@wix/himalaya-cli 0.1579.0 → 0.1580.0

package/dist/quickjs-worker-entry.js

@@ -0,0 +1,313 @@
+// ../../core/dev-server/src/quickjs-worker-entry.ts
+import { parentPort, workerData } from "node:worker_threads";
+import { pathToFileURL } from "node:url";
+var CTL_READY = 0;
+var CTL_LEN = 1;
+var CTL_SEQ = 2;
+var CTL_WORDS = 4;
+var DATA_OFFSET = CTL_WORDS * 4;
+var sessions = /* @__PURE__ */ new Map();
+var { sab, intlPath, webGlobalsPath } = workerData;
+var webGlobalsInstaller = null;
+async function installWebGlobalsInto(ctx) {
+  webGlobalsInstaller ??= (await import(pathToFileURL(webGlobalsPath).href)).installWebGlobals;
+  webGlobalsInstaller(ctx);
+}
+var intlInstaller = null;
+async function installIntlInto(ctx) {
+  intlInstaller ??= (await import(pathToFileURL(intlPath).href)).installIntl;
+  intlInstaller(ctx);
+}
+var ctl = new Int32Array(sab, 0, CTL_WORDS);
+var data = new Uint8Array(sab, DATA_OFFSET);
+var decoder = new TextDecoder();
+var crossingSeq = 0;
+function crossToHost(kind, method, path, body, waitMs, headers = "") {
+  const mine = ++crossingSeq;
+  const deadline = Date.now() + waitMs;
+  Atomics.store(ctl, CTL_SEQ, 0);
+  Atomics.store(ctl, CTL_READY, 0);
+  parentPort.postMessage({ want: { kind, method, path, body, headers, seq: mine } });
+  for (; ; ) {
+    const left = deadline - Date.now();
+    if (left <= 0) {
+      return JSON.stringify({ ok: false, e: `the host transport did not answer within ${waitMs}ms` });
+    }
+    const res = Atomics.wait(ctl, CTL_READY, 0, left);
+    if (res === "timed-out") {
+      return JSON.stringify({ ok: false, e: `the host transport did not answer within ${waitMs}ms` });
+    }
+    if (Atomics.load(ctl, CTL_SEQ) !== mine) {
+      Atomics.store(ctl, CTL_READY, 0);
+      continue;
+    }
+    const len = Atomics.load(ctl, CTL_LEN);
+    if (len < 0 || len > data.length) {
+      return JSON.stringify({ ok: false, e: `the host transport returned an out-of-range length (${len})` });
+    }
+    return decoder.decode(data.subarray(0, len));
+  }
+}
+var modulePromise = null;
+async function realmModule() {
+  modulePromise ??= (async () => {
+    const { newQuickJSWASMModuleFromVariant } = await import("quickjs-emscripten");
+    const variant = await import("@jitl/quickjs-wasmfile-release-sync");
+    return newQuickJSWASMModuleFromVariant(variant.default ?? variant);
+  })();
+  return modulePromise;
+}
+async function boot(msg) {
+  const mod = await realmModule();
+  const runtime = mod.newRuntime();
+  runtime.setMemoryLimit(msg.memoryLimitBytes);
+  let deadline = Date.now() + (msg.timeoutMs > 0 ? msg.timeoutMs : 2e3);
+  let waiting = false;
+  runtime.setInterruptHandler(() => !waiting && Date.now() > deadline);
+  const ctx = runtime.newContext();
+  let keepAlive = false;
+  try {
+    const host = ctx.newFunction("__himiWixCall", (mH, pH, bH, hH) => {
+      waiting = true;
+      try {
+        const answer = crossToHost(
+          "wix",
+          ctx.getString(mH),
+          ctx.getString(pH),
+          ctx.getString(bH),
+          // An explicit per-crossing budget when the caller set one; otherwise the remaining boot
+          // time, floored, so a stalled transport still surfaces as a rejected call rather than as
+          // the whole boot timing out with no attribution.
+          msg.answerTimeoutMs !== void 0 ? msg.answerTimeoutMs : Math.max(1e3, deadline - Date.now()),
+          // `undefined` when the guest called with three arguments, which every caller did
+          // before per-call site scope existed.
+          hH === void 0 ? "" : ctx.getString(hH)
+        );
+        return ctx.newString(answer);
+      } finally {
+        waiting = false;
+      }
+    });
+    ctx.setProp(ctx.global, "__himiWixCall", host);
+    host.dispose();
+    const dispatchHost = ctx.newFunction("__himiDispatch", (aH, pH) => {
+      waiting = true;
+      try {
+        const answer = crossToHost(
+          "dispatch",
+          "",
+          ctx.getString(aH),
+          ctx.getString(pH),
+          msg.answerTimeoutMs !== void 0 ? msg.answerTimeoutMs : Math.max(1e3, deadline - Date.now())
+        );
+        return ctx.newString(answer);
+      } finally {
+        waiting = false;
+      }
+    });
+    ctx.setProp(ctx.global, "__himiDispatch", dispatchHost);
+    dispatchHost.dispose();
+    const pre = ctx.evalCode(msg.prelude, "himi-sandbox.js");
+    if (pre.error) {
+      const detail = ctx.dump(pre.error);
+      pre.error.dispose();
+      throw new Error(`sandbox prelude failed: ${String(detail?.message ?? detail)}`);
+    }
+    const bridge = pre.value;
+    const readback = ctx.getProp(bridge, "readback");
+    const dispatch2 = ctx.getProp(bridge, "dispatch");
+    const actionsReadback = ctx.getProp(bridge, "actions");
+    bridge.dispose();
+    if (msg.webGlobals && !msg.hide?.length) await installWebGlobalsInto(ctx);
+    if (msg.intl) await installIntlInto(ctx);
+    let bundleThrow = null;
+    try {
+      const res = ctx.evalCode(msg.bundleJs, msg.filename);
+      if (res.error) {
+        const detail = ctx.dump(res.error);
+        res.error.dispose();
+        bundleThrow = String(detail?.message ?? detail);
+      } else {
+        res.value.dispose();
+      }
+      let actions = "[]";
+      let sweepError = null;
+      try {
+        actions = drain(ctx, runtime, msg.skipLoad ? "himi.quickjs.actions" : "himi.quickjs.loads");
+      } catch (e) {
+        sweepError = String(e?.message ?? e);
+      }
+      const services = readbackJson(ctx, readback);
+      sessions.set(msg.id, {
+        runtime,
+        ctx,
+        dispatch: dispatch2,
+        actions: actionsReadback,
+        setDeadline(timeoutMs) {
+          deadline = Date.now() + (timeoutMs > 0 ? timeoutMs : 2e3);
+        }
+      });
+      keepAlive = true;
+      return { actions, error: bundleThrow ?? sweepError ?? void 0, console: services, sessionId: msg.id };
+    } finally {
+      readback.dispose();
+      if (!keepAlive) {
+        dispatch2.dispose();
+        actionsReadback.dispose();
+      }
+    }
+  } finally {
+    if (!keepAlive) {
+      try {
+        ctx.dispose();
+      } catch {
+      }
+      try {
+        runtime.dispose();
+      } catch {
+      }
+    }
+  }
+}
+function dispatch(msg) {
+  const session = sessions.get(msg.sessionId);
+  if (!session) throw new Error("the contained guest session is no longer available");
+  session.setDeadline(msg.timeoutMs);
+  const service = session.ctx.newString(msg.service);
+  const action = session.ctx.newString(msg.action);
+  const args = session.ctx.newString(msg.argsJson);
+  try {
+    const called = session.ctx.callFunction(
+      session.dispatch,
+      session.ctx.undefined,
+      service,
+      action,
+      args,
+      typeof msg.online === "boolean" ? msg.online ? session.ctx.true : session.ctx.false : session.ctx.undefined
+    );
+    if (called.error) {
+      const detail = session.ctx.dump(called.error);
+      called.error.dispose();
+      throw new Error(`the guest dispatch could not be started: ${String(detail?.message ?? detail)}`);
+    }
+    settlePromise(session.ctx, session.runtime, called.value, "guest dispatch");
+    drainDetachedJobs(session.ctx, session.runtime);
+    return { actions: readbackJson(session.ctx, session.actions) };
+  } finally {
+    service.dispose();
+    action.dispose();
+    args.dispose();
+  }
+}
+function release(sessionId) {
+  const session = sessions.get(sessionId);
+  if (!session) return;
+  sessions.delete(sessionId);
+  try {
+    session.dispatch.dispose();
+  } catch {
+  }
+  try {
+    session.actions.dispose();
+  } catch {
+  }
+  try {
+    session.ctx.dispose();
+  } catch {
+  }
+  try {
+    session.runtime.dispose();
+  } catch {
+  }
+}
+function drain(ctx, runtime, trigger) {
+  const trig = ctx.evalCode(`globalThis[${JSON.stringify(trigger)}]`, "himi-actions.js");
+  if (trig.error) {
+    const detail = ctx.dump(trig.error);
+    trig.error.dispose();
+    throw new Error(`the guest load sweep could not be started: ${String(detail?.message ?? detail)}`);
+  }
+  return settlePromise(ctx, runtime, trig.value, "guest load sweep");
+}
+function settlePromise(ctx, runtime, promise, label) {
+  try {
+    for (let i = 0; i < MAX_PUMP_ROUNDS; i++) {
+      const state = ctx.getPromiseState(promise);
+      if (state.type === "fulfilled") {
+        const out = String(ctx.dump(state.value));
+        state.value.dispose();
+        return out;
+      }
+      if (state.type === "rejected") {
+        const detail = ctx.dump(state.error);
+        state.error.dispose();
+        throw new Error(`the ${label} failed: ${String(detail?.message ?? detail)}`);
+      }
+      state.value?.dispose?.();
+      const pending = runtime.executePendingJobs();
+      if (pending.error) {
+        const detail = ctx.dump(pending.error);
+        pending.error.dispose();
+        throw new Error(`a guest job threw during the load sweep: ${String(detail?.message ?? detail)}`);
+      }
+      if (pending.value === 0) {
+        const ticked = ctx.evalCode(`globalThis["himi.quickjs.tick"]`, "himi-tick.js");
+        if (ticked.error) {
+          const detail = ctx.dump(ticked.error);
+          ticked.error.dispose();
+          throw new Error(`the guest timer pump failed: ${String(detail?.message ?? detail)}`);
+        }
+        const fired = ctx.dump(ticked.value) === true;
+        ticked.value.dispose();
+        if (fired) continue;
+        throw new Error(
+          `the ${label} is pending with no runnable jobs \u2014 a worker awaited something the sandbox never resolves (a capability this realm does not provide)`
+        );
+      }
+    }
+    throw new Error(`the ${label} did not settle within ${MAX_PUMP_ROUNDS} job rounds`);
+  } finally {
+    promise.dispose();
+  }
+}
+function drainDetachedJobs(ctx, runtime) {
+  for (let i = 0; i < MAX_PUMP_ROUNDS; i++) {
+    const pending = runtime.executePendingJobs();
+    if (pending.error) {
+      const detail = ctx.dump(pending.error);
+      pending.error.dispose();
+      throw new Error(`a nested guest job threw after dispatch: ${String(detail?.message ?? detail)}`);
+    }
+    if (pending.value === 0) {
+      const ticked = ctx.evalCode(`globalThis["himi.quickjs.tick"]`, "himi-tick.js");
+      if (ticked.error) {
+        const detail = ctx.dump(ticked.error);
+        ticked.error.dispose();
+        throw new Error(`the nested guest timer pump failed: ${String(detail?.message ?? detail)}`);
+      }
+      const fired = ctx.dump(ticked.value) === true;
+      ticked.value.dispose();
+      if (!fired) return;
+    }
+  }
+  throw new Error(`nested guest actions did not quiesce within ${MAX_PUMP_ROUNDS} job rounds`);
+}
+var MAX_PUMP_ROUNDS = 1e4;
+parentPort.on("message", (msg) => {
+  if ("end" in msg) {
+    process.exit(0);
+  }
+  const operation = msg.kind === "warm" ? realmModule().then(() => ({})) : msg.kind === "boot" ? boot(msg) : msg.kind === "dispatch" ? Promise.resolve(dispatch(msg)) : Promise.resolve((release(msg.sessionId), {}));
+  operation.then((r) => parentPort.postMessage({ id: msg.id, ...r })).catch((e) => parentPort.postMessage({ id: msg.id, error: String(e?.message ?? e) }));
+});
+function readbackJson(ctx, readback) {
+  const called = ctx.callFunction(readback, ctx.undefined);
+  if (called.error) {
+    const detail = ctx.dump(called.error);
+    called.error.dispose();
+    throw new Error(String(detail?.message ?? detail));
+  }
+  const dumped = ctx.dump(called.value);
+  called.value.dispose();
+  return String(dumped);
+}

package/guides/himi-json-output.md

@@ -6,7 +6,7 @@ repurposed when human wording changes. New codes may be added; consumers must
 handle an unknown code as a failure, without parsing prose.
 
 **Rollout:** this contract is enforced for **`himi push`**, including `--only`,
-first, for **`himi store iap connect`**, for **`himi site member-app`**, for **`himi fidelity`**, for the **`himi base44`** entity and function verbs, and for **`himi l10n import`**. Other subcommands still have legacy failures without codes and are a
+first, for **`himi publish-size`**, for **`himi store iap connect`**, for **`himi site member-app`**, for **`himi fidelity`**, for the **`himi base44`** entity and function verbs, and for **`himi l10n import`**. Other subcommands still have legacy failures without codes and are a
 follow-up migration. This is an additive change: existing `error`, `errors`,
 `message`, `hint`, status, body, and gate-specific fields stay as they were.
 Some legacy envelopes have no singular `error` or `hint`; consumers must not
@@ -47,6 +47,22 @@ keeps its existing fields and adds the code:
 | `source_icon_unavailable` | Verified source evidence or its logo is missing, unreadable, unavailable, over the download/decoding budget, or cannot be normalized. |
 | `source_icon_unusable` | The prepared source mark fails mechanical launcher/store checks. Existing icon files and metadata are left unchanged. |
 
+## `himi publish-size` codes
+
+This local planning command never claims or publishes. Every failure includes
+`pushed: false` and `claimed: false`.
+
+| Code | Meaning |
+| --- | --- |
+| `invalid_usage` | Unsupported, repeated, missing or invalid measurement options (exit 2). Publishing flags are refused. |
+| `build_failed` | The contained local release could not be built completely, required host/network access, or the isolated build failed; measuring missing screens or bundles would undercount (exit 1). |
+| `app_source_contains_secrets` | The shared source scanner found possible credentials (exit 1). |
+| `app_source_too_large` | The base64 source archive exceeds its independent limit (exit 1). |
+| `publish_body_too_large` | Measured draft JSON plus the explicit metadata planning reserve exceeds the publish budget (exit 1). `bodyBytes` and `overageBytes` describe the measured envelope; `planningBytes` and `planningOverageBytes` also include the reserve. |
+
+`ok: true` means the measured draft plus its reserve fits. It does not certify
+publication readiness or bound metadata not yet supplied to the final push.
+
 ## `himi one-app validate-payments` codes
 
 | Code | Meaning |
@@ -58,6 +74,19 @@ keeps its existing fields and adds the code:
 The checker validates recorded evidence and decisions; it does not independently
 verify merchant readiness or create transactions. General publication remains unchanged.
 
+## `himi one-app validate-identity` codes
+
+| Code | Meaning |
+| --- | --- |
+| `invalid_usage` | Missing, repeated or unsupported identity-check arguments. |
+| `identity_source_unverified` | Collected source hashes or the business display name cannot be verified. Recollect older evidence that did not save business identity. |
+| `identity_target_unverified` | The technical app slug, target compilation or complete built descriptors are unavailable. |
+| `literal_slug_visible` | Built display text or the known business-chat identity seed contains the technical slug instead of the collected business identity, without matching exact authored source copy. |
+
+The check reads built descriptors, not every possible runtime string. A passing
+result does not verify dynamic live data, translations, branding images or device
+appearance. It does not change publication or coverage policy.
+
 ## Push codes
 
 | Code | Meaning |

package/guides/one-app-section-mappings.md

@@ -16,7 +16,7 @@ Use this companion to the [Structure inference guide](https://apps.wix.com/_api/
 - Existing screen builders often return a complete screen. Preserve the source inline placement using supported composition; do not replace a mixed source screen with an unrelated full vertical screen.
 - Map data selectors, labels/media, design, permissions, CTA parameters and target destinations. The source definition's `settingsData.componentId` identifies a source editor component, not a Himalaya implementation or a complete settings schema.
 
-Source snapshots: Catalyst `617c06d43d2a5608b6876d724553269b1e5346f0`; Himalaya `97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67`. GitHub references are pinned to these inspected versions. Recheck implementation contracts if using another version. No customer data was fetched, no app was generated, and no parity tests were run for this documentation inventory.
+Source snapshots: Catalyst `617c06d43d2a5608b6876d724553269b1e5346f0`; Himalaya `97f1542f2f7d6e8cb7a902b912c87dcaa37e5a67`. GitHub references are pinned to these inspected versions. Recheck implementation contracts if using another version. No customer data was fetched, no app was generated, and no parity tests were run for the original documentation inventory. The Pages row now links the current source-selected editorial reconstruction recipe; its capture/decoder tests do not certify an individual app’s parity.
 
 ## Coverage summary
 
@@ -24,9 +24,9 @@ Source snapshots: Catalyst `617c06d43d2a5608b6876d724553269b1e5346f0`; Himalaya
 | --- | ---: |
 | Module | 13 |
 | Primitive | 7 |
-| Composition | 8 |
+| Composition | 9 |
 | Partial | 24 |
-| Empty | 25 |
+| Empty | 24 |
 | Total | 77 |
 
 ## Mappings by server group
@@ -169,7 +169,7 @@ carousel placement remain separate gaps; the mappings above stay Partial.
 
 | Source sectionDefinitionId | Source viewer component | Himalaya implementation | Placement / reuse | Class | Settings, actions and gaps |
 | --- | --- | --- | --- | --- | --- |
-| `pages_section` | `Pages.SectionPageClientScreen` |  |  | Empty | No matching Wix Pages content fetch/render adapter was found. Generic CMS or RichContent renderers do not identify the original page entity or its data contract. |
+| `pages_section` | `Pages.SectionPageClientScreen` | [Pages capture recipe](https://apps.wix.com/_api/himi-serve/docs/one-app-to-himi-app.md#referenced-pages-content) / `oneAppPageSection` | Editable inline native RichContent | Composition | Select `settings.value.pageId`; use the collector’s Visitor-only referenced read and `pages-content.json`. Preserve source placement order, text, formatting and links. Ready/empty captures can be reconstructed; missing, forbidden, malformed and unsupported captures remain explicit gaps. This is editorial reconstruction, not a live runtime Pages adapter. |
 
 ### 12. photoalbum-section-definitions.json
 
@@ -358,7 +358,6 @@ These are the exact definitions whose target cells above remain empty. “Not fo
 | `loyalty-section-definitions.json` | `loyalty_status_section` | The existing Loyalty worker lists the program and rewards but does not load this member's points balance/tier/status. A rewards catalog is not a loyalty-status widget. |
 | `referrals-section-definitions.json` | `referrals_refer_section` | No consumer referral-code/link sharing and referral-status feature was found. Do not map to Loyalty or generic sharing without a user decision. A visitor-readable program read exists; see the row above. |
 | `referrals-section-definitions.json` | `referrals_description_section` | No referral-program description/data implementation was found. Text primitives alone do not resolve the business-bound referral content. A visitor-readable program read exists; see the row above. |
-| `pages-section-definitions.json` | `pages_section` | No matching Wix Pages content fetch/render adapter was found. Generic CMS or RichContent renderers do not identify the original page entity or its data contract. |
 | `photoalbum-section-definitions.json` | `photoAlbums_list_section` | Existing Photo Albums code is an empty-state placeholder with no album API wired. Pro Gallery uses a different data source and is not a substitute; choose an implementation explicitly. |
 | `photoalbum-section-definitions.json` | `photoAlbums_photos_list` | Existing Photo Albums code is an empty-state placeholder with no album API wired. Pro Gallery uses a different data source and is not a substitute; choose an implementation explicitly. |
 | `photoalbum-section-definitions.json` | `photoAlbums_carousel_section` | Existing Photo Albums code is an empty-state placeholder with no album API wired. Pro Gallery uses a different data source and is not a substitute; choose an implementation explicitly. |

package/guides/one-app-to-himi-app.md

@@ -116,6 +116,15 @@ user request. Preserve the collected files as evidence. Read the [versioned
 reference index](https://apps.wix.com/_api/himi-serve/docs/one-app-reference.md) and its five guides before interpreting
 settings or claiming coverage.
 
+When raw source placements reference `pages_section`, collection also saves
+`pages-content.json`. It selects `settings.value.pageId`, reads only those unique
+documents as the site's Visitor, and retains every original placement separately.
+The evidence records capture time, source identity, a serialized response JSON SHA-256,
+decoded content and an editable native RichContent component per placement.
+The hash identifies that captured response, not an invented server revision.
+Recollect to refresh editorial content; a changed response produces a changed hash.
+Never import the evidence directory into runtime code.
+
 An unavailable supporting runtime view is recorded as `runtime_context_unavailable`
 with its platform and typed failure code; that enriched file is absent. Continue
 from authored intent and mark the platform behavior as unverified in the report.
@@ -500,16 +509,69 @@ Apply these interpretation rules:
   alone does not prove native navigation or control availability. Record any
   unavailable device check as unverified.
 - Business context contains `phoneNumber`, `website`, `services`, optional public
-  `contact`, and an optional validated public `memberCount`, with their permitted
-  nested values. Structure wins on authored phone/URL/design.
+  `contact`, an optional validated public `memberCount`, and optional `displayName`
+  from the same-site Business title, with their permitted nested values.
+  Use `displayName` for business identity; structure wins on authored screen titles,
+  phone/URL/design.
   Installed services do not add features. Installation IDs are not record IDs.
-  Do not restore excluded Business titles, colors, identity or member fields.
+  Do not restore other excluded Business colors, identity or member fields.
 - Referenced editor-authored documents, such as Pages rich text, are presentation
   evidence too. Fetch only the referenced documents through verified read-only
   routes, record their IDs and versions, and reconstruct their authored content
   as editable native components. Keep changing business records live; do not
   substitute captured catalogs, memberships or transaction data for runtime reads.
 
+### Referenced Pages content
+
+`pages_section` is an editor-authored document selected by
+`settings.value.pageId`. It is not a CMS collection, Blog post or placeholder.
+Use `pages-content.json` to reconstruct each ready placement as editable app
+source, in its original layout array order, interleaved with the other sections.
+Repeated page IDs may share one captured document but retain separate placement
+IDs. Preserve source visibility/access rules and every screen alias that uses
+that layout; do not multiply canonical placements by navigation aliases.
+
+The collector's fixed read is
+`GET https://apps.wix.com/social-content/api/v1/pages/{pageId}` using the source
+site's Visitor signed instance. The response contains
+`{pageId, content: {title, body: {contentType, content}}}`. It verifies the returned
+page ID. `RICH_CONTENT` and `DRAFTJS` contain serialized JSON; `PLAIN_TEXT` stays
+literal. The pinned [original reader](https://github.com/wix-private/wix-one-app-pages/blob/5055bf29109c51c48f0009a403bb70976c54e8dc/packages/wix-one-app-pages/src/services/pages-api.ts "audience-lint-ok: optional pinned upstream evidence, not a local authoring dependency") documents this contract.
+No page listing, source mutation or manager credential fallback is needed.
+
+Use the emitted `placement.component`, or rebuild it with the screens SDK's
+`decodeOneAppPage(response, pageId)` and `oneAppPageSection(page, {id})`.
+Copy the resulting component into an editable app source file, then insert it
+into the actual generated screen's payload. Keep it outside collection-bound
+rows that a worker replaces on load. Rendering a separate unused sample or merely
+changing the catalog classification does not restore a migrated placement.
+The component uses literal `RichContent.documentJson`; no source prose is a
+service binding. The existing viewer preserves text, supported formatting, media
+and safe http(s)/mailto/tel links. Legacy bare website domains gain HTTPS before
+encoding; `normalizedWebsiteLinks` records the count. Relative paths, credentials
+and unsafe schemes do not gain an implicit origin. Root editor metadata is omitted from rendered
+content. Keep normal RichContent links or use the existing rich-link handler;
+do not replace them with generic navigation or a WebView.
+
+`ready` and genuine `empty` are successful captures. The section helper renders an
+empty page's message from optional `emptyTitle` / `emptyDescription`; localize
+that copy to the app and preserve the source empty-state intent. `invalid` (including missing
+or malformed selectors/content), `unsupported`, `forbidden`, `unauthorized`,
+`not_found` and `unavailable` remain distinct gaps. A failed document has no
+emitted component. Preserve the gap and resolve it before claiming its coverage;
+never substitute an empty paragraph, demo copy or owner read. Supported DraftJS
+text, styled links, flat lists, headings and images are converted; nested lists
+and unknown plugins remain explicit `unsupported` gaps.
+
+This reconstruction captures editorial presentation only. Changing catalogs,
+transactions and member records remain live. It uses the existing cross-platform
+RichContent component and does not require a new Pages endpoint in native/web
+runtime transports. A CLI/SDK source merge still needs its normal publication,
+and an existing customer app must be regenerated, checked and published before
+its text changes. Validate the actual generated screens and record every source
+placement's text/link and native checks in the coverage ledger; collection alone
+is not customer acceptance or permission to mark all rows supported.
+
 ### Navigation from top tabs
 
 `navigation-plan.json` records the source navigation kind and the planned target.
@@ -984,6 +1046,43 @@ cannot be inspected: call the builder in your generator and serialize the value
 returns. Run the generator inside the app (after `npm install`), so
 `@wix/himalaya/screens` resolves to the app's own dependency.
 
+### Preserve the template features the source exposes
+
+Treat trimming as a source-feature decision, not a list of screens reached during
+one visitor walkthrough. Before removing a template destination, compare the source
+Account and native widget journeys under the appropriate visitor/member state.
+Keep the supported destination and its data/permission contract when the source
+exposes it. Do not add unrelated verticals merely because the template has them.
+
+| Source feature | Preserve in the generated app |
+| --- | --- |
+| Business identity | Use the collected `business-context.json.displayName` for business identity and bind live chat header/sender/app-info values to the actual business or host state. Preserve the source logo as an image or image binding. Keep the authored app/screen title separate. The technical app slug is an identifier, not a replacement display name. Avoid a global string replacement across source, routes and URLs. |
+| Account Orders and Subscriptions | Retain source-exposed My activity links and their supported `himi_orders` / `himi_my_subscriptions` destinations, including their workers and sign-in/return routing. A visitor gate is not evidence that a member destination should be deleted. Installed services alone do not prove source exposure; compare the source Account. |
+| Programs | Reuse the supported Program card/detail and worker behavior. Preserve access type and the actual login/request/join/pay/Continue action for the visitor or participant state. Do not replace these with an image/title-only card or a generic authenticated Continue. Preserve paid/private policy; do not invoke a live purchase or membership mutation as part of a read-only comparison. |
+| Feed attachments | Reuse the template's rich post card and its `RichContent`/attachment presentation. Preserve inline images, files and their destinations together with text and actions. A text-only replacement is a functional loss even when it can read the post body. |
+
+After applying identity and before claiming completion, run:
+
+```sh
+himi one-app validate-identity --evidence-dir .himi/one-app --content . --json
+```
+
+The command verifies the collected business-name hash, builds the current content,
+and checks emitted screen titles, supported component display fields and the known
+business-chat identity seed for accidental literal slugs. It ignores route IDs,
+URLs and arbitrary API/action values. Exact authored source copy containing the
+slug and a real business whose display name is its slug are preserved. An unrelated
+source page title cannot waive the business-chat identity or its name seed. An older
+collection without a business display name remains unverified; recollect rather
+than editing its evidence or guessing a name.
+
+This is a narrow identity check. It cannot prove every dynamic or translated
+string, branding image, account journey, access policy or attachment is correct.
+Inspect the actual generated descriptors and workers, exercise recorded examples,
+then compare those four source journeys in the real host. Keep their missing
+behavior explicit in coverage and the report. A stock template screenshot or a
+passing identity check cannot substitute for the fresh reconstruction/device pass.
+
 ### Screen-content contract
 
 Use the current [screen design guide](https://apps.wix.com/_api/himi-serve/docs/designing-himi-screens.md) and the app's
@@ -1108,6 +1207,116 @@ configuration, workers, evidence, screenshots or logs.
 
 ## 4. Verify the reconstructed app and publish its draft
 
+### Check the publish budget before final evidence
+
+Plan for the **8,388,608-byte** publish JSON budget before spending time on final
+screenshots, behavioral runs or native UX records. `.himi` file size and source
+directory totals are different measurements: publication carries JSON-escaped
+descriptors, base64 bundles/assets/icon and the compressed source archive together.
+
+First repoint navigation and retained detail/back-link destinations at the implemented
+generated screens, including destination IDs configured in shared workers. Keep every required
+source journey and its shared destinations in `SPEC.md`'s Screen catalogue, including
+cart, checkout, authentication and detail routes. Inspect a trim plan before applying it:
+
+```sh
+himi template trim --from-spec SPEC.md --links follow --dry-run
+```
+
+Review the retained/removed screens, workers and navigation. Trim only unused template
+definitions that the generated screens replace; `--links follow` can retain linked
+destinations that still matter. Review `workerRefs` and `reparented` results, and preserve
+overflow entries and back navigation instead of accepting their deletion. Do not remove a required vertical or drop its actions
+merely to fit. Apply the same reviewed command without `--dry-run`, then measure:
+
+```sh
+himi publish-size --app <intended-publish-slug> --json
+```
+
+This builds locally using the same release payload, source collector and JSON serializer
+as push. It never looks up an owner, claims a slug or publishes; no credentials or final
+UX/attestation records are required. It can write local build output. It reports
+`bodyBytes`, `limit`, `remainingBytes`, `overageBytes`, source archive bytes and screen/
+bundle counts. Failed static record-ID enumeration, missing declared icons/screens/bundles, unavailable font assets, failed declared widgets
+and failed token snapshots are refused instead of undercounted. The builder's optional
+token absence (404) is reported without inventing token bytes; it does not certify styling.
+The default `reserveBytes` is a **65,536-byte planning allowance** for final metadata;
+`planningBytes` includes it. `--reserve-bytes <n>` changes that allowance.
+
+Measurement uses an isolated contained build: put the intended configuration and
+collected static seed IDs in the package explicitly. Host environment substitutions
+are not its input. A source module that needs host code or live catalog enumeration
+is refused as `build_failed`; materialize the verified source IDs from the collection
+before measuring, or report that prerequisite as blocked. Never swallow that refusal
+and treat missing detail screens as saved bytes.
+
+`bodyBytes` is exact for the stated slug, source-included draft and **no publish metadata**.
+The allowance is not a verified upper bound: final label/notes, evidence and migration
+metadata must fit within the remaining bytes. A changed slug changes both app fields;
+`minimumBodyBytes` uses empty slugs and no metadata as a lower bound. If even that exceeds
+the limit, unknown owner metadata cannot rescue the build. A passing size check is
+conditional on those remaining bytes; the final push still measures its exact envelope
+and runs every evidence gate. The push command has no size-only dry run; use the
+measurement command for probes. Transport compression is not evidence that the current push guard accepts
+an oversized JSON body.
+
+Init-generated `.agents/`, `.claude/` and `HIMALAYA.md` are already excluded by the
+source archive policy shown in `himi push --help`.
+Keep source included; do not work around the budget with `--no-source` or `--force`.
+
+For a large static 8-bit PNG icon, lossless recompression is optional. Keep the original and candidate
+under `.himi/` while checking, use no resize, palette reduction, quantization or lossy
+format, and prove decoded RGBA pixels, dimensions and color profile are unchanged before
+replacing the declared icon. For example, with the optional `sharp` image tool installed
+locally (`npm install --prefix .himi/pixel-tools --no-save --package-lock=false sharp@0.33.5`):
+
+```sh
+node --input-type=module - <declared-icon.png> .himi/icon-lossless.png <<'JS'
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { createHash } from 'node:crypto';
+import { resolve } from 'node:path';
+import { readFileSync, statSync } from 'node:fs';
+const sharp = createRequire(resolve('.himi/pixel-tools/tool.cjs'))('sharp');
+const [input, output] = process.argv.slice(2);
+assert.notEqual(resolve(input), resolve(output), 'preserve the original');
+const beforeMeta = await sharp(input).metadata();
+assert.equal(beforeMeta.format, 'png');
+assert.equal(beforeMeta.depth, 'uchar', 'retain higher-precision originals');
+assert.equal(beforeMeta.pages ?? 1, 1, 'retain animated originals');
+const before = await sharp(input).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+await sharp(input).keepMetadata().png({ compressionLevel: 9, adaptiveFiltering: true, palette: false }).toFile(output);
+const afterMeta = await sharp(output).metadata();
+const after = await sharp(output).ensureAlpha().raw().toBuffer({ resolveWithObject: true });
+assert.deepEqual(after.info, before.info);
+assert.deepEqual(afterMeta.icc, beforeMeta.icc);
+assert.equal(afterMeta.orientation ?? 1, beforeMeta.orientation ?? 1);
+assert.ok(after.data.equals(before.data), 'decoded RGBA pixels must match exactly');
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+console.log(JSON.stringify({ pixelsEqual: true, width: after.info.width, height: after.info.height,
+  channels: after.info.channels, beforeBytes: statSync(input).size, afterBytes: statSync(output).size,
+  beforeSHA256: hash(readFileSync(input)), afterSHA256: hash(readFileSync(output)), rgbaSHA256: hash(after.data) }));
+JS
+```
+
+Only copy the candidate over the declared icon if that proof passes and the file is
+smaller. If the tool is unavailable, retain the original and report that optimization
+as unverified. Re-run `himi icon check`, size measurement and affected visual checks
+after replacing it. Save the equality result and original/candidate hashes.
+
+If required journeys still exceed the budget, stop before final evidence and report the
+measured bytes, limit and overage, source archive size, major contributing journeys/
+assets, reviewed trim results, compression/pixel proof, what was tried and what was
+preserved. Attach the numerical output and sanitized manifest/inventory; file sizes can
+explain contributors but never substitute for the assembled measurement. Hand this to
+the migration project owner for the maintained
+[Himalaya issue tracker](https://github.com/wix-private/himalaya/issues) (repository access
+required). If you lack access, return the prepared report to that owner for escalation;
+do not guess a person's contact or claim a hosted preview exists. This step does not
+authorize posting an issue, changing the server limit or publishing.
+
+### Run the final checks
+
 After the source composition and same-site binding are implemented, use the
 existing authoring loop:
 
@@ -1210,9 +1419,8 @@ himi push --draft --target bo
 Keep the editable source archive included. The publish body is limited to 8,388,608
 bytes. It is about base64(source archive + worker bundles + assets + icons) plus the
 descriptor JSON, so a large app can exceed it: one 33-page migration measured
-11,259,935 bytes. Measure early, not at the end: after `himi build`, add up
-`dist/bundles/*`, the icons and a zip of the content directory without the excluded
-paths below. `himi push` refuses an oversized body locally, before it sends anything,
+11,259,935 bytes. Measure early, not at the end, with `himi publish-size` (see
+"Check the publish budget before final evidence"). `himi push` refuses an oversized body locally, before it sends anything,
 with `publish_body_too_large`; its `breakdown`
 gives each part's bytes (`appSource`, `screens`, `bundles`, `assets`, `icon`, `other`)
 and the largest entries by name. Reduce it in this order, and repeat affected