@wix/himalaya-cli 0.1558.0 → 0.1560.0

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/_types/stdlib/wix-sdk/online-programs/src/index.d.ts

@@ -164,7 +164,7 @@ export declare function queryParticipants(programId: string, opts?: {
     limit?: number;
 }, readOptions?: WixCallOptions): Promise<WixQueryParticipantsResponse>;
 /** Participant lifecycle state. */
-export type WixParticipantState = "JOINED" | "PAYMENT_PENDING" | "APPROVAL_PENDING" | "COMPLETED" | "INVITED" | "REMOVED" | string;
+export type WixParticipantState = "JOINED" | "PAYMENT_PENDING" | "ENROLLMENT_PENDING" | "APPROVAL_PENDING" | "COMPLETED" | "INVITED" | "REMOVED" | string;
 export interface WixParticipantPaymentPending {
     /** The payable handle for the cashier rail, when the program charges. */
     purchaseFlowId?: string;
@@ -172,7 +172,7 @@ export interface WixParticipantPaymentPending {
     snapshotId?: string;
 }
 /**
- * The participant JoinProgram hands back — a DIFFERENT entity from the roster
+ * The compatibility result joinProgram returns — a DIFFERENT entity from the roster
  * `WixParticipant` above, which is why it gets its own name. This one describes the join
  * outcome (`state`, `paymentPendingOptions`); the roster one describes who the member is
  * and how far they have got (`member`, `progress`, `enrollmentStatus`).
@@ -195,7 +195,16 @@ export interface WixJoinedParticipant {
 export interface WixJoinProgramResponse {
     participant?: WixJoinedParticipant;
 }
-/** Join a program as the signed-in member. Branch on `participant.state`. */
-export declare function joinProgram(programId: string): Promise<WixJoinProgramResponse>;
-/** The cashier handle to settle, or "" when the join needs no payment. */
+/**
+ * Join as the signed-in member through Join Applications. Read the current
+ * application first so an existing application is resumed without another create.
+ * Approved paid applications prepare
+ * SINGLE_PAYMENT and return the Wix Payments order as paymentPendingOptions.orderId.
+ * mayPreparePayment rechecks the caller's checkout guard before creating that order.
+ * @scope member
+ */
+export declare function joinProgram(programId: string, options?: {
+    mayPreparePayment?: () => boolean;
+}): Promise<WixJoinProgramResponse>;
+/** The cashier handle to settle, or "" when no payable order is available. */
 export declare function payableIdOf(participant?: WixJoinedParticipant): string;

package/dist/authoring-runtime/node_modules/@wix/himalaya/dist/wix-online-programs.mjs

@@ -29,13 +29,41 @@ function queryParticipants(programId, opts, readOptions) {
   };
   return wixCall("POST", "/online-programs/v3/participants/query", { query, fields: ["PROGRESS"] }, readOptions);
 }
-function joinProgram(programId) {
-  if (!programId) throw new Error("joinProgram: programId is required");
-  return wixCall(
-    "POST",
-    `/online-programs/v3/participants/${encodeURIComponent(programId)}/join`,
-    {}
-  );
+function joinProgramError(code, message) {
+  return Object.assign(new Error(`joinProgram: ${message}`), { code });
+}
+var JOIN_APPLICATIONS = "/online-programs/participants/v3/join-applications";
+async function joinProgram(programId, options) {
+  if (!programId) throw joinProgramError("program_id_required", "programId is required");
+  let response;
+  let currentReadSucceeded = false;
+  try {
+    response = await wixCall("GET", `${JOIN_APPLICATIONS}/current/${encodeURIComponent(programId)}`);
+    currentReadSucceeded = true;
+  } catch {
+  }
+  if (!currentReadSucceeded) {
+    response = await wixCall("POST", JOIN_APPLICATIONS, { joinApplication: { programId } });
+  }
+  let application = response?.joinApplication;
+  if (!application?.id || application.programId !== programId) throw joinProgramError("invalid_join_application", "invalid join application");
+  if (application.status === "APPROVED" && ["PAYMENT_PENDING", "PAYMENT_FAILED", "PAYMENT_CANCELED"].includes(application.paymentStatus ?? "")) {
+    if (options?.mayPreparePayment && !options.mayPreparePayment()) throw joinProgramError("payment_preparation_withdrawn", "payment preparation withdrawn");
+    const prepared = await wixCall("POST", `${JOIN_APPLICATIONS}/${encodeURIComponent(application.id)}/prepare-payment`, { paymentType: "SINGLE_PAYMENT" });
+    if (prepared?.joinApplication?.id !== application.id || prepared.joinApplication.programId !== programId) throw joinProgramError("invalid_prepared_application", "invalid prepared application");
+    application = prepared.joinApplication;
+  }
+  const participant = { programId, memberId: application.memberId };
+  if (application.status === "APPROVAL_PENDING") return { participant: { ...participant, state: "APPROVAL_PENDING" } };
+  if (application.status !== "APPROVED") throw joinProgramError("join_application_not_approved", "application not approved");
+  if (application.paymentStatus === "PENDING_OWNER_APPROVAL") return { participant: { ...participant, state: "ENROLLMENT_PENDING" } };
+  if (["NO_PAYMENT_REQUIRED", "PAYMENT_SUCCESSFUL"].includes(application.paymentStatus ?? "")) {
+    return { participant: application.participantId ? { ...participant, id: application.participantId, state: "JOINED" } : { ...participant, state: "ENROLLMENT_PENDING" } };
+  }
+  if (application.paymentStatus === "PAYMENT_IN_PROGRESS" && application.paymentInfo?.paymentOrderId) {
+    return { participant: { ...participant, state: "PAYMENT_PENDING", paymentPendingOptions: { orderId: application.paymentInfo.paymentOrderId } } };
+  }
+  throw joinProgramError("join_application_not_ready", "enrollment or payment is not ready");
 }
 function payableIdOf(participant) {
   const pending = participant?.paymentPendingOptions;

package/dist/cli.mjs

@@ -23086,9 +23086,9 @@ function inferScreenDisplayName(screenId) {
     const suffix = id.slice(product2[0].length).replace(/^_/, "");
     return `${kind}Product Details${suffix ? ` (${suffix})` : ""}`;
   }
-  const opaque = /(?:_|\/)([0-9a-f]{8}-[0-9a-f-]{27,}|[0-9]+|[0-9a-f]{16,})$/i.exec(id);
-  const words = (opaque ? id.slice(0, opaque.index) : id).replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[_\/\s-]+/).filter(Boolean).map((word) => /^(cms|faq|api|ai|id|url)$/i.test(word) ? word.toUpperCase() : word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
-  return `${words || screenId}${opaque ? ` (${opaque[1]})` : ""}`;
+  const opaque2 = /(?:_|\/)([0-9a-f]{8}-[0-9a-f-]{27,}|[0-9]+|[0-9a-f]{16,})$/i.exec(id);
+  const words = (opaque2 ? id.slice(0, opaque2.index) : id).replace(/([a-z0-9])([A-Z])/g, "$1 $2").split(/[_\/\s-]+/).filter(Boolean).map((word) => /^(cms|faq|api|ai|id|url)$/i.test(word) ? word.toUpperCase() : word.charAt(0).toUpperCase() + word.slice(1)).join(" ");
+  return `${words || screenId}${opaque2 ? ` (${opaque2[1]})` : ""}`;
 }
 function screenDisplayName(screenId, displayName3, title, navigationLabel) {
   const literal = (value2) => typeof value2 === "string" && !!value2.trim() && !value2.trim().startsWith("$") && !/^__[A-Z0-9_]+__$/.test(value2.trim());
@@ -143328,7 +143328,7 @@ Transport: same targets/tokens as himi-serve \u2014 --target <local|prod|bo>, --
 --telemetry-url, --control-token/--telemetry-token, or HIMI_* env.
 Guides: ${DEVELOPER_PORTAL_URL}`;
     COMMANDS = [
-      { name: "one-app", summary: "collect One App source configuration and evidence for reconstruction; validate-topbar checks authored settings and resolved platform bars; validate-design compares the source theme's colors and button shape with the migrated tokens.json; coverage inventories and verifies source requirements. Branded falls back to Free/Spaces only when absent. Collection does not launch a model or build the app. User-scoped Wix authentication is required; WIX_API_KEY is not used.", required: "migrate --msid <uuid> [--app-instance branded|free] [--prompt <text> | --prompt-file <file>] [--name <slug>] [--dir <parent>] [--target bo] [--top-tabs bottom-tabs|keep] [--json] | validate-topbar --evidence-dir <.himi/one-app> --content <app-dir> [--json] | validate-design --evidence-dir <.himi/one-app> --content <app-dir> [--json] [--fix] [--record --release-hash <sha256>] | coverage init|sync|check|verify --evidence-dir <.himi/one-app> --content <app-dir> [--release-hash <sha256>]" },
+      { name: "one-app", summary: "collect One App source configuration and evidence for reconstruction; validate-topbar checks authored settings and resolved platform bars; validate-design compares the source theme's colors, heading/body font families, button shape and accent text contrast with the migrated tokens.json; coverage inventories and verifies source requirements. Branded falls back to Free/Spaces only when absent. Collection does not launch a model or build the app. User-scoped Wix authentication is required; WIX_API_KEY is not used.", required: "migrate --msid <uuid> [--app-instance branded|free] [--prompt <text> | --prompt-file <file>] [--name <slug>] [--dir <parent>] [--target bo] [--top-tabs bottom-tabs|keep] [--json] | validate-topbar --evidence-dir <.himi/one-app> --content <app-dir> [--json] | validate-design --evidence-dir <.himi/one-app> --content <app-dir> [--json] [--fix] [--record --release-hash <sha256>] | coverage init|sync|check|verify --evidence-dir <.himi/one-app> --content <app-dir> [--release-hash <sha256>]" },
       { name: "hhp", summary: "author responsive HTML/CSS/TypeScript screens compiled to native SDUI and T5 workers; scaffold, inspect the app profile, lint or compile declared sources", required: "init <screen> | profile | lint | compile [--app <name>|--content <dir>] [--json] [--dry-run]" },
       { name: "captcha", summary: "create and store native CAPTCHA keys in Serve, or inspect setup status; customer setup verifies Wix site ownership; does not enable member CAPTCHA SDKs", required: "setup|status --app <app> [--content <dir>] [--site <msid>] [--ios-bundle-id <id>] [--android-package-name <id>] [--target <t>]" },
       { name: "init", summary: "scaffold a starter content package (OTA-only; no native shells). --template <t> starts from a full reference app (branded-lite = consumer storefront over a Wix site; owner-lite = owner CRUD/management) instead of the minimal counter; --templates lists bundled ones; --remote fetches the template off the serve plane (falls back to the bundled copy offline). The new app also gets its agent files (the same set `himi agent-init` writes: AGENTS.md, CLAUDE.md, the himalaya skill, HIMALAYA.md, a SessionStart hook) so the next session started inside it picks the work up; --no-agent skips them. It also makes the build board (.himi/studio/, exactly as `himi studio --no-open` does \u2014 it never opens a browser), so every later render, test, validate, push and progress entry refreshes it; and, for a template bundled with this CLI, it makes the FIRST PICTURE itself (never for a --remote one: that is its publisher's code, and a render runs it on this machine, so next[] leaves the render to the agent after it has read the code): exactly `himi render <homeScreenId> --png --mocks --device iphone` (offline \u2014 no request; never --live; --mocks loads the app's recorded data when it has any), run as a child it kills after a time budget, writing .himi/shots/<home>.png and journaling it (by: himi) as the STARTING POINT (\"Starting point: the <template> template, before any of your changes\") so the board and the journal hold a picture when init returns. init also records the source it wrote (.himi/init-source.json: a content fingerprint, Markdown left out), and the first home PNG render after the source diverges from it is journaled once as \"First look at your app\" \u2014 reported as `firstLook: {image}` or `{skipped: <reason>}`, never a failed init; `--no-first-look` skips it (for scripts and CI that render themselves). For a bundled template (never a --remote one \u2014 the preview would build and serve its publisher's code) init also STARTS the live preview itself: `himi run --watch --content <dir> --port <p> --no-open --idle-exit 30`, detached in its own process group with its output in .himi/watch.log, never waited for (the url is chosen before it builds), recorded in .himi/watch.json, and reported as `watch: {started, pid, url, board, log}` \u2014 or `{skipped: <reason>}` for a `CI` environment, a test runner, a watch already running, or a start that failed (never a failed init). Nothing else skips it: outside CI it is started, and `watch.note` says an opt-out was ignored. The envelope LEADS with `doNow`: three lines to run now (the consent preflight, the live preview \u2014 its url and board when init started it, else `himi run --watch --content <dir> &` with the board's path \u2014 and the postcard line), and ENDS with the same lines as `doNowAgain`, so an agent that reads only the head or only the tail (`| tail`) gets them; at a terminal they are also printed as plain text on stderr, before the JSON and again after it. Its `next[]` LEADS with the steps for THIS session, in this order for every app \u2014 the offline first render and that picture's `himi progress` postcard (only when init could not make the picture), the skill's consent preflight (authorize or mock any Wix or external startup request; with none, go straight on), and only then the live preview (the running one's url, or `himi run --watch &` when init did not start it) \u2014 ahead of the next-session guidance", required: "<name> [--dir] [--template <t>] [--remote] [--base44-app-id <id>] [--base44-app-url <https://tenant>] [--no-agent] [--no-first-look] | --templates" },
@@ -157546,11 +157546,11 @@ function deriveAccentText(accent, surfaces) {
   const all = (typeof surfaces === "string" ? [surfaces] : [...surfaces]).map((s2) => s2.slice(0, 7));
   const page = all[0];
   const worst2 = (color) => Math.min(...all.map((s2) => contrastRatio4(color, s2)));
-  const opaque = accent.length === 9 ? mix2(accent.slice(0, 7), page, channel2(accent, 7) / 255) : accent;
-  if (worst2(opaque) >= ACCENT_TEXT_MIN_CONTRAST) return opaque;
+  const opaque2 = accent.length === 9 ? mix2(accent.slice(0, 7), page, channel2(accent, 7) / 255) : accent;
+  if (worst2(opaque2) >= ACCENT_TEXT_MIN_CONTRAST) return opaque2;
   const pole = worst2("#FFFFFF") >= worst2("#000000") ? "#FFFFFF" : "#000000";
   for (let step = 1; step <= 100; step++) {
-    const candidate = mix2(pole, opaque, step / 100);
+    const candidate = mix2(pole, opaque2, step / 100);
     if (worst2(candidate) >= ACCENT_TEXT_MIN_CONTRAST) return candidate;
   }
   if (all.length > 1) {
@@ -171783,6 +171783,14 @@ var init_graph = __esm({
 });
 
 // src/one-app/design-rules.ts
+function typographyRole(name) {
+  return /(title|heading|headline|display|hero)/i.test(name) ? "heading" : "body";
+}
+function sourceFontFamily(id, role) {
+  if (id === "madefor") return role === "heading" ? "Wix Madefor Display" : "Wix Madefor Text";
+  if (id === "system") return SYSTEM_FONT_FAMILY;
+  return Object.hasOwn(SOURCE_FONT_FAMILIES, id) ? SOURCE_FONT_FAMILIES[id] : void 0;
+}
 function sourceMode(manifest2, raw) {
   const resolved2 = obj3(manifest2.source)?.resolvedAppInstance;
   if (resolved2 === "branded") return "branded";
@@ -171829,6 +171837,15 @@ function sourceDesign(raw, mode) {
   if (mode === "branded") {
     add("colors.surfacePrimary.light", "/settings/theme/colors/background", "color", colors.background);
     add("colors.textPrimary.light", "/settings/theme/colors/content", "color", colors.content);
+    const primary = fields.find((field) => field.field === "colors.accentPrimary.light");
+    if (primary) {
+      add("colors.textOnAccent.light", primary.pointer, "contrast", String(primary.value));
+      add("colors.accentText.light", primary.pointer, "contrast", String(primary.value));
+    }
+    const typography = obj3(theme.typography) ?? {};
+    for (const role of ["heading", "body"]) {
+      add(`typography.${role}.family`, `/settings/theme/typography/${role}`, "font", typography[role]);
+    }
     const button = obj3(theme.button) ?? {};
     for (const variant of BUTTON_VARIANTS2) {
       const style = obj3(button[variant]);
@@ -171848,9 +171865,33 @@ function sourceDesign(raw, mode) {
   leafPointers(theme, "/settings/theme", all);
   return { mode, fields, notCompared: all.filter((pointer) => !read.has(pointer)).sort() };
 }
-var BUTTON_VARIANTS2, obj3, seg;
+var SOURCE_FONT_FAMILIES, BUTTON_VARIANTS2, obj3, seg;
 var init_design_rules = __esm({
   "src/one-app/design-rules.ts"() {
+    init_tokens();
+    SOURCE_FONT_FAMILIES = {
+      lato: "Lato",
+      poppins: "Poppins",
+      notoSans: "Noto Sans",
+      inconsolata: "Inconsolata",
+      vollkorn: "Vollkorn",
+      playfairDisplay: "Playfair Display",
+      bebasNeue: "Bebas Neue",
+      lobster: "Lobster",
+      brygada1918: "Brygada 1918",
+      spaceGrotesk: "Space Grotesk",
+      rubik: "Rubik",
+      caudex: "Caudex",
+      fahkwang: "Fahkwang",
+      forum: "Forum",
+      leagueSpartan: "League Spartan",
+      marcellus: "Marcellus",
+      marmelad: "Marmelad",
+      pacifico: "Pacifico",
+      questrial: "Questrial",
+      sora: "Sora",
+      workSans: "Work Sans"
+    };
     BUTTON_VARIANTS2 = ["primary", "secondary"];
     obj3 = (value2) => value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
     seg = (key3) => key3.replaceAll("~", "~0").replaceAll("/", "~1");
@@ -172562,12 +172603,59 @@ function readButtonToken(tokens2, variant, property2) {
   const values = new Set(drawn.map((entry) => entry.radius));
   return values.size === 1 ? { value: drawn[0].radius, origin } : { value: drawn.map((entry) => `${entry.size} ${entry.radius}`).join(", "), origin };
 }
+function opaque(value2) {
+  const hex2 = value2 ? canonicalHex(value2) : void 0;
+  return hex2?.length === 7 ? hex2 : hex2?.endsWith("FF") ? hex2.slice(0, 7) : void 0;
+}
+function contrastRow(field, tokens2, base) {
+  const accent = opaque(readColorToken(tokens2, "accentPrimary").value);
+  const isFill = field.field === "colors.textOnAccent.light";
+  const background = isFill ? accent : opaque(readColorToken(tokens2, "surfacePrimary").value);
+  if (!accent || !background) return { ...base, status: "unresolved", note: !accent ? "Accent contrast requires an opaque target accentPrimary token." : "Author an opaque surfacePrimary token before checking accent text; native hosts do not share the web's white page fallback." };
+  const name = isFill ? "textOnAccent" : "accentText";
+  const read = readColorToken(tokens2, name);
+  const target = opaque(read.value ?? (isFill ? "#FFFFFF" : accent));
+  const neutral = isFill ? [] : (textSurfacesOf(obj5(tokens2.colors) ?? {}).light ?? []).map((value2) => opaque(value2));
+  if (neutral.some((value2) => !value2)) return { ...base, status: "unresolved", note: "Accent text contrast requires opaque neutral surface tokens." };
+  const surfaces = [background, ...neutral];
+  const desired = isFill ? contrastRatio3("#FFFFFF", accent) >= 4.5 ? "#FFFFFF" : "#000000" : deriveAccentText(accent, surfaces);
+  const ratio = target ? Math.min(...surfaces.map((surface) => contrastRatio3(target, surface))) : 0;
+  if (ratio < 4.5 && surfaces.some((surface) => contrastRatio3(desired, surface) < 4.5)) {
+    return { ...base, status: "unresolved", note: "No single derived accent text shade reaches 4.5:1 on every neutral surface; author separate local text roles for the conflicting backdrops." };
+  }
+  return {
+    ...base,
+    source: desired,
+    ...target ? { target } : {},
+    targetOrigin: read.origin === "absent" ? "renderer-default" : read.origin,
+    status: target && ratio >= 4.5 ? "match" : "mismatch",
+    note: `Accent text must reach 4.5:1; observed ${ratio.toFixed(2)}:1.`
+  };
+}
 function compare3(field, tokens2) {
   const id = requirementId("design", field.pointer, field.field);
   const base = { id, field: field.field, sourcePath: field.pointer, source: field.value };
   if (field.kind === "unsupported") {
     return { ...base, status: "unresolved", note: field.note };
   }
+  if (field.kind === "contrast") return contrastRow(field, tokens2, { ...base, status: "mismatch" });
+  if (field.kind === "font") {
+    const role = field.field.split(".")[1];
+    const mapped = sourceFontFamily(String(field.value), role);
+    const family = mapped === SYSTEM_FONT_FAMILY ? mapped : mapped ? canonicalFamilyName(mapped) : void 0;
+    const entries = Object.entries(obj5(tokens2.typography) ?? {}).filter(([name]) => typographyRole(name) === role);
+    if (!family || !entries.length || entries.some(([, entry]) => !obj5(entry))) {
+      return { ...base, status: "unresolved", note: !family ? mapped ? `Source font ${mapped} is not in the Himi font catalog; resolve a supported family before importing it.` : "Unknown source font ID; resolve its family before importing it." : "No inspectable target typography entries for this role; author numeric metrics before importing the family." };
+    }
+    const wrong = entries.filter(([, entry]) => obj5(entry)?.family !== family);
+    return {
+      ...base,
+      source: family,
+      target: wrong.length ? wrong.map(([name, entry]) => `${name}: ${obj5(entry)?.family ?? "system"}`).join(", ") : family,
+      targetOrigin: "token",
+      status: wrong.length ? "mismatch" : "match"
+    };
+  }
   const parts = field.field.split(".");
   const read = field.kind === "color" ? readColorToken(tokens2, parts[1]) : readButtonToken(tokens2, parts[3], parts[4]);
   const row2 = { ...base, status: "mismatch", targetOrigin: read.origin, ...read.value !== void 0 ? { target: read.value } : {} };
@@ -172618,6 +172706,10 @@ function applyFix(tokens2, rows) {
       const previous = typeof existing === "string" ? existing : obj5(existing)?.light;
       const entry = obj5(existing) ?? {};
       colors[parts[1]] = typeof previous === "string" ? { ...entry, light: row2.source, dark: entry.dark ?? previous, highContrast: entry.highContrast ?? entry.dark ?? previous } : { ...entry, light: row2.source };
+    } else if (parts[0] === "typography") {
+      for (const [name, entry] of Object.entries(obj5(tokens2.typography) ?? {})) {
+        if (typographyRole(name) === parts[1] && obj5(entry)) entry.family = row2.source;
+      }
     } else {
       const variant = ensure2(ensure2(ensure2(ensure2(tokens2, "controls"), "button"), "variants"), parts[3]);
       variant[parts[4]] = row2.source;
@@ -172809,7 +172901,7 @@ function validateDesign(evidenceDir, contentDir2, options = {}) {
   const adapted = waivers(contentDir2, hashes);
   const evaluate2 = () => design.fields.map((field) => {
     const row2 = compare3(field, tokens2);
-    const waiver = adapted.get(row2.id);
+    const waiver = field.kind === "contrast" || field.kind === "font" && row2.status === "unresolved" ? void 0 : adapted.get(row2.id);
     if (row2.status === "unresolved") return waiver ? { ...row2, status: "adapted" } : row2;
     let overlayDifference;
     let waivedOverlay = false;
@@ -172819,7 +172911,7 @@ function validateDesign(evidenceDir, contentDir2, options = {}) {
       if (!overlay) continue;
       const drawn = compare3(field, mergeIdiomOverlay(tokens2, overlay));
       if (drawn.status === "match") continue;
-      if (waiver?.has(name)) {
+      if (waiver?.has(name) && !(field.kind === "font" && drawn.status === "unresolved")) {
         waivedOverlay = true;
         continue;
       }
@@ -172839,7 +172931,34 @@ function validateDesign(evidenceDir, contentDir2, options = {}) {
   let rows = evaluate2();
   let fixed = [];
   if (options.fix) {
-    fixed = applyFix(tokens2, rows);
+    if (design.fields.some((field) => field.kind === "contrast") && !opaque(readColorToken(tokens2, "accentPrimary").value)) {
+      return {
+        ok: false,
+        code: "design_unresolved",
+        ...base,
+        rows,
+        fixed: [],
+        unresolved: ["Author an opaque target accentPrimary palette before --fix; its existing dark/high-contrast appearance cannot be preserved from a missing or translucent accent."]
+      };
+    }
+    const previousColors = structuredClone(obj5(tokens2.colors) ?? {});
+    const contrastFields = new Set(design.fields.filter((field) => field.kind === "contrast").map((field) => field.field));
+    fixed = applyFix(tokens2, rows.filter((row2) => !contrastFields.has(row2.field)));
+    const contrastRows = evaluate2().filter((row2) => contrastFields.has(row2.field));
+    for (const row2 of contrastRows) {
+      const name = row2.field.split(".")[1];
+      if (row2.status !== "mismatch" || row2.targetOrigin === "idiom-token" || previousColors[name] !== void 0) continue;
+      const fallback = name === "textOnAccent" ? "#FFFFFF" : previousColors.accentPrimary;
+      const prior = typeof fallback === "string" ? { light: fallback } : obj5(fallback);
+      if (prior && typeof prior.light === "string") {
+        tokens2.colors[name] = {
+          light: prior.light,
+          dark: prior.dark ?? prior.light,
+          highContrast: prior.highContrast ?? prior.dark ?? prior.light
+        };
+      }
+    }
+    fixed.push(...applyFix(tokens2, contrastRows));
     if (fixed.length) {
       try {
         writeFixedTokens(contentDir2, location, tokensPath, tokens2);
@@ -172855,9 +172974,10 @@ function validateDesign(evidenceDir, contentDir2, options = {}) {
     }
   }
   const mismatches = rows.filter((row2) => row2.status === "mismatch");
+  const unresolvedRequired = rows.some((row2) => row2.status === "unresolved" && design.fields.some((field) => (field.kind === "contrast" || field.kind === "font") && field.field === row2.field));
   return {
-    ok: mismatches.length === 0,
-    ...mismatches.length ? { code: "design_mismatch" } : {},
+    ok: mismatches.length === 0 && !unresolvedRequired,
+    ...mismatches.length ? { code: "design_mismatch" } : unresolvedRequired ? { code: "design_unresolved" } : {},
     ...base,
     rows,
     mismatches: mismatches.map((row2) => `${row2.field}: source ${row2.source} vs target ${row2.target ?? "absent"}`),
@@ -172986,10 +173106,12 @@ var init_validate_design = __esm({
     init_token_colors();
     init_token_lint();
     init_tokens();
+    init_catalog2();
     init_idiom();
     init_preview_surfaces();
     init_config_source_edit();
     init_coverage2();
+    init_brand_color_math();
     init_design_rules();
     init_progress();
     USAGE3 = "himi one-app validate-design --evidence-dir <.himi/one-app> --content <app-dir> [--json] [--fix] [--record --release-hash <sha256>]";
@@ -193078,10 +193200,10 @@ function tokensFromWst(wst) {
   const cream = accent2 && isNearWhite(accent2) ? accent2 : void 0;
   const surface2 = base2 && !isNearBlack(base2) ? base2 : cream;
   if (surface2) colors.surfaceSecondary = { light: surface2 };
-  const opaque = (c2) => c2 && c2.length === 7 ? c2 : void 0;
-  const surface = opaque(usableCssColor(wst["--wst-color-fill-base-1"]));
-  const ramp = !surface ? [] : ["--wst-color-fill-base-shade-1", "--wst-color-fill-base-shade-2", "--wst-color-fill-base-shade-3"].map((v2) => opaque(usableCssColor(wst[v2]))).filter((c2) => !!c2).map((c2) => ({ c: c2, ratio: contrastRatio3(c2, surface) }));
-  const primary = surface ? opaque(usableCssColor(wst["--wst-color-text-primary"])) : void 0;
+  const opaque2 = (c2) => c2 && c2.length === 7 ? c2 : void 0;
+  const surface = opaque2(usableCssColor(wst["--wst-color-fill-base-1"]));
+  const ramp = !surface ? [] : ["--wst-color-fill-base-shade-1", "--wst-color-fill-base-shade-2", "--wst-color-fill-base-shade-3"].map((v2) => opaque2(usableCssColor(wst[v2]))).filter((c2) => !!c2).map((c2) => ({ c: c2, ratio: contrastRatio3(c2, surface) }));
+  const primary = surface ? opaque2(usableCssColor(wst["--wst-color-text-primary"])) : void 0;
   const primaryRatio = primary && surface ? contrastRatio3(primary, surface) : void 0;
   const tertiary = primaryRatio === void 0 ? void 0 : ramp.filter((x2) => x2.ratio >= 4.5 && x2.ratio < primaryRatio).sort((a2, b2) => a2.ratio - b2.ratio)[0];
   if (tertiary) colors.textTertiary = { light: tertiary.c };
@@ -198899,7 +199021,7 @@ async function runOneAppCommand(argv, io2, deps = {}, commandIncluded = false) {
 
 Collect the source mobile app and hand it to the current coding agent. The agent continues with a faithful plan, local generation and a checked hosted draft. Branded falls back to Free (Spaces) only when absent. This command itself does not launch AI or build an app. --dir is the parent directory; an existing destination is refused. --top-tabs bottom-tabs (default) plans bottom tabs, one per visible page, for a source with top tabs; keep retains the top tabs.
 
-validate-topbar checks authored source top-bar controls against the migrated config.ts. validate-design compares the source theme's colors and button shape with the migrated tokens.json, repairs the mismatches with --fix, and records a passing check for the coverage ledger with --record. Both are scoped to a One App evidence directory and do not change general himi validate behavior.`);
+validate-topbar checks authored source top-bar controls against the migrated config.ts. validate-design compares the source theme's colors, heading/body font families, button shape and accent text contrast with the migrated tokens.json, repairs the mismatches with --fix, and records a passing check for the coverage ledger with --record. Both are scoped to a One App evidence directory and do not change general himi validate behavior.`);
     return 0;
   }
   const now = deps.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());

package/guides/one-app-to-himi-app.md

@@ -163,20 +163,45 @@ Apply these interpretation rules:
   a feature to account for; they do not alone prove visibility or access for every
   visitor or member. Resolve those rules separately. This check is specific to this
   migration workflow; it does not change the behavior of `himi validate`.
-- Before publishing, run the migration-only design check:
+- Apply the collected app theme before the first build: run
+  `himi one-app validate-design --evidence-dir .himi/one-app --content . --fix`,
+  resolve any remaining mismatches/unresolved values, then rebuild. The source is
+  `settings.theme`, not the website or the starter template. Before publishing,
+  run the migration-only design check:
   `himi one-app validate-design --evidence-dir .himi/one-app --content .`.
   It resolves the effective source theme with the reader the source app instance
-  actually uses, then compares the resolved primary, background and content colors
-  and each button's `borderRadius` and `outlineWidth` against the app's `tokens.json`.
+  actually uses, then compares the resolved primary, background and content colors,
+  each button's `borderRadius` and `outlineWidth`, and resolved heading/body font families
+  against the app's `tokens.json`.
   Hex case and shorthand are normalized; an absent button token is compared with the
   value the renderer draws (an outline only on `secondary`; a radius of `radius.pill`,
   else 24), not called a difference. A variant without its own radius must draw the
   source radius at every Button size. A descriptor's per-button `cornerRadius` overrides
-  the tokens and is not checked. `--fix` writes the mismatching source values into
+  the tokens and is not checked; descriptor/control-specific fill and label overrides
+  also need a rendered check. `--fix` writes the mismatching source values into
   `tokens.json` and pins the dark and high-contrast schemes to what they drew before,
   because a missing scheme falls back to the light value. Rebuild after `--fix`.
+  For Branded apps, known source typography IDs (for example `lato`) become family
+  names (`Lato`); tokens whose names contain title/heading/headline/display/hero use the heading family; other
+  typography tokens use the body family. Numeric metrics stay unchanged. Unknown IDs,
+  families outside the Himi font catalog, and missing target typography roles remain unresolved; resolve them before recording
+  a pass, even when the coverage ledger cites an adaptation. A deliberate difference
+  between resolved font roles can still be adapted. Build/font validation still has
+  to prove the font bytes are available. Unresolved fonts and contrast also fail
+  the plain check used by push, not only `--record`.
+  Branded accent text must reach 4.5:1: `textOnAccent` against the fill, and `accentText` against the target page and declared neutral
+  surfaces. `--fix` chooses readable ink and derives a same-hue text shade while
+  retaining the exact source accent fill. For example, `#D6BD07` needs dark labels;
+  `#7A6C00` is a readable accent text shade on white. Translucent target colors cannot earn
+  an opaque contrast claim; an explicitly adapted source color still needs independently
+  readable opaque target roles. Author `surfacePrimary` explicitly when absent: native
+  hosts do not share the web's white page fallback. Conflicting page/card backdrops with no derived shade
+  that clears every surface stay unresolved; use separate local text roles. A missing
+  or translucent target accent palette must be authored explicitly before `--fix`,
+  because its non-light appearance cannot be preserved safely. Source `system` font
+  IDs use the portable `$system` sentinel. Contrast failures cannot be waived by a ledger adaptation.
   The report names every theme pointer the check did not compare, including typography
-  kits and any button `uppercase`, which Himi tokens cannot carry; resolve those
+  kit IDs and any button `uppercase`, which Himi tokens cannot carry; resolve those
   explicitly rather than treating a pass as full design parity. A deliberate difference
   is waived only by a `design` coverage row with status `adapted` that cites the user's
   instruction and explains the change. This check compares values, not rendered screens.

package/guides/sdk-reference.json

@@ -23983,7 +23983,7 @@
         "name": "WixParticipantState",
         "kind": "type",
         "jsdoc": "/** Participant lifecycle state. */",
-        "decl": "export type WixParticipantState =\n  | \"JOINED\"\n  | \"PAYMENT_PENDING\"\n  | \"APPROVAL_PENDING\"\n  | \"COMPLETED\"\n  | \"INVITED\"\n  | \"REMOVED\"\n  | string;"
+        "decl": "export type WixParticipantState =\n  | \"JOINED\"\n  | \"PAYMENT_PENDING\"\n  | \"ENROLLMENT_PENDING\"\n  | \"APPROVAL_PENDING\"\n  | \"COMPLETED\"\n  | \"INVITED\"\n  | \"REMOVED\"\n  | string;"
       },
       {
         "name": "WixParticipantPaymentPending",
@@ -23994,7 +23994,7 @@
       {
         "name": "WixJoinedParticipant",
         "kind": "interface",
-        "jsdoc": "/**\n * The participant JoinProgram hands back — a DIFFERENT entity from the roster\n * `WixParticipant` above, which is why it gets its own name. This one describes the join\n * outcome (`state`, `paymentPendingOptions`); the roster one describes who the member is\n * and how far they have got (`member`, `progress`, `enrollmentStatus`).\n *\n * Both were spelled `WixParticipant` until #2289, so TypeScript MERGED the two declarations\n * instead of keeping them apart. That is wrong twice over: the merged type carries every\n * field of both, so it describes neither response — and the merge is itself an error,\n * because `id` was required in the roster shape and optional here (TS2687 + TS2717).\n */",
+        "jsdoc": "/**\n * The compatibility result joinProgram returns — a DIFFERENT entity from the roster\n * `WixParticipant` above, which is why it gets its own name. This one describes the join\n * outcome (`state`, `paymentPendingOptions`); the roster one describes who the member is\n * and how far they have got (`member`, `progress`, `enrollmentStatus`).\n *\n * Both were spelled `WixParticipant` until #2289, so TypeScript MERGED the two declarations\n * instead of keeping them apart. That is wrong twice over: the merged type carries every\n * field of both, so it describes neither response — and the merge is itself an error,\n * because `id` was required in the roster shape and optional here (TS2687 + TS2717).\n */",
         "decl": "export interface WixJoinedParticipant {\n  id?: string;\n  programId?: string;\n  memberId?: string;\n  state?: WixParticipantState;\n  paymentPendingOptions?: WixParticipantPaymentPending;\n  joinedOptions?: { joinedDate?: string };\n}"
       },
       {
@@ -24006,14 +24006,14 @@
       {
         "name": "joinProgram",
         "kind": "function",
-        "jsdoc": "/** Join a program as the signed-in member. Branch on `participant.state`. */",
-        "decl": "export function joinProgram(programId: string): Promise<WixJoinProgramResponse>;",
-        "http": "POST /online-programs/v3/participants/{…}/join"
+        "jsdoc": "/**\n * Join as the signed-in member through Join Applications. Read the current\n * application first so an existing application is resumed without another create.\n * Approved paid applications prepare\n * SINGLE_PAYMENT and return the Wix Payments order as paymentPendingOptions.orderId.\n * mayPreparePayment rechecks the caller's checkout guard before creating that order.\n * @scope member\n */",
+        "decl": "export async function joinProgram(programId: string, options?: { mayPreparePayment?: () => boolean }): Promise<WixJoinProgramResponse>;",
+        "scope": "member"
       },
       {
         "name": "payableIdOf",
         "kind": "function",
-        "jsdoc": "/** The cashier handle to settle, or \"\" when the join needs no payment. */",
+        "jsdoc": "/** The cashier handle to settle, or \"\" when no payable order is available. */",
         "decl": "export function payableIdOf(participant?: WixJoinedParticipant): string;"
       }
     ]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1558.0",
+  "version": "0.1560.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -71,5 +71,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "3e25c3d6c9c9f3a1d3abe87df97e8a1f848ce1a712d321126ce42454"
+  "falconPackageHash": "4a9c5b9b83751ee0bf714c03ed0abc9d8738a205eed4a022bdec8fcb"
 }

package/templates/branded-lite/tier5-src/himi-branded-lite-program/index.ts

@@ -9,7 +9,7 @@ import { withOnlineWrites } from "../_shared/online-actions.js";
 // error card.
 //
 // Phase 2d — enrolling is NATIVE. `joinProgram` covers all three program kinds in
-// one call and the outcome is read off `participant.state`, not assumed:
+// the Join Applications API; its compatibility result exposes only confirmed outcomes:
 // a free/open program comes back JOINED with nothing to pay, a paid one comes back
 // PAYMENT_PENDING and settles on the shared in-app pay rail, and a private one comes
 // back APPROVAL_PENDING (the owner approves; there is nothing to charge). Any failure
@@ -190,18 +190,26 @@ interface CommerceGuards {
 async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<string> {
   const blocked = () => iapPriceCopy("program").purchaseUnavailable;
   if (!guards.mayStart()) return blocked();
+  let preparationWithdrawn = false;
   try {
-    const joined = await joinProgram(inputId());
+    const joined = await joinProgram(inputId(), { mayPreparePayment: () => {
+      if (!guards.mayContinue()) preparationWithdrawn = true;
+      return !preparationWithdrawn;
+    } });
     const participant = joined.participant;
     const programState = (participant?.state ?? "").toUpperCase();
     if (programState === "APPROVAL_PENDING") {
       return copyParam("program.approvalPendingMessage", "Request sent — the host will approve your place.");
     }
+    if (programState === "ENROLLMENT_PENDING") {
+      return copyParam("program.enrollmentPendingMessage", "Your enrollment is processing — check back shortly.");
+    }
     const payable = payableIdOf(participant);
-    if (!payable) {
-      // Free / open program (or one already settled) ⇒ nothing to charge.
+    if (programState === "JOINED") {
+      // Only a confirmed participant is enrolled; absent payment data is not success.
       return copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
     }
+    if (programState !== "PAYMENT_PENDING" || !payable) throw new Error("Program enrollment is not ready");
     const msid = await wixPlatformSession.signedInstanceStatus().then((s) => s.msid ?? "").catch(() => "");
     // Re-read before each step that commits money: a route that settles meanwhile wins.
     let withdrawn = false;
@@ -221,12 +229,8 @@ async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<
       // which is precisely the dead-end the two-rail design exists to prevent
       // (and which the cart/plans/events flows each guard with a test).
       //
-      // There is no `programsCheckout` redirect intent. `ecomOrderPaymentRequest`
-      // is the only payment-request-shaped one, and a program's `purchaseFlowId`
-      // is a payment-request handle, so that is what we hand it. If that mapping
-      // is ever wrong the call throws, we degrade to the same site-directing
-      // message as before, and nothing regresses — but when it is right, a
-      // wallet-less site can actually sell the program IN-APP.
+      // Join Applications returns a Wix Payments order id; the payment-request
+      // redirect uses that same order handle on the hosted rail.
       cashierUrl: async () => {
         if (!stillAllowed()) return undefined;
         const redirect = await createRedirectSession({
@@ -237,10 +241,13 @@ async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<
       },
     });
     if (withdrawn) return blocked();
-    if (pay.kind === "paid") return copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
+    if (pay.kind === "paid") return pay.pending
+      ? copyParam("program.paymentPendingMessage", "Payment is processing — enrollment will be confirmed after payment.")
+      : copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
     if (pay.kind === "handoff") return "";
     if (pay.kind === "cancelled") return copyParam("program.joinCancelledMessage", "Payment cancelled — you haven't enrolled.");
   } catch {
+    if (preparationWithdrawn) return blocked();
     // fall through to the site-directing message
   }
   return copyTemplate("program.joinOnSiteMessage", "Enrolment happens on the website — visit the site to join {name}.", { name });

package/templates/yoga-studio/tier5-src/himi-branded-lite-program/index.ts

@@ -9,7 +9,7 @@ import { withOnlineWrites } from "../_shared/online-actions.js";
 // error card.
 //
 // Phase 2d — enrolling is NATIVE. `joinProgram` covers all three program kinds in
-// one call and the outcome is read off `participant.state`, not assumed:
+// the Join Applications API; its compatibility result exposes only confirmed outcomes:
 // a free/open program comes back JOINED with nothing to pay, a paid one comes back
 // PAYMENT_PENDING and settles on the shared in-app pay rail, and a private one comes
 // back APPROVAL_PENDING (the owner approves; there is nothing to charge). Any failure
@@ -190,18 +190,26 @@ interface CommerceGuards {
 async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<string> {
   const blocked = () => iapPriceCopy("program").purchaseUnavailable;
   if (!guards.mayStart()) return blocked();
+  let preparationWithdrawn = false;
   try {
-    const joined = await joinProgram(inputId());
+    const joined = await joinProgram(inputId(), { mayPreparePayment: () => {
+      if (!guards.mayContinue()) preparationWithdrawn = true;
+      return !preparationWithdrawn;
+    } });
     const participant = joined.participant;
     const programState = (participant?.state ?? "").toUpperCase();
     if (programState === "APPROVAL_PENDING") {
       return copyParam("program.approvalPendingMessage", "Request sent — the host will approve your place.");
     }
+    if (programState === "ENROLLMENT_PENDING") {
+      return copyParam("program.enrollmentPendingMessage", "Your enrollment is processing — check back shortly.");
+    }
     const payable = payableIdOf(participant);
-    if (!payable) {
-      // Free / open program (or one already settled) ⇒ nothing to charge.
+    if (programState === "JOINED") {
+      // Only a confirmed participant is enrolled; absent payment data is not success.
       return copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
     }
+    if (programState !== "PAYMENT_PENDING" || !payable) throw new Error("Program enrollment is not ready");
     const msid = await wixPlatformSession.signedInstanceStatus().then((s) => s.msid ?? "").catch(() => "");
     // Re-read before each step that commits money: a route that settles meanwhile wins.
     let withdrawn = false;
@@ -221,12 +229,8 @@ async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<
       // which is precisely the dead-end the two-rail design exists to prevent
       // (and which the cart/plans/events flows each guard with a test).
       //
-      // There is no `programsCheckout` redirect intent. `ecomOrderPaymentRequest`
-      // is the only payment-request-shaped one, and a program's `purchaseFlowId`
-      // is a payment-request handle, so that is what we hand it. If that mapping
-      // is ever wrong the call throws, we degrade to the same site-directing
-      // message as before, and nothing regresses — but when it is right, a
-      // wallet-less site can actually sell the program IN-APP.
+      // Join Applications returns a Wix Payments order id; the payment-request
+      // redirect uses that same order handle on the hosted rail.
       cashierUrl: async () => {
         if (!stillAllowed()) return undefined;
         const redirect = await createRedirectSession({
@@ -237,10 +241,13 @@ async function enrollmentMessage(name: string, guards: CommerceGuards): Promise<
       },
     });
     if (withdrawn) return blocked();
-    if (pay.kind === "paid") return copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
+    if (pay.kind === "paid") return pay.pending
+      ? copyParam("program.paymentPendingMessage", "Payment is processing — enrollment will be confirmed after payment.")
+      : copyTemplate("program.joinedMessage", "You're enrolled in {name}.", { name });
     if (pay.kind === "handoff") return "";
     if (pay.kind === "cancelled") return copyParam("program.joinCancelledMessage", "Payment cancelled — you haven't enrolled.");
   } catch {
+    if (preparationWithdrawn) return blocked();
     // fall through to the site-directing message
   }
   return copyTemplate("program.joinOnSiteMessage", "Enrolment happens on the website — visit the site to join {name}.", { name });