import { existsSync as existsSync75, readdirSync as readdirSync33, readFileSync as readFileSync85, realpathSync as realpathSync11, statSync as statSync20 } from "node:fs";
 import { join as join79, posix as posix3, relative as relative16, sep as sep19 } from "node:path";
 function humanMs(ms2) {
   return ms2 < 1e3 ? `${ms2}ms` : `${Math.round(ms2 / 1e3)}s`;
@@ -163365,7 +164116,7 @@ function collectWorkerSources(tier5SrcDir, bundleName) {
       }
     }
   };
-  if (!existsSync74(root)) return null;
+  if (!existsSync75(root)) return null;
   walk2(root, `/tier5-src/${bundleName}`);
   const entry = [`/tier5-src/${bundleName}/index.ts`, `/tier5-src/${bundleName}/index.js`].find((p2) => p2 in files);
   if (!entry) return null;
@@ -163392,7 +164143,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
         join79(onDisk, "index.js")
       ];
       for (const abs of candidates) {
-        if (!existsSync74(abs) || statSync20(abs).isDirectory()) continue;
+        if (!existsSync75(abs) || statSync20(abs).isDirectory()) continue;
         const key3 = `/tier5-src/${relative16(tier5SrcDir, abs).split(sep19).join(posix3.sep)}`;
         if (key3 in files) break;
         files[key3] = readFileSync85(abs, "utf8");
@@ -163503,7 +164254,7 @@ async function readBody3(req) {
 async function runBrowserAuthoring(opts) {
   const log = opts.log ?? (() => {
   });
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS3;
   const payload = encodeJob(opts.job);
   const token = mintToken2(payload);
   const unusable = await probeAuthoringPage(opts.authoringBase, opts.fetchImpl, opts.probeTimeoutMs);
@@ -163579,11 +164330,11 @@ async function runBrowserAuthoring(opts) {
     });
   });
 }
-var DEFAULT_TIMEOUT_MS2, PROBE_TIMEOUT_MS, POINT_ELSEWHERE, NO_SUCH_ROUTE, NOT_STAGED, MAX_CALLBACK_BYTES;
+var DEFAULT_TIMEOUT_MS3, PROBE_TIMEOUT_MS, POINT_ELSEWHERE, NO_SUCH_ROUTE, NOT_STAGED, MAX_CALLBACK_BYTES;
 var init_browser_authoring = __esm({
   "src/browser-authoring.ts"() {
     init_open_url();
-    DEFAULT_TIMEOUT_MS2 = 5 * 60 * 1e3;
+    DEFAULT_TIMEOUT_MS3 = 5 * 60 * 1e3;
     PROBE_TIMEOUT_MS = 5e3;
     POINT_ELSEWHERE = "Point --serve-url at a plane that mounts /v1/authoring/* (the local serve stack does NOT: core/serve-authoring is a separate service), or pass --target to select a deployed one.";
     NO_SUCH_ROUTE = /* @__PURE__ */ new Set([404, 410]);
@@ -163602,7 +164353,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync75, mkdirSync as mkdirSync38, readFileSync as readFileSync86, writeFileSync as writeFileSync32 } from "node:fs";
+import { existsSync as existsSync76, mkdirSync as mkdirSync38, readFileSync as readFileSync86, writeFileSync as writeFileSync32 } from "node:fs";
 import { dirname as dirname43, join as join80 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -163786,7 +164537,7 @@ function trendAndStore(dir, entries, suppressed) {
   const p2 = join80(dir, LEDGER_FILE);
   let previous = null;
   try {
-    if (existsSync75(p2)) {
+    if (existsSync76(p2)) {
       const parsed = JSON.parse(readFileSync86(p2, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k2) => typeof k2 === "string");
     }
@@ -163829,7 +164580,7 @@ function diffAndStoreObservations(dir, current) {
   const p2 = join80(dir, OBS_FILE);
   let previous = null;
   try {
-    if (existsSync75(p2)) {
+    if (existsSync76(p2)) {
       const parsed = JSON.parse(readFileSync86(p2, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v2) => Array.isArray(v2) && v2.every((l2) => typeof l2 === "string")
@@ -164202,11 +164953,11 @@ __export(design_kits_exports, {
   kitsDir: () => kitsDir,
   listKits: () => listKits2
 });
-import { existsSync as existsSync77, readFileSync as readFileSync88, readdirSync as readdirSync34 } from "node:fs";
+import { existsSync as existsSync78, readFileSync as readFileSync88, readdirSync as readdirSync34 } from "node:fs";
 import { join as join83, basename as basename20 } from "node:path";
 import { fileURLToPath as fileURLToPath28 } from "node:url";
 function kitsDir() {
-  return KIT_DIR_CANDIDATES.find((p2) => existsSync77(p2));
+  return KIT_DIR_CANDIDATES.find((p2) => existsSync78(p2));
 }
 function listKits2() {
   const dir = kitsDir();
@@ -164701,7 +165452,7 @@ __export(coverage_exports2, {
   verifyNativeProof: () => verifyNativeProof
 });
 import { createHash as createHash39 } from "node:crypto";
-import { existsSync as existsSync79, readFileSync as readFileSync90, writeFileSync as writeFileSync33 } from "node:fs";
+import { existsSync as existsSync80, readFileSync as readFileSync90, writeFileSync as writeFileSync33 } from "node:fs";
 import { isAbsolute as isAbsolute8, join as join85, resolve as resolve64 } from "node:path";
 function verifiedEvidence(evidenceDir) {
   const manifest2 = obj3(JSON.parse(readFileSync90(join85(evidenceDir, "manifest.json"), "utf8")));
@@ -164797,7 +165548,7 @@ function deriveRequirements(evidenceDir) {
 function verifyNativeProof(contentDir2, releaseHash, requirementIds) {
   const root = resolve64(contentDir2);
   const path2 = join85(root, NATIVE_PROOF_FILE);
-  if (!existsSync79(path2)) return { ok: false, issues: [`${NATIVE_PROOF_FILE} is absent.`] };
+  if (!existsSync80(path2)) return { ok: false, issues: [`${NATIVE_PROOF_FILE} is absent.`] };
   let proof;
   try {
     proof = obj3(JSON.parse(readFileSync90(path2, "utf8")));
@@ -164819,7 +165570,7 @@ function verifyNativeProof(contentDir2, releaseHash, requirementIds) {
       continue;
     }
     const artifact = record2.artifact;
-    if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync79(join85(root, artifact))) {
+    if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync80(join85(root, artifact))) {
       issues.push(`Native walkthrough check ${id} needs a reviewable artifact file.`);
     }
   }
@@ -164828,7 +165579,7 @@ function verifyNativeProof(contentDir2, releaseHash, requirementIds) {
 function syncCoverage(evidenceDir, contentDir2, write2 = true) {
   const current = deriveRequirements(evidenceDir);
   const path2 = join85(resolve64(contentDir2), COVERAGE_FILE);
-  const existed = existsSync79(path2);
+  const existed = existsSync80(path2);
   const old = existed ? obj3(JSON.parse(readFileSync90(path2, "utf8"))) : {};
   const hashesChanged = existed && JSON.stringify(old.sourceHashes) !== JSON.stringify(current.sourceHashes);
   const prior = Array.isArray(old.requirements) ? old.requirements : [];
@@ -164869,7 +165620,7 @@ function verifyCoverage(evidenceDir, contentDir2, releaseHash, builtScreenIds) {
   const saved = result.existed ? obj3(JSON.parse(readFileSync90(join85(resolve64(contentDir2), COVERAGE_FILE), "utf8"))) : {};
   const rows = Array.isArray(saved.requirements) ? saved.requirements.map(obj3) : [];
   const contentManifest = join85(resolve64(contentDir2), "himalaya.content.json");
-  const declaredScreens = existsSync79(contentManifest) ? obj3(obj3(JSON.parse(readFileSync90(contentManifest, "utf8"))).screens) : void 0;
+  const declaredScreens = existsSync80(contentManifest) ? obj3(obj3(JSON.parse(readFileSync90(contentManifest, "utf8"))).screens) : void 0;
   const availableScreens = builtScreenIds ? new Set(builtScreenIds) : declaredScreens && Object.keys(declaredScreens).length ? new Set(Object.keys(declaredScreens)) : void 0;
   for (const row2 of rows) {
     const id = typeof row2.id === "string" ? row2.id : void 0;
@@ -164905,7 +165656,7 @@ function verifyCoverage(evidenceDir, contentDir2, releaseHash, builtScreenIds) {
       const path2 = check.evidence;
       if (typeof path2 !== "string" || !path2.trim() || isAbsolute8(path2) || path2.split(/[\\/]/).includes("..")) {
         issues.push({ id, message: `Check ${required3} needs a safe relative evidence path.` });
-      } else if (!existsSync79(join85(resolve64(contentDir2), path2))) {
+      } else if (!existsSync80(join85(resolve64(contentDir2), path2))) {
         issues.push({ id, message: `Check ${required3} evidence file is absent: ${path2}.` });
       } else {
         try {
@@ -164916,7 +165667,7 @@ function verifyCoverage(evidenceDir, contentDir2, releaseHash, builtScreenIds) {
             issues.push({ id, message: `Check ${required3} has no latest passed record for this requirement and target.` });
           } else {
             const artifact = record2.artifact;
-            if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync79(join85(resolve64(contentDir2), artifact))) {
+            if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync80(join85(resolve64(contentDir2), artifact))) {
               issues.push({ id, message: `Check ${required3} needs a reviewable artifact file.` });
             }
           }
@@ -164956,7 +165707,7 @@ __export(validate_topbar_exports, {
   runOneAppTopBarValidation: () => runOneAppTopBarValidation
 });
 import { createHash as createHash40 } from "node:crypto";
-import { existsSync as existsSync80, readFileSync as readFileSync91, statSync as statSync22 } from "node:fs";
+import { existsSync as existsSync81, readFileSync as readFileSync91, statSync as statSync22 } from "node:fs";
 import { resolve as resolve65, join as join86 } from "node:path";
 import ts8 from "typescript";
 function enrichedControls(raw, views) {
@@ -165165,7 +165916,7 @@ function configActions(configPath) {
 }
 function screenActions2(contentDir2) {
   const path2 = join86(contentDir2, "dev", "index.ts");
-  if (!existsSync80(path2)) return /* @__PURE__ */ new Map();
+  if (!existsSync81(path2)) return /* @__PURE__ */ new Map();
   const source = ts8.createSourceFile(path2, readFileSync91(path2, "utf8"), ts8.ScriptTarget.Latest, true, ts8.ScriptKind.TS);
   if (source.parseDiagnostics.length) throw Error("dev/index.ts could not be parsed.");
   const declaration = source.statements.filter(ts8.isVariableStatement).flatMap((statement) => [...statement.declarationList.declarations]).find((item) => ts8.isIdentifier(item.name) && item.name.text === "SCREENS");
@@ -165266,7 +166017,7 @@ function validate3(evidenceDir, contentDir2) {
   }
   const mappings = /* @__PURE__ */ new Map();
   const coveragePath = join86(contentDir2, "ONE-APP-COVERAGE.json");
-  if (existsSync80(coveragePath)) {
+  if (existsSync81(coveragePath)) {
     try {
       const coverage = readJson7(coveragePath);
       for (const row2 of Array.isArray(coverage.requirements) ? coverage.requirements : []) {
@@ -166132,7 +166883,7 @@ async function generatePkce() {
   return { verifier, challenge: base64url(new Uint8Array(digest2)) };
 }
 async function hostedAuthUrl(req, visitorToken, fetchImpl = fetch) {
-  const res = await fetchImpl(`${WIX_API2}${REDIRECT_SESSION_PATH}`, {
+  const res = await fetchImpl(`${WIX_API3}${REDIRECT_SESSION_PATH}`, {
     method: "POST",
     headers: { "Content-Type": "application/json", Authorization: `Bearer ${visitorToken}` },
     body: JSON.stringify({
@@ -166175,7 +166926,7 @@ async function hostedAuthUrl(req, visitorToken, fetchImpl = fetch) {
   return fullUrl;
 }
 async function exchangeAuthCode(cfg, code, verifier, fetchImpl = fetch) {
-  const res = await fetchImpl(`${WIX_API2}${TOKEN_PATH}`, {
+  const res = await fetchImpl(`${WIX_API3}${TOKEN_PATH}`, {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
@@ -166224,10 +166975,10 @@ function safeReturnPath(value2, fallback) {
   if (/[-]/.test(value2)) return fallback;
   return value2;
 }
-var WIX_API2, REDIRECT_SESSION_PATH, TOKEN_PATH, MEMBER_SESSION_COOKIE, MEMBER_SESSION_TTL_MS, PENDING_LOGIN_TTL_MS, MEMBER_CALLBACK_PATH;
+var WIX_API3, REDIRECT_SESSION_PATH, TOKEN_PATH, MEMBER_SESSION_COOKIE, MEMBER_SESSION_TTL_MS, PENDING_LOGIN_TTL_MS, MEMBER_CALLBACK_PATH;
 var init_wix_member_auth = __esm({
   "../../core/serve-runtime/src/wix-member-auth.ts"() {
-    WIX_API2 = "https://www.wixapis.com";
+    WIX_API3 = "https://www.wixapis.com";
     REDIRECT_SESSION_PATH = "/_api/redirects-api/v1/redirect-session";
     TOKEN_PATH = "/oauth2/token";
     MEMBER_SESSION_COOKIE = "himi_wm_sid";
@@ -168099,7 +168850,7 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync as cpSync2, existsSync as existsSync83, mkdirSync as mkdirSync39, mkdtempSync as mkdtempSync7, readFileSync as readFileSync93, rmSync as rmSync23, statSync as statSync24 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync84, mkdirSync as mkdirSync39, mkdtempSync as mkdtempSync7, readFileSync as readFileSync93, rmSync as rmSync23, statSync as statSync24 } from "node:fs";
 import { networkInterfaces as osNetworkInterfaces, tmpdir as tmpdir8 } from "node:os";
 import { dirname as dirname44, join as join89 } from "node:path";
 import { fileURLToPath as fileURLToPath29 } from "node:url";
@@ -168129,9 +168880,9 @@ async function fetchBytes(url) {
 }
 async function resolvePackage(source, workDir) {
   const isUrl2 = /^https?:\/\//i.test(source);
-  if (!isUrl2 && existsSync83(source) && statSync24(source).isDirectory()) {
+  if (!isUrl2 && existsSync84(source) && statSync24(source).isDirectory()) {
     const appDirManifest = join89(source, "release-manifest.json");
-    if (existsSync83(appDirManifest)) {
+    if (existsSync84(appDirManifest)) {
       const opened2 = openPackageDir(source);
       if (!opened2.validation.ok) {
         throw new Error(`package is not valid:
@@ -168189,7 +168940,7 @@ async function loadPreviewAssets() {
       // in-repo checkout
     ];
     for (const path2 of candidates) {
-      if (!existsSync83(path2)) continue;
+      if (!existsSync84(path2)) continue;
       const blob = readFileSync93(path2);
       return mod.assemblePreviewAssetsFromBlob(new Uint8Array(blob.buffer, blob.byteOffset, blob.byteLength));
     }
@@ -168328,7 +169079,7 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer6 } from "node:http";
-import { existsSync as existsSync84, readFileSync as readFileSync94 } from "node:fs";
+import { existsSync as existsSync85, readFileSync as readFileSync94 } from "node:fs";
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { dirname as dirname45, resolve as resolve69 } from "node:path";
 import { fileURLToPath as fileURLToPath30 } from "node:url";
@@ -168336,7 +169087,7 @@ function stagedDir() {
   return process.env.HIMI_BROWSER_PLANE_OUT ? resolve69(process.env.HIMI_BROWSER_PLANE_OUT) : resolve69(REPO2, "packages", "serve", "dist", "browser-plane");
 }
 function missingStaged() {
-  return [...SERVED].filter((f2) => !existsSync84(resolve69(stagedDir(), f2))).sort();
+  return [...SERVED].filter((f2) => !existsSync85(resolve69(stagedDir(), f2))).sort();
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
@@ -168426,7 +169177,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
     }
     const name = path2 === "/" || path2 === "/index.html" ? "host.html" : path2.slice(1);
     if (SERVED.has(name)) {
-      if (!existsSync84(resolve69(stagedDir(), name))) {
+      if (!existsSync85(resolve69(stagedDir(), name))) {
         const restaged = ensureBrowserPlaneStaged();
         if (!restaged.ok) {
           res.writeHead(503, { "content-type": "application/json" });
@@ -168489,14 +169240,14 @@ var hhp_preview_exports = {};
 __export(hhp_preview_exports, {
   hhpPreviewResponse: () => hhpPreviewResponse
 });
-import { existsSync as existsSync85, readFileSync as readFileSync95 } from "node:fs";
+import { existsSync as existsSync86, readFileSync as readFileSync95 } from "node:fs";
 import { join as join90 } from "node:path";
 function hhpPreviewResponse(root, request) {
-  if (new URL(request.url).pathname !== "/__himi/hhp-preview" || !existsSync85(join90(root, "hhp.json"))) return null;
+  if (new URL(request.url).pathname !== "/__himi/hhp-preview" || !existsSync86(join90(root, "hhp.json"))) return null;
   if (request.method !== "GET") return new Response(null, { status: 405 });
   try {
     const file2 = localPath(root, ".himi/hhp-preview.json");
-    const authored2 = existsSync85(file2) ? JSON.parse(readFileSync95(file2, "utf8")) : {};
+    const authored2 = existsSync86(file2) ? JSON.parse(readFileSync95(file2, "utf8")) : {};
     if (authored2.mockCapabilities && (!Array.isArray(authored2.mockCapabilities) || authored2.mockCapabilities.some((v2) => typeof v2 !== "string"))) throw new Error("mockCapabilities must be a string array.");
     const fixtures = authored2.fixtures ?? {};
     if (typeof fixtures !== "object" || Array.isArray(fixtures) || fixtures === null) throw new Error("fixtures must be an object.");
@@ -171193,7 +171944,7 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync87, readFileSync as readFileSync101 } from "node:fs";
+import { existsSync as existsSync88, readFileSync as readFileSync101 } from "node:fs";
 import { homedir as homedir11 } from "node:os";
 import { join as join93 } from "node:path";
 function credentialsDir(home = homedir11()) {
@@ -171237,7 +171988,7 @@ function resolveStoreCredentials(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homedir11();
   const read = opts.readProfile ?? ((p2) => readFileSync101(p2, "utf8"));
-  const exists = opts.profileExists ?? existsSync87;
+  const exists = opts.profileExists ?? existsSync88;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
   const named = namedProfile(cfg, opts.profileFlag);
@@ -171303,7 +172054,7 @@ var init_credential_profile = __esm({
 
 // ../store-release/iap-credentials.ts
 import { createHash as createHash45 } from "node:crypto";
-import { existsSync as existsSync88, readFileSync as readFileSync102, realpathSync as realpathSync12 } from "node:fs";
+import { existsSync as existsSync89, readFileSync as readFileSync102, realpathSync as realpathSync12 } from "node:fs";
 import { homedir as homedir12 } from "node:os";
 function accountFingerprint(keyId, issuerId) {
   return `sha256:${createHash45("sha256").update(`${issuerId}:${keyId}`).digest("hex").slice(0, 16)}`;
@@ -171350,7 +172101,7 @@ function resolveIapCredentials(options) {
     env: {},
     home,
     readProfile: readFile3,
-    profileExists: options.exists ?? existsSync88
+    profileExists: options.exists ?? existsSync89
   });
   assertCredentialOutsideRepo(`credential profile "${profile}"`, realpath(profilePath(profile, home)));
   assertCredentialOutsideRepo(`credential profile "${profile}" ascKeyPath`, canonicalKeyPath(creds.ascKeyPath, profile, realpath));
@@ -171855,7 +172606,7 @@ var init_store_spec = __esm({
 });
 
 // src/iap-config-edit.ts
-import { existsSync as existsSync89, readFileSync as readFileSync104 } from "node:fs";
+import { existsSync as existsSync90, readFileSync as readFileSync104 } from "node:fs";
 import { basename as basename24, join as join94 } from "node:path";
 import ts9 from "typescript";
 function bindPurchasesAppInConfig(source, options) {
@@ -171936,7 +172687,7 @@ function capabilityFinding(app, fileName) {
 function withStoreBundle(dir, options) {
   if (options.storeBundleId) return options;
   const path2 = join94(dir, "store", "store.config.yaml");
-  if (!existsSync89(path2)) return options;
+  if (!existsSync90(path2)) return options;
   const storeBundleId = parseStoreConfig(readFileSync104(path2, "utf8")).ios?.bundleId;
   return storeBundleId ? { ...options, storeBundleId } : options;
 }
@@ -172676,7 +173427,7 @@ var init_store_iap_screenshots = __esm({
 });
 
 // src/store-iap-screenshot-render.ts
-import { existsSync as existsSync90, mkdtempSync as mkdtempSync9, readFileSync as readFileSync105, rmSync as rmSync25 } from "node:fs";
+import { existsSync as existsSync91, mkdtempSync as mkdtempSync9, readFileSync as readFileSync105, rmSync as rmSync25 } from "node:fs";
 import { tmpdir as tmpdir10 } from "node:os";
 import { join as join96 } from "node:path";
 function renderProblems(render, entityId) {
@@ -172739,7 +173490,7 @@ function createReviewScreenRenderer() {
     async capture(html, contentDir2) {
       const { pngPageHtml: pngPageHtml2, stabilizePngPage: stabilizePngPage2 } = await Promise.resolve().then(() => (init_render_descriptor(), render_descriptor_exports));
       const tokensPath = join96(contentDir2, "tokens.json");
-      const tokens2 = existsSync90(tokensPath) ? JSON.parse(readFileSync105(tokensPath, "utf8")) : null;
+      const tokens2 = existsSync91(tokensPath) ? JSON.parse(readFileSync105(tokensPath, "utf8")) : null;
       const { width, height, scale } = REVIEW_SCREENSHOT_FRAME;
       const page = await (await (browser ??= launch())).newPage({ viewport: { width, height }, deviceScaleFactor: scale, colorScheme: "light" });
       try {
@@ -172810,166 +173561,6 @@ var init_serve_preview = __esm({
   }
 });
 
-// src/site-analyze/rest.ts
-var rest_exports = {};
-__export(rest_exports, {
-  WIX_API: () => WIX_API3,
-  WixApiError: () => WixApiError2,
-  classifyHttp: () => classifyHttp,
-  compactWixstaticUrl: () => compactWixstaticUrl,
-  isGenericWixFavicon: () => isGenericWixFavicon,
-  makeTransport: () => makeTransport,
-  mediaUrlFromLogo: () => mediaUrlFromLogo,
-  ownerTransportFrom: () => ownerTransportFrom,
-  probeCall: () => probeCall,
-  resolveWixUrl: () => resolveWixUrl,
-  uploadMediaBytes: () => uploadMediaBytes,
-  visitorTransportFrom: () => visitorTransportFrom,
-  wixMediaFileId: () => wixMediaFileId
-});
-function resolveWixUrl(path2) {
-  if (/^https?:\/\//i.test(path2)) return path2;
-  return `${WIX_API3}${path2}`;
-}
-function classifyHttp(status, count2) {
-  if (status === 428) return "not-installed";
-  if (status === 404) return "wrong-path";
-  if (status && status >= 400) return "error";
-  return count2 > 0 ? "ok" : "empty";
-}
-function makeTransport(fetchImpl, auth, timeoutMs = DEFAULT_TIMEOUT_MS3) {
-  return async (method, path2, body) => {
-    const headers2 = { Accept: "application/json" };
-    if (auth?.token) headers2.Authorization = auth.token;
-    if (auth?.msid) headers2["wix-site-id"] = auth.msid;
-    if (body !== void 0) headers2["Content-Type"] = "application/json";
-    const res = await fetchImpl(resolveWixUrl(path2), {
-      method,
-      headers: headers2,
-      body: body === void 0 ? void 0 : JSON.stringify(body),
-      signal: AbortSignal.timeout(timeoutMs)
-    });
-    const text11 = await res.text();
-    let parsed = text11;
-    try {
-      parsed = text11 ? JSON.parse(text11) : null;
-    } catch {
-    }
-    if (!res.ok) throw new WixApiError2(res.status, method, path2, parsed);
-    return parsed;
-  };
-}
-function ownerTransportFrom(fetchImpl, owner) {
-  return makeTransport(fetchImpl, { token: owner.token, msid: owner.msid });
-}
-function visitorTransportFrom(fetchImpl, token, msid) {
-  return makeTransport(fetchImpl, { token, msid });
-}
-async function probeCall(call, method, path2, body) {
-  try {
-    return { data: await call(method, path2, body), err: null };
-  } catch (e2) {
-    if (e2 instanceof WixApiError2) return { data: null, err: e2 };
-    throw e2;
-  }
-}
-function mediaUrlFromLogo(logo) {
-  const s2 = (logo ?? "").trim();
-  if (!s2) return null;
-  if (/^https?:\/\//i.test(s2)) return s2;
-  const id = s2.replace(/^wix:image:\/\/v1\//, "").split("/")[0].split("#")[0];
-  if (!id) return null;
-  if (/^https?:\/\//i.test(id)) return id;
-  return `https://static.wixstatic.com/media/${id}`;
-}
-function isGenericWixFavicon(url) {
-  try {
-    const h2 = new URL(url).hostname.toLowerCase();
-    return h2 === "wix.com" || h2.endsWith(".wix.com");
-  } catch {
-    return false;
-  }
-}
-function wixMediaFileId(url) {
-  const m2 = url.match(/static\.wixstatic\.com\/media\/([^/?#]+)/i);
-  return m2?.[1] ? decodeURIComponent(m2[1]) : void 0;
-}
-function compactWixstaticUrl(url, maxEdge = 800) {
-  if (!/static\.wixstatic\.com\/media\//i.test(url)) return url;
-  if (/\.(svg|ico)(\?|#|$)/i.test(url.split("?")[0] ?? url)) return url;
-  const w2 = url.match(/(?:\/|,)w_(\d+)/)?.[1];
-  if (w2 && Number(w2) <= maxEdge) return url;
-  const id = wixMediaFileId(url);
-  if (!id) return url;
-  return `https://static.wixstatic.com/media/${id}/v1/fill/w_${maxEdge},h_${maxEdge},al_c,q_80,enc_auto/file.jpg`;
-}
-async function uploadMediaBytes(call, fetchImpl, bytes2, fileName, mimeType) {
-  const { uploadUrl } = await call(
-    "POST",
-    "/site-media/v1/files/generate-upload-url",
-    { mimeType, fileName: `himi-business-book/${fileName}` }
-  );
-  const put = await fetchImpl(`${uploadUrl}?filename=${encodeURIComponent(fileName)}`, {
-    method: "PUT",
-    headers: { "Content-Type": mimeType },
-    body: bytes2,
-    signal: AbortSignal.timeout(12e4)
-  });
-  if (!put.ok) throw new Error(`media upload PUT failed: ${put.status}`);
-  const payload = await put.json();
-  const file2 = payload.file ?? payload;
-  const id = file2?.id ?? file2?.fileId;
-  const url = file2?.url ?? (id ? `https://static.wixstatic.com/media/${id}` : void 0);
-  if (!id || !url) throw new Error("media upload returned no file id");
-  return { id, url };
-}
-var WIX_API3, DEFAULT_TIMEOUT_MS3, WixApiError2;
-var init_rest = __esm({
-  "src/site-analyze/rest.ts"() {
-    WIX_API3 = "https://www.wixapis.com";
-    DEFAULT_TIMEOUT_MS3 = 8e3;
-    WixApiError2 = class extends Error {
-      constructor(status, method, path2, body) {
-        super(`${method} ${path2} \u2192 ${status}`);
-        this.status = status;
-        this.method = method;
-        this.path = path2;
-        this.body = body;
-        this.name = "WixApiError";
-      }
-    };
-  }
-});
-
-// src/site-analyze/visitor-auth.ts
-var visitor_auth_exports = {};
-__export(visitor_auth_exports, {
-  mintVisitorToken: () => mintVisitorToken
-});
-async function mintVisitorToken(fetchImpl, clientId) {
-  const res = await fetchImpl(`${WIX_API3}/oauth2/token`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({ clientId, grantType: "anonymous" }),
-    signal: AbortSignal.timeout(8e3)
-  });
-  const text11 = await res.text();
-  let parsed = text11;
-  try {
-    parsed = text11 ? JSON.parse(text11) : null;
-  } catch {
-  }
-  if (!res.ok) throw new WixApiError2(res.status, "POST", "/oauth2/token", parsed);
-  const token = parsed?.access_token ?? parsed?.accessToken;
-  if (!token) throw new Error("visitor mint returned no access_token");
-  return token;
-}
-var init_visitor_auth = __esm({
-  "src/site-analyze/visitor-auth.ts"() {
-    init_rest();
-  }
-});
-
 // src/store-iap.ts
 var store_iap_exports = {};
 __export(store_iap_exports, {
@@ -174181,7 +174772,7 @@ __export(preflight_app_exports, {
   profileAccount: () => profileAccount,
   readXcconfigVars: () => readXcconfigVars
 });
-import { readFileSync as readFileSync107, existsSync as existsSync91, readdirSync as readdirSync38, statSync as statSync25 } from "node:fs";
+import { readFileSync as readFileSync107, existsSync as existsSync92, readdirSync as readdirSync38, statSync as statSync25 } from "node:fs";
 import { createHash as createHash47 } from "node:crypto";
 import { dirname as dirname48, join as join98 } from "node:path";
 function analyze(projectYml, storeConfig, icon, account) {
@@ -174308,7 +174899,7 @@ function readXcconfigVars(iosDir, projectYml) {
   const vars = {};
   const seen = /* @__PURE__ */ new Set();
   const read = (path2) => {
-    if (seen.has(path2) || !existsSync91(path2)) return;
+    if (seen.has(path2) || !existsSync92(path2)) return;
     seen.add(path2);
     for (const raw of readFileSync107(path2, "utf8").split("\n")) {
       const inc = /^\s*#include\??\s+"([^"]+)"/.exec(raw);
@@ -174337,8 +174928,8 @@ function profileAccount(app, storeConfig, opts = {}) {
   }
 }
 async function preflightApp(app, opts = {}) {
-  const projectYml = existsSync91(iosProjectYml(app)) ? readFileSync107(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync91(storeConfigPath(app)) ? readFileSync107(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync92(iosProjectYml(app)) ? readFileSync107(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync92(storeConfigPath(app)) ? readFileSync107(storeConfigPath(app), "utf8") : "";
   const identity = projectYml ? analyzeStoreIdentity(projectYml, storeConfig, readXcconfigVars(join98(appDir(app), "ios"), projectYml)) : [];
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }, ...identity];
   const findings = analyze(
@@ -174376,15 +174967,15 @@ function analyzeSubmissionRecord(appLevel, review, opts) {
 function appLevelMetadataFiles(app, locale = "en-US") {
   const root = join98(storeDir(app), "metadata");
   const out2 = /* @__PURE__ */ new Set();
-  if (existsSync91(root)) {
+  if (existsSync92(root)) {
     for (const n2 of readdirSync38(root)) if (n2.endsWith(".txt")) out2.add(n2);
   }
-  if (existsSync91(join98(root, locale, "privacy_url.txt"))) out2.add("privacy_url.txt");
+  if (existsSync92(join98(root, locale, "privacy_url.txt"))) out2.add("privacy_url.txt");
   return out2;
 }
 function reviewInfoFiles(app) {
   const dir = join98(storeDir(app), "review_information");
-  if (!existsSync91(dir)) return /* @__PURE__ */ new Set();
+  if (!existsSync92(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync38(dir).filter((n2) => n2.endsWith(".txt")));
 }
 function isValidAppStoreSize(w2, h2) {
@@ -174531,20 +175122,20 @@ function analyzeListing(metaFiles, shots) {
 }
 function metadataFilesPresent(app, locale = "en-US") {
   const dir = join98(storeDir(app), "metadata", locale);
-  if (!existsSync91(dir)) return /* @__PURE__ */ new Set();
+  if (!existsSync92(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync38(dir).filter((n2) => n2.endsWith(".txt")));
 }
 function listScreenshots(app, locale = "en-US") {
   const out2 = [];
   const flat = join98(storeDir(app), "screenshots", locale);
-  if (existsSync91(flat)) {
+  if (existsSync92(flat)) {
     for (const png of readdirSync38(flat).filter((n2) => n2.endsWith(".png"))) {
       const sz = pngSize2(readFileSync107(join98(flat, png)));
       if (sz) out2.push({ name: png, w: sz.w, h: sz.h });
     }
   }
   const legacy = join98(storeDir(app), "metadata", locale, "screenshots");
-  if (existsSync91(legacy)) {
+  if (existsSync92(legacy)) {
     for (const deviceDir of readdirSync38(legacy)) {
       const d2 = join98(legacy, deviceDir);
       if (!statSync25(d2).isDirectory()) continue;
@@ -174558,7 +175149,7 @@ function listScreenshots(app, locale = "en-US") {
 }
 function placeholderHashes2() {
   const templateIos = join98(appDir("_template"), "ios");
-  if (!existsSync91(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
+  if (!existsSync92(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
   for (const target of readdirSync38(templateIos)) {
     const p2 = join98(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
@@ -174594,7 +175185,7 @@ async function pixelIssues(bytes2) {
   }
 }
 async function appIconState(iosDir) {
-  if (!existsSync91(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
+  if (!existsSync92(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
   for (const target of readdirSync38(iosDir)) {
     const p2 = join98(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
@@ -174730,6 +175321,19 @@ var init_asc_status = __esm({
   }
 });
 
+// ../../core/serve-control/src/captcha-bindable.ts
+var captcha_bindable_exports = {};
+__export(captcha_bindable_exports, {
+  captchaBindable: () => captchaBindable
+});
+function captchaBindable(shell, externalContract) {
+  return !externalContract && ["branded-lite", "owner-lite"].includes(shell);
+}
+var init_captcha_bindable = __esm({
+  "../../core/serve-control/src/captcha-bindable.ts"() {
+  }
+});
+
 // src/browser-login.ts
 import { createServer as createServer7 } from "node:http";
 import { randomBytes as randomBytes6 } from "node:crypto";
@@ -175661,7 +176265,7 @@ function headers(session) {
     ...session ? { "X-Admin-Session": session } : {}
   };
 }
-function truncate2(token) {
+function truncate3(token) {
   return token.length <= 20 ? token : `${token.slice(0, 8)}\u2026${token.slice(-8)}`;
 }
 function parseDataFlag(raw) {
@@ -175787,7 +176391,7 @@ async function runNotify(pos, flags, io2, deps = {}) {
       const bits = [
         String(t2.id).padStart(4),
         t2.platform.padEnd(8),
-        truncate2(t2.token).padEnd(19),
+        truncate3(t2.token).padEnd(19),
         (t2.environment ?? "-").padEnd(11),
         (t2.appVersion ?? "-").padEnd(10),
         t2.lastSeen,
@@ -175999,7 +176603,7 @@ __export(base44_adopt_exports, {
   renderAdoptModule: () => renderAdoptModule,
   runBase44Adopt: () => runBase44Adopt
 });
-import { existsSync as existsSync95, readFileSync as readFileSync114, writeFileSync as writeFileSync38 } from "node:fs";
+import { existsSync as existsSync96, readFileSync as readFileSync114, writeFileSync as writeFileSync38 } from "node:fs";
 import { join as join104, resolve as resolve74 } from "node:path";
 function prop(entity, key3) {
   const props = entity.schema?.properties;
@@ -176108,7 +176712,7 @@ function runBase44Adopt(opts) {
   const issues = validateBase44Entities({ entities: result.entities, functions: result.functions }, opts.app);
   if (opts.write === void 0 || opts.write === false || issues.some((i2) => i2.severity === "error")) return { result, module, issues };
   const target = typeof opts.write === "string" ? resolve74(opts.cwd, opts.write) : join104(opts.cwd, ADOPT_MODULE_FILENAME);
-  if (existsSync95(target)) {
+  if (existsSync96(target)) {
     throw new AdoptError("adopt_target_exists", `${target} already exists \u2014 adopt never overwrites. Delete or rename it, or pass --write <other path>.`, 1, { path: target });
   }
   writeFileSync38(target, module);
@@ -176357,7 +176961,7 @@ __export(generate_exports, {
   writeGenerated: () => writeGenerated
 });
 import { createHash as createHash50 } from "node:crypto";
-import { existsSync as existsSync96, mkdirSync as mkdirSync42, readdirSync as readdirSync39, readFileSync as readFileSync115, writeFileSync as writeFileSync39 } from "node:fs";
+import { existsSync as existsSync97, mkdirSync as mkdirSync42, readdirSync as readdirSync39, readFileSync as readFileSync115, writeFileSync as writeFileSync39 } from "node:fs";
 import { dirname as dirname51, join as join105 } from "node:path";
 function withHeader(body) {
   return `${GENERATED_HEADER}${sha2566(body)}
@@ -176484,7 +177088,7 @@ function writeGenerated(dir, files, opts = {}) {
     const abs = join105(dir, f2.path);
     const next = withHeader(f2.body);
     let outcome;
-    if (!existsSync96(abs)) outcome = "written";
+    if (!existsSync97(abs)) outcome = "written";
     else {
       const cur = readFileSync115(abs, "utf8");
       if (cur === next) outcome = "unchanged";
@@ -176503,14 +177107,14 @@ function orphanedFiles(dir, current) {
   const keep = new Set(current.map((f2) => f2.path));
   const found = [];
   const t5 = join105(dir, "tier5-src");
-  if (!existsSync96(t5)) return found;
+  if (!existsSync97(t5)) return found;
   const candidates = readdirSync39(t5).filter((d2) => d2.startsWith("b44-")).map((d2) => `tier5-src/${d2}/index.ts`);
   const shared = join105(t5, "_shared");
-  if (existsSync96(shared)) {
+  if (existsSync97(shared)) {
     for (const f2 of readdirSync39(shared)) if (/^b44-.*-plan\.ts$/.test(f2)) candidates.push(`tier5-src/_shared/${f2}`);
   }
   for (const rel of candidates.sort()) {
-    if (keep.has(rel) || !existsSync96(join105(dir, rel))) continue;
+    if (keep.has(rel) || !existsSync97(join105(dir, rel))) continue;
     if (readFileSync115(join105(dir, rel), "utf8").startsWith(GENERATED_HEADER)) found.push(rel);
   }
   return found;
@@ -176549,7 +177153,7 @@ __export(base44_auth_exports, {
   usableBase44Auth: () => usableBase44Auth,
   writeBase44Session: () => writeBase44Session
 });
-import { chmodSync as chmodSync4, existsSync as existsSync97, mkdirSync as mkdirSync43, readFileSync as readFileSync116, rmSync as rmSync27, writeFileSync as writeFileSync40 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync98, mkdirSync as mkdirSync43, readFileSync as readFileSync116, rmSync as rmSync27, writeFileSync as writeFileSync40 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
 import { dirname as dirname52, join as join106 } from "node:path";
 function base44ApiBase(env = process.env) {
@@ -176560,7 +177164,7 @@ function base44SessionPath(home = homedir15()) {
 }
 function readBase44Session(home) {
   const p2 = base44SessionPath(home);
-  if (!existsSync97(p2)) return void 0;
+  if (!existsSync98(p2)) return void 0;
   try {
     const s2 = JSON.parse(readFileSync116(p2, "utf8"));
     return typeof s2.accessToken === "string" && s2.accessToken ? s2 : void 0;
@@ -176578,7 +177182,7 @@ function writeBase44Session(session, home) {
 }
 function deleteBase44Session(home) {
   const p2 = base44SessionPath(home);
-  if (!existsSync97(p2)) return false;
+  if (!existsSync98(p2)) return false;
   rmSync27(p2, { force: true });
   return true;
 }
@@ -176681,7 +177285,7 @@ function hasBase44WriteScope(auth) {
 }
 function importBase44CliSession(home = homedir15(), env = process.env) {
   const src = join106(home, ".base44", "auth", "auth.json");
-  if (!existsSync97(src)) throw new Error(`no Base44 CLI session at ${src} \u2014 run \`npx base44 login\` first, or use \`himi base44 login\``);
+  if (!existsSync98(src)) throw new Error(`no Base44 CLI session at ${src} \u2014 run \`npx base44 login\` first, or use \`himi base44 login\``);
   const a2 = JSON.parse(readFileSync116(src, "utf8"));
   if (typeof a2.accessToken !== "string" || !a2.accessToken) throw new Error(`${src} holds no access token`);
   const session = {
@@ -176779,11 +177383,11 @@ __export(seed_exports, {
   seedBase44Entities: () => seedBase44Entities,
   writeBase44SeedRows: () => writeBase44SeedRows
 });
-import { existsSync as existsSync98, readFileSync as readFileSync117, writeFileSync as writeFileSync41 } from "node:fs";
+import { existsSync as existsSync99, readFileSync as readFileSync117, writeFileSync as writeFileSync41 } from "node:fs";
 import { join as join107 } from "node:path";
 function readBase44SeedFile(dir) {
   const file2 = join107(dir, BASE44_SEED_FILE);
-  if (!existsSync98(file2)) return {};
+  if (!existsSync99(file2)) return {};
   let parsed;
   try {
     parsed = JSON.parse(readFileSync117(file2, "utf8"));
@@ -176943,7 +177547,7 @@ function writeBase44SeedRows(opts) {
     return { ok: false, path: path2, entities: {}, agentPrompt: "", next: [], note: opts.only ? `--only ${opts.only.join(",")} matched no owned entity` : `no owned Base44 entities declared \u2014 add one with \`name\` (physically ${base44Prefix(app)}<Name>). Adopted entities are never seeded.` };
   }
   let existing = {};
-  if (existsSync98(path2)) {
+  if (existsSync99(path2)) {
     let parsed;
     try {
       parsed = JSON.parse(readFileSync117(path2, "utf8"));
@@ -177298,7 +177902,7 @@ __export(functions_exports2, {
   markerContent: () => markerContent,
   readFunctionSource: () => readFunctionSource
 });
-import { existsSync as existsSync99, lstatSync as lstatSync22 } from "node:fs";
+import { existsSync as existsSync100, lstatSync as lstatSync22 } from "node:fs";
 import { join as join108 } from "node:path";
 function markerContent(app) {
   return `${JSON.stringify({ app, by: "himi" })}
@@ -177307,7 +177911,7 @@ function markerContent(app) {
 function readFunctionSource(appDir3, name, app) {
   const rel = `base44/functions/${name}/`;
   const folder = join108(appDir3, "base44", "functions", name);
-  if (!existsSync99(folder) || !lstatSync22(folder).isDirectory()) throw new FunctionSourceError("function_source_missing", `no source folder at ${rel}`);
+  if (!existsSync100(folder) || !lstatSync22(folder).isDirectory()) throw new FunctionSourceError("function_source_missing", `no source folder at ${rel}`);
   const { entries, skipped } = collectAppSource(folder);
   if (skipped.length) throw new FunctionSourceError("function_source_unsafe", `${rel} holds paths himi will not upload (symlinks or denied names): ${skipped.join(", ")} \u2014 remove them`);
   const secrets = secretFindings(entries);
@@ -177462,9 +178066,9 @@ function propsOf2(schema) {
 function isOwnedPhysical(name, app) {
   return name.startsWith(base44Prefix(app));
 }
-function foreignGuard(snapshot2, next, owned) {
+function foreignGuard(snapshot3, next, owned) {
   const out2 = [];
-  for (const e2 of snapshot2) {
+  for (const e2 of snapshot3) {
     if (owned.has(e2.name)) continue;
     if (!Object.prototype.hasOwnProperty.call(next, e2.name)) {
       out2.push({ code: "would_delete_foreign_entity", entity: e2.name, detail: `"${e2.name}" is not himi's and would be left out of the full-set sync \u2014 Base44 would delete it and its rows` });
@@ -177501,20 +178105,20 @@ function inheritUndeclaredPermissions(desired, remote, spec) {
     if (f2.rls === void 0 && remoteProps[f2.key]?.rls !== void 0) desiredProps[f2.key].rls = remoteProps[f2.key].rls;
   }
 }
-function planEntitySync(declared, snapshot2, opts) {
+function planEntitySync(declared, snapshot3, opts) {
   const { app, allowDestructive = false, applyPermissions = false, emptyAppOk = false } = opts;
   const plan = { next: {}, actions: [], refusals: [], warnings: [], owned: [] };
-  if (snapshot2.length === 0 && !emptyAppOk) {
+  if (snapshot3.length === 0 && !emptyAppOk) {
     plan.refusals.push({ code: "schema_snapshot_empty", detail: "the project download holds no entity schemas \u2014 if the Base44 app really has no entities, pass --empty-app-ok" });
   }
   const specs = declared.filter((s2) => !!s2 && typeof s2 === "object");
   const owned = new Map(specs.filter(isOwnedEntity).map((s2) => [physicalEntityName(s2, app), s2]));
   const adopted = new Set(specs.filter(isAdoptedEntity).map((s2) => physicalEntityName(s2, app)));
-  const live3 = new Map(snapshot2.map((e2) => [e2.name, e2]));
+  const live3 = new Map(snapshot3.map((e2) => [e2.name, e2]));
   const provisioned = new Set((opts.provisioned ?? []).filter((n2) => isOwnedPhysical(n2, app)));
-  const ownedHere = /* @__PURE__ */ new Set([...snapshot2.map((e2) => e2.name).filter((n2) => provisioned.has(n2)), ...[...owned.keys()].filter((n2) => !live3.has(n2))]);
+  const ownedHere = /* @__PURE__ */ new Set([...snapshot3.map((e2) => e2.name).filter((n2) => provisioned.has(n2)), ...[...owned.keys()].filter((n2) => !live3.has(n2))]);
   plan.owned = [...ownedHere].sort();
-  for (const e2 of snapshot2) {
+  for (const e2 of snapshot3) {
     if (!ownedHere.has(e2.name)) {
       plan.next[e2.name] = e2.schema;
       if (owned.has(e2.name)) {
@@ -177578,7 +178182,7 @@ function planEntitySync(declared, snapshot2, opts) {
   for (const name of adopted) {
     if (!live3.has(name)) plan.warnings.push(`adopted entity "${name}" is not on the live app \u2014 himi never creates an entity it does not own`);
   }
-  plan.refusals.push(...foreignGuard(snapshot2, plan.next, ownedHere));
+  plan.refusals.push(...foreignGuard(snapshot3, plan.next, ownedHere));
   return plan;
 }
 var BUILTINS2;
@@ -177645,12 +178249,12 @@ __export(apply_exports, {
   createBase44Entities: () => createBase44Entities,
   fileLedger: () => fileLedger
 });
-import { existsSync as existsSync100, readFileSync as readFileSync118, writeFileSync as writeFileSync42 } from "node:fs";
+import { existsSync as existsSync101, readFileSync as readFileSync118, writeFileSync as writeFileSync42 } from "node:fs";
 import { join as join109 } from "node:path";
 function fileLedger(dir, appId2) {
   const path2 = join109(dir, LEDGER_FILE2);
   const load3 = () => {
-    if (!existsSync100(path2)) return {};
+    if (!existsSync101(path2)) return {};
     let v2;
     try {
       v2 = JSON.parse(readFileSync118(path2, "utf8"));
@@ -180695,7 +181299,7 @@ var init_analyze = __esm({
 });
 
 // src/base44-analyze/write-artifacts.ts
-import { existsSync as existsSync101, mkdirSync as mkdirSync45, readFileSync as readFileSync119, rmSync as rmSync29, writeFileSync as writeFileSync44 } from "node:fs";
+import { existsSync as existsSync102, mkdirSync as mkdirSync45, readFileSync as readFileSync119, rmSync as rmSync29, writeFileSync as writeFileSync44 } from "node:fs";
 import { dirname as dirname53, join as join111, resolve as resolve75, sep as sep20 } from "node:path";
 function isBookFolder(dir) {
   try {
@@ -180786,7 +181390,7 @@ function writeBase44Book(result, outDir, opts = {}) {
   const md = renderBookMd(book);
   assertNoSecrets(json8);
   assertNoSecrets(md);
-  const owned = ["book.json", "BOOK.md", "source", "screenshots"].filter((n2) => existsSync101(join111(out2, n2)));
+  const owned = ["book.json", "BOOK.md", "source", "screenshots"].filter((n2) => existsSync102(join111(out2, n2)));
   if (owned.length) {
     if (!isBookFolder(out2)) throw new Error(`refusing to write the app book into ${out2}: it already has ${owned.join(", ")} that ${owned.length === 1 ? "is" : "are"} not from an app book \u2014 pick an empty --out`);
     for (const d2 of ["source", "screenshots"]) rmSync29(join111(out2, d2), { recursive: true, force: true });
@@ -184675,12 +185279,19 @@ async function collectOneApp(input, deps = {}) {
   const fetchImpl = deps.fetchImpl ?? fetch;
   const maxBytes = boundedSetting(deps.maxResponseBytes, MAX_RESPONSE_BYTES);
   const timeoutMs = boundedSetting(deps.timeoutMs, TIMEOUT_MS3);
+  const credentials = /* @__PURE__ */ new Set([input.authorization]);
+  let internalBusinessRead = false;
   function redact(value2) {
+    const secrets = [...credentials].sort((a2, b2) => b2.length - a2.length);
+    const redactString = (value3) => {
+      for (const credential of secrets) value3 = value3.split(credential).join("[REDACTED]");
+      return value3;
+    };
     const visit = (item) => {
-      if (typeof item === "string") return item.split(input.authorization).join("[REDACTED]");
+      if (typeof item === "string") return redactString(item);
       if (Array.isArray(item)) return item.map(visit);
       if (isObject2(item)) return Object.fromEntries(Object.entries(item).map(([key3, child]) => [
-        key3.split(input.authorization).join("[REDACTED]"),
+        redactString(key3),
         visit(child)
       ]));
       return item;
@@ -184695,19 +185306,23 @@ async function collectOneApp(input, deps = {}) {
       throw new OneAppError("artifact_write_failed", "Could not save the collected source evidence.", { stage });
     }
   }
-  async function request(url, stage, body, platform, instance) {
+  async function request(url, stage, body, context = {}) {
+    const { platform, instance } = context;
     const controller = new AbortController();
     let timedOut = false;
     let timer;
     const headers2 = {
-      Authorization: input.authorization,
-      "wix-site-id": input.metaSiteId,
+      Authorization: context.authorization ?? input.authorization,
       Accept: "application/json"
     };
+    if (context.siteScoped !== false) headers2["wix-site-id"] = input.metaSiteId;
     if (body !== void 0) headers2["Content-Type"] = "application/json";
+    if (instance && !platform) {
+      headers2["x-wix-mobile-app-version"] = `${sourceApp(instance)}/1.0.0`;
+    }
     if (platform) {
       headers2.isAndroid = String(platform === "android");
-      headers2.isVisitor = "false";
+      headers2.isVisitor = String(context.visitor ?? false);
       headers2.os = platform;
       headers2.mobile_app_type = instance === "branded" ? "branded" : "places";
     }
@@ -184780,6 +185395,38 @@ async function collectOneApp(input, deps = {}) {
       clearTimeout(timer);
     }
   }
+  async function readBusiness(url, instance) {
+    try {
+      return await request(url.href, "business");
+    } catch (error) {
+      if (!input.allowInternalBusinessRead || !(error instanceof OneAppError) || error.code !== "source_forbidden") throw error;
+      try {
+        const info4 = await request(TOKEN_INFO, "business_authorization", { token: input.authorization });
+        if (!isObject2(info4) || info4.active !== true || info4.subjectType !== "USER" || typeof info4.subjectId !== "string" || !info4.subjectId.trim() || typeof info4.siteId !== "string" || info4.siteId.toLowerCase() !== input.metaSiteId.toLowerCase()) throw error;
+        const contexts = [
+          { organizationContext: {} },
+          { siteContext: { metasiteId: input.metaSiteId } }
+        ];
+        for (const resourceContext of contexts) {
+          const permission = await request(IS_PERMITTED, "business_authorization", { permission: INTERNAL_PERMISSION, resourceContext });
+          if (!isObject2(permission) || permission.isPermitted !== true) throw error;
+        }
+      } catch {
+        throw error;
+      }
+      const visitorUrl = new URL(url);
+      visitorUrl.pathname = visitorUrl.pathname.replace("/user/businesses/", "/visitor/businesses/");
+      internalBusinessRead = true;
+      return request(visitorUrl.href, "business", void 0, { instance });
+    }
+  }
+  async function enrichmentAuthorization() {
+    if (!internalBusinessRead) return input.authorization;
+    const session = await request(`${VISITOR_SESSION}${input.metaSiteId}/signed-instance?signed_instance_type=Visitor`, "enrichment_session", void 0, { siteScoped: false });
+    if (!isObject2(session) || session.signedInstanceType !== "Visitor" || typeof session.signedInstance !== "string" || !session.signedInstance.trim() || /[\r\n]/.test(session.signedInstance) || typeof session.validUntil !== "string" || !Number.isFinite(Date.parse(session.validUntil)) || Date.parse(session.validUntil) <= (deps.now ?? (() => /* @__PURE__ */ new Date()))().getTime()) throw invalidResponse("enrichment_session");
+    credentials.add(session.signedInstance);
+    return session.signedInstance;
+  }
   const rawUrl = structureUrl("published-structure", input.metaSiteId, requested);
   const originalRaw = validateStructure(await request(rawUrl, "published", {}), "published");
   const baseline = semanticFingerprint(originalRaw);
@@ -184791,7 +185438,7 @@ async function collectOneApp(input, deps = {}) {
   await progress("raw-structure", rawStructure);
   const businessUrl = new URL(`${BUSINESS}${input.metaSiteId}`);
   businessUrl.searchParams.set("forApp", sourceApp(resolved2));
-  const projected = businessProjection(await request(businessUrl.href, "business"), input.metaSiteId);
+  const projected = businessProjection(await readBusiness(businessUrl, resolved2), input.metaSiteId);
   const businessContext = redact(projected.context);
   await progress("business-context", businessContext);
   const enrichBody = {
@@ -184800,8 +185447,14 @@ async function collectOneApp(input, deps = {}) {
     ...projected.title ? { businessTitle: redact(projected.title) } : {}
   };
   const enrichUrl = structureUrl("v2/structure-enriched", input.metaSiteId, resolved2);
+  const authorization = await enrichmentAuthorization();
   const enrich = async (platform) => {
-    const structure = validateStructure(await request(enrichUrl, `enriched_${platform}`, enrichBody, platform, resolved2), `enriched_${platform}`, true);
+    const structure = validateStructure(await request(enrichUrl, `enriched_${platform}`, enrichBody, {
+      platform,
+      instance: resolved2,
+      authorization,
+      visitor: internalBusinessRead
+    }), `enriched_${platform}`, true);
     if (structure.appInstance !== rawStructure.appInstance) {
       throw new OneAppError("source_changed", "The source app changed during collection. Run the command again.", { stage: `enriched_${platform}` });
     }
@@ -184813,11 +185466,11 @@ async function collectOneApp(input, deps = {}) {
   const enriched = {};
   const contextWarnings = [];
   for (const [index, platform] of ["ios", "android"].entries()) {
-    const snapshot2 = snapshots[index];
-    if (snapshot2.status === "fulfilled") {
-      enriched[platform] = snapshot2.value;
+    const snapshot3 = snapshots[index];
+    if (snapshot3.status === "fulfilled") {
+      enriched[platform] = snapshot3.value;
     } else {
-      const error = snapshot2.reason;
+      const error = snapshot3.reason;
       if (!(error instanceof OneAppError) || ![
         "source_not_found",
         "source_request_failed",
@@ -184845,24 +185498,28 @@ async function collectOneApp(input, deps = {}) {
       sourceApp: sourceApp(resolved2),
       fallback: requested !== resolved2,
       fetchedAt: (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString(),
-      context: { locale: "en", shell: resolved2 === "branded" ? "branded" : "places", platforms: ["ios", "android"], identity: "user", productionRules: "not-collected" }
+      context: { locale: "en", shell: resolved2 === "branded" ? "branded" : "places", platforms: ["ios", "android"], identity: internalBusinessRead ? "visitor" : "user", productionRules: "not-collected" }
     },
     rawStructure,
     enriched,
     businessContext,
     warnings: [
       { code: "runtime_rules_unavailable", message: "Engine production rules were not collected. Empty rule input does not establish that the source has no restrictions." },
-      { code: "viewer_context", message: "Enrichment shows English iOS and Android views for a Wix user. Preserve authored raw access rules; this view does not establish visitor or member access." },
+      { code: "viewer_context", message: internalBusinessRead ? "Enrichment shows English iOS and Android visitor views. Preserve authored raw access rules; this view does not establish member or manager access." : "Enrichment shows English iOS and Android views for a Wix user. Preserve authored raw access rules; this view does not establish visitor or member access." },
       ...contextWarnings
     ]
   };
 }
-var MIDDLEWARE, BUSINESS, MAX_RESPONSE_BYTES, TIMEOUT_MS3, UUID, LIFECYCLE_FIELDS;
+var MIDDLEWARE, BUSINESS, TOKEN_INFO, IS_PERMITTED, INTERNAL_PERMISSION, VISITOR_SESSION, MAX_RESPONSE_BYTES, TIMEOUT_MS3, UUID, LIFECYCLE_FIELDS;
 var init_collect = __esm({
   "src/one-app/collect.ts"() {
     init_errors2();
     MIDDLEWARE = "https://manage.wix.com/_serverless/mobile-apps-editor-middleware";
     BUSINESS = "https://apps.wix.com/_api/app-state/v1/user/businesses/";
+    TOKEN_INFO = "https://www.wixapis.com/oauth2/token-info";
+    IS_PERMITTED = "https://www.wixapis.com/authorization-server/v1/authorization/is_permitted";
+    INTERNAL_PERMISSION = "BRANDED_APPS.MANAGE_INTERNAL";
+    VISITOR_SESSION = "https://apps.wix.com/_api/one-app-session-web/v3/businesses/";
     MAX_RESPONSE_BYTES = 8e6;
     TIMEOUT_MS3 = 3e4;
     UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -185222,7 +185879,8 @@ validate-topbar checks authored source top-bar controls against the migrated con
     const collected = await (deps.collect ?? collectOneApp)({
       metaSiteId: options.metaSiteId,
       appInstance: options.appInstance,
-      authorization: token
+      authorization: token,
+      allowInternalBusinessRead: true
     }, {
       fetchImpl: deps.fetchImpl,
       onProgress: (completedStage, value2) => {
@@ -187293,7 +187951,7 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync103, readFileSync as readFileSync121, writeFileSync as writeFileSync47, copyFileSync as copyFileSync2, mkdirSync as mkdirSync48, realpathSync as realpathSync15, statSync as statSync27 } from "node:fs";
+import { existsSync as existsSync104, readFileSync as readFileSync121, writeFileSync as writeFileSync47, copyFileSync as copyFileSync2, mkdirSync as mkdirSync48, realpathSync as realpathSync15, statSync as statSync27 } from "node:fs";
 import { dirname as dirname55, isAbsolute as isAbsolute9, join as join115, resolve as resolve79, sep as sep21 } from "node:path";
 import { spawnSync as spawnSync6 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
@@ -187309,7 +187967,7 @@ function committedShellProvisioning(path2) {
 function findRepoRoot(cwd) {
   let dir = cwd;
   for (let i2 = 0; i2 < 8; i2++) {
-    if (SHELL_NAMES.some((name) => existsSync103(join115(dir, shellAppDir(name), "package.json")))) return dir;
+    if (SHELL_NAMES.some((name) => existsSync104(join115(dir, shellAppDir(name), "package.json")))) return dir;
     const next = dirname55(dir);
     if (next === dir) break;
     dir = next;
@@ -187413,7 +188071,7 @@ function sameKnownSite(previous, next) {
 function buildMergedContract(options) {
   const { appDir: appDir3, packageDir, overlay } = options;
   const committedPath = join115(appDir3, "provisioning.json");
-  if (!existsSync103(committedPath)) {
+  if (!existsSync104(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
   const committed = JSON.parse(readFileSync121(committedPath, "utf8"));
@@ -187429,7 +188087,7 @@ function buildMergedContract(options) {
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
     const to2 = contained(join115(appDir3, STAGED), toRel.slice(STAGED.length + 1));
-    if (!from || !to2 || !existsSync103(from)) return void 0;
+    if (!from || !to2 || !existsSync104(from)) return void 0;
     let real;
     let realRoot;
     try {
@@ -187452,7 +188110,7 @@ function buildMergedContract(options) {
   const icon = stage("media/icon.png", `${STAGED}/icon.png`);
   if (icon) branding.appIconPath = icon;
   const facesPath = join115(packageDir, "media/fonts/faces.json");
-  if (existsSync103(facesPath)) {
+  if (existsSync104(facesPath)) {
     let faces = [];
     try {
       const parsed = JSON.parse(readFileSync121(facesPath, "utf8"));
@@ -187514,7 +188172,7 @@ function staticFaqFor(overlay, overlayPath) {
   const own6 = overlay.faq;
   if (own6 !== void 0) return deriveStaticFaq(own6);
   const bookPath = join115(dirname55(resolve79(overlayPath)), "book.json");
-  if (!existsSync103(bookPath)) return void 0;
+  if (!existsSync104(bookPath)) return void 0;
   try {
     const book = JSON.parse(readFileSync121(bookPath, "utf8"));
     const copy = book?.copy;
@@ -187531,7 +188189,7 @@ function staticGalleriesFor(overlay, overlayPath) {
     overlay.galleries.map((gallery) => ({ role: "gallery", title: gallery.title, galleryImageUrls: gallery.photos }))
   );
   const bookPath = join115(dirname55(resolve79(overlayPath)), "book.json");
-  if (!existsSync103(bookPath)) return void 0;
+  if (!existsSync104(bookPath)) return void 0;
   try {
     const book = JSON.parse(readFileSync121(bookPath, "utf8"));
     if (!book.look || book.look.unavailable || !Array.isArray(book.look.pages)) return void 0;
@@ -187565,7 +188223,7 @@ async function applyOverlays(input) {
     }
     const appDir3 = join115(repoRoot2, shellAppDir(shell));
     const committedPath = join115(appDir3, "provisioning.json");
-    const committedSite = existsSync103(committedPath) ? JSON.parse(readFileSync121(committedPath, "utf8")).site : void 0;
+    const committedSite = existsSync104(committedPath) ? JSON.parse(readFileSync121(committedPath, "utf8")).site : void 0;
     if (committedSite !== void 0 && overlay.site === void 0) {
       throw new Error(
         `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), and this overlay has none. Re-run \`himi site analyze --url <site> --shell ${shell}\` to derive the site's page map (edit \`site.pages\` in provisioning.overlay.json if needed), then --apply.`
@@ -187606,7 +188264,7 @@ async function applyOverlays(input) {
   };
   let packageFaq = faq;
   let packageGalleries = galleries;
-  if (existsSync103(pkgProv)) {
+  if (existsSync104(pkgProv)) {
     const cur = JSON.parse(readFileSync121(pkgProv, "utf8"));
     if (galleries === void 0 && !sameKnownSite(cur, overlay)) overlay.galleries = [];
     const merged = deepMerge4(cur, overlay);
@@ -187624,7 +188282,7 @@ async function applyOverlays(input) {
     overlay.installedVerticals.push("galleries");
   }
   const pkgTokens = join115(cwd, "tokens.json");
-  if (existsSync103(pkgTokens) && (tokens2.colors || tokens2.typography)) {
+  if (existsSync104(pkgTokens) && (tokens2.colors || tokens2.typography)) {
     const cur = JSON.parse(readFileSync121(pkgTokens, "utf8"));
     let tokensIn = tokens2;
     if (tokens2.typography) {
@@ -187651,7 +188309,7 @@ async function applyOverlays(input) {
   }
   const homeAction = homeRefreshActionId(shell);
   const homeSrc = join115(cwd, "dev/index.ts");
-  if (homeAction && existsSync103(homeSrc)) {
+  if (homeAction && existsSync104(homeSrc)) {
     const prev = readFileSync121(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
@@ -187687,13 +188345,13 @@ async function applyOverlays(input) {
       notes.push(`${patched.unparsed} onAppear params block(s) in ${homeSrc} could not be read \u2014 any brand values inside them were not applied`);
     }
   }
-  if (!input.iconPath || !existsSync103(input.iconPath)) {
+  if (!input.iconPath || !existsSync104(input.iconPath)) {
     const book = input.iconPath ? dirname55(dirname55(resolve79(input.iconPath))) : void 0;
     notes.push(
       book ? `no icon installed \u2014 ${siteLogoAbsence(book).hint}` : "no icon installed and no business book to say why \u2014 `himi icon generate` draws one from the accent, or `himi icon set <file.png>` installs the customer's own mark"
     );
   }
-  if (input.iconPath && existsSync103(input.iconPath)) {
+  if (input.iconPath && existsSync104(input.iconPath)) {
     try {
       const installed = await installIcon(cwd, input.iconPath, { derivePlay: true });
       wrote.push(...installed.wrote);
@@ -188652,7 +189310,7 @@ __export(cli_exports3, {
   runSiteAnalyze: () => runSiteAnalyze,
   runSiteFunctionCli: () => runSiteFunctionCli
 });
-import { existsSync as existsSync104, readFileSync as readFileSync122 } from "node:fs";
+import { existsSync as existsSync105, readFileSync as readFileSync122 } from "node:fs";
 import { resolve as resolve80 } from "node:path";
 function applyNeedsClient(shell) {
   if (shell === void 0 || !SHELL_NAMES.includes(shell)) return true;
@@ -188720,7 +189378,7 @@ async function runSiteAnalyze(opts) {
       if (book?.skipped) result.warnings = [...result.warnings ?? [], book.skipped];
       const derived = deriveSiteShell({ siteUrl: result.book.input.siteUrl, look: result.book.look, kind, routes });
       const prevOverlayPath = resolve80(outDir, "provisioning.overlay.json");
-      const prevSite = existsSync104(prevOverlayPath) ? (() => {
+      const prevSite = existsSync105(prevOverlayPath) ? (() => {
         try {
           return JSON.parse(readFileSync122(prevOverlayPath, "utf8")).site;
         } catch {
@@ -188741,7 +189399,7 @@ async function runSiteAnalyze(opts) {
   }
   const previousOverlay = resolve80(outDir, "provisioning.overlay.json");
   carryOverGoals(
-    existsSync104(previousOverlay) ? readFileSync122(previousOverlay, "utf8") : void 0,
+    existsSync105(previousOverlay) ? readFileSync122(previousOverlay, "utf8") : void 0,
     result.provisioningOverlay
   );
   const ownerCall = ownerAuth ? ownerTransportFrom(fetchImpl, ownerAuth) : void 0;
@@ -188827,7 +189485,7 @@ async function runSiteFunctionCli(opts) {
   });
 }
 function base44BookRoutes(bookPath, siteUrl) {
-  if (!existsSync104(bookPath)) return void 0;
+  if (!existsSync105(bookPath)) return void 0;
   try {
     const book = JSON.parse(readFileSync122(bookPath, "utf8"));
     if (book.kind !== "base44-app-book" || !Array.isArray(book.routes)) return void 0;
@@ -189084,7 +189742,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync105, readFileSync as readFileSync123, writeFileSync as writeFileSync48 } from "node:fs";
+import { existsSync as existsSync106, readFileSync as readFileSync123, writeFileSync as writeFileSync48 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -189233,7 +189891,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync105, readFileSync: readFileSync123, writeFileSync: writeFileSync48 }) {
+function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync106, readFileSync: readFileSync123, writeFileSync: writeFileSync48 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -190012,7 +190670,7 @@ __export(capture_exports, {
   nativeNotConfigured: () => nativeNotConfigured,
   variantWidth: () => variantWidth
 });
-import { existsSync as existsSync106, mkdirSync as mkdirSync49, rmSync as rmSync31, writeFileSync as writeFileSync49 } from "node:fs";
+import { existsSync as existsSync107, mkdirSync as mkdirSync49, rmSync as rmSync31, writeFileSync as writeFileSync49 } from "node:fs";
 import { join as join116 } from "node:path";
 import { pathToFileURL as pathToFileURL8 } from "node:url";
 function variantWidth(variant) {
@@ -190025,7 +190683,7 @@ function frameFile(outDir, screen, variant, surface) {
 async function captureMockup(root, screen, entry, variant, outDir, session) {
   if (!entry.mockup) throw new MockupMissingError(`screen ${screen} declares no mockup in hhp.json`);
   const file2 = localPath(root, entry.mockup);
-  if (!existsSync106(file2)) throw new MockupMissingError(`screen ${screen}: mockup ${entry.mockup} does not exist`);
+  if (!existsSync107(file2)) throw new MockupMissingError(`screen ${screen}: mockup ${entry.mockup} does not exist`);
   const own6 = session ?? new MockupSession();
   try {
     const png = await own6.shoot(file2, variant);
@@ -190333,8 +190991,8 @@ var init_score = __esm({
 });
 
 // ../visual-proof/evidence.mjs
-import { existsSync as existsSync107, rmSync as rmSync34 } from "node:fs";
-function resolveCaptionFont({ exists = existsSync107, env = process.env } = {}) {
+import { existsSync as existsSync108, rmSync as rmSync34 } from "node:fs";
+function resolveCaptionFont({ exists = existsSync108, env = process.env } = {}) {
   if (env?.VISUAL_PROOF_FONT) return env.VISUAL_PROOF_FONT;
   return CAPTION_FONT_CANDIDATES.find((p2) => exists(p2)) ?? null;
 }
@@ -190587,7 +191245,7 @@ __export(fidelity_exports, {
   himalayaRepoRoot: () => himalayaRepoRoot
 });
 import { execFileSync as execFileSync10 } from "node:child_process";
-import { existsSync as existsSync108, realpathSync as realpathSync16 } from "node:fs";
+import { existsSync as existsSync109, realpathSync as realpathSync16 } from "node:fs";
 import { join as join121, relative as relative19, sep as sep22 } from "node:path";
 function himalayaRepoRoot(dir) {
   let top;
@@ -190596,7 +191254,7 @@ function himalayaRepoRoot(dir) {
   } catch {
     return null;
   }
-  if (!existsSync108(join121(top, "tools/judges/fidelity/JUDGE.md"))) return null;
+  if (!existsSync109(join121(top, "tools/judges/fidelity/JUDGE.md"))) return null;
   const rel = relative19(realpathSync16(top), realpathSync16(dir));
   return rel.startsWith(`..${sep22}`) || rel === ".." ? null : top;
 }
@@ -190606,7 +191264,7 @@ function fidelityEnvelope(report3) {
 async function fidelityCommand(ctx) {
   const { io: io2, flags, print } = ctx;
   const dir = contentDir(flags);
-  if (!existsSync108(dir)) {
+  if (!existsSync109(dir)) {
     io2.error(failure("fidelity_bad_flag", `content dir ${dir} does not exist`));
     return 2;
   }
@@ -190780,8 +191438,11 @@ var ServeCliClient = class {
   fetchTokens(app, release2) {
     return this.request("serve", "GET", `/v1/tokens?app=${encodeURIComponent(app)}${this.pinQ(release2)}`);
   }
-  fetchAppConfig(app, release2) {
-    return this.request("serve", "GET", `/v1/app-config/${encodeURIComponent(app)}${release2 ? `?release=${encodeURIComponent(release2)}` : ""}`);
+  /** A pinned non-live [release] on a deployed plane needs [previewToken] (see `fetchScreen`). */
+  fetchAppConfig(app, release2, previewToken) {
+    return this.request("serve", "GET", `/v1/app-config/${encodeURIComponent(app)}${release2 ? `?release=${encodeURIComponent(release2)}` : ""}`, {
+      ...previewToken ? { headers: { "x-himalaya-preview-token": previewToken } } : {}
+    });
   }
   fetchBundle(app, hash2) {
     return this.request("serve", "GET", `/v1/bundles/${hash2}.bundle.js?app=${encodeURIComponent(app)}`);
@@ -191322,7 +191983,8 @@ var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
   "empty-app-ok",
   "aab",
   "managed",
-  "source-hash"
+  "source-hash",
+  "skip-captcha-check"
 ]);
 var SWITCH_FLAGS = new Set([...BOOLEAN_FLAGS].filter((name) => name !== "deep"));
 var SWITCH_CONSEQUENCE = {
@@ -192232,7 +192894,7 @@ var COMMANDS = [
   { name: "patch", summary: 'change ONE item of a published app \u2014 a screen descriptor, a Tier-5 bundle, tokens, or the app-config baseline \u2014 from a RAW FILE, with no content package and no build. The low-level door: it does not lint your package, because there is no package here; `himi push --only <selector>` is the same edit with the full build + lint gate and is what to reach for when the package is in hand. Derives a new release from the app\'s current LIVE release, or from `--from-release <id>`. An explicit `--draft` or `--live` is REQUIRED \u2014 a patch has no default blast radius \u2014 and `--notes` is required with `--live` on a screen or app-config patch, because off-repo `gitSha` is "dev" and the ledger notes are then the only durable record of bytes that correspond to no commit. A branch does not merge: activating one derived from an older release reverts every item the patch does not move, so that case is refused until `--accept-regressions`. A bundle patch must repoint a screen (`--for-screen`) or the bytes land under a manifest key nothing reads. It cannot ADD a screen (screens are git-only, RFC 0012), never claims a slug \u2014 the app must already be published \u2014 and carries no attestation, source archive, assets, icon or minBinaryVersion, each named in the output.', required: "screen <id> --file <descriptor.json> [--bundle <sha256|none>] | bundle --file <bundle.js> (--for-screen <id>[,<id>] | --no-rebind) | tokens --file <tokens.json> | app-config --file <app-config.json> ; (--draft|--live) --app <a> [--from-release <id>] [--accept-regressions] [--label <n>] [--notes <t>] [--force] [--allow-binary-gap] [--target <t>] (--control-token)" },
   { name: "flags", summary: "read and change the app's OPERATIONAL flags (RFC 0013) \u2014 `list` prints what the DEVICE door serves, `set <key> --definition` creates or replaces one, `ramp <key>` moves its rollout share or kills it, `rm <key>` deletes it and echoes the definition back so the removal is reversible. Every write is followed by a read of the same door the device uses, and the answer is reported as `servedNow`: flags are stored in the app's git-committed flags.json, so a control plane with no checkout accepts a write it will never serve.", required: "list|set|ramp|rm [<key>] [--definition <json|@file>] [--percent 0-100] [--enabled true|false] [--app <a>] (--control-token)" },
   { name: "visibility", summary: "read (no value) or set whether the public registry (/v1/apps + the Himi Player picker) LISTS the app. `public` lists it for everyone; `unlisted` hides it from listings while direct reads by app id \u2014 deep links, previews \u2014 keep working. App from --app or the content dir. Setting it needs no republish.", required: "[public|unlisted] [--app <a>] [--content <dir>] (--control-token)" },
-  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | base44 | player | demo-app) and defaults to the content package's himalaya.content.json `shell` (templates carry the one they were written for), else branded-lite. The per-app shells ADD the release's declared capabilities to the binary, while Himi Player and demo-app refuse a release declaring one they lack; `--plan` previews it without building; `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo --site <id>` reuses an existing customer ad-hoc profile and certificate for iOS; requires an owned site and a completed personal signing binding. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). `--aab` builds an Android App Bundle (.aab) for the owner to upload to Google Play AND an APK from the same build \u2014 a download link for the .aab, an install link and QR for the APK; Android only; the bundle is signed with the Wix production key (`wix-keystore`, the upload key Branded apps use) \u2014 any other `--android-signing` is refused \u2014 and the APK with the committed QA key; a self-serve caller gets one only as the store build of its own Containers app (it must own the app's site, and `--aab` sends your Wix login); any other self-serve `--aab` gets 403 android_format_not_allowed. NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|base44|player|demo-app] [--signing wix-managed|byo] [--site <id>] [--android-signing qa-keystore|wix-keystore|debug] [--aab] [--borrow-ios-id <bundleId>] [--no-wait] [--force] [--plan] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
+  { name: "dist", summary: "build an INSTALLABLE QA binary (signed IPA / APK) on the Wix Job Service Mac pool and return an install link \u2014 the serve plane brokers the job, the pool builds it. WAITS for the build by default (~4 min) and prints the install link; `--no-wait` returns a jobId immediately instead. Omitting `--release` builds whatever is LIVE for the app. A named draft is refused unless `--allow-draft` makes that exceptional build explicit. `status <jobId>` / `watch <jobId>` / `list --app <a>` / `cancel <jobId>` inspect and stop builds (`watch` reports up front whether the job mints its own signing identity or borrows one, so a doomed iOS build is cancellable in seconds rather than after the archive). Off-repo, name a target \u2014 `--target wix` for a self-serve Wix login or `--target bo` for the internal employee path (the in-repo default is a local dev plane that isn't reachable off-repo); self-serve callers may build their OWN apps under a tighter budget (2 in flight / 5 per 24h), while a manage-only owner-role credential is refused. `--shell` picks the native host to sign into (branded-lite | owner-lite | brandy | base44 | player | demo-app) and defaults to the content package's himalaya.content.json `shell` (templates carry the one they were written for), else branded-lite. The per-app shells ADD the release's declared capabilities to the binary, while Himi Player and demo-app refuse a release declaring one they lack; `--plan` previews it without building; `brandy` is the site shell \u2014 the customer's own website as native-framed tabs. `--signing` defaults to `wix-managed` \u2014 the Wix Apple account mints a per-app signing identity for the build, so the caller provisions no Apple credentials of their own; `--signing byo --site <id>` reuses an existing customer ad-hoc profile and certificate for iOS; requires an owned site and a completed personal signing binding. `--android-signing` is the Android counterpart and a SEPARATE axis (a keystore, not an Apple account): `qa-keystore` (default \u2014 the repo's committed QA key, identical on every pool machine, so a build installs over the previous one), `wix-keystore` (the Wix key the pool machine carries; the build FAILS naming the paths searched if it carries none, rather than quietly signing with something else), or `debug` (the old per-machine key \u2014 QA must uninstall any previous build first). `--aab` builds an Android App Bundle (.aab) for the owner to upload to Google Play AND an APK from the same build \u2014 a download link for the .aab, an install link and QR for the APK; Android only; the bundle is signed with the Wix production key (`wix-keystore`, the upload key Branded apps use) \u2014 any other `--android-signing` is refused \u2014 and the APK with the committed QA key; a self-serve caller gets one only as the store build of its own Containers app (it must own the app's site, and `--aab` sends your Wix login); any other self-serve `--aab` gets 403 android_format_not_allowed. NOT the normal way to ship: screens, Tier-5 bundles, tokens and app-config all go over the air with `himi push` in seconds \u2014 a binary trip is only needed for a NATIVE delta (a new SDUI component, a new declared capability/entitlement, a new bundle id, or a minBinaryVersion floor bump). Refuses to build an app whose launcher icon is missing, a placeholder, or one a store would reject \u2014 the one thing a binary carries that no later OTA push can fix; `--force` builds anyway. Also refuses a release whose member login (WixConsumerAuthProvider) names no siteId, or not in lower case, when Wix says its site requires a member CAPTCHA \u2014 such a binary ships without the CAPTCHA key and every member sign-in fails; whatever it cannot read (the release, the site's setting) only warns and builds; `--skip-captcha-check` builds anyway", required: "[--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>] [--shell branded-lite|owner-lite|brandy|base44|player|demo-app] [--signing wix-managed|byo] [--site <id>] [--android-signing qa-keystore|wix-keystore|debug] [--aab] [--borrow-ios-id <bundleId>] [--no-wait] [--force] [--skip-captcha-check] [--plan] | status <jobId> [--target <t>] | watch <jobId> [--target <t>] [--interval <ms>] | list --app <a> [--target <t>] | cancel <jobId> [--target <t>]" },
   { name: "testflight", summary: 'build, sign and upload an app to TestFlight (internal testers \u2014 no Beta App Review), then WAIT until App Store Connect finishes processing it. Sugar for `store upload --track testflight`. Prompts first: a build number is consumed permanently on a real Apple account and cannot be reused \u2014 `--yes` for CI, `--dry-run` to see the plan without touching anything. The wait is the real check, not a nicety: fastlane prints "Successfully uploaded" for a binary App Store Connect then rejects in processing, and a rejected binary leaves NO build record at all (the reason is emailed). Public App Store review is deliberately NOT automatable here \u2014 `--track appstore` is refused; use /submit-ios-app when you mean to go public', required: "<app> [--track testflight|internal] [--profile <name>] [--yes] [--dry-run] [--skip-build] [--no-wait] [--json]" },
   { name: "store", summary: "the App Store Connect group behind `testflight`. `preflight <app>` checks readiness offline (icon, entitlements, encryption flag, version, store.config ids, listing + review record); `upload <app>` is what `testflight` runs; `status <app>` reads live build + processing state. `--profile` selects WHICH App Store Connect account: an app built for a Wix customer ships under the CUSTOMER's Apple team (Apple guideline 4.2.6 forbids an app-generation service submitting on a client's behalf), declared per-app as ios.credentialProfile in store.config.yaml and resolved from ~/.himalaya/store-credentials/<name>.json \u2014 the .p8 itself never enters the repo. `iap draft|plan|apply|status|connect|screenshots|check|mappings` registers an app owner's digital products as in-app purchases (non-consumables, or consumable price tiers): draft reads the Wix catalog and writes the manifest, plan and status only read, apply is the one App Store mutation boundary, connect readies the Wix site to sell them (purchases app, In-App Purchase key, appleIAP provider, product mappings; --preview-tag routes only its Serve calls to a deploy preview), legacy screenshots --profile renders each product's purchase screen from the app (--content) as a bound iPhone shows it to a signed-in member and names the 1290\xD72796 PNG as the item's App Review screenshot, and none of them builds, signs or needs a checkout (`himi docs iap-products`) IAP provisioning defaults to Catalog; managed apply generates screenshots on the server with no local .p8 or profile fallback; --managed is optional and --profile selects legacy mode; --catalog-route or HIMI_IAP_CATALOG_ROUTE has no default.", required: "preflight <app> [--profile <n>] | upload <app> [--track <t>] [--profile <n>] [--yes] [--dry-run] | status <app> [--profile <n>] | iap draft --site <msid> " + IAP_CREDENTIAL_OPTIONS + " --apple-app <id> --bundle <id> --base-territory <t> --out <f> [--territories <a,b>] [--locale <l>] [--mode per-item|tiers] [--merge <f>] [--report <f>] [--json] | iap plan --manifest <f> " + IAP_CREDENTIAL_OPTIONS + " --out <f> [--json] | iap apply --plan <f> " + IAP_CREDENTIAL_OPTIONS + " --out <f> [--yes] [--limit <n>] [--no-submit] [--json] | iap status --manifest <f> " + IAP_CREDENTIAL_OPTIONS + " [--out <f>] [--json] | iap connect --manifest <f> [--profile <n>] [--catalog-route <prefix>] [--iap-key <AuthKey.p8> --iap-key-id <id>] [--content <dir>] [--preview-tag dp-<tag>] [--dry-run] [--yes] [--out <f>] [--json] | iap screenshots --manifest <f> --content <dir> --profile <n> [--out-dir <d>] [--only <id,\u2026>] [--force] [--dry-run] [--json] | iap check --manifest <f> --catalog-route <prefix> [--purchases-app <id>] [--content <dir>] [--plist <file>] [--visitor-client <id>] [--json] | iap mappings --site <msid> --purchases-app <id> --catalog-route <prefix> [--product <id> --active true|false --yes] [--json]" },
   { name: "guide", summary: "print the Himalaya overview + headless dev loop + available topics (offline)", required: "[--json]" },
@@ -192843,7 +193505,7 @@ async function hhpCommand(ctx) {
 // src/commands/init.ts
 init_scaffold();
 init_store();
-import { existsSync as existsSync45 } from "node:fs";
+import { existsSync as existsSync46 } from "node:fs";
 import { join as join44, resolve as resolve43 } from "node:path";
 init_cli_shared();
 async function adoptAtInit(dir) {
@@ -192870,7 +193532,7 @@ var NoBase44SlotError = class extends Error {
 };
 async function initFromRemoteTemplate(name, parentDir, template, c2, opts = {}) {
   const dir = resolve43(parentDir, name);
-  if (existsSync45(join44(dir, "himalaya.content.json"))) {
+  if (existsSync46(join44(dir, "himalaya.content.json"))) {
     throw new Error(`content package already exists at ${dir}`);
   }
   const r3 = await c2.fetchTemplateSource(TEMPLATE_APP_PREFIX + template);
@@ -192946,7 +193608,7 @@ async function initCommand(ctx) {
       const owed = openApprovals2(readApprovals2(dir).events).length;
       next.push(`carried the planning journal into the app (${carried.join(", ")}${owed ? `; ${owed} approval${owed === 1 ? "" : "s"} still owed` : ""}) \u2014 \`himi progress --brief\` there shows it`);
     }
-    const planInParent = ["SPEC.md", "MOBILE-UX.md"].filter((f2) => existsSync45(join44(parentDir, f2)));
+    const planInParent = ["SPEC.md", "MOBILE-UX.md"].filter((f2) => existsSync46(join44(parentDir, f2)));
     if (planInParent.length) {
       next.push(`${planInParent.join(" and ")} in ${parentDir} ${planInParent.length > 1 ? "are" : "is"} not the app's \u2014 if that is the approved plan, move it over the template's boilerplate in ${dir}`);
     }
@@ -193013,7 +193675,7 @@ ${doNow.map((l2) => `  ${l2}`).join("\n")}`);
 }
 
 // src/commands/template.ts
-import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync67, existsSync as existsSync57, rmSync as rmSync16 } from "node:fs";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync67, existsSync as existsSync58, rmSync as rmSync16 } from "node:fs";
 import { createHash as createHash30 } from "node:crypto";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join57, resolve as resolve46, basename as basename15 } from "node:path";
@@ -193080,7 +193742,7 @@ async function cmsIssues(dir, app, strict, opts) {
 // src/surface-lint.ts
 init_car();
 init_preview_surfaces();
-import { existsSync as existsSync46, readFileSync as readFileSync55 } from "node:fs";
+import { existsSync as existsSync47, readFileSync as readFileSync55 } from "node:fs";
 import { join as join45 } from "node:path";
 var VALID_PLATFORM_KEYS2 = /* @__PURE__ */ new Set([
   ...PREVIEW_SURFACES.map((s2) => s2.platformKey).filter((k2) => k2 !== null),
@@ -193093,7 +193755,7 @@ function surfaceIssues(dir, surfaceNav, strict) {
   let platforms = {};
   let envelopeUnreadable = false;
   const p2 = join45(dir, "platforms.json");
-  if (existsSync46(p2)) {
+  if (existsSync47(p2)) {
     let raw;
     try {
       raw = JSON.parse(readFileSync55(p2, "utf8"));
@@ -193126,7 +193788,7 @@ function surfaceIssues(dir, surfaceNav, strict) {
   }
   if (envelopeUnreadable) return issues;
   const configTs = join45(dir, "config.ts");
-  if (existsSync46(configTs)) {
+  if (existsSync47(configTs)) {
     const declared = parseCarConfig(readFileSync55(configTs, "utf8")).category;
     const inEnvelope = platforms.androidauto === true;
     if (inEnvelope && !declared) {
@@ -193186,10 +193848,10 @@ async function fontIssues(dir, strict, opts = {}) {
 }
 
 // src/stores-api-lint.ts
-import { existsSync as existsSync49, readdirSync as readdirSync26, readFileSync as readFileSync58 } from "node:fs";
+import { existsSync as existsSync50, readdirSync as readdirSync26, readFileSync as readFileSync58 } from "node:fs";
 import { join as join48 } from "node:path";
 function storesV1Issues(contentDir2, strict) {
-  const roots2 = [join48(contentDir2, "tier5-src"), join48(contentDir2, "dev")].filter(existsSync49);
+  const roots2 = [join48(contentDir2, "tier5-src"), join48(contentDir2, "dev")].filter(existsSync50);
   const files = [];
   const visit = (dir) => {
     for (const entry of readdirSync26(dir, { withFileTypes: true })) {
@@ -193462,7 +194124,7 @@ async function templateCommand(ctx) {
     const result = { ...outcome.result, ...fromSpec };
     const adoptDir = contentDir(flags);
     const kept = flags["dry-run"] !== true && (outcome.code === 0 || outcome.result.forcedKeep === true);
-    if (kept && existsSync57(join57(adoptDir, adoptBits.ADOPT_FILE))) {
+    if (kept && existsSync58(join57(adoptDir, adoptBits.ADOPT_FILE))) {
       try {
         const inv = adoptBits.inspectApp(adoptDir);
         adoptBits.writeInventory(adoptDir, inv, { companions: "if-missing" });
@@ -193847,16 +194509,16 @@ async function ejectCommand(ctx) {
 // src/commands/validate.ts
 init_wix_placeholders();
 init_lint_report();
-import { readFileSync as readFileSync77, existsSync as existsSync66 } from "node:fs";
+import { readFileSync as readFileSync77, existsSync as existsSync67 } from "node:fs";
 import { join as join69 } from "node:path";
 init_token_lint();
 
 // src/icon-lint.ts
 init_icon2();
-import { existsSync as existsSync60 } from "node:fs";
+import { existsSync as existsSync61 } from "node:fs";
 import { join as join60 } from "node:path";
 async function iconIssues(dir, strict, opts = {}) {
-  if (!existsSync60(join60(dir, "himalaya.content.json"))) return [];
+  if (!existsSync61(join60(dir, "himalaya.content.json"))) return [];
   const status = await iconStatus(dir);
   const issue2 = (severity, message2) => ({
     screen: null,
@@ -193919,7 +194581,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync66(iosYmlPath) ? readFileSync77(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync67(iosYmlPath) ? readFileSync77(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -194009,7 +194671,7 @@ import { readFileSync as readFileSync80 } from "node:fs";
 
 // src/dpx.ts
 import { spawnSync as spawnSync3 } from "node:child_process";
-import { existsSync as existsSync67, readFileSync as readFileSync78 } from "node:fs";
+import { existsSync as existsSync68, readFileSync as readFileSync78 } from "node:fs";
 import { homedir as homedir9 } from "node:os";
 import { join as join70 } from "node:path";
 var BO_COOKIE = "WixBoAuthentication_1_19_0";
@@ -194037,7 +194699,7 @@ function dpxSessionTokenPath() {
 var DPX_SESSION_PORT = 5151;
 function dpxSessionPresent(path2 = dpxSessionTokenPath()) {
   try {
-    return existsSync67(path2) && readFileSync78(path2, "utf8").trim().length > 0;
+    return existsSync68(path2) && readFileSync78(path2, "utf8").trim().length > 0;
   } catch {
     return false;
   }
@@ -194272,13 +194934,13 @@ async function mcpCommand(ctx) {
 
 // src/commands/studio.ts
 init_cli_shared();
-import { mkdirSync as mkdirSync36, writeFileSync as writeFileSync30, existsSync as existsSync70 } from "node:fs";
+import { mkdirSync as mkdirSync36, writeFileSync as writeFileSync30, existsSync as existsSync71 } from "node:fs";
 import { join as join74, resolve as resolve60, basename as basename19, dirname as dirname42 } from "node:path";
 async function studioCommand(ctx) {
   const { io: io2, pos, flags, print } = ctx;
   const { openStudio: openStudio2 } = await Promise.resolve().then(() => (init_studio(), studio_exports));
   const dir = contentDir(flags);
-  if (!existsSync70(join74(dir, "himalaya.content.json"))) {
+  if (!existsSync71(join74(dir, "himalaya.content.json"))) {
     io2.error(JSON.stringify({ ok: false, error: "not_a_content_package", dir, hint: "run from the app directory (or pass --content <dir>) \u2014 the board reads that package's .himi/" }));
     return 2;
   }
@@ -194338,7 +195000,7 @@ ${handover.hint[0].toUpperCase()}${handover.hint.slice(1)}.`);
 
 // src/commands/progress.ts
 init_cli_shared();
-import { existsSync as existsSync71 } from "node:fs";
+import { existsSync as existsSync72 } from "node:fs";
 import { join as join75 } from "node:path";
 async function progressCommand2(ctx) {
   const { io: io2, pos, flags, print } = ctx;
@@ -194362,7 +195024,7 @@ async function progressCommand2(ctx) {
   } = await Promise.resolve().then(() => (init_progress(), progress_exports));
   const dir = contentDir(flags);
   const journal2 = journalPath2(dir);
-  const isContentPackage = existsSync71(join75(dir, "himalaya.content.json"));
+  const isContentPackage = existsSync72(join75(dir, "himalaya.content.json"));
   const hint = isContentPackage ? {} : { hint: "no himalaya.content.json here \u2014 run from the app directory (or pass --content <dir>) so the build board finds this journal" };
   const message2 = pos.slice(1).join(" ").trim();
   const approvalFlags = ["approve", "done", "drop"].filter((f2) => flags[f2] !== void 0);
@@ -194552,7 +195214,7 @@ init_himi_report();
 init_attestation();
 init_wix_placeholders();
 init_lint_report();
-import { existsSync as existsSync76, rmSync as rmSync21 } from "node:fs";
+import { existsSync as existsSync77, rmSync as rmSync21 } from "node:fs";
 import { join as join81 } from "node:path";
 init_crawl_layers();
 init_cli_shared();
@@ -194575,7 +195237,7 @@ async function testCommand(ctx) {
   const { io: io2, deps, pos, flags, print, serveBase } = ctx;
   const dir = contentDir(flags);
   const structuredOutput = flags.json === true || io2.isTTY !== true;
-  if (existsSync76(join81(dir, "functions"))) {
+  if (existsSync77(join81(dir, "functions"))) {
     const { invokeLocalFunction: invokeLocalFunction2, loadFunctionsApp: loadFunctionsApp2 } = await Promise.resolve().then(() => (init_functions(), functions_exports));
     const loaded = await loadFunctionsApp2(dir);
     const results = [];
@@ -195240,7 +195902,7 @@ async function iconsCommand(ctx) {
 
 // src/commands/pull.ts
 init_cli_shared();
-import { existsSync as existsSync78, readdirSync as readdirSync35, statSync as statSync21 } from "node:fs";
+import { existsSync as existsSync79, readdirSync as readdirSync35, statSync as statSync21 } from "node:fs";
 import { join as join84, resolve as resolve63 } from "node:path";
 async function pullCommand(ctx) {
   const { io: io2, pos, flags, print, client: client2 } = ctx;
@@ -195258,7 +195920,7 @@ async function pullCommand(ctx) {
     io2.error(JSON.stringify(linked));
     return 1;
   }
-  if (existsSync78(dest)) {
+  if (existsSync79(dest)) {
     if (!statSync21(dest).isDirectory()) {
       io2.error(JSON.stringify({
         error: `${dest} exists and is not a directory`,
@@ -195271,7 +195933,7 @@ async function pullCommand(ctx) {
       io2.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway (merging, and naming what it keeps), --replace to restore exactly what was archived, or --out/--name to land somewhere else" }));
       return 1;
     }
-    if (replace && occupied && !existsSync78(join84(dest, "himalaya.content.json"))) {
+    if (replace && occupied && !existsSync79(join84(dest, "himalaya.content.json"))) {
       io2.error(JSON.stringify({
         error: `${dest} is not a content package \u2014 refusing to --replace it`,
         hint: "--replace only clears a directory that holds himalaya.content.json. Check --out/--name, or pass --force to merge into it instead."
@@ -195352,7 +196014,7 @@ async function pullCommand(ctx) {
 
 // src/commands/push.ts
 import { createHash as createHash41 } from "node:crypto";
-import { existsSync as existsSync81 } from "node:fs";
+import { existsSync as existsSync82 } from "node:fs";
 import { join as join87, relative as relative17 } from "node:path";
 init_config();
 init_release();
@@ -195520,7 +196182,7 @@ async function pushCommand(ctx) {
   const payload = await loadReleaseFromDir(declared, out2);
   const oneAppEvidence = join87(dir, ".himi", "one-app");
   const oneAppCoverage = join87(dir, "ONE-APP-COVERAGE.json");
-  const oneAppMarked = existsSync81(join87(oneAppEvidence, "manifest.json")) || existsSync81(oneAppCoverage);
+  const oneAppMarked = existsSync82(join87(oneAppEvidence, "manifest.json")) || existsSync82(oneAppCoverage);
   let oneAppCoverageCount = 0;
   let oneAppCoverageReady = false;
   let oneAppNativeProof;
@@ -196188,12 +196850,12 @@ async function packCommand(ctx) {
 
 // src/commands/import.ts
 init_cli_shared();
-import { existsSync as existsSync82, readdirSync as readdirSync36, statSync as statSync23 } from "node:fs";
+import { existsSync as existsSync83, readdirSync as readdirSync36, statSync as statSync23 } from "node:fs";
 import { resolve as resolve67 } from "node:path";
 function restoreDestinationIssue(dest, force) {
   const link = symlinkDestinationIssue(dest);
   if (link) return link;
-  if (!existsSync82(dest)) return null;
+  if (!existsSync83(dest)) return null;
   if (!statSync23(dest).isDirectory()) {
     return { error: `${dest} exists and is not a directory`, hint: "pass --out/--name to land somewhere else, or remove the file" };
   }
@@ -197385,7 +198047,7 @@ async function promoteCommand(ctx) {
 // src/commands/patch.ts
 init_lint_report();
 init_cli_shared();
-import { readFileSync as readFileSync98, existsSync as existsSync86 } from "node:fs";
+import { readFileSync as readFileSync98, existsSync as existsSync87 } from "node:fs";
 import { createHash as createHash42 } from "node:crypto";
 var PATCH_HELP = `himi patch \u2014 change ONE item of a published app, from a raw file, on a machine
              that does not have the content package.
@@ -197464,7 +198126,7 @@ async function patchCommand(ctx) {
     io2.error(JSON.stringify({ error: `patch ${kind} needs --file`, usage: PATCH_USAGE }));
     return 2;
   }
-  if (!existsSync86(file2)) {
+  if (!existsSync87(file2)) {
     io2.error(JSON.stringify({ error: `no such file: ${file2}` }));
     return 2;
   }
@@ -198025,7 +198687,7 @@ async function testflightCommand(ctx) {
 }
 
 // src/commands/dist.ts
-import { existsSync as existsSync92 } from "node:fs";
+import { existsSync as existsSync93 } from "node:fs";
 import { join as join99 } from "node:path";
 init_wix_owner();
 init_cli_shared();
@@ -198065,7 +198727,7 @@ async function distCommand(ctx) {
   const rememberLastDist = async (jobs2) => {
     try {
       const dir = contentDir(flags);
-      if (!existsSync92(join99(dir, "himalaya.content.json"))) return;
+      if (!existsSync93(join99(dir, "himalaya.content.json"))) return;
       const { lastDistFromJob: lastDistFromJob2, writeLastDist: writeLastDist2 } = await Promise.resolve().then(() => (init_capabilities(), capabilities_exports));
       const own6 = await appId(dir);
       for (const job of jobs2) {
@@ -198309,9 +198971,35 @@ ${label3}`);
     return 0;
   }
   const platform = str3(flags.platform)?.split(",").map((p2) => p2.trim()).filter(Boolean);
+  const { captchaContentInput: captchaContentInput2, captchaDistGate: captchaDistGate2 } = await Promise.resolve().then(() => (init_captcha2(), captcha_exports));
+  const captchaSiteId = str3(flags.site) ?? (await appId(contentDir(flags)) === app ? captchaContentInput2(contentDir(flags)).siteId : void 0);
+  const { captchaBindable: captchaBindable2 } = await Promise.resolve().then(() => (init_captcha_bindable(), captcha_bindable_exports));
+  const { DEFAULT_DIST_SHELL: DEFAULT_DIST_SHELL2 } = await Promise.resolve().then(() => (init_dist_jobs(), dist_jobs_exports));
+  if (flags.force !== true && flags["skip-captcha-check"] !== true && captchaBindable2(distShell ?? DEFAULT_DIST_SHELL2, false)) {
+    const verdict = await captchaDistGate2({
+      client: c2,
+      app,
+      release: str3(flags.release),
+      requestedSite: captchaSiteId,
+      // The plane's own default when --platform is absent: Android (iOS for a customer TestFlight build).
+      platforms: platform?.length ? platform : str3(flags.destination) === "testflight" ? ["ios"] : ["android"]
+    });
+    if (verdict.refuse) {
+      print({
+        ok: false,
+        code: verdict.refuse.code,
+        error: verdict.refuse.code,
+        message: verdict.refuse.message,
+        captchaPolicy: verdict.refuse.captchaPolicy,
+        hint: "fix config.ts and `himi push`, then build that release: `himi dist --release <its id> --allow-draft` (a draft), or promote it first \u2014 or `himi dist --skip-captcha-check` to build without the member CAPTCHA key"
+      });
+      return 1;
+    }
+    if (verdict.advisory) (flags.json === true ? io2.error : io2.log)(`\u26A0 ${verdict.advisory}`);
+  }
   {
     const distDir = contentDir(flags);
-    if (existsSync92(join99(distDir, "himalaya.content.json"))) {
+    if (existsSync93(join99(distDir, "himalaya.content.json"))) {
       const issues = await iconIssues(distDir, flags.strict === true, { requireDeclared: true, requireVerified: true });
       const errors = issues.filter((i2) => i2.severity === "error");
       for (const i2 of issues.filter((i3) => i3.severity === "warning")) {
@@ -198328,8 +199016,6 @@ ${label3}`);
       }
     }
   }
-  const { captchaContentInput: captchaContentInput2 } = await Promise.resolve().then(() => (init_captcha2(), captcha_exports));
-  const captchaSiteId = str3(flags.site) ?? captchaContentInput2(contentDir(flags)).siteId;
   let wixAuthorization;
   const customerTestflight = str3(flags.signing)?.trim().toLowerCase() === "byo" && str3(flags.destination) === "testflight";
   if (str3(flags.signing)?.trim().toLowerCase() === "byo") {
@@ -199321,7 +200007,7 @@ ${report3.ok ? "OK \u2014 data + serve plane reachable." : typeof report3.hint =
 // src/commands/guide.ts
 init_guides();
 init_cli_shared();
-import { existsSync as existsSync93 } from "node:fs";
+import { existsSync as existsSync94 } from "node:fs";
 import { join as join101, resolve as resolve72 } from "node:path";
 async function runGuideCommand(command, pos, flags, io2, print) {
   const { referenceCache: referenceCache2, referenceIdentity: referenceIdentity2 } = await Promise.resolve().then(() => (init_guides(), guides_exports));
@@ -199549,7 +200235,7 @@ Seed your coding agent with \`himi agent-init\`. Guides: ${idx.portalUrl}`);
         ...res.removed.length ? { removed: res.removed, note: "older copies at the app root, moved to .himi/legacy-agent-files/ (a backup, in case one became app code) \u2014 the current ones live in .agents/skills/himalaya/" } : {},
         // In a git repo the refresh moves the diff identity an earlier `himi test` attested (that
         // hash is shared with the repo gates and deliberately exempts nothing but its own metadata).
-        ...existsSync93(join101(dir, ".himi", "attestations", "latest.json")) ? { next: "if `himi push` then refuses the attestation as stale, re-run `himi test` \u2014 in a git checkout this refresh changed the tree it covered" } : {},
+        ...existsSync94(join101(dir, ".himi", "attestations", "latest.json")) ? { next: "if `himi push` then refuses the attestation as stale, re-run `himi test` \u2014 in a git checkout this refresh changed the tree it covered" } : {},
         ...res.skipped.length ? { skipped: res.skipped } : {},
         portalUrl: idx.portalUrl
       });
@@ -199617,7 +200303,7 @@ init_schema2();
 // src/cms.ts
 init_cms_schema();
 init_wix_owner();
-import { existsSync as existsSync94, readFileSync as readFileSync112, writeFileSync as writeFileSync36 } from "node:fs";
+import { existsSync as existsSync95, readFileSync as readFileSync112, writeFileSync as writeFileSync36 } from "node:fs";
 import { join as join102 } from "node:path";
 var FOREIGN_DETAIL_LIMIT = 25;
 var MAX_COLLECTION_PAGES = 40;
@@ -200050,7 +200736,7 @@ async function seedCms(opts) {
 }
 function readSeedFile(dir) {
   const file2 = join102(dir, "cms-seed.json");
-  if (!existsSync94(file2)) return {};
+  if (!existsSync95(file2)) return {};
   let parsed;
   try {
     parsed = JSON.parse(readFileSync112(file2, "utf8"));
@@ -200112,7 +200798,7 @@ async function writeSeedRows(opts) {
     };
   }
   let existing = {};
-  if (existsSync94(file2)) {
+  if (existsSync95(file2)) {
     let parsed;
     try {
       parsed = JSON.parse(readFileSync112(file2, "utf8"));
@@ -200427,7 +201113,7 @@ async function cmsCommand(ctx) {
 
 // src/commands/base44.ts
 init_cli_shared();
-import { existsSync as existsSync102 } from "node:fs";
+import { existsSync as existsSync103 } from "node:fs";
 import { join as join113, resolve as resolve77 } from "node:path";
 async function base44Command(ctx) {
   const { io: io2, pos, flags, print } = ctx;
@@ -200499,7 +201185,7 @@ async function base44Command(ctx) {
       return 1;
     };
     const gen = await Promise.resolve().then(() => (init_generate(), generate_exports));
-    const missing3 = gen.ENGINE_FILES.filter((f2) => !existsSync102(join113(dir, f2)));
+    const missing3 = gen.ENGINE_FILES.filter((f2) => !existsSync103(join113(dir, f2)));
     if (missing3.length) {
       return fail6("content_dir_not_base44_starter", `${dir} is not a base44-starter content package: the generated screens import a shared engine it does not have (${missing3.join(", ")})`, { missing: missing3, hint: "scaffold one with `himi init <name> --template base44-starter --base44-app-id <id>`" });
     }
@@ -200585,7 +201271,7 @@ async function base44Command(ctx) {
     if (!provisioning || str3(flags.content) !== void 0 || !slug) return contentDir(flags);
     if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) return void 0;
     const dir = resolve77("apps", slug);
-    return existsSync102(join113(dir, "config.ts")) || existsSync102(join113(dir, "config.mjs")) ? dir : void 0;
+    return existsSync103(join113(dir, "config.ts")) || existsSync103(join113(dir, "config.mjs")) ? dir : void 0;
   };
   if (sub === "entities" || sub === "functions") {
     if (sub === "entities" && !["query", "create", "seed"].includes(pos[2] ?? "")) {