@wix/himalaya-cli 0.1597.0 → 0.1598.0

package/dist/cli.mjs

@@ -1821,7 +1821,7 @@ function sentinelizeIdentity(body, identity) {
   }
   if (identity.name) {
     const re2 = new RegExp(`\\b(${NAME_FIELDS.join("|")})(["']?\\s*[:=]\\s*)(["'])${escapeRe(identity.name)}\\3`, "g");
-    out2 = out2.replace(re2, (_m, key3, sep24, q3) => `${key3}${sep24}${q3}__HIMI_APP_NAME__${q3}`);
+    out2 = out2.replace(re2, (_m, key3, sep26, q3) => `${key3}${sep26}${q3}__HIMI_APP_NAME__${q3}`);
   }
   return out2;
 }
@@ -3339,7 +3339,7 @@ function distJobSpec(req) {
     // not get to answer a per-shell question.
     ...req.provisioningEnv ? { HIMI_DIST_PROVISIONING_ENV: req.provisioningEnv } : {}
   };
-  const command = `dist:${req.platform} ${DIST_PARAMS_FLAG} ${encodeDistParams(envVars)}`;
+  const command = `${req.runner === "linux" ? "linux:" : ""}dist:${req.platform} ${DIST_PARAMS_FLAG} ${encodeDistParams(envVars)}`;
   if (command.length > MAX_COMMAND_CHARS) {
     throw new Error(
       `dist command is ${command.length} chars (cap ${MAX_COMMAND_CHARS}); shrink the job env \u2014 pass large values as a URL the Mac job fetches, as the brand contract does`
@@ -3547,7 +3547,7 @@ var init_dist_jobs = __esm({
     DEFAULT_DIST_SIGNING = "wix-managed";
     WIX_MANAGED_SIGNING_ALIASES = ["wix-managed", "wix", "pool-enterprise"];
     DEFAULT_ANDROID_SIGNING = "qa-keystore";
-    ANDROID_SIGNING_POLICIES = ["qa-keystore", "wix-keystore", "debug", "oneapp-debug"];
+    ANDROID_SIGNING_POLICIES = ["qa-keystore", "wix-keystore", "debug", "oneapp-debug", "unsigned"];
     ANDROID_SIGNING_ALIASES = {
       // The canonical spellings, derived so the two lists cannot drift apart.
       ...Object.fromEntries(ANDROID_SIGNING_POLICIES.map((p2) => [p2, p2])),
@@ -3556,7 +3556,9 @@ var init_dist_jobs = __esm({
       wix: "wix-keystore",
       oneapp: "wix-keystore",
       "one-app-debug": "oneapp-debug",
-      oneappdebug: "oneapp-debug"
+      oneappdebug: "oneapp-debug",
+      // The CLI's word for an owner bundle. `unsigned` is the fact about the file, which the pool reports.
+      owner: "unsigned"
     };
     DEFAULT_ANDROID_FORMAT = "apk";
     ANDROID_FORMATS = ["apk", "aab"];
@@ -3595,8 +3597,8 @@ function committedProvisioningPath(name) {
 function committedShellFor(path2) {
   const normalized = path2.replace(/\\/g, "/");
   return SHELL_NAMES.find((name) => {
-    const relative26 = committedProvisioningPath(name);
-    return normalized === relative26 || normalized.endsWith(`/${relative26}`);
+    const relative27 = committedProvisioningPath(name);
+    return normalized === relative27 || normalized.endsWith(`/${relative27}`);
   });
 }
 function isBrandable(repoRoot2, name) {
@@ -4993,8 +4995,8 @@ var init_catalog_cache = __esm({
 
 // ../authoring-kit/ensure-authoring-client.mjs
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync5, readdirSync as readdirSync4, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
-import { basename as basename2, dirname as dirname6, join as join7, resolve as resolve4 } from "node:path";
+import { existsSync as existsSync5, lstatSync as lstatSync3, mkdirSync as mkdirSync4, readdirSync as readdirSync4, readFileSync as readFileSync6, renameSync as renameSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { basename as basename2, dirname as dirname6, join as join7, relative, resolve as resolve4, sep as sep3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function aggregatesStamp(root = REPO) {
   return resolve4(root, "tools/authoring-kit/aggregates.stamp.json");
@@ -5063,7 +5065,7 @@ __export(guides_exports, {
   withReferenceCache: () => withReferenceCache,
   writeAgentContext: () => writeAgentContext
 });
-import { readFileSync as readFileSync7, existsSync as existsSync6, mkdirSync as mkdirSync4, writeFileSync as writeFileSync5, lstatSync as lstatSync3, readdirSync as readdirSync5, renameSync as renameSync3, rmdirSync } from "node:fs";
+import { readFileSync as readFileSync7, existsSync as existsSync6, mkdirSync as mkdirSync5, writeFileSync as writeFileSync5, lstatSync as lstatSync4, readdirSync as readdirSync5, renameSync as renameSync3, rmdirSync } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { dirname as dirname7, join as join8, resolve as resolve5 } from "node:path";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -5283,8 +5285,8 @@ function removeLegacyRootCopies(targetDir) {
   for (const rel of legacy) {
     const p2 = linkFreeTarget(targetDir, rel);
     const dest = linkFreeTarget(targetDir, `.himi/legacy-agent-files/${rel}`);
-    if (p2 && dest && existsSync6(p2) && lstatSync3(p2).isFile()) {
-      mkdirSync4(dirname7(dest), { recursive: true });
+    if (p2 && dest && existsSync6(p2) && lstatSync4(p2).isFile()) {
+      mkdirSync5(dirname7(dest), { recursive: true });
       renameSync3(p2, existsSync6(dest) ? `${dest}.${Date.now()}` : dest);
       removed.push(rel);
     }
@@ -5298,7 +5300,7 @@ function linkFreeTarget(dir, rel) {
   for (const part4 of rel.split(/[\\/]+/).filter(Boolean)) {
     at2 = join8(at2, part4);
     try {
-      if (lstatSync3(at2).isSymbolicLink()) return null;
+      if (lstatSync4(at2).isSymbolicLink()) return null;
     } catch (e2) {
       if (e2.code === "ENOENT") break;
       return null;
@@ -5327,20 +5329,20 @@ function writeAgentContext(targetDir, opts = {}) {
   const write2 = (rel, body) => {
     const p2 = target(rel);
     if (!p2) return;
-    mkdirSync4(dirname7(p2), { recursive: true });
+    mkdirSync5(dirname7(p2), { recursive: true });
     writeFileSync5(p2, body);
     files.push(rel);
   };
   const copy = (srcRel, destRel) => {
     const p2 = target(destRel);
     if (!p2) return;
-    mkdirSync4(dirname7(p2), { recursive: true });
+    mkdirSync5(dirname7(p2), { recursive: true });
     writeFileSync5(p2, readReference(srcRel));
     files.push(destRel);
   };
   const writeIfMissing = (rel, body) => {
     try {
-      lstatSync3(join8(targetDir, rel));
+      lstatSync4(join8(targetDir, rel));
       return;
     } catch {
       write2(rel, body);
@@ -6761,9 +6763,9 @@ function compileV2(html, profile, options) {
       if (!row2) error(el2, "HHP-BINDING-SCOPE", "Item bindings require a keyed list template.");
       return raw;
     }
-    const relative26 = statePath(raw);
-    if (!info4?.paths.has(relative26)) error(el2, "HHP-BINDING-PATH", `Unknown controller state path ${relative26}.`);
-    return `$service:${serviceName}.${relative26}`;
+    const relative27 = statePath(raw);
+    if (!info4?.paths.has(relative27)) error(el2, "HHP-BINDING-PATH", `Unknown controller state path ${relative27}.`);
+    return `$service:${serviceName}.${relative27}`;
   }
   const read = (value2, dotted) => dotted.split(".").reduce((current, key3) => current && typeof current === "object" && Object.hasOwn(current, key3) ? current[key3] : void 0, value2);
   function rowValues(row2, raw) {
@@ -7403,8 +7405,8 @@ __export(progress_exports, {
 import { spawn } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { appendFileSync, closeSync, existsSync as existsSync7, lstatSync as lstatSync4, mkdirSync as mkdirSync5, openSync, readdirSync as readdirSync6, readFileSync as readFileSync9, readSync, renameSync as renameSync4, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "node:fs";
-import { isAbsolute, join as join9, relative, resolve as resolve6, sep as sep3 } from "node:path";
+import { appendFileSync, closeSync, existsSync as existsSync7, lstatSync as lstatSync5, mkdirSync as mkdirSync6, openSync, readdirSync as readdirSync6, readFileSync as readFileSync9, readSync, renameSync as renameSync4, rmSync as rmSync3, statSync as statSync2, writeFileSync as writeFileSync6 } from "node:fs";
+import { isAbsolute, join as join9, relative as relative2, resolve as resolve6, sep as sep4 } from "node:path";
 function agentCovers(agent, cli) {
   if (isCliEntry(agent)) return false;
   const agentShas = shasOf(agent.images);
@@ -7458,11 +7460,11 @@ function realDirIn(dir, rel) {
   for (const part4 of rel.split(/[\\/]+/).filter(Boolean)) {
     at2 = join9(at2, part4);
     try {
-      if (!lstatSync4(at2).isDirectory()) return null;
+      if (!lstatSync5(at2).isDirectory()) return null;
     } catch (e2) {
       if (e2.code !== "ENOENT") return null;
-      mkdirSync5(at2);
-      if (!lstatSync4(at2).isDirectory()) return null;
+      mkdirSync6(at2);
+      if (!lstatSync5(at2).isDirectory()) return null;
     }
   }
   return at2;
@@ -7479,7 +7481,7 @@ function writeFileAtomic(file2, content) {
 }
 function isSymlink(file2) {
   try {
-    return lstatSync4(file2).isSymbolicLink();
+    return lstatSync5(file2).isSymbolicLink();
   } catch {
     return false;
   }
@@ -7521,7 +7523,7 @@ function appendProgress(dir, input) {
   return entry;
 }
 function packageRelative(dir, p2) {
-  const rel = relative(dir, resolve6(p2));
+  const rel = relative2(dir, resolve6(p2));
   return rel && !rel.startsWith("..") && !isAbsolute(rel) ? toPosix(rel) : null;
 }
 function endsWithNewline(file2) {
@@ -7683,7 +7685,7 @@ function carryPlanningJournal(parentDir, appDir3) {
   if (existsSync7(join9(parentDir, "himalaya.content.json"))) return [];
   const src = join9(parentDir, ".himi");
   try {
-    if (!lstatSync4(src).isDirectory()) return [];
+    if (!lstatSync5(src).isDirectory()) return [];
   } catch {
     return [];
   }
@@ -7700,12 +7702,12 @@ function carryPlanningJournal(parentDir, appDir3) {
     const hist = join9(parentDir, HISTORY_DIR);
     let names2 = [];
     try {
-      if (lstatSync4(hist).isDirectory()) names2 = readdirSync6(hist);
+      if (lstatSync5(hist).isDirectory()) names2 = readdirSync6(hist);
     } catch {
     }
     for (const name of names2) {
       const from = join9(hist, name);
-      if (isSymlink(from) || !lstatSync4(from).isFile()) continue;
+      if (isSymlink(from) || !lstatSync5(from).isFile()) continue;
       const bytes2 = readFileSync9(from);
       archiveBytes(appDir3, bytes2);
     }
@@ -7717,7 +7719,7 @@ function formatBrief(input) {
   const who = `himi \u2014 ${input.appName ?? "this folder"}`;
   const lines = [];
   if (!summary2.count) {
-    lines.push(`${who}: no journey journal yet (${PROGRESS_FILE.split(sep3).join("/")}).`);
+    lines.push(`${who}: no journey journal yet (${PROGRESS_FILE.split(sep4).join("/")}).`);
     lines.push(
       'A new app starts with discovery (step 1). An app built before journaling existed continues from its current state instead: confirm with the customer that its SPEC.md was approved rather than re-running discovery. Either way, journal each milestone with `himi progress "<what changed>" --step <n>` so the next session can pick up from it.'
     );
@@ -7799,7 +7801,7 @@ function appLabel(dir) {
 }
 function journalPath(dir) {
   const abs = join9(dir, PROGRESS_FILE);
-  const rel = relative(process.cwd(), abs);
+  const rel = relative2(process.cwd(), abs);
   return rel && !rel.startsWith("..") ? rel : abs;
 }
 var JOURNEY_STEPS, CLI_AUTHOR, AUTO_MILESTONES, MILESTONE_STEP, AGENT_WINS_WITHIN_MS, isCliEntry, shasOf, PROGRESS_FILE, HISTORY_DIR, APPROVALS_FILE, APPROVAL_GATES, MAX_MESSAGE_CHARS, MAX_IMAGE_BYTES, ProgressError, toPosix, UnsafeHimiDirError, SECRET_SHAPES, looksSecret, REF_SHAPE, gateLabel, minute, NOTIFY_TIMEOUT_MS;
@@ -7833,7 +7835,7 @@ var init_progress = __esm({
         this.code = code;
       }
     };
-    toPosix = (p2) => p2.split(sep3).join("/");
+    toPosix = (p2) => p2.split(sep4).join("/");
     UnsafeHimiDirError = class extends Error {
       constructor(rel) {
         super(`${rel} is not a real directory inside the content package (a symlink?) \u2014 refusing to write through it`);
@@ -8520,7 +8522,7 @@ var init_run_identity = __esm({
 
 // src/mcp/preview.ts
 import { spawn as nodeSpawn } from "node:child_process";
-import { closeSync as closeSync2, constants as fsc, existsSync as existsSync8, lstatSync as lstatSync5, mkdirSync as mkdirSync6, openSync as openSync2, readFileSync as readFileSync10, rmSync as rmSync4 } from "node:fs";
+import { closeSync as closeSync2, constants as fsc, existsSync as existsSync8, lstatSync as lstatSync6, mkdirSync as mkdirSync7, openSync as openSync2, readFileSync as readFileSync10, rmSync as rmSync4 } from "node:fs";
 import { createServer } from "node:net";
 import { basename as basename3, join as join10 } from "node:path";
 function previewPortFor(appName2) {
@@ -8570,14 +8572,14 @@ async function recordState(dir, r3, deps) {
 }
 function openPreviewLog(dir, name = "preview.log") {
   const himiDir2 = join10(dir, ".himi");
-  if (existsSync8(himiDir2) && !lstatSync5(himiDir2).isDirectory()) {
+  if (existsSync8(himiDir2) && !lstatSync6(himiDir2).isDirectory()) {
     throw new PreviewStartError(`${himiDir2} is not a real directory (a symlink?) \u2014 refusing to write the preview log through it`, "");
   }
-  mkdirSync6(himiDir2, { recursive: true });
+  mkdirSync7(himiDir2, { recursive: true });
   const path2 = join10(himiDir2, name);
   let existing;
   try {
-    existing = lstatSync5(path2);
+    existing = lstatSync6(path2);
   } catch {
   }
   if (existing?.isDirectory()) {
@@ -8745,7 +8747,7 @@ var init_preview = __esm({
 });
 
 // src/mcp/client-configs.ts
-import { dirname as dirname8, relative as relative2, resolve as resolve8, sep as sep4 } from "node:path";
+import { dirname as dirname8, relative as relative3, resolve as resolve8, sep as sep5 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function sourceCheckout(moduleUrl = import.meta.url) {
   if (!moduleUrl.endsWith(".ts")) return null;
@@ -8843,8 +8845,8 @@ var init_client_configs = __esm({
     NPM_PACKAGE = HIMI_NPM_PACKAGE;
     HERE2 = dirname8(fileURLToPath5(import.meta.url));
     inside = (child, parent) => {
-      const rel = relative2(parent, child);
-      return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep4) && !/^[A-Za-z]:/.test(rel);
+      const rel = relative3(parent, child);
+      return rel === "" || !rel.startsWith("..") && !rel.startsWith(sep5) && !/^[A-Za-z]:/.test(rel);
     };
     same = (a2, b2) => JSON.stringify(a2) === JSON.stringify(b2);
     out = (o2) => `${JSON.stringify(o2, null, 2)}
@@ -8875,7 +8877,7 @@ __export(agent_context_exports, {
   withoutBlock: () => withoutBlock,
   writeAgentLayer: () => writeAgentLayer
 });
-import { existsSync as existsSync9, lstatSync as lstatSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync11, realpathSync as realpathSync2, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync9, lstatSync as lstatSync7, mkdirSync as mkdirSync8, readFileSync as readFileSync11, realpathSync as realpathSync2, writeFileSync as writeFileSync7 } from "node:fs";
 import { dirname as dirname9, join as join11 } from "node:path";
 function beginMarker(version5) {
   return `${BLOCK_BEGIN} v=${version5} \u2014 written by \`himi agent-init\`; edit OUTSIDE this block, it is replaced on refresh -->`;
@@ -8962,7 +8964,7 @@ perform the step. Reading the pages of a site the customer already published nee
 }
 function claudeLinksToAgents(dir) {
   try {
-    if (!lstatSync6(join11(dir, "CLAUDE.md")).isSymbolicLink()) return false;
+    if (!lstatSync7(join11(dir, "CLAUDE.md")).isSymbolicLink()) return false;
     return realpathSync2(join11(dir, "CLAUDE.md")) === realpathSync2(join11(dir, "AGENTS.md"));
   } catch {
     return false;
@@ -9052,7 +9054,7 @@ function writeAgentLayer(dir, opts) {
       skipped.push({ file: posix(rel), reason: LINKED_PATH_REASON });
       return;
     }
-    mkdirSync7(dirname9(p2), { recursive: true });
+    mkdirSync8(dirname9(p2), { recursive: true });
     if (readOrNull(p2) !== body) writeFileSync7(p2, body);
     files.push(posix(rel));
   };
@@ -9225,8 +9227,8 @@ __export(build_lib_exports, {
   umbrellaRewritePlugin: () => umbrellaRewritePlugin
 });
 import { fileURLToPath as fileURLToPath6, pathToFileURL } from "node:url";
-import { basename as basename4, dirname as dirname10, join as join12, resolve as resolve9, sep as sep5 } from "node:path";
-import { readdirSync as readdirSync7, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync3, writeFileSync as writeFileSync8 } from "node:fs";
+import { basename as basename4, dirname as dirname10, join as join12, resolve as resolve9, sep as sep6 } from "node:path";
+import { readdirSync as readdirSync7, existsSync as existsSync10, mkdirSync as mkdirSync9, readFileSync as readFileSync12, realpathSync as realpathSync3, statSync as statSync3, writeFileSync as writeFileSync8 } from "node:fs";
 async function loadCompiler() {
   try {
     const nativeCompiler = ["es", "build"].join("");
@@ -9273,7 +9275,7 @@ function realpathOrSelf(p2) {
   }
 }
 function isUnder(p2, root) {
-  return p2 === root || p2.startsWith(root + sep5);
+  return p2 === root || p2.startsWith(root + sep6);
 }
 function confinementRoots(contentRoot2) {
   const roots2 = /* @__PURE__ */ new Set();
@@ -9563,7 +9565,7 @@ function tsExtResolvePlugin() {
 }
 function importMetaUrlPlugin({ scope: scope2 } = {}) {
   const scopes = scope2 ? [.../* @__PURE__ */ new Set([realpathOrSelf(scope2), resolve9(scope2)])] : [];
-  const inScope = (p2) => scopes.some((r3) => p2 === r3 || p2.startsWith(r3 + sep5));
+  const inScope = (p2) => scopes.some((r3) => p2 === r3 || p2.startsWith(r3 + sep6));
   return {
     name: "himalaya-import-meta-url",
     setup(b2) {
@@ -9624,7 +9626,7 @@ async function buildBundle(name, opts = {}) {
     } catch {
     }
     if (same3) continue;
-    mkdirSync8(dirname10(file2.path), { recursive: true });
+    mkdirSync9(dirname10(file2.path), { recursive: true });
     writeFileSync8(file2.path, file2.contents);
   }
   return name;
@@ -10276,7 +10278,7 @@ var init_tier5_dir = __esm({
 
 // src/tier5-typecheck.ts
 import { existsSync as existsSync11, readFileSync as readFileSync13 } from "node:fs";
-import { relative as relative3, resolve as resolve11, sep as sep6 } from "node:path";
+import { relative as relative4, resolve as resolve11, sep as sep7 } from "node:path";
 import { pathToFileURL as pathToFileURL2 } from "node:url";
 async function loadTypeScript() {
   const runtime = process.env.HIMI_AUTHORING_RUNTIME_DIR;
@@ -10315,7 +10317,7 @@ function pathsFor(options) {
   return declarationPaths(options.umbrellaDir);
 }
 function relativeFile(contentDir2, fileName) {
-  return relative3(contentDir2, fileName).split(sep6).join("/");
+  return relative4(contentDir2, fileName).split(sep7).join("/");
 }
 function belongsToContentWorkers(contentDir2, diagnostic) {
   if (!diagnostic.file) return true;
@@ -10501,8 +10503,8 @@ var init_provisioning_facts = __esm({
 
 // ../../core/dev-server/src/app-assets.ts
 import { createHash as createHash6 } from "node:crypto";
-import { existsSync as existsSync12, lstatSync as lstatSync7, readFileSync as readFileSync15, readdirSync as readdirSync9, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
-import { join as join13, resolve as resolve13, sep as sep7 } from "node:path";
+import { existsSync as existsSync12, lstatSync as lstatSync8, readFileSync as readFileSync15, readdirSync as readdirSync9, realpathSync as realpathSync4, statSync as statSync4 } from "node:fs";
+import { join as join13, resolve as resolve13, sep as sep8 } from "node:path";
 function contentTypeFor(name) {
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
   return CONTENT_TYPES[ext] ?? "application/octet-stream";
@@ -10523,7 +10525,7 @@ function findAssetsDir(appDir3) {
   const rel = typeof declared === "string" && declared ? declared : "assets";
   const abs = resolve13(appDir3, rel);
   const base = resolve13(appDir3);
-  if (abs !== base && !abs.startsWith(base + sep7)) return null;
+  if (abs !== base && !abs.startsWith(base + sep8)) return null;
   return existsSync12(abs) && statSync4(abs).isDirectory() ? abs : null;
 }
 function readOtaOnlyPatterns(appDir3) {
@@ -10579,9 +10581,9 @@ function collectBrandFonts(appDir3) {
     if (rel.startsWith("/") || rel.split("/").includes("..")) continue;
     const path2 = join13(appDir3, rel);
     try {
-      if (!lstatSync7(path2).isFile()) continue;
+      if (!lstatSync8(path2).isFile()) continue;
       const root = realpathSync4(appDir3);
-      if (!realpathSync4(path2).startsWith(root + sep7)) continue;
+      if (!realpathSync4(path2).startsWith(root + sep8)) continue;
     } catch {
       continue;
     }
@@ -15701,8 +15703,8 @@ function textOf(node) {
 function plainText(node) {
   if (typeOf2(node) === "TEXT") return str(at(node, "textData", "text"));
   const children = kids(node).filter(isObj);
-  const sep24 = children.every((c2) => typeOf2(c2) === "TEXT") ? "" : "\n";
-  return children.map(plainText).join(sep24);
+  const sep26 = children.every((c2) => typeOf2(c2) === "TEXT") ? "" : "\n";
+  return children.map(plainText).join(sep26);
 }
 function alignOf(v2) {
   switch (v2) {
@@ -21588,16 +21590,83 @@ var init_contained_dev_module = __esm({
 // ../authoring-kit/ensure-templates.mjs
 import { spawnSync as spawnSync3 } from "node:child_process";
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync16, readdirSync as readdirSync11, renameSync as renameSync5, rmSync as rmSync5, rmdirSync as rmdirSync2, statSync as statSync5, writeFileSync as writeFileSync9 } from "node:fs";
-import { dirname as dirname11, join as join14, relative as relative4, resolve as resolve15 } from "node:path";
+import { existsSync as existsSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync10, readFileSync as readFileSync16, readdirSync as readdirSync11, renameSync as renameSync5, rmSync as rmSync5, rmdirSync as rmdirSync2, statSync as statSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import { dirname as dirname11, isAbsolute as isAbsolute2, join as join14, relative as relative5, resolve as resolve15, sep as sep9 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
+function generationBase(outRoot) {
+  const out2 = resolve15(outRoot);
+  const tree = join14(sep9, TEMPLATES_REL);
+  return out2.endsWith(tree) ? join14(out2.slice(0, -tree.length), GENERATION_REL, "templates") : out2;
+}
 function stampPath(outRoot) {
-  return `${outRoot}.stamp.json`;
+  return `${generationBase(outRoot)}.stamp.json`;
 }
 function head(root) {
   const r3 = spawnSync3("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" });
   return r3.status === 0 ? r3.stdout.trim() : null;
 }
+function isLink(path2) {
+  try {
+    return lstatSync9(path2).isSymbolicLink();
+  } catch (e2) {
+    if (e2.code === "ENOENT" || e2.code === "ENOTDIR") return false;
+    throw e2;
+  }
+}
+function replaceLinkedRoot(path2, root = REPO2) {
+  const out2 = resolve15(path2);
+  const rel = relative5(root, out2);
+  const outside = rel === ".." || rel.startsWith(`..${sep9}`) || isAbsolute2(rel);
+  if (!outside && rel.split(sep9)[0] !== "node_modules") {
+    for (let dir = dirname11(out2); dir !== root; dir = dirname11(dir)) {
+      if (isLink(dir)) throw new Error(`${relative5(root, dir)} is a symlink: refusing to generate ${rel} through it`);
+    }
+  }
+  if (isLink(out2)) rmSync5(out2);
+}
+function sweepLegacyGeneration(out2) {
+  rmSync5(`${out2}.stamp.json`, { force: true });
+  const lock = `${out2}.lock`;
+  let held = false;
+  try {
+    held = lockAlive(lock, readOwner(lock));
+  } catch {
+  }
+  if (!held) rmSync5(lock, { recursive: true, force: true });
+  const mutex = `${lock}.takeover`;
+  try {
+    if (isLink(mutex) || Date.now() - statSync5(mutex).mtimeMs > PIDLESS_LOCK_GRACE_MS) rmSync5(mutex, { recursive: true, force: true });
+  } catch {
+  }
+  const staging = `${out2}.staging`;
+  if (isLink(staging)) return void rmSync5(staging);
+  let staged;
+  try {
+    staged = readdirSync11(staging);
+  } catch {
+    return;
+  }
+  for (const name of staged) {
+    const run2 = /\.build-(\d+)$/.exec(name);
+    if (run2 && processAlive(Number(run2[1]))) continue;
+    rmSync5(join14(staging, name), { recursive: true, force: true });
+  }
+  try {
+    rmdirSync2(staging);
+  } catch (e2) {
+    if (!["ENOENT", "ENOTEMPTY", "EEXIST"].includes(e2.code)) throw e2;
+  }
+}
+function prepareGeneration(outRoot, root = REPO2) {
+  const out2 = resolve15(outRoot);
+  replaceLinkedRoot(out2, root);
+  const real = generationBase(out2) !== out2;
+  if (real) replaceLinkedRoot(dirname11(generationBase(out2)), root);
+  for (const path2 of [stagingRoot(out2), lockPath(out2), `${lockPath(out2)}.takeover`, stampPath(out2)]) {
+    if (isLink(path2)) rmSync5(path2);
+  }
+  if (real) sweepLegacyGeneration(out2);
+}
 function templatesReady(root = REPO2) {
   const out2 = resolve15(root, TEMPLATES_REL);
   if (!existsSync15(out2) || !existsSync15(stampPath(out2))) return false;
@@ -21610,8 +21679,11 @@ function templatesReady(root = REPO2) {
   const now = head(root);
   return now === null || stamp.head === now;
 }
+function stagingRoot(outRoot) {
+  return `${generationBase(outRoot)}.staging`;
+}
 function lockPath(outRoot) {
-  return `${outRoot}.lock`;
+  return `${generationBase(outRoot)}.lock`;
 }
 function processAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -21637,7 +21709,7 @@ function lockAlive(lock, owner) {
 function tryLock(lock, token) {
   for (; ; ) {
     try {
-      mkdirSync9(lock);
+      mkdirSync10(lock);
       writeFileSync9(join14(lock, "pid"), token);
       return true;
     } catch (e2) {
@@ -21653,7 +21725,7 @@ function tryLock(lock, token) {
     if (alive) return false;
     const mutex = `${lock}.takeover`;
     try {
-      mkdirSync9(mutex);
+      mkdirSync10(mutex);
     } catch (e2) {
       if (e2.code !== "EEXIST") throw e2;
       try {
@@ -21687,7 +21759,7 @@ ${randomUUID3()}`;
   let waited = false;
   while (!tryLock(lock, token)) {
     if (Date.now() > deadline) {
-      throw new Error(`another process has held ${relative4(root, lock)} for over ${Math.round(waitMs / 1e3)}s \u2014 remove it if no generation is running`);
+      throw new Error(`another process has held ${relative5(root, lock)} for over ${Math.round(waitMs / 1e3)}s \u2014 remove it if no generation is running`);
     }
     waited = true;
     sleepSync(LOCK_POLL_MS);
@@ -21706,8 +21778,9 @@ function ensureTemplates({
   if (env[TEMPLATES_FRESH]) return false;
   if (!refresh && templatesReady(root)) return false;
   const out2 = resolve15(root, TEMPLATES_REL);
-  mkdirSync9(dirname11(out2), { recursive: true });
+  prepareGeneration(out2, root);
   const lock = lockPath(out2);
+  mkdirSync10(dirname11(lock), { recursive: true });
   const { token, waited } = acquireLock(lock, { root, waitMs });
   try {
     if (waited && templatesReady(root)) return false;
@@ -21729,12 +21802,13 @@ ${(r3.stderr || r3.stdout || "").trim()}`);
     releaseLock(lock, token);
   }
 }
-var REPO2, TEMPLATES_REL, GENERATOR, TEMPLATES_FRESH, PIDLESS_LOCK_GRACE_MS, LOCK_POLL_MS, isMain;
+var REPO2, TEMPLATES_REL, GENERATION_REL, GENERATOR, TEMPLATES_FRESH, PIDLESS_LOCK_GRACE_MS, LOCK_POLL_MS, isMain;
 var init_ensure_templates = __esm({
   "../authoring-kit/ensure-templates.mjs"() {
     init_define_HHP_CATALOG();
     REPO2 = resolve15(dirname11(fileURLToPath9(import.meta.url)), "../..");
     TEMPLATES_REL = "tools/himi-cli/templates";
+    GENERATION_REL = "tools/.himi-templates";
     GENERATOR = "tools/authoring-kit/gen-templates.mts";
     TEMPLATES_FRESH = "HIMI_TEMPLATES_FRESH";
     PIDLESS_LOCK_GRACE_MS = 3e4;
@@ -21754,8 +21828,8 @@ var init_ensure_templates = __esm({
 
 // ../../core/dev-server/tier5-bundles-src/ensure-bundles.mjs
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync16, mkdirSync as mkdirSync10, readFileSync as readFileSync17, rmSync as rmSync6 } from "node:fs";
-import { dirname as dirname12, relative as relative5, resolve as resolve16 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync11, readFileSync as readFileSync17, rmSync as rmSync6 } from "node:fs";
+import { dirname as dirname12, relative as relative6, resolve as resolve16 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 function head2(root) {
   const r3 = spawnSync4("git", ["rev-parse", "HEAD"], { cwd: root, encoding: "utf8" });
@@ -21785,7 +21859,7 @@ function ensureBundles({
   if (!existsSync16(resolve16(root, GENERATOR2))) return false;
   if (!refresh && bundlesReady(root)) return false;
   const out2 = resolve16(root, BUNDLES_REL);
-  mkdirSync10(dirname12(out2), { recursive: true });
+  mkdirSync11(dirname12(out2), { recursive: true });
   const lock = lockPath(out2);
   const { token, waited } = acquireLock(lock, { root, waitMs });
   try {
@@ -21803,7 +21877,7 @@ function ensureBundles({
 ${(r3.stderr || r3.stdout || "").trim()}`);
     }
     if (!existsSync16(stampPath(out2))) {
-      throw new Error(`${GENERATOR2} exited 0 but did not record a complete build in ${relative5(root, stampPath(out2))}`);
+      throw new Error(`${GENERATOR2} exited 0 but did not record a complete build in ${relative6(root, stampPath(out2))}`);
     }
     return true;
   } finally {
@@ -21851,7 +21925,7 @@ __export(loader_exports, {
 });
 import { resolve as resolve17, basename as basename7, dirname as dirname13 } from "node:path";
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { existsSync as existsSync17, readdirSync as readdirSync12, readFileSync as readFileSync18, mkdirSync as mkdirSync11, rmSync as rmSync7 } from "node:fs";
+import { existsSync as existsSync17, readdirSync as readdirSync12, readFileSync as readFileSync18, mkdirSync as mkdirSync12, rmSync as rmSync7 } from "node:fs";
 import { pathToFileURL as pathToFileURL3, fileURLToPath as fileURLToPath11 } from "node:url";
 function resolveWixWebAuthConfig(app) {
   const auth = app?.meta.auth;
@@ -21894,7 +21968,7 @@ async function devModuleUrl(entry, dir, fresh = false, sourceCopy = false) {
   const direct = !isOffRepo() && hasTypeScriptLoader;
   if (direct && !fresh && !sourceCopy) return { url: pathToFileURL3(entry).href };
   const out2 = resolve17(dir, sourceCopy ? `dist/.himi/dev-source-${randomUUID4()}.mjs` : fresh ? `dist/.himi/dev-${process.pid}-${++freshLoads}.mjs` : "dist/.himi/dev.mjs");
-  mkdirSync11(dirname13(out2), { recursive: true });
+  mkdirSync12(dirname13(out2), { recursive: true });
   const buildOptions2 = direct ? { confineTo: dir } : {
     // Plain Node must resolve the published-style umbrella entry points for
     // both standalone and in-repo CLI content. In-repo workspace packages
@@ -22697,7 +22771,7 @@ __export(config_exports2, {
   serializeRolloutYaml: () => serializeRolloutYaml,
   validateOverlayPatch: () => validateOverlayPatch
 });
-import { mkdirSync as mkdirSync12, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "node:fs";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync10 } from "node:fs";
 import { dirname as dirname14, join as join15, resolve as resolve18 } from "node:path";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 function strip(line) {
@@ -22825,7 +22899,7 @@ function readJsonAt(app, file2, root) {
 }
 function writeJsonAt(app, file2, root, value2) {
   const path2 = appConfigPath(app, file2, root);
-  mkdirSync12(dirname14(path2), { recursive: true });
+  mkdirSync13(dirname14(path2), { recursive: true });
   writeFileSync10(path2, JSON.stringify(value2, null, 2) + "\n");
   return path2;
 }
@@ -23272,19 +23346,19 @@ var init_hhp_command = __esm({
 });
 
 // src/hhp.ts
-import { existsSync as existsSync20, readFileSync as readFileSync21, writeFileSync as writeFileSync11, mkdirSync as mkdirSync13, renameSync as renameSync6, rmSync as rmSync8, lstatSync as lstatSync8, readdirSync as readdirSync14 } from "node:fs";
-import { basename as basename8, dirname as dirname16, resolve as resolve21, relative as relative6, sep as sep8, join as join17 } from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync21, writeFileSync as writeFileSync11, mkdirSync as mkdirSync14, renameSync as renameSync6, rmSync as rmSync8, lstatSync as lstatSync10, readdirSync as readdirSync14 } from "node:fs";
+import { basename as basename8, dirname as dirname16, resolve as resolve21, relative as relative7, sep as sep10, join as join17 } from "node:path";
 import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
 import ts3 from "typescript";
 function localPath(root, path2, from = join17(root, "hhp.json")) {
   if (/^[a-z]+:|^\/\//i.test(path2)) throw new Error("HHP source dependencies must be local files.");
-  const target = resolve21(dirname16(from), path2), rel = relative6(resolve21(root), target);
-  if (rel.startsWith(`..${sep8}`) || rel === ".." || !rel || target === resolve21(root)) throw new Error("HHP source path escapes the app.");
-  const components2 = rel.split(sep8);
+  const target = resolve21(dirname16(from), path2), rel = relative7(resolve21(root), target);
+  if (rel.startsWith(`..${sep10}`) || rel === ".." || !rel || target === resolve21(root)) throw new Error("HHP source path escapes the app.");
+  const components2 = rel.split(sep10);
   let current = resolve21(root);
   for (const component of components2) {
     current = join17(current, component);
-    if (existsSync20(current) && lstatSync8(current).isSymbolicLink()) throw new Error("HHP paths cannot traverse symlinks.");
+    if (existsSync20(current) && lstatSync10(current).isSymbolicLink()) throw new Error("HHP paths cannot traverse symlinks.");
   }
   return target;
 }
@@ -23417,13 +23491,13 @@ async function compileContentHhp(root, opts = {}) {
     for (const dependency of result2.dependencies.filter((f2) => /\.tsx?$/.test(f2))) inspect2(dependency);
     result2.manifest.requiredCapabilities = [...requiredCapabilities2].sort();
     outputs.set(`dev/hhp/${id}.descriptor.json`, JSON.stringify(result2.descriptor, null, 2) + "\n");
-    outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative6(root, node.file).split(sep8).join("/") }])) }, null, 2) + "\n");
+    outputs.set(`dev/hhp/${id}.map.json`, JSON.stringify({ ...result2.manifest, nodes: Object.fromEntries(Object.entries(result2.sourceMap).map(([key3, node]) => [key3, { ...node, file: relative7(root, node.file).split(sep10).join("/") }])) }, null, 2) + "\n");
     if (result2.worker && result2.bundleName) {
       if (results.some((r3) => r3 !== result2 && r3.bundleName === result2.bundleName)) diagnostics.push({ code: "HHP-BUNDLE-ID", severity: "error", file: file2, line: 1, column: 1, message: "Screen ids normalize to the same bundle name." });
       const workerRel = `tier5-src/${result2.bundleName}/index.ts`;
       let worker = result2.worker;
       for (const dependency of result2.dependencies.filter((f2) => /\.(controller|service)\.tsx?$/.test(f2)))
-        worker = worker.replace(JSON.stringify(dependency), JSON.stringify(relative6(dirname16(join17(root, workerRel)), dependency).split(sep8).join("/").replace(/\.tsx?$/, ".js")));
+        worker = worker.replace(JSON.stringify(dependency), JSON.stringify(relative7(dirname16(join17(root, workerRel)), dependency).split(sep10).join("/").replace(/\.tsx?$/, ".js")));
       outputs.set(workerRel, worker);
     }
   }
@@ -23477,13 +23551,13 @@ async function compileContentHhp(root, opts = {}) {
   for (const [path2, png] of rasters) {
     if (!png) continue;
     if (existsExact(path2) && readFileSync21(path2).equals(png)) continue;
-    mkdirSync13(dirname16(path2), { recursive: true });
+    mkdirSync14(dirname16(path2), { recursive: true });
     writeFileSync11(`${path2}.tmp`, png);
     rmSync8(path2, { force: true });
     renameSync6(`${path2}.tmp`, path2);
   }
   const target = localPath(root, "dev/hhp"), stage = localPath(root, `dev/.hhp-${randomUUID5()}`), backup = `${stage}-old`;
-  mkdirSync13(stage, { recursive: true });
+  mkdirSync14(stage, { recursive: true });
   try {
     for (const [rel, source] of outputs) if (rel.startsWith("dev/hhp/")) writeFileSync11(join17(stage, rel.slice(8)), source);
     const workers = [...outputs].filter(([rel]) => rel.startsWith("tier5-src/"));
@@ -23496,7 +23570,7 @@ async function compileContentHhp(root, opts = {}) {
     try {
       for (const [rel, source] of workers) {
         const path2 = localPath(root, rel);
-        mkdirSync13(dirname16(path2), { recursive: true });
+        mkdirSync14(dirname16(path2), { recursive: true });
         writeFileSync11(`${path2}.tmp`, source);
         renameSync6(`${path2}.tmp`, path2);
       }
@@ -23513,7 +23587,7 @@ async function compileContentHhp(root, opts = {}) {
       for (const [path2, source] of oldWorkers) {
         if (source === null) rmSync8(path2, { force: true });
         else {
-          mkdirSync13(dirname16(path2), { recursive: true });
+          mkdirSync14(dirname16(path2), { recursive: true });
           writeFileSync11(path2, source);
         }
       }
@@ -23570,7 +23644,7 @@ export default defineController({
   if ((await loadContent(root)).module.screens.exact[id]) throw new Error(`Screen id ${id} is already registered.`);
   for (const [rel, body] of Object.entries(files)) {
     const path2 = localPath(root, rel);
-    mkdirSync13(dirname16(path2), { recursive: true });
+    mkdirSync14(dirname16(path2), { recursive: true });
     writeFileSync11(path2, body);
   }
   manifest2.screens[id] = { html: `screens/${id}.html` };
@@ -23583,7 +23657,7 @@ export default defineController({
       const originalSettings = existsSync20(settings) ? readFileSync21(settings, "utf8") : "{}";
       const updated = hhpEditorSettings(originalSettings);
       if (originalSettings !== updated) {
-        mkdirSync13(dirname16(settings), { recursive: true });
+        mkdirSync14(dirname16(settings), { recursive: true });
         writeFileSync11(settings, updated);
       }
       built.outputs.push(".vscode/settings.json");
@@ -23625,7 +23699,7 @@ var init_hhp = __esm({
 });
 
 // src/shared-drift.ts
-import { existsSync as existsSync21, lstatSync as lstatSync9, readdirSync as readdirSync15, readFileSync as readFileSync22 } from "node:fs";
+import { existsSync as existsSync21, lstatSync as lstatSync11, readdirSync as readdirSync15, readFileSync as readFileSync22 } from "node:fs";
 import { spawnSync as spawnSync5 } from "node:child_process";
 import { basename as basename9, dirname as dirname17, join as join18, resolve as resolve22 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
@@ -23677,7 +23751,7 @@ function missingSiblings(shippedFile, sharedDir) {
 }
 function hasEntry(p2) {
   try {
-    lstatSync9(p2);
+    lstatSync11(p2);
     return true;
   } catch {
     return false;
@@ -23729,7 +23803,7 @@ function scanSharedDrift(contentDir2, templatesRoot) {
   if (!templatesRoot || !existsSync21(templatesRoot)) return null;
   const sharedDir = join18(contentDir2, SHARED_REL);
   try {
-    if (!lstatSync9(sharedDir).isDirectory()) return null;
+    if (!lstatSync11(sharedDir).isDirectory()) return null;
   } catch {
     return null;
   }
@@ -23789,7 +23863,7 @@ var init_shared_drift = __esm({
     SIBLING_IMPORT = /(?:from\s+|import\s+)(["'])\.\/([A-Za-z0-9_-]+)(?:\.js|\.ts)?\1/g;
     isRealFile = (p2) => {
       try {
-        return lstatSync9(p2).isFile();
+        return lstatSync11(p2).isFile();
       } catch {
         return false;
       }
@@ -23817,7 +23891,7 @@ __export(build_exports, {
   umbrellaVersion: () => umbrellaVersion,
   umbrellaVersionIssue: () => umbrellaVersionIssue
 });
-import { existsSync as existsSync22, readdirSync as readdirSync16, mkdirSync as mkdirSync14, statSync as statSync6, symlinkSync, readFileSync as readFileSync23 } from "node:fs";
+import { existsSync as existsSync22, readdirSync as readdirSync16, mkdirSync as mkdirSync15, statSync as statSync6, symlinkSync, readFileSync as readFileSync23 } from "node:fs";
 import { resolve as resolve23, join as join19, dirname as dirname18 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
 import { execFileSync } from "node:child_process";
@@ -23865,7 +23939,7 @@ function ensureUmbrella(contentDir2, globalPath = globalUmbrella()) {
   if (!globalPath) return false;
   try {
     const scope2 = join19(contentDir2, "node_modules", "@wix");
-    mkdirSync14(scope2, { recursive: true });
+    mkdirSync15(scope2, { recursive: true });
     const link = join19(scope2, "himalaya");
     if (!existsSync22(link)) symlinkSync(globalPath, link, "dir");
     return existsSync22(join19(link, "package.json"));
@@ -23968,7 +24042,7 @@ async function buildContentBundles(contentDir2, opts = {}) {
     return { built, outDir, compileErrors: [{ bundle: "hhp", errors: [{ text: e2.message }] }], ...advisories };
   }
   if (!existsSync22(srcDir)) return { built, outDir, compileErrors, ...advisories };
-  mkdirSync14(outDir, { recursive: true });
+  mkdirSync15(outDir, { recursive: true });
   for (const name of readdirSync16(srcDir).sort()) {
     const entry = join19(srcDir, name, "index.ts");
     if (!statSync6(join19(srcDir, name)).isDirectory() || !existsSync22(entry)) continue;
@@ -24027,7 +24101,7 @@ __export(app_config_loader_exports, {
   makeBuildMemo: () => makeBuildMemo,
   uninstallContainedAppConfigRealm: () => uninstallContainedAppConfigRealm
 });
-import { existsSync as existsSync23, mkdirSync as mkdirSync15 } from "node:fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync16 } from "node:fs";
 import { dirname as dirname19, join as join20, resolve as resolve24 } from "node:path";
 import { pathToFileURL as pathToFileURL4 } from "node:url";
 function configEntry(dir) {
@@ -24043,7 +24117,7 @@ async function buildConfigModuleUrl(entry, dir) {
   const { bundledRuntimeDir: bundledRuntimeDir2 } = await Promise.resolve().then(() => (init_build(), build_exports));
   bundledRuntimeDir2();
   const out2 = resolve24(dir, "dist/.himi/config.mjs");
-  mkdirSync15(dirname19(out2), { recursive: true });
+  mkdirSync16(dirname19(out2), { recursive: true });
   await buildAppEntry(entry, out2, { umbrella: true, resolveTsExtensions: true, absWorkingDir: dir, confineTo: dir });
   return pathToFileURL4(out2).href;
 }
@@ -27315,7 +27389,7 @@ var init_plan_fonts = __esm({
 
 // ../font-bake/face-source.ts
 import { createHash as createHash9 } from "node:crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync16, readFileSync as readFileSync27, renameSync as renameSync7, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, readFileSync as readFileSync27, renameSync as renameSync7, rmSync as rmSync9, writeFileSync as writeFileSync12 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 import { basename as basename10, join as join23 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
@@ -27349,7 +27423,7 @@ async function fetchUpstreamBytes(url) {
 }
 function writeCachedFace(bytes2) {
   const hash3 = sha256Hex3(bytes2);
-  mkdirSync16(CACHE_DIR, { recursive: true });
+  mkdirSync17(CACHE_DIR, { recursive: true });
   const tmp = join23(CACHE_DIR, `.${hash3}.${process.pid}.${Date.now()}.tmp`);
   try {
     writeFileSync12(tmp, bytes2);
@@ -28224,7 +28298,7 @@ var init_inject = __esm({
 });
 
 // ../../core/dev-server/src/store.ts
-import { mkdirSync as mkdirSync17 } from "node:fs";
+import { mkdirSync as mkdirSync18 } from "node:fs";
 import { dirname as dirname21, resolve as resolve27 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 import { createRequire as createRequire2 } from "node:module";
@@ -28244,7 +28318,7 @@ var init_store2 = __esm({
       /** The node:sqlite handle — opened, bootstrapped, and seeded on first access. */
       get db() {
         if (this._db) return this._db;
-        mkdirSync17(dirname21(this.dbPath), { recursive: true });
+        mkdirSync18(dirname21(this.dbPath), { recursive: true });
         const { DatabaseSync } = nodeRequire("node:sqlite");
         this._db = new DatabaseSync(this.dbPath, { timeout: 5e3 });
         this.bootstrap();
@@ -33178,7 +33252,7 @@ function redactBodyString(body) {
     } catch {
     }
   }
-  return body.replace(FORM_ASSIGNMENT_RE, (m2, name) => isSensitiveBodyName(name) ? `${name}=${REDACTED}` : m2).replace(JSON_FIELD_RE, (m2, name, sep24) => isSensitiveBodyName(name) ? `"${name}"${sep24}"${REDACTED}"` : m2).replace(JSON_FIELD_UNTERMINATED_RE, (m2, name, sep24) => isSensitiveBodyName(name) ? `"${name}"${sep24}"${REDACTED}` : m2).replace(BEARER_RE, (_m, s2) => `${s2} ${REDACTED}`);
+  return body.replace(FORM_ASSIGNMENT_RE, (m2, name) => isSensitiveBodyName(name) ? `${name}=${REDACTED}` : m2).replace(JSON_FIELD_RE, (m2, name, sep26) => isSensitiveBodyName(name) ? `"${name}"${sep26}"${REDACTED}"` : m2).replace(JSON_FIELD_UNTERMINATED_RE, (m2, name, sep26) => isSensitiveBodyName(name) ? `"${name}"${sep26}"${REDACTED}` : m2).replace(BEARER_RE, (_m, s2) => `${s2} ${REDACTED}`);
 }
 function createWixGatewayState() {
   return { mode: "record", rules: [], traffic: [], clients: /* @__PURE__ */ new Set(), seq: 0, ruleSeq: 0 };
@@ -38741,10 +38815,10 @@ async function runRicosImageUpload(o2) {
     } catch {
       return fail7("read");
     }
-    const sep24 = entry.uploadUrl.includes("?") ? "&" : "?";
+    const sep26 = entry.uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
-      res = await deps.fetch(`${entry.uploadUrl}${sep24}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
+      res = await deps.fetch(`${entry.uploadUrl}${sep26}filename=${encodeURIComponent(file2.fileName)}`, { method: "PUT", headers: { "Content-Type": file2.mimeType }, body });
     } catch {
       return fail7("put");
     }
@@ -39387,10 +39461,10 @@ async function runMediaFieldUpload(o2) {
     } catch (e2) {
       return { ok: false, reason: e2 instanceof Deadline ? "timeout" : "read" };
     }
-    const sep24 = uploadUrl.includes("?") ? "&" : "?";
+    const sep26 = uploadUrl.includes("?") ? "&" : "?";
     let res;
     try {
-      res = await bounded2(deps.fetch(`${uploadUrl}${sep24}filename=${encodeURIComponent(file2.fileName)}`, {
+      res = await bounded2(deps.fetch(`${uploadUrl}${sep26}filename=${encodeURIComponent(file2.fileName)}`, {
         method: "PUT",
         headers: { "Content-Type": file2.mimeType },
         body,
@@ -123073,8 +123147,8 @@ function ensureCountUpRuntime() {
     const neg = fixed.startsWith("-");
     const body = neg ? fixed.slice(1) : fixed;
     const [int2, frac] = body.split(".");
-    const sep24 = int2.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-    return (neg ? "-" : "") + sep24 + (frac ? "." + frac : "");
+    const sep26 = int2.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+    return (neg ? "-" : "") + sep26 + (frac ? "." + frac : "");
   };
   const animateEl = (el2) => {
     const node = el2;
@@ -133783,7 +133857,7 @@ __export(widgets_exports, {
   widgetScanRunCount: () => widgetScanRunCount
 });
 import { createHash as createHash15 } from "node:crypto";
-import { lstatSync as lstatSync10, readdirSync as readdirSync19, statSync as statSync8 } from "node:fs";
+import { lstatSync as lstatSync12, readdirSync as readdirSync19, statSync as statSync8 } from "node:fs";
 import { join as join27 } from "node:path";
 import { inspect } from "node:util";
 async function widgetRealm() {
@@ -133910,7 +133984,7 @@ function bundleDirFingerprint(roots2) {
         } catch (err) {
           const code = err.code;
           if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "ELOOP") throw err;
-          st2 = lstatSync10(path2, { bigint: true });
+          st2 = lstatSync12(path2, { bigint: true });
           hash3.update(`${root}\0${entry}\0unresolved\0${st2.ino}\0${st2.mtimeNs}\0${st2.ctimeNs}
 `);
           continue;
@@ -134534,8 +134608,8 @@ var init_widgets = __esm({
 // ../../core/dev-server/src/index.ts
 import { createServer as createServer2 } from "node:http";
 import { readFile, stat } from "node:fs/promises";
-import { readFileSync as readFileSync37, existsSync as existsSync33, watch, mkdirSync as mkdirSync18, rmSync as rmSync10 } from "node:fs";
-import { basename as basename11, dirname as dirname24, extname as extname2, join as join28, relative as relative7, resolve as resolve32, normalize as normalize4, sep as sep9 } from "node:path";
+import { readFileSync as readFileSync37, existsSync as existsSync33, watch, mkdirSync as mkdirSync19, rmSync as rmSync10 } from "node:fs";
+import { basename as basename11, dirname as dirname24, extname as extname2, join as join28, relative as relative8, resolve as resolve32, normalize as normalize4, sep as sep11 } from "node:path";
 import { createHash as createHash16, randomUUID as randomUUID6 } from "node:crypto";
 import { fileURLToPath as fileURLToPath24, pathToFileURL as pathToFileURL5 } from "node:url";
 function readLogicBundle(read, tier5Dir, name) {
@@ -135362,7 +135436,7 @@ function startBundleArtifactWatcher(state) {
     });
   };
   try {
-    mkdirSync18(TIER5_ROOT2, { recursive: true });
+    mkdirSync19(TIER5_ROOT2, { recursive: true });
     const watcher2 = watch(TIER5_ROOT2, { persistent: false }, (_event, filename) => {
       const bundle = builtBundleName(filename);
       if (!bundle) return;
@@ -135411,7 +135485,7 @@ function startBundleSourceWatcher(state) {
   try {
     const watcher2 = watch(TIER5_SRC_ROOT, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename || !/\.(ts|tsx)$/.test(filename)) return;
-      const name = filename.split(sep9)[0];
+      const name = filename.split(sep11)[0];
       if (!name || name.startsWith(".")) return;
       pending.add(name);
       if (timer) clearTimeout(timer);
@@ -135490,7 +135564,7 @@ async function reloadAppModuleNow(state, opts) {
   const current = state.app;
   if (!current) return { ok: false, error: "no_app" };
   const entry = resolve32(current.dir, "dev/index.ts");
-  mkdirSync18(HMR_TMP_DIR, { recursive: true });
+  mkdirSync19(HMR_TMP_DIR, { recursive: true });
   const outfile = resolve32(HMR_TMP_DIR, `${current.name}-${++appReloadSeq}.mjs`);
   try {
     const lib = await import(pathToFileURL5(resolve32(TIER5_SRC_ROOT, "build-lib.mjs")).href);
@@ -135559,12 +135633,12 @@ function servedTokensHash(app) {
   }
 }
 function appDependencyFiles(inputs, appDir3) {
-  const inside2 = (root, p2) => p2 === root || p2.startsWith(root + sep9);
+  const inside2 = (root, p2) => p2 === root || p2.startsWith(root + sep11);
   const out2 = /* @__PURE__ */ new Set();
   for (const raw of inputs) {
     const p2 = resolve32(raw);
     if (!inside2(ROOT6, p2) || inside2(resolve32(appDir3), p2) || inside2(HMR_TMP_DIR, p2)) continue;
-    if (p2.split(sep9).includes("node_modules")) continue;
+    if (p2.split(sep11).includes("node_modules")) continue;
     out2.add(p2);
   }
   return [...out2].sort();
@@ -135594,7 +135668,7 @@ function syncAppDependencyWatchers(state, inputs) {
         if (timer) clearTimeout(timer);
         timer = setTimeout(() => {
           timer = void 0;
-          const files = [...changed].map((f2) => relative7(ROOT6, f2));
+          const files = [...changed].map((f2) => relative8(ROOT6, f2));
           changed.clear();
           console.log(`[himalaya-dev] app dependency changed: ${files.join(", ")}`);
           void reloadAppModule(state, { reason: "dependency_changed" });
@@ -135613,7 +135687,7 @@ async function primeAppDependencyWatchers(state) {
   if (!current) return;
   const entry = resolve32(current.dir, "dev/index.ts");
   if (!existsSync33(entry)) return;
-  mkdirSync18(HMR_TMP_DIR, { recursive: true });
+  mkdirSync19(HMR_TMP_DIR, { recursive: true });
   const outfile = resolve32(HMR_TMP_DIR, `${current.name}-deps-${++appReloadSeq}.mjs`);
   try {
     const lib = await import(pathToFileURL5(resolve32(TIER5_SRC_ROOT, "build-lib.mjs")).href);
@@ -135682,7 +135756,7 @@ function startAppSourceWatcher(state) {
   try {
     const watcher2 = watch(appDir3, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename) return;
-      const rel = String(filename).split(sep9).join("/");
+      const rel = String(filename).split(sep11).join("/");
       if (!classifyAppPath(rel)) return;
       pending.add(rel);
       if (timer) clearTimeout(timer);
@@ -137277,8 +137351,8 @@ async function handleActionHandlerBundleGet(res, app) {
 }
 async function serveStatic(req, res, root, prefix) {
   const requested = decodeURIComponent((req.url ?? "").split("?")[0]);
-  const relative26 = requested.replace(prefix, "").replace(/^\//, "");
-  const safe = normalize4(relative26).replace(/^(\.\.[\/\\])+/, "");
+  const relative27 = requested.replace(prefix, "").replace(/^\//, "");
+  const safe = normalize4(relative27).replace(/^(\.\.[\/\\])+/, "");
   const fullPath = resolve32(root, safe);
   if (!fullPath.startsWith(root)) {
     return send(res, 403, "forbidden");
@@ -138074,8 +138148,8 @@ var init_src6 = __esm({
 });
 
 // ../../core/serve-storage/src/file-store.ts
-import { mkdirSync as mkdirSync19, readFileSync as readFileSync38, rmSync as rmSync11, writeFileSync as writeFileSync13, readdirSync as readdirSync20, existsSync as existsSync34 } from "node:fs";
-import { join as join29, resolve as resolve33, sep as sep10 } from "node:path";
+import { mkdirSync as mkdirSync20, readFileSync as readFileSync38, rmSync as rmSync11, writeFileSync as writeFileSync13, readdirSync as readdirSync20, existsSync as existsSync34 } from "node:fs";
+import { join as join29, resolve as resolve33, sep as sep12 } from "node:path";
 var FileReleaseStore;
 var init_file_store = __esm({
   "../../core/serve-storage/src/file-store.ts"() {
@@ -138113,7 +138187,7 @@ var init_file_store = __esm({
        */
       appDir(app) {
         const dir = resolve33(this.root, this.safe(app));
-        if (!dir.startsWith(this.root + sep10)) {
+        if (!dir.startsWith(this.root + sep12)) {
           throw new Error(`unsafe app id ${JSON.stringify(app)}: ${dir} is not inside the store root`);
         }
         return dir;
@@ -138125,58 +138199,58 @@ var init_file_store = __esm({
       async reset(app) {
         const dir = this.appDir(app);
         rmSync11(dir, { recursive: true, force: true });
-        mkdirSync19(join29(dir, "screens"), { recursive: true });
-        mkdirSync19(join29(dir, "bundles"), { recursive: true });
+        mkdirSync20(join29(dir, "screens"), { recursive: true });
+        mkdirSync20(join29(dir, "bundles"), { recursive: true });
       }
       async remove(app) {
         rmSync11(this.appDir(app), { recursive: true, force: true });
       }
       async putManifest(app, manifest2) {
         validateFunctionManifest(manifest2);
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "release-manifest.json"), JSON.stringify(manifest2, null, 2));
       }
       async putScreen(app, screenId, json8) {
         const dir = join29(this.appDir(app), "screens");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, `${this.safe(screenId)}.json`), json8);
       }
       async putBundle(app, sha2567, bytes2) {
         const dir = join29(this.appDir(app), "bundles");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, `${this.safe(sha2567)}.bundle.js`), bytes2);
       }
       async putTokens(app, json8) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "tokens.json"), json8);
       }
       async putDoc(app, sha2567, json8) {
         const dir = join29(this.appDir(app), "docs");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, `${this.safe(sha2567)}.json`), json8);
       }
       async putAppConfig(app, json8) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "app-config.json"), json8);
       }
       async putIcon(app, bytes2) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "icon.png"), bytes2);
       }
       async putWidget(app, widgetId, json8) {
         const dir = join29(this.appDir(app), "widgets");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, `${this.safe(widgetId)}.json`), json8);
       }
       // Per-app settings (registry visibility) — release-independent, so it lives beside the
       // manifest, not inside it. NOTE: listApps() keys on release-manifest.json/ledger presence,
       // so a settings-only dir never lists an app.
       async putAppSettings(app, settings) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "settings.json"), JSON.stringify(settings, null, 2));
       }
       async putOneAppEnrollment(app) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "one-app-enrollment"), "one-app-to-himi-app");
       }
       // Template scaffold source archive — a content-addressed JSON doc, so it rides the same
@@ -138189,7 +138263,7 @@ var init_file_store = __esm({
       // bundles/<sha>.bundle.js, which bakes ".bundle.js" into the filename).
       async putAsset(app, sha2567, bytes2) {
         const dir = join29(this.appDir(app), "assets");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, this.safe(sha2567)), bytes2);
       }
       async getManifest(app) {
@@ -138259,7 +138333,7 @@ var init_file_store = __esm({
       async putManifestVersioned(app, releaseId, manifest2) {
         validateFunctionManifest(manifest2);
         const dir = join29(this.appDir(app), "manifests");
-        mkdirSync19(dir, { recursive: true });
+        mkdirSync20(dir, { recursive: true });
         writeFileSync13(join29(dir, `${this.safe(releaseId)}.json`), JSON.stringify(manifest2, null, 2));
       }
       async getManifestById(app, releaseId) {
@@ -138280,7 +138354,7 @@ var init_file_store = __esm({
         }
       }
       async appendRelease(app, entry) {
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         const ledger = await this.listReleases(app);
         const i2 = ledger.findIndex((e2) => e2.releaseId === entry.releaseId);
         if (i2 >= 0) ledger[i2] = entry;
@@ -138307,7 +138381,7 @@ var init_file_store = __esm({
       async updateWipRecord(app, fn2) {
         const next = fn2(this.readWipSync(app));
         if (next === void 0) return false;
-        mkdirSync19(this.appDir(app), { recursive: true });
+        mkdirSync20(this.appDir(app), { recursive: true });
         writeFileSync13(join29(this.appDir(app), "_wip.json"), JSON.stringify(next, null, 2));
         return true;
       }
@@ -140587,8 +140661,8 @@ async function crawlScreenInner(opts) {
       if (linkable.has(target)) return true;
       for (const base of linkable) {
         if (target.length > base.length + 1 && target.startsWith(base)) {
-          const sep24 = target[base.length];
-          if (sep24 === "_" || sep24 === "/") return true;
+          const sep26 = target[base.length];
+          if (sep26 === "_" || sep26 === "/") return true;
         }
       }
       return false;
@@ -144510,13 +144584,13 @@ __export(studio_exports, {
 });
 import { createHash as createHash21 } from "node:crypto";
 import { existsSync as existsSync38, readdirSync as readdirSync23, readFileSync as readFileSync42, realpathSync as realpathSync6, statSync as statSync9 } from "node:fs";
-import { basename as basename12, extname as extname3, join as join33, relative as relative8, resolve as resolve35, sep as sep11 } from "node:path";
+import { basename as basename12, extname as extname3, join as join33, relative as relative9, resolve as resolve35, sep as sep13 } from "node:path";
 import { pathToFileURL as pathToFileURL6 } from "node:url";
 function realInside(dir, abs) {
   try {
     const root = realpathSync6(dir);
     const real = realpathSync6(abs);
-    return real.startsWith(root + sep11) ? real : null;
+    return real.startsWith(root + sep13) ? real : null;
   } catch {
     return null;
   }
@@ -144533,7 +144607,7 @@ function archiveFile(dir, memory, abs) {
     return null;
   }
   if (size === 0) return null;
-  const key3 = relative8(dir, abs);
+  const key3 = relative9(dir, abs);
   const hit = memory.files?.[key3];
   if (hit && hit.size === size && hit.mtimeMs === mtimeMs && hit.ino === ino && existsSync38(join33(dir, HISTORY_DIR, `${hit.sha}.${hit.ext}`))) {
     return { sha: hit.sha, ext: hit.ext, file: `${hit.sha}.${hit.ext}` };
@@ -144954,7 +145028,7 @@ __export(cli_shared_exports, {
   visibilityFlag: () => visibilityFlag,
   writePngFile: () => writePngFile
 });
-import { mkdtempSync, readFileSync as readFileSync43, mkdirSync as mkdirSync20, writeFileSync as writeFileSync14, existsSync as existsSync39, rmSync as rmSync12, readdirSync as readdirSync24, lstatSync as lstatSync11 } from "node:fs";
+import { mkdtempSync, readFileSync as readFileSync43, mkdirSync as mkdirSync21, writeFileSync as writeFileSync14, existsSync as existsSync39, rmSync as rmSync12, readdirSync as readdirSync24, lstatSync as lstatSync13 } from "node:fs";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join34, resolve as resolve36, basename as basename13, dirname as dirname26 } from "node:path";
@@ -145107,7 +145181,7 @@ function nativeConfigTokenNotice(configSource, optedIn) {
   return `launch-screen token ${list2} also feeds the BUILD-TIME native launch screen (tools/native-config) \u2014 an OTA-only change to its value updates the live app but NOT the baked launch screen until the next native build (regenerate: npm run native-config -- <app>)`;
 }
 function writePngFile(path2, base64) {
-  mkdirSync20(dirname26(path2), { recursive: true });
+  mkdirSync21(dirname26(path2), { recursive: true });
   writeFileSync14(path2, Buffer.from(base64, "base64"));
   return path2;
 }
@@ -145150,7 +145224,7 @@ function renameRestoredSource(restored, declaredApp, renamed) {
 function symlinkDestinationIssue(dest) {
   let kind;
   try {
-    kind = lstatSync11(dest);
+    kind = lstatSync13(dest);
   } catch {
     return null;
   }
@@ -145214,7 +145288,7 @@ function materializeForPreview(appDir3, slug, displayName3) {
   }
   const dest = join34(root, `${slug}-${process.pid}`);
   rmSync12(dest, { recursive: true, force: true });
-  mkdirSync20(dest, { recursive: true });
+  mkdirSync21(dest, { recursive: true });
   try {
     materializeSource(forBuild, displayName3, dest, slug);
   } catch (e2) {
@@ -145225,8 +145299,8 @@ function materializeForPreview(appDir3, slug, displayName3) {
 }
 async function appId(dir) {
   try {
-    const { readFileSync: readFileSync138 } = await import("node:fs");
-    const m2 = JSON.parse(readFileSync138(join34(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync139 } = await import("node:fs");
+    const m2 = JSON.parse(readFileSync139(join34(dir, "himalaya.content.json"), "utf8"));
     if (m2.name) return m2.name;
   } catch {
   }
@@ -145459,7 +145533,7 @@ var init_cli_shared = __esm({
 });
 
 // src/self-update.ts
-import { readFileSync as readFileSync44, mkdirSync as mkdirSync21, writeFileSync as writeFileSync15, existsSync as existsSync40, rmSync as rmSync13, statSync as statSync10, accessSync, constants } from "node:fs";
+import { readFileSync as readFileSync44, mkdirSync as mkdirSync22, writeFileSync as writeFileSync15, existsSync as existsSync40, rmSync as rmSync13, statSync as statSync10, accessSync, constants } from "node:fs";
 import { execFile, execFileSync as execFileSync3, spawnSync as spawnSync6 } from "node:child_process";
 import { randomUUID as randomUUID7 } from "node:crypto";
 import { homedir as homedir8, hostname } from "node:os";
@@ -145646,7 +145720,7 @@ function readUpdateCache(path2) {
 }
 function writeUpdateCache(path2, cache2) {
   try {
-    mkdirSync21(dirname27(path2), { recursive: true, mode: 448 });
+    mkdirSync22(dirname27(path2), { recursive: true, mode: 448 });
     writeFileSync15(path2, JSON.stringify(cache2, null, 2) + "\n", { mode: 384 });
   } catch {
   }
@@ -145800,7 +145874,7 @@ function acquireUpdateLock(cachePath, now, hooks = {}) {
   };
   const release2 = () => removeIfMine(lockPath2);
   try {
-    mkdirSync21(dirname27(lockPath2), { recursive: true, mode: 448 });
+    mkdirSync22(dirname27(lockPath2), { recursive: true, mode: 448 });
   } catch {
     return () => {
     };
@@ -147081,10 +147155,10 @@ __export(preflight_exports, {
   requireEnv: () => requireEnv
 });
 import { existsSync as existsSync43, readFileSync as readFileSync47 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative9, resolve as resolve39 } from "node:path";
+import { isAbsolute as isAbsolute3, relative as relative10, resolve as resolve39 } from "node:path";
 function isInsideRepo(p2) {
-  const rel = relative9(REPO_ROOT, resolve39(p2));
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+  const rel = relative10(REPO_ROOT, resolve39(p2));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute3(rel);
 }
 function assertCredentialOutsideRepo(label3, p2) {
   if (isInsideRepo(p2)) {
@@ -150690,21 +150764,21 @@ var init_Matcher = __esm({
        * @returns {string}
        */
       toString(separator, includeNamespace = true) {
-        const sep24 = separator || this.separator;
-        const isDefault = sep24 === this.separator && includeNamespace === true;
+        const sep26 = separator || this.separator;
+        const isDefault = sep26 === this.separator && includeNamespace === true;
         if (isDefault) {
           if (this._pathStringCache !== null) {
             return this._pathStringCache;
           }
           const result = this.path.map(
             (n2) => n2.namespace ? `${n2.namespace}:${n2.tag}` : n2.tag
-          ).join(sep24);
+          ).join(sep26);
           this._pathStringCache = result;
           return result;
         }
         return this.path.map(
           (n2) => includeNamespace && n2.namespace ? `${n2.namespace}:${n2.tag}` : n2.tag
-        ).join(sep24);
+        ).join(sep26);
       }
       /**
        * Get path as array of tag names.
@@ -151414,77 +151488,77 @@ var init_redos = __esm({
 });
 
 // ../../node_modules/is-unsafe/src/contexts/nosql.js
-var sep12, NOSQL_PATTERNS, nosql_default;
+var sep14, NOSQL_PATTERNS, nosql_default;
 var init_nosql = __esm({
   "../../node_modules/is-unsafe/src/contexts/nosql.js"() {
     init_define_HHP_CATALOG();
-    sep12 = `["'\\s]*:`;
+    sep14 = `["'\\s]*:`;
     NOSQL_PATTERNS = [
       // ─── MongoDB $ operator injection ────────────────────────────────────────
       {
         id: "nosql-where-operator",
         description: "$where \u2014 executes arbitrary JavaScript server-side in MongoDB",
-        pattern: new RegExp(`\\$where${sep12}`, "i")
+        pattern: new RegExp(`\\$where${sep14}`, "i")
       },
       {
         id: "nosql-ne-operator",
         description: '$ne \u2014 "not equal" operator used to bypass equality checks',
-        pattern: new RegExp(`\\$ne${sep12}`, "i")
+        pattern: new RegExp(`\\$ne${sep14}`, "i")
       },
       {
         id: "nosql-gt-operator",
         description: '$gt \u2014 "greater than" used to bypass password/value checks',
-        pattern: new RegExp(`\\$gte?${sep12}`, "i")
+        pattern: new RegExp(`\\$gte?${sep14}`, "i")
       },
       {
         id: "nosql-lt-operator",
         description: '$lt / $lte \u2014 "less than" bypass variants',
-        pattern: new RegExp(`\\$lte?${sep12}`, "i")
+        pattern: new RegExp(`\\$lte?${sep14}`, "i")
       },
       {
         id: "nosql-regex-operator",
         description: "$regex \u2014 can be used to extract data character by character (blind injection)",
-        pattern: new RegExp(`\\$regex${sep12}`, "i")
+        pattern: new RegExp(`\\$regex${sep14}`, "i")
       },
       {
         id: "nosql-or-operator",
         description: "$or \u2014 logical OR; used to create always-true conditions",
-        pattern: new RegExp(`\\$or${sep12}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$or${sep14}\\s*\\[`, "i")
       },
       {
         id: "nosql-and-operator",
         description: "$and \u2014 logical AND operator injection",
-        pattern: new RegExp(`\\$and${sep12}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$and${sep14}\\s*\\[`, "i")
       },
       {
         id: "nosql-nor-operator",
         description: "$nor \u2014 logical NOR operator injection",
-        pattern: new RegExp(`\\$nor${sep12}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$nor${sep14}\\s*\\[`, "i")
       },
       {
         id: "nosql-exists-operator",
         description: "$exists \u2014 can enumerate fields to determine schema",
-        pattern: new RegExp(`\\$exists${sep12}`, "i")
+        pattern: new RegExp(`\\$exists${sep14}`, "i")
       },
       {
         id: "nosql-in-operator",
         description: "$in \u2014 matches any value in a list; can enumerate values",
-        pattern: new RegExp(`\\$in${sep12}\\s*\\[`, "i")
+        pattern: new RegExp(`\\$in${sep14}\\s*\\[`, "i")
       },
       {
         id: "nosql-expr-operator",
         description: "$expr \u2014 allows aggregation expressions in queries (MongoDB 3.6+)",
-        pattern: new RegExp(`\\$expr${sep12}`, "i")
+        pattern: new RegExp(`\\$expr${sep14}`, "i")
       },
       {
         id: "nosql-function-operator",
         description: "$function \u2014 executes arbitrary JavaScript in MongoDB 4.4+",
-        pattern: new RegExp(`\\$function${sep12}`, "i")
+        pattern: new RegExp(`\\$function${sep14}`, "i")
       },
       {
         id: "nosql-accumulator-operator",
         description: "$accumulator \u2014 custom aggregation with arbitrary JS execution",
-        pattern: new RegExp(`\\$accumulator${sep12}`, "i")
+        pattern: new RegExp(`\\$accumulator${sep14}`, "i")
       },
       // ─── Prototype pollution ─────────────────────────────────────────────────
       {
@@ -153915,7 +153989,7 @@ var init_customer_signing_inspect = __esm({
 });
 
 // src/push-onboarding.ts
-import { existsSync as existsSync44, mkdirSync as mkdirSync22, readFileSync as readFileSync48, statSync as statSync11, writeFileSync as writeFileSync16, chmodSync as chmodSync2 } from "node:fs";
+import { existsSync as existsSync44, mkdirSync as mkdirSync23, readFileSync as readFileSync48, statSync as statSync11, writeFileSync as writeFileSync16, chmodSync as chmodSync2 } from "node:fs";
 import { basename as basename14, dirname as dirname28, join as join36, resolve as resolve40 } from "node:path";
 function readJson4(path2) {
   try {
@@ -154065,7 +154139,7 @@ function readPushOnboarding(dir) {
 }
 function writeFile(dir, file2) {
   const path2 = join36(resolve40(dir), PUSH_ONBOARDING_PATH);
-  mkdirSync22(dirname28(path2), { recursive: true, mode: 448 });
+  mkdirSync23(dirname28(path2), { recursive: true, mode: 448 });
   writeFileSync16(path2, JSON.stringify(file2, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync2(path2, 384);
@@ -154164,7 +154238,7 @@ __export(signing_inspect_exports, {
   runSigningInspect: () => runSigningInspect
 });
 import { existsSync as existsSync45, readFileSync as readFileSync49, statSync as statSync12 } from "node:fs";
-import { isAbsolute as isAbsolute3, resolve as resolve41 } from "node:path";
+import { isAbsolute as isAbsolute4, resolve as resolve41 } from "node:path";
 function fail5(io2, code, fields = {}) {
   io2.error(JSON.stringify({ ok: false, code, ...fields }));
   return code.endsWith("_required") || code.endsWith("_usage") ? 2 : 1;
@@ -154220,7 +154294,7 @@ async function runSigningInspect(pos, flags, io2, deps = {}) {
       hint: "Pass --bundle-id --team-id and ASC key flags, or set ASC_KEY_PATH / ASC_KEY_ID / ASC_ISSUER_ID."
     });
   }
-  const resolvedKey = isAbsolute3(keyFile) ? keyFile : resolve41(process.cwd(), keyFile);
+  const resolvedKey = isAbsolute4(keyFile) ? keyFile : resolve41(process.cwd(), keyFile);
   try {
     assertCredentialOutsideRepo("asc-key-file", resolvedKey);
   } catch (error) {
@@ -154245,8 +154319,8 @@ async function runSigningInspect(pos, flags, io2, deps = {}) {
         error: "local asset check needs --cert-file, --cert-password, and --profile-file together"
       });
     }
-    const certPath = isAbsolute3(certFile) ? certFile : resolve41(process.cwd(), certFile);
-    const profilePath2 = isAbsolute3(profileFile) ? profileFile : resolve41(process.cwd(), profileFile);
+    const certPath = isAbsolute4(certFile) ? certFile : resolve41(process.cwd(), certFile);
+    const profilePath2 = isAbsolute4(profileFile) ? profileFile : resolve41(process.cwd(), profileFile);
     try {
       assertCredentialOutsideRepo("cert-file", certPath);
       assertCredentialOutsideRepo("profile-file", profilePath2);
@@ -154301,12 +154375,12 @@ __export(content_manifest_exports, {
   writeContentManifest: () => writeContentManifest
 });
 import { randomUUID as randomUUID8 } from "node:crypto";
-import { constants as constants2, lstatSync as lstatSync12, readFileSync as readFileSync50, realpathSync as realpathSync7, writeFileSync as writeFileSync17, renameSync as renameSync9, openSync as openSync3, closeSync as closeSync3, unlinkSync as unlinkSync2 } from "node:fs";
+import { constants as constants2, lstatSync as lstatSync14, readFileSync as readFileSync50, realpathSync as realpathSync7, writeFileSync as writeFileSync17, renameSync as renameSync9, openSync as openSync3, closeSync as closeSync3, unlinkSync as unlinkSync2 } from "node:fs";
 import { join as join37 } from "node:path";
 function contentManifestPath(dir) {
   const path2 = join37(realpathSync7(dir), "himalaya.content.json");
   try {
-    if (lstatSync12(path2).isSymbolicLink()) throw new Error("himalaya.content.json is a symlink \u2014 refusing to read or write through it");
+    if (lstatSync14(path2).isSymbolicLink()) throw new Error("himalaya.content.json is a symlink \u2014 refusing to read or write through it");
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
@@ -154823,7 +154897,7 @@ __export(template_trim_exports, {
   runTemplateTrim: () => runTemplateTrim,
   trimCapabilities: () => trimCapabilities
 });
-import { cpSync, existsSync as existsSync46, mkdirSync as mkdirSync23, readdirSync as readdirSync25, readFileSync as readFileSync51, renameSync as renameSync10, rmSync as rmSync14, statSync as statSync13, writeFileSync as writeFileSync18 } from "node:fs";
+import { cpSync, existsSync as existsSync46, mkdirSync as mkdirSync24, readdirSync as readdirSync25, readFileSync as readFileSync51, renameSync as renameSync10, rmSync as rmSync14, statSync as statSync13, writeFileSync as writeFileSync18 } from "node:fs";
 import { dirname as dirname29, join as join38 } from "node:path";
 import ts5 from "typescript";
 function routeMatcher(pattern) {
@@ -155855,9 +155929,9 @@ async function runTemplateTrim(req, deps) {
     return { code: 1, result: { ok: false, error: `${error} (${message2}); every file was restored`, rolledBack: true, ...base(validate6) } };
   };
   try {
-    mkdirSync23(join38(backup, "dev"), { recursive: true });
+    mkdirSync24(join38(backup, "dev"), { recursive: true });
     for (const [path2, rel] of originals) cpSync(path2, join38(backup, rel));
-    if (plan.removedWorkers.length) mkdirSync23(join38(backup, "tier5-src"), { recursive: true });
+    if (plan.removedWorkers.length) mkdirSync24(join38(backup, "tier5-src"), { recursive: true });
   } catch (e2) {
     dropBackup();
     return { code: 1, result: { ok: false, error: `could not back up the app before trimming it (${e2.message}); nothing was changed`, rolledBack: true, ...base() } };
@@ -156155,7 +156229,7 @@ __export(template_adopt_exports, {
   workerReach: () => workerReach,
   writeInventory: () => writeInventory
 });
-import { existsSync as existsSync47, lstatSync as lstatSync13, mkdirSync as mkdirSync24, readdirSync as readdirSync26, readFileSync as readFileSync52, renameSync as renameSync11, statSync as statSync14, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync47, lstatSync as lstatSync15, mkdirSync as mkdirSync25, readdirSync as readdirSync26, readFileSync as readFileSync52, renameSync as renameSync11, statSync as statSync14, writeFileSync as writeFileSync19 } from "node:fs";
 import { dirname as dirname30, join as join39, posix as posix2 } from "node:path";
 import ts6 from "typescript";
 function readAppSources(dir) {
@@ -156499,9 +156573,9 @@ function inventorySummary(inv) {
 function writeNoFollow(dir, rel, body) {
   const p2 = join39(dir, rel);
   const parent = dirname30(p2);
-  if (existsSync47(parent) && lstatSync13(parent).isSymbolicLink()) throw new TrimRefusal(`${dirname30(rel)} is a symlink \u2014 refusing to write through it`);
-  mkdirSync24(parent, { recursive: true });
-  if (existsSync47(p2) && lstatSync13(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it`);
+  if (existsSync47(parent) && lstatSync15(parent).isSymbolicLink()) throw new TrimRefusal(`${dirname30(rel)} is a symlink \u2014 refusing to write through it`);
+  mkdirSync25(parent, { recursive: true });
+  if (existsSync47(p2) && lstatSync15(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it`);
   const tmp = `${p2}.${process.pid}.${Date.now()}.tmp`;
   writeFileSync19(tmp, body, { flag: "wx" });
   renameSync11(tmp, p2);
@@ -156555,7 +156629,7 @@ function replaceScreen(dir, id, entry) {
   }
   for (const rel of ["dev", "dev/index.ts"]) {
     const p2 = join39(dir, rel);
-    if (existsSync47(p2) && lstatSync13(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (dev/index.ts left unchanged)`);
+    if (existsSync47(p2) && lstatSync15(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (dev/index.ts left unchanged)`);
   }
   writeNoFollow(dir, "dev/index.ts", next);
   return { ok: true, screen: id, bytes: body.length };
@@ -156619,7 +156693,7 @@ function addScreen(dir, id, entry, opts = {}) {
   }
   for (const rel of ["dev", "dev/index.ts", ...config !== src.config ? ["config.ts"] : [], ...contentWithView !== void 0 ? ["himalaya.content.json"] : []]) {
     const p2 = join39(dir, rel);
-    if (existsSync47(p2) && lstatSync13(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (nothing written)`);
+    if (existsSync47(p2) && lstatSync15(p2).isSymbolicLink()) throw new TrimRefusal(`${rel} is a symlink \u2014 refusing to write through it (nothing written)`);
   }
   writeNoFollow(dir, "dev/index.ts", dev);
   if (config !== src.config) writeNoFollow(dir, "config.ts", config);
@@ -156918,7 +156992,7 @@ var init_hosted_owner = __esm({
 });
 
 // src/config-source-edit.ts
-import { lstatSync as lstatSync14 } from "node:fs";
+import { lstatSync as lstatSync16 } from "node:fs";
 import { join as join40 } from "node:path";
 import ts7 from "typescript";
 function defineAppLiteral(file2) {
@@ -157024,7 +157098,7 @@ function backUpConfig(dir, folder, fileName, original) {
 }
 function isSymlink2(path2) {
   try {
-    return lstatSync14(path2).isSymbolicLink();
+    return lstatSync16(path2).isSymbolicLink();
   } catch {
     return false;
   }
@@ -157511,7 +157585,7 @@ __export(pack_exports, {
 });
 import { createHash as createHash24 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync48, mkdirSync as mkdirSync25, readFileSync as readFileSync54, readdirSync as readdirSync27, rmSync as rmSync15, statSync as statSync15, writeFileSync as writeFileSync20 } from "node:fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync26, readFileSync as readFileSync54, readdirSync as readdirSync27, rmSync as rmSync15, statSync as statSync15, writeFileSync as writeFileSync20 } from "node:fs";
 import { dirname as dirname31, join as join41, resolve as resolve43 } from "node:path";
 function writeZip(entries) {
   const sorted2 = entries.slice().sort((a2, b2) => a2.path < b2.path ? -1 : a2.path > b2.path ? 1 : 0);
@@ -157690,7 +157764,7 @@ function packRelease(releaseRoot, app, out2, opts = {}) {
   const buf = writeZip(all);
   const isDir2 = existsSync48(out2) && statSync15(out2).isDirectory();
   const outFile = isDir2 ? join41(resolve43(out2), packageFileName(app, header.releaseId)) : resolve43(out2);
-  mkdirSync25(dirname31(outFile), { recursive: true });
+  mkdirSync26(dirname31(outFile), { recursive: true });
   writeFileSync20(outFile, buf);
   return { app, releaseId: header.releaseId, header, out: outFile, bytes: buf.length, entryCount: all.length, skipped };
 }
@@ -157734,7 +157808,7 @@ function packReleaseToDir(releaseRoot, app, outDir, opts = {}) {
   let bytes2 = 0;
   for (const entry of all) {
     const target = join41(dest, entry.path);
-    mkdirSync25(dirname31(target), { recursive: true });
+    mkdirSync26(dirname31(target), { recursive: true });
     writeFileSync20(target, entry.bytes);
     bytes2 += entry.bytes.length;
   }
@@ -157816,7 +157890,7 @@ function unpackTo(buf, dest, appFallback) {
   rmSync15(appDir3, { recursive: true, force: true });
   for (const [rel, bytes2] of entries) {
     const target = join41(appDir3, rel);
-    mkdirSync25(dirname31(target), { recursive: true });
+    mkdirSync26(dirname31(target), { recursive: true });
     writeFileSync20(target, bytes2);
   }
   return { root, appDir: appDir3, app };
@@ -157856,8 +157930,8 @@ __export(app_source_exports, {
   zipAppSource: () => zipAppSource
 });
 import { createHash as createHash25 } from "node:crypto";
-import { readdirSync as readdirSync28, lstatSync as lstatSync15, readFileSync as readFileSync55, mkdirSync as mkdirSync26, writeFileSync as writeFileSync21, existsSync as existsSync49, rmSync as rmSync16, rmdirSync as rmdirSync3, unlinkSync as unlinkSync3 } from "node:fs";
-import { join as join42, resolve as resolve44, sep as sep13 } from "node:path";
+import { readdirSync as readdirSync28, lstatSync as lstatSync17, readFileSync as readFileSync55, mkdirSync as mkdirSync27, writeFileSync as writeFileSync21, existsSync as existsSync49, rmSync as rmSync16, rmdirSync as rmdirSync3, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join42, resolve as resolve44, sep as sep15 } from "node:path";
 import { createRequire as createRequire4 } from "node:module";
 import { deflateRawSync as deflateRawSync2 } from "node:zlib";
 function walkSourceTree(dir, file2, skip, enter = () => {
@@ -157866,7 +157940,7 @@ function walkSourceTree(dir, file2, skip, enter = () => {
     enter(relDir);
     for (const name of readdirSync28(join42(dir, relDir))) {
       const rel = relDir ? join42(relDir, name) : name;
-      const st2 = lstatSync15(join42(dir, rel));
+      const st2 = lstatSync17(join42(dir, rel));
       if (st2.isSymbolicLink()) {
         skip(rel);
         continue;
@@ -157880,7 +157954,7 @@ function walkSourceTree(dir, file2, skip, enter = () => {
         skip(rel);
         continue;
       }
-      file2(rel.split(sep13).join("/"), rel);
+      file2(rel.split(sep15).join("/"), rel);
     }
   };
   walk2("");
@@ -157940,14 +158014,14 @@ function renderInputRootDirs(dir) {
 }
 function newestSourceChangeMs(dir) {
   const roots2 = renderInputRootDirs(dir);
-  const inRead = (hostRel) => !roots2 || roots2.has(hostRel.split(sep13)[0]);
-  const counts = (hostRel) => !hostRel.includes(sep13) || inRead(hostRel);
+  const inRead = (hostRel) => !roots2 || roots2.has(hostRel.split(sep15)[0]);
+  const counts = (hostRel) => !hostRel.includes(sep15) || inRead(hostRel);
   let newest = 0;
   walkSourceTree(
     dir,
     (archivePath, hostRel) => {
       if (/\.md$/i.test(archivePath) || !counts(hostRel)) return;
-      const m2 = lstatSync15(join42(dir, hostRel)).mtimeMs;
+      const m2 = lstatSync17(join42(dir, hostRel)).mtimeMs;
       if (m2 > newest) newest = m2;
     },
     () => {
@@ -157959,7 +158033,7 @@ function newestSourceChangeMs(dir) {
     // Nor a root directory the render does not read: creating a file in `_qa/` moves `_qa/`.
     (hostRel) => {
       if (hostRel === "" || !inRead(hostRel)) return;
-      const m2 = lstatSync15(join42(dir, hostRel)).mtimeMs;
+      const m2 = lstatSync17(join42(dir, hostRel)).mtimeMs;
       if (m2 > newest) newest = m2;
     }
   );
@@ -158007,7 +158081,7 @@ function readAppSource(zip) {
 }
 function pathKind(p2) {
   try {
-    return lstatSync15(p2);
+    return lstatSync17(p2);
   } catch {
     return null;
   }
@@ -158019,7 +158093,7 @@ function writeAppSource(entries, destDir) {
       `refusing to restore into ${root}: the destination itself is a symlink, so every file would be written outside it. Remove it, or pass --out/--name somewhere else.`
     );
   }
-  mkdirSync26(root, { recursive: true });
+  mkdirSync27(root, { recursive: true });
   const written = [];
   for (const entry of entries) {
     if (isDeniedSourcePath(entry.path)) continue;
@@ -158030,7 +158104,7 @@ function writeAppSource(entries, destDir) {
       const kind = pathKind(dir);
       if (kind?.isSymbolicLink()) unlinkSync3(dir);
       else if (kind) continue;
-      mkdirSync26(dir);
+      mkdirSync27(dir);
     }
     const target = join42(root, ...segments);
     if (pathKind(target)?.isSymbolicLink()) unlinkSync3(target);
@@ -158103,8 +158177,8 @@ function pruneEmptyDirs(root, rel, needed, removed) {
   let empty2 = true;
   for (const name of readdirSync28(rel ? join42(root, rel) : root)) {
     const childRel = rel ? join42(rel, name) : name;
-    const posix5 = childRel.split(sep13).join("/");
-    const kind = lstatSync15(join42(root, childRel));
+    const posix5 = childRel.split(sep15).join("/");
+    const kind = lstatSync17(join42(root, childRel));
     if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name, rel)) {
       empty2 = false;
       continue;
@@ -158186,9 +158260,9 @@ __export(run_watch_exports, {
   watchedContentDir: () => watchedContentDir,
   writeRunRecord: () => writeRunRecord
 });
-import { closeSync as closeSync4, constants as constants3, existsSync as existsSync50, fstatSync, lstatSync as lstatSync16, statSync as statSync16, readdirSync as readdirSync29, mkdirSync as mkdirSync27, openSync as openSync4, readFileSync as readFileSync56, realpathSync as realpathSync8, renameSync as renameSync12, rmSync as rmSync17, writeFileSync as writeFileSync22, watch as fsWatch } from "node:fs";
+import { closeSync as closeSync4, constants as constants3, existsSync as existsSync50, fstatSync, lstatSync as lstatSync18, statSync as statSync16, readdirSync as readdirSync29, mkdirSync as mkdirSync28, openSync as openSync4, readFileSync as readFileSync56, realpathSync as realpathSync8, renameSync as renameSync12, rmSync as rmSync17, writeFileSync as writeFileSync22, watch as fsWatch } from "node:fs";
 import { randomUUID as randomUUID9 } from "node:crypto";
-import { extname as extname4, join as join43, relative as relative10, resolve as resolve45, sep as sep14 } from "node:path";
+import { extname as extname4, join as join43, relative as relative11, resolve as resolve45, sep as sep16 } from "node:path";
 function diffReleases(prev, next) {
   const bundles = Object.keys(next.bundles).filter((b2) => prev.bundles[b2]?.sha256 !== next.bundles[b2].sha256).sort();
   const changedBundles = new Set(bundles);
@@ -158216,7 +158290,7 @@ function reloadEvents(d2) {
 function hhpRasterDir(dir) {
   const assets = findAssetsDir(dir);
   if (!assets) return null;
-  const rel = relative10(dir, assets).split(sep14).join("/");
+  const rel = relative11(dir, assets).split(sep16).join("/");
   return rel ? `${rel}/hhp-raster` : "hhp-raster";
 }
 function ignoredChange(relPath, isDirectory = () => false, rasterDir = "assets/hhp-raster") {
@@ -158266,7 +158340,7 @@ function watchContent(dir, onChange, opts = {}) {
       for (const name of entries) {
         const path2 = join43(directory, String(name)), rel = prefix ? `${prefix}/${name}` : String(name);
         try {
-          const stat2 = lstatSync16(path2);
+          const stat2 = lstatSync18(path2);
           if (stat2.isSymbolicLink() || ignoredChange(rel, () => stat2.isDirectory(), rasterDir)) continue;
           if (stat2.isDirectory()) visit(path2, rel);
           else if (stat2.isFile()) files.set(rel, `${stat2.mtimeMs}:${stat2.ctimeMs}:${stat2.size}`);
@@ -158364,11 +158438,11 @@ function serialize(task) {
 function himiDir(dir) {
   const root = join43(dir, ".himi");
   try {
-    return lstatSync16(root).isDirectory() ? root : null;
+    return lstatSync18(root).isDirectory() ? root : null;
   } catch (e2) {
     if (e2.code !== "ENOENT") return null;
-    mkdirSync27(root, { recursive: true });
-    return lstatSync16(root).isDirectory() ? root : null;
+    mkdirSync28(root, { recursive: true });
+    return lstatSync18(root).isDirectory() ? root : null;
   }
 }
 function writeRunRecord(dir, record3) {
@@ -158388,7 +158462,7 @@ function writeRunRecord(dir, record3) {
 function removeRunRecord(dir, owner) {
   const root = join43(dir, ".himi");
   try {
-    if (!lstatSync16(root).isDirectory()) return;
+    if (!lstatSync18(root).isDirectory()) return;
   } catch {
     return;
   }
@@ -158406,7 +158480,7 @@ function removeRunRecord(dir, owner) {
 function removeInitWatchRecord(dir, owner) {
   const root = join43(dir, ".himi");
   try {
-    if (!lstatSync16(root).isDirectory()) return;
+    if (!lstatSync18(root).isDirectory()) return;
   } catch {
     return;
   }
@@ -158443,16 +158517,16 @@ function boardFile(dir, pathname) {
 }
 function readConfined(root, rel) {
   try {
-    if (!lstatSync16(root).isDirectory()) return null;
-    const parts = rel.split(sep14);
+    if (!lstatSync18(root).isDirectory()) return null;
+    const parts = rel.split(sep16);
     let at2 = root;
     for (let i2 = 0; i2 < parts.length; i2++) {
       at2 = join43(at2, parts[i2]);
-      const st2 = lstatSync16(at2);
+      const st2 = lstatSync18(at2);
       if (st2.isSymbolicLink() || !(i2 === parts.length - 1 ? st2.isFile() : st2.isDirectory())) return null;
     }
     const canonicalRoot = realpathSync8(root);
-    if (!realpathSync8(at2).startsWith(canonicalRoot + sep14)) return null;
+    if (!realpathSync8(at2).startsWith(canonicalRoot + sep16)) return null;
     const fd = openSync4(at2, constants3.O_RDONLY | (constants3.O_NOFOLLOW ?? 0));
     try {
       if (!fstatSync(fd).isFile()) return null;
@@ -158516,7 +158590,7 @@ __export(screen_state_exports, {
   withHomeCaveat: () => withHomeCaveat
 });
 import { createHash as createHash26 } from "node:crypto";
-import { lstatSync as lstatSync17, readFileSync as readFileSync57 } from "node:fs";
+import { lstatSync as lstatSync19, readFileSync as readFileSync57 } from "node:fs";
 import { join as join44 } from "node:path";
 function quotableLine(text13) {
   if (!text13) return void 0;
@@ -158575,7 +158649,7 @@ function screenStateOf(services, html, opts = {}) {
 function readRecord(dir) {
   const file2 = join44(dir, SHOT_STATES_FILE);
   try {
-    if (!lstatSync17(file2).isFile()) return {};
+    if (!lstatSync19(file2).isFile()) return {};
     const r3 = JSON.parse(readFileSync57(file2, "utf8"));
     return r3.v === 1 && r3.shots && typeof r3.shots === "object" ? r3.shots : {};
   } catch {
@@ -158652,7 +158726,7 @@ __export(studio_reel_exports, {
   utcDay: () => utcDay
 });
 import { createHash as createHash27 } from "node:crypto";
-import { lstatSync as lstatSync18, readFileSync as readFileSync58 } from "node:fs";
+import { lstatSync as lstatSync20, readFileSync as readFileSync58 } from "node:fs";
 import { basename as basename16, join as join45 } from "node:path";
 function loadMemory2(dir) {
   const m2 = readJson5(join45(dir, ".himi", "studio", "memory.json"));
@@ -158737,7 +158811,7 @@ function inlineImages(dir, plan, budget = REEL_BUDGET_BYTES) {
     if (!HISTORY_NAME.test(f2)) return null;
     try {
       const path2 = join45(dir, HISTORY_DIR, f2);
-      const st2 = lstatSync18(path2);
+      const st2 = lstatSync20(path2);
       if (!st2.isFile() || st2.nlink !== 1) return null;
       const bytes2 = readFileSync58(path2);
       return createHash27("sha256").update(bytes2).digest("hex") === f2.slice(0, 64) && imageExtension(bytes2) === f2.slice(65) ? bytes2 : null;
@@ -158987,25 +159061,25 @@ __export(milestones_exports, {
 });
 import { createHash as createHash28, randomUUID as randomUUID10 } from "node:crypto";
 import { spawn as spawn4 } from "node:child_process";
-import { closeSync as closeSync5, existsSync as existsSync51, lstatSync as lstatSync19, readFileSync as readFileSync60, statSync as statSync17 } from "node:fs";
+import { closeSync as closeSync5, existsSync as existsSync51, lstatSync as lstatSync21, readFileSync as readFileSync60, statSync as statSync17 } from "node:fs";
 import { createServer as createServer3 } from "node:net";
-import { basename as basename17, dirname as dirname33, isAbsolute as isAbsolute4, join as join48, relative as relative11, resolve as resolve46, sep as sep15 } from "node:path";
+import { basename as basename17, dirname as dirname33, isAbsolute as isAbsolute5, join as join48, relative as relative12, resolve as resolve46, sep as sep17 } from "node:path";
 function homeShotPath(dir, home) {
   const root = resolve46(dir);
   const base = resolve46(root, ".himi", "shots");
   const shot = resolve46(base, `${home}.png`);
-  if (!shot.startsWith(base + sep15)) return null;
-  for (let p2 = shot; p2 !== root && p2.startsWith(root + sep15); p2 = dirname33(p2)) {
+  if (!shot.startsWith(base + sep17)) return null;
+  for (let p2 = shot; p2 !== root && p2.startsWith(root + sep17); p2 = dirname33(p2)) {
     try {
-      if (lstatSync19(p2).isSymbolicLink()) return null;
+      if (lstatSync21(p2).isSymbolicLink()) return null;
     } catch {
     }
   }
   return shot;
 }
 function displayPath(p2, cwd = process.cwd()) {
-  const rel = relative11(cwd, p2);
-  return rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : p2;
+  const rel = relative12(cwd, p2);
+  return rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : p2;
 }
 function progressCommand(opts) {
   return `himi progress "<${opts.what}>"${opts.step ? ` --step ${opts.step}` : ""}${opts.image ? ` --image ${shellQuote(opts.image)}` : ""}${contentArg(opts.content)}`;
@@ -159145,8 +159219,8 @@ async function openBoardForSession(dir, cwd = process.cwd()) {
   try {
     const { openStudio: openStudio2 } = await Promise.resolve().then(() => (init_studio(), studio_exports));
     const { page, url } = openStudio2(dir);
-    const rel = relative11(cwd, page);
-    return { page: rel && !rel.startsWith("..") && !isAbsolute4(rel) ? rel : page, url, opened: false };
+    const rel = relative12(cwd, page);
+    return { page: rel && !rel.startsWith("..") && !isAbsolute5(rel) ? rel : page, url, opened: false };
   } catch (e2) {
     return { opened: false, error: `the build board was not created: ${e2.message} \u2014 \`himi studio --no-open\` in the app retries it` };
   }
@@ -159332,7 +159406,7 @@ function rememberDraft(dir, releaseId, m2) {
 function lastDraft(dir) {
   try {
     const file2 = join48(dir, LAST_DRAFT_FILE);
-    if (!lstatSync19(file2).isFile()) return null;
+    if (!lstatSync21(file2).isFile()) return null;
     const r3 = JSON.parse(readFileSync60(file2, "utf8"));
     const m2 = r3.manifest;
     if (r3.v !== 1 || typeof r3.releaseId !== "string" || !m2 || typeof m2.screens !== "object" || !m2.screens || typeof m2.bundles !== "object" || !m2.bundles) return null;
@@ -159394,7 +159468,7 @@ function recordInitSource(dir, opts = {}) {
 function readInitSource(dir) {
   const file2 = join48(dir, INIT_SOURCE_FILE);
   try {
-    if (!lstatSync19(file2).isFile()) return null;
+    if (!lstatSync21(file2).isFile()) return null;
     const r3 = JSON.parse(readFileSync60(file2, "utf8"));
     if (r3.v !== 1 || typeof r3.fingerprint !== "string" || !/^[0-9a-f]{64}$/.test(r3.fingerprint) || typeof r3.newestMs !== "number") return null;
     return {
@@ -159469,7 +159543,7 @@ function contentHomePictures(dir, home) {
     if (r3.state.state !== "content") continue;
     for (const file2 of [shot, hist && join48(hist, `${r3.sha256}.png`)]) {
       try {
-        if (!file2 || !lstatSync19(file2).isFile() || sha256Of2(file2) !== r3.sha256) continue;
+        if (!file2 || !lstatSync21(file2).isFile() || sha256Of2(file2) !== r3.sha256) continue;
       } catch {
         continue;
       }
@@ -159482,7 +159556,7 @@ function contentHomePictures(dir, home) {
 function readInitWatch(dir) {
   const file2 = join48(dir, INIT_WATCH_FILE);
   try {
-    if (!lstatSync19(file2).isFile()) return null;
+    if (!lstatSync21(file2).isFile()) return null;
     const r3 = JSON.parse(readFileSync60(file2, "utf8"));
     if (r3.v !== 1 || typeof r3.pid !== "number" || !Number.isInteger(r3.pid) || r3.pid < 1) return null;
     if (typeof r3.url !== "string" || !/^http:\/\/127\.0\.0\.1:\d+\//.test(r3.url) || typeof r3.board !== "string" || typeof r3.log !== "string" || typeof r3.startedAt !== "string") return null;
@@ -159515,7 +159589,7 @@ function watchReminder(dir, opts = {}) {
     const file2 = join48(dir, REMINDERS_FILE);
     let last = Number.NaN;
     try {
-      if (lstatSync19(file2).isFile()) last = Date.parse(JSON.parse(readFileSync60(file2, "utf8")).watch ?? "");
+      if (lstatSync21(file2).isFile()) last = Date.parse(JSON.parse(readFileSync60(file2, "utf8")).watch ?? "");
     } catch {
     }
     if (Number.isFinite(last) && now - last >= 0 && now - last < WATCH_REMINDER_EVERY_MS) return void 0;
@@ -159638,7 +159712,7 @@ function afterHandoverPostcard(dir, opts = {}) {
   const file2 = join48(dir, ".himi", "making-of.html");
   let fresh = false;
   try {
-    const st2 = lstatSync19(file2);
+    const st2 = lstatSync21(file2);
     fresh = st2.isFile() && !st2.isSymbolicLink() && st2.mtimeMs >= statSync17(join48(dir, ".himi", "progress.jsonl")).mtimeMs;
   } catch {
     fresh = false;
@@ -163256,7 +163330,7 @@ __export(gen_native_config_exports, {
   xmlAttr: () => xmlAttr2,
   yamlScalar: () => yamlScalar
 });
-import { existsSync as existsSync61, mkdirSync as mkdirSync28, readFileSync as readFileSync71, readdirSync as readdirSync33, rmSync as rmSync18, statSync as statSync19, writeFileSync as writeFileSync25 } from "node:fs";
+import { existsSync as existsSync61, mkdirSync as mkdirSync29, readFileSync as readFileSync71, readdirSync as readdirSync33, rmSync as rmSync18, statSync as statSync19, writeFileSync as writeFileSync25 } from "node:fs";
 import { dirname as dirname36, join as join59 } from "node:path";
 import { fileURLToPath as fileURLToPath28 } from "node:url";
 function withoutComments(src) {
@@ -163778,7 +163852,7 @@ function applyWholeFile(path2, content, check) {
   const current = existsSync61(path2) ? readFileSync71(path2, "utf8") : null;
   if (current === content) return { path: path2, outcome: "unchanged" };
   if (check) return { path: path2, outcome: "drift" };
-  mkdirSync28(dirname36(path2), { recursive: true });
+  mkdirSync29(dirname36(path2), { recursive: true });
   writeFileSync25(path2, content);
   return { path: path2, outcome: "written" };
 }
@@ -164179,7 +164253,7 @@ __export(capabilities_exports, {
   shellSupport: () => shellSupport,
   writeLastDist: () => writeLastDist
 });
-import { existsSync as existsSync62, lstatSync as lstatSync20, readFileSync as readFileSync72 } from "node:fs";
+import { existsSync as existsSync62, lstatSync as lstatSync22, readFileSync as readFileSync72 } from "node:fs";
 import { join as join60 } from "node:path";
 function declareHintFor(id) {
   return catalogKey(id) === "app_services" ? "each calling screen's `logicBundle.declaredCapabilities` (the runtime gate) \u2014 an app need not list app_services in config.ts `capabilities`, which only a shell that hosts app services must (an HHP app declares it there, since HHP copies that list onto every screen)" : DECLARE_HINT;
@@ -164281,7 +164355,7 @@ async function writeLastDist(dir, rec) {
 function readLastDist(dir) {
   const path2 = join60(dir, LAST_DIST_FILE);
   try {
-    if (lstatSync20(join60(dir, ".himi")).isSymbolicLink() || lstatSync20(path2).isSymbolicLink()) return null;
+    if (lstatSync22(join60(dir, ".himi")).isSymbolicLink() || lstatSync22(path2).isSymbolicLink()) return null;
   } catch {
     return null;
   }
@@ -165125,7 +165199,7 @@ __export(base44_types_exports, {
   renderBase44Types: () => renderBase44Types,
   writeBase44Types: () => writeBase44Types
 });
-import { existsSync as existsSync63, mkdirSync as mkdirSync29, readFileSync as readFileSync73, writeFileSync as writeFileSync26 } from "node:fs";
+import { existsSync as existsSync63, mkdirSync as mkdirSync30, readFileSync as readFileSync73, writeFileSync as writeFileSync26 } from "node:fs";
 import { dirname as dirname37, join as join61 } from "node:path";
 function logicalName(spec) {
   return (isAdoptedEntity(spec) ? spec.base44Name : spec.name) ?? "";
@@ -165207,7 +165281,7 @@ async function writeBase44Types(dir, app) {
   const path2 = join61(dir, BASE44_TYPES_PATH);
   const changed = !existsSync63(path2) || readFileSync73(path2, "utf8") !== text13;
   if (changed) {
-    mkdirSync29(dirname37(path2), { recursive: true });
+    mkdirSync30(dirname37(path2), { recursive: true });
     writeFileSync26(path2, text13);
   }
   return { path: path2, changed, entities: text13.split("\nexport const ").length - 1 };
@@ -165359,8 +165433,8 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync65, mkdirSync as mkdirSync30, readFileSync as readFileSync75, writeFileSync as writeFileSync27 } from "node:fs";
-import { dirname as dirname38, join as join63, relative as relative12, resolve as resolve51, sep as sep16 } from "node:path";
+import { existsSync as existsSync65, mkdirSync as mkdirSync31, readFileSync as readFileSync75, writeFileSync as writeFileSync27 } from "node:fs";
+import { dirname as dirname38, join as join63, relative as relative13, resolve as resolve51, sep as sep18 } from "node:path";
 function locate(repoRootOrCwd, mod) {
   const inRepo = resolve51(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
   if (existsSync65(inRepo)) return { path: inRepo, form: "source" };
@@ -165390,7 +165464,7 @@ function ejectModule(opts) {
   }
   const ext = found.form === "source" ? "ts" : "mjs";
   const target = join63(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
-  mkdirSync30(dirname38(target), { recursive: true });
+  mkdirSync31(dirname38(target), { recursive: true });
   const banner = `// EJECTED from @wix/himalaya/${mod}. This app owns this file now.
 //
 // Central fixes to @wix/himalaya/${mod} NO LONGER REACH THIS APP \u2014 including any
@@ -165413,7 +165487,7 @@ function ejectModule(opts) {
     if (!existsSync65(f2)) continue;
     const before = readFileSync75(f2, "utf8");
     let after = before;
-    let rel = relative12(dirname38(f2), target).split(sep16).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative13(dirname38(f2), target).split(sep18).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q3 = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -165594,8 +165668,8 @@ __export(icon_exports, {
   writePreparedIcon: () => writePreparedIcon
 });
 import { createHash as createHash31 } from "node:crypto";
-import { accessSync as accessSync2, constants as constants4, existsSync as existsSync66, mkdirSync as mkdirSync31, readFileSync as readFileSync76, statSync as statSync20, writeFileSync as writeFileSync28 } from "node:fs";
-import { basename as basename19, dirname as dirname39, join as join64, resolve as resolve52, sep as sep17 } from "node:path";
+import { accessSync as accessSync2, constants as constants4, existsSync as existsSync66, mkdirSync as mkdirSync32, readFileSync as readFileSync76, statSync as statSync20, writeFileSync as writeFileSync28 } from "node:fs";
+import { basename as basename19, dirname as dirname39, join as join64, resolve as resolve52, sep as sep19 } from "node:path";
 function readManifest(dir) {
   try {
     return JSON.parse(readFileSync76(join64(dir, MANIFEST), "utf8"));
@@ -165612,12 +165686,12 @@ function declaredIconName(dir) {
 function iconDest(dir, name) {
   const base = resolve52(dir);
   const abs = resolve52(base, name);
-  if (!abs.startsWith(base + sep17)) {
+  if (!abs.startsWith(base + sep19)) {
     throw new Error(
       `himi icon: himalaya.content.json declares "icon": "${name}", which resolves outside the package (${abs}). Declare a path inside it, e.g. "${DEFAULT_CONTENT_ICON}".`
     );
   }
-  mkdirSync31(dirname39(abs), { recursive: true });
+  mkdirSync32(dirname39(abs), { recursive: true });
   return abs;
 }
 function templateIconMatch(png) {
@@ -165973,8 +166047,8 @@ function baseOf(target, linkable, known) {
   let best = null;
   for (const base of linkable ?? []) {
     if (!known.has(base) || target.length <= base.length + 1 || !target.startsWith(base)) continue;
-    const sep24 = target[base.length];
-    if ((sep24 === "_" || sep24 === "/") && (!best || base.length > best.length)) best = base;
+    const sep26 = target[base.length];
+    if ((sep26 === "_" || sep26 === "/") && (!best || base.length > best.length)) best = base;
   }
   return best;
 }
@@ -166347,7 +166421,7 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync69, mkdirSync as mkdirSync32, readFileSync as readFileSync79, writeFileSync as writeFileSync29 } from "node:fs";
+import { existsSync as existsSync69, mkdirSync as mkdirSync33, readFileSync as readFileSync79, writeFileSync as writeFileSync29 } from "node:fs";
 import { join as join68, resolve as resolve53 } from "node:path";
 function readTestConfig(dir) {
   const p2 = resolve53(dir, TEST_CONFIG_FILE);
@@ -166525,7 +166599,7 @@ function writeRecordedMocks(opts) {
     };
   }
   const fs2 = opts.io ?? {
-    mkdir: (p2) => mkdirSync32(p2, { recursive: true }),
+    mkdir: (p2) => mkdirSync33(p2, { recursive: true }),
     write: (p2, s2) => writeFileSync29(p2, s2)
   };
   fs2.mkdir(join68(opts.dir, "dev"));
@@ -167130,7 +167204,7 @@ var init_policy = __esm({
 // ../pre-pr-review/scope.mjs
 import { execFileSync as execFileSync4 } from "node:child_process";
 import { createHash as createHash32 } from "node:crypto";
-import { resolve as resolve55, dirname as dirname41, isAbsolute as isAbsolute5, join as join69 } from "node:path";
+import { resolve as resolve55, dirname as dirname41, isAbsolute as isAbsolute6, join as join69 } from "node:path";
 import { fileURLToPath as fileURLToPath30 } from "node:url";
 function resolveRepoRoot2(cwd = process.cwd()) {
   let top;
@@ -167175,8 +167249,8 @@ var init_scope = __esm({
 
 // ../verify-gate/diff-hash.mjs
 import {
-  lstatSync as lstatSync21,
-  mkdirSync as mkdirSync33,
+  lstatSync as lstatSync23,
+  mkdirSync as mkdirSync34,
   mkdtempSync as mkdtempSync3,
   readFileSync as readFileSync80,
   readlinkSync,
@@ -167289,7 +167363,7 @@ function validationDiffHash(cwd = process.cwd()) {
     const deletedRecord = () => [`${Buffer.byteLength(path2)}:${path2}`, "deleted", stagedIdentity(headEntry, indexEntry, void 0), ""].join("\0");
     let stat2;
     try {
-      stat2 = lstatSync21(absolute);
+      stat2 = lstatSync23(absolute);
     } catch (error) {
       if (error?.code === "ENOENT") return deletedRecord();
       throw error;
@@ -167325,7 +167399,7 @@ function validationDiffHash(cwd = process.cwd()) {
       }
     } catch (error) {
       try {
-        lstatSync21(absolute);
+        lstatSync23(absolute);
       } catch (recheck) {
         if (recheck?.code === "ENOENT") return deletedRecord();
       }
@@ -167351,7 +167425,7 @@ function seed(repo, commands) {
 }
 function write(repo, rel, body) {
   const absolute = resolve56(repo, rel);
-  mkdirSync33(dirname42(absolute), { recursive: true });
+  mkdirSync34(dirname42(absolute), { recursive: true });
   writeFileSync30(absolute, body);
 }
 function selfTestRepo({ withBase }) {
@@ -167523,8 +167597,8 @@ import { execFileSync as execFileSync5 } from "node:child_process";
 import { createHash as createHash35, randomBytes as randomBytes2 } from "node:crypto";
 import {
   existsSync as existsSync70,
-  lstatSync as lstatSync22,
-  mkdirSync as mkdirSync34,
+  lstatSync as lstatSync24,
+  mkdirSync as mkdirSync35,
   realpathSync as realpathSync9,
   readlinkSync as readlinkSync2,
   readFileSync as readFileSync81,
@@ -167532,7 +167606,7 @@ import {
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync31
 } from "node:fs";
-import { basename as basename21, join as join71, relative as relative13, resolve as resolve57 } from "node:path";
+import { basename as basename21, join as join71, relative as relative14, resolve as resolve57 } from "node:path";
 function attestationVersionOf(value2) {
   if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return null;
   const version5 = value2.attestation;
@@ -167582,7 +167656,7 @@ function repoRoot(contentDir2) {
 function storedContentDir(contentDir2) {
   const absolute = resolve57(contentDir2);
   const root = repoRoot(absolute);
-  return root ? relative13(root, absolute) || "." : ".";
+  return root ? relative14(root, absolute) || "." : ".";
 }
 function currentGitDiffHash(contentDir2) {
   const root = repoRoot(resolve57(contentDir2));
@@ -167594,20 +167668,20 @@ function currentGitUntrackedHash(contentDir2) {
   const absolute = realpathSync9.native(unresolved);
   const root = repoRoot(absolute);
   if (!root) return sourceTreeHash(absolute);
-  const scope2 = relative13(root, absolute) || ".";
+  const scope2 = relative14(root, absolute) || ".";
   const listed = execFileSync5("git", ["-C", root, "ls-files", "--others", "--exclude-standard", "-z", "--", scope2], {
     encoding: "utf8",
     maxBuffer: GIT_HASH_MAX_BUFFER
   });
   const hash3 = createHash35("sha256");
   for (const path2 of listed.split("\0").filter(Boolean).sort()) {
-    const local = relative13(absolute, join71(root, path2));
+    const local = relative14(absolute, join71(root, path2));
     const segs = local.split(/[\\/]/);
     if (NOT_ATTESTED_DIRS.has(segs[0])) continue;
     if (segs.length === 1 && AGENT_TOOLING_ROOT_FILES.includes(segs[0])) continue;
     if (MCP_HOST_CONFIG_FILES.includes(segs.join("/"))) continue;
     const full = join71(root, path2);
-    const stats = lstatSync22(full, { throwIfNoEntry: false });
+    const stats = lstatSync24(full, { throwIfNoEntry: false });
     if (!stats) continue;
     const kind = stats.isSymbolicLink() ? "link" : stats.isDirectory() ? "dir" : stats.isFile() ? "file" : null;
     if (!kind) continue;
@@ -167624,7 +167698,7 @@ function sourceTreeHash(root) {
     for (const entry of readdirSync34(dir, { withFileTypes: true }).sort((a2, b2) => a2.name < b2.name ? -1 : a2.name > b2.name ? 1 : 0)) {
       if (entry.isDirectory() && (entry.name === ".git" || entry.name === "node_modules" || NOT_ATTESTED_DIRS.has(entry.name))) continue;
       const path2 = join71(dir, entry.name);
-      const local = relative13(root, path2);
+      const local = relative14(root, path2);
       if (dir === root && entry.isFile() && AGENT_TOOLING_ROOT_FILES.includes(entry.name)) continue;
       if (MCP_HOST_CONFIG_FILES.includes(local.split(/[\\/]/).join("/"))) continue;
       if (entry.isDirectory()) visit(path2);
@@ -167742,7 +167816,7 @@ function summaryOf2(attestation) {
 function writeAttestation(input, opts = {}) {
   const contentDir2 = resolve57(input.contentDir);
   const dir = join71(contentDir2, ".himi", "attestations");
-  mkdirSync34(dir, { recursive: true });
+  mkdirSync35(dir, { recursive: true });
   const previous = readLatestAttestation(contentDir2);
   const runId2 = `${(opts.now ?? (() => /* @__PURE__ */ new Date()))().toISOString()}-${(opts.randomSuffix ?? (() => randomBytes2(3).toString("hex")))()}`;
   const descriptorHashes = Object.fromEntries(
@@ -167755,7 +167829,7 @@ function writeAttestation(input, opts = {}) {
   const screenshots = Object.fromEntries(screenshotEntries.map(({ screen, hash: hash3 }) => [screen, hash3]));
   for (const { bytes: bytes2, hash: hash3 } of screenshotEntries) {
     const artifact = screenshotArtifactPath(contentDir2, hash3);
-    mkdirSync34(join71(dir, "artifacts"), { recursive: true });
+    mkdirSync35(join71(dir, "artifacts"), { recursive: true });
     if (!existsSync70(artifact)) writeFileSync31(artifact, bytes2);
   }
   const unsigned = {
@@ -167902,8 +167976,8 @@ var init_attestation = __esm({
 });
 
 // src/ux-evidence.ts
-import { existsSync as existsSync71, mkdirSync as mkdirSync35, readFileSync as readFileSync82, writeFileSync as writeFileSync32 } from "node:fs";
-import { dirname as dirname43, isAbsolute as isAbsolute6, join as join72, relative as relative14, resolve as resolve58 } from "node:path";
+import { existsSync as existsSync71, mkdirSync as mkdirSync36, readFileSync as readFileSync82, writeFileSync as writeFileSync32 } from "node:fs";
+import { dirname as dirname43, isAbsolute as isAbsolute7, join as join72, relative as relative15, resolve as resolve58 } from "node:path";
 function isNativePlatform(value2) {
   return typeof value2 === "string" && NATIVE_PLATFORMS.includes(value2);
 }
@@ -167947,12 +168021,12 @@ function recordedRenderWidths(content) {
   return renderEvidenceEntries(evidence).map((entry) => entry.width);
 }
 function writeEvidence(path2, evidence) {
-  mkdirSync35(dirname43(path2), { recursive: true });
+  mkdirSync36(dirname43(path2), { recursive: true });
   writeFileSync32(path2, JSON.stringify(evidence, null, 2) + "\n");
 }
 function recordedFilePath(dir, file2) {
-  const rel = relative14(dir, resolve58(file2));
-  return rel && !rel.startsWith("..") && !isAbsolute6(rel) ? rel : file2;
+  const rel = relative15(dir, resolve58(file2));
+  return rel && !rel.startsWith("..") && !isAbsolute7(rel) ? rel : file2;
 }
 function recordRenderWidth(content, entry) {
   try {
@@ -170003,12 +170077,12 @@ var init_cli_bridge = __esm({
 });
 
 // src/mcp/file-tools.ts
-import { closeSync as closeSync6, constants as constants5, lstatSync as lstatSync23, mkdirSync as mkdirSync36, openSync as openSync5, readdirSync as readdirSync35, readFileSync as readFileSync88, realpathSync as realpathSync10, renameSync as renameSync13, rmSync as rmSync21, statSync as statSync21, writeSync, existsSync as existsSync76 } from "node:fs";
+import { closeSync as closeSync6, constants as constants5, lstatSync as lstatSync25, mkdirSync as mkdirSync37, openSync as openSync5, readdirSync as readdirSync35, readFileSync as readFileSync88, realpathSync as realpathSync10, renameSync as renameSync13, rmSync as rmSync21, statSync as statSync21, writeSync, existsSync as existsSync76 } from "node:fs";
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { dirname as dirname44, isAbsolute as isAbsolute7, join as join77, relative as relative15, resolve as resolve60, sep as sep18 } from "node:path";
+import { dirname as dirname44, isAbsolute as isAbsolute8, join as join77, relative as relative16, resolve as resolve60, sep as sep20 } from "node:path";
 import * as z2 from "zod";
 function within(root, p2) {
-  return p2 === root || p2.startsWith(root.endsWith(sep18) ? root : root + sep18);
+  return p2 === root || p2.startsWith(root.endsWith(sep20) ? root : root + sep20);
 }
 function realish(p2) {
   let cur = p2;
@@ -170016,17 +170090,17 @@ function realish(p2) {
   while (!existsSync76(cur)) {
     const up = dirname44(cur);
     if (up === cur) break;
-    tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep20) ? 0 : 1)));
     cur = up;
   }
   return join77(realpathSync10(cur), ...tail);
 }
 function symlinkComponent(base, abs) {
   let cur = base;
-  for (const part4 of relative15(base, abs).split(sep18).filter(Boolean)) {
+  for (const part4 of relative16(base, abs).split(sep20).filter(Boolean)) {
     cur = join77(cur, part4);
     try {
-      if (lstatSync23(cur).isSymbolicLink()) return relative15(base, cur);
+      if (lstatSync25(cur).isSymbolicLink()) return relative16(base, cur);
     } catch {
       return void 0;
     }
@@ -170049,7 +170123,7 @@ async function confinedAppDir(args, deps) {
   if (!within(root, dir) || !within(realpathSync10(root), realish(dir))) return refuse5("outside_workspace", `"${String(args.dir)}" is outside the workspace folder`);
   const link = symlinkComponent(root, dir);
   if (link) return refuse5("outside_workspace", `"${link}" is a symlink \u2014 the app folder must be a real folder in the workspace`);
-  const rel = relative15(root, dir);
+  const rel = relative16(root, dir);
   if (rel && (isDeniedSourcePath(`${rel}/x`) || isDeniedSourcePath(`${rel.toLowerCase()}/x`))) return refuse5("denied", `"${rel}" is a folder this tool does not touch`);
   if (!existsSync76(join77(dir, CONTENT_MARKER))) {
     return refuse5("not_an_app", `"${rel || "."}" is not an app folder (no ${CONTENT_MARKER}) \u2014 see himi_list_apps, or create one with himi_init`);
@@ -170062,16 +170136,16 @@ function onDiskSpelling(abs) {
   while (!existsSync76(cur)) {
     const up = dirname44(cur);
     if (up === cur) break;
-    tail.unshift(cur.slice(up.length + (up.endsWith(sep18) ? 0 : 1)));
+    tail.unshift(cur.slice(up.length + (up.endsWith(sep20) ? 0 : 1)));
     cur = up;
   }
   return join77(realpathSync10.native(cur), ...tail);
 }
 function denied(appDir3, abs) {
-  const rel = relative15(appDir3, abs);
+  const rel = relative16(appDir3, abs);
   if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) return true;
   try {
-    return isDeniedSourcePath(relative15(realpathSync10.native(appDir3), onDiskSpelling(abs)));
+    return isDeniedSourcePath(relative16(realpathSync10.native(appDir3), onDiskSpelling(abs)));
   } catch {
     return true;
   }
@@ -170079,7 +170153,7 @@ function denied(appDir3, abs) {
 function confinedPath(appDir3, rel) {
   if (typeof rel !== "string" || !rel.trim()) return { error: "a path is required" };
   if (rel.includes("\0")) return { error: "a path may not contain NUL" };
-  if (isAbsolute7(rel)) return { error: `"${rel}" is absolute \u2014 give a path inside the app folder` };
+  if (isAbsolute8(rel)) return { error: `"${rel}" is absolute \u2014 give a path inside the app folder` };
   const abs = resolve60(appDir3, rel);
   if (!within(appDir3, abs) || abs === appDir3) return { error: `"${rel}" is outside the app folder` };
   const real = realish(abs);
@@ -170091,7 +170165,7 @@ function confinedPath(appDir3, rel) {
   return abs;
 }
 function writeNoFollow2(appDir3, abs, content) {
-  mkdirSync36(dirname44(abs), { recursive: true });
+  mkdirSync37(dirname44(abs), { recursive: true });
   const before = symlinkComponent(appDir3, abs);
   if (before) throw new Error(`"${before}" became a symlink`);
   const tmp = join77(dirname44(abs), `.himi-write-${process.pid}-${randomBytes3(6).toString("hex")}.tmp`);
@@ -170104,14 +170178,14 @@ function writeNoFollow2(appDir3, abs, content) {
   const link = symlinkComponent(appDir3, abs);
   if (link || !within(realpathSync10(appDir3), realpathSync10(dirname44(abs)))) {
     rmSync21(tmp, { force: true });
-    throw new Error(`"${link ?? relative15(appDir3, dirname44(abs))}" changed into a link while writing`);
+    throw new Error(`"${link ?? relative16(appDir3, dirname44(abs))}" changed into a link while writing`);
   }
   renameSync13(tmp, abs);
 }
 function listFiles(appDir3) {
   const files = [];
   const walk2 = (d2) => {
-    const parentRel = relative15(appDir3, d2);
+    const parentRel = relative16(appDir3, d2);
     for (const e2 of readdirSync35(d2, { withFileTypes: true }).sort((a2, b2) => a2.name.localeCompare(b2.name))) {
       if (e2.isSymbolicLink()) continue;
       const p2 = join77(d2, e2.name);
@@ -170119,10 +170193,10 @@ function listFiles(appDir3) {
         if (isDeniedSourceDir(e2.name, parentRel) || isDeniedSourceDir(e2.name.toLowerCase(), parentRel)) continue;
         if (!walk2(p2)) return false;
       } else if (e2.isFile()) {
-        const rel = relative15(appDir3, p2);
+        const rel = relative16(appDir3, p2);
         if (isDeniedSourcePath(rel) || isDeniedSourcePath(rel.toLowerCase())) continue;
         if (files.length >= MAX_LISTED) return false;
-        files.push({ path: rel.split(sep18).join("/"), bytes: statSync21(p2).size });
+        files.push({ path: rel.split(sep20).join("/"), bytes: statSync21(p2).size });
       }
     }
     return true;
@@ -170173,7 +170247,7 @@ function fileTools() {
         if (typeof app !== "string") return app;
         const p2 = confinedPath(app, a2.path);
         if (typeof p2 !== "string") return refuse5("bad_path", p2.error);
-        if (!existsSync76(p2) || !lstatSync23(p2).isFile()) return refuse5("not_found", `no file "${String(a2.path)}"`);
+        if (!existsSync76(p2) || !lstatSync25(p2).isFile()) return refuse5("not_found", `no file "${String(a2.path)}"`);
         const size = statSync21(p2).size;
         if (size > MAX_FILE_BYTES) return refuse5("too_large", `"${String(a2.path)}" is ${size} bytes \u2014 over the ${MAX_FILE_BYTES}-byte read limit`);
         return ok({ ok: true, path: a2.path, bytes: size, content: readFileSync88(p2, "utf8") });
@@ -170200,7 +170274,7 @@ function fileTools() {
           if (typeof p2 !== "string") refused2.push({ path: f2.path, error: p2.error });
           else if (typeof f2.content !== "string") refused2.push({ path: f2.path, error: "content must be text" });
           else if (Buffer.byteLength(f2.content) > MAX_FILE_BYTES) refused2.push({ path: f2.path, error: `over the ${MAX_FILE_BYTES}-byte limit` });
-          else if (existsSync76(p2) && !lstatSync23(p2).isFile()) refused2.push({ path: f2.path, error: "not a regular file" });
+          else if (existsSync76(p2) && !lstatSync25(p2).isFile()) refused2.push({ path: f2.path, error: "not a regular file" });
           else if (planned2.some((q3) => q3.abs === p2)) refused2.push({ path: f2.path, error: "the same file twice in one call" });
           else planned2.push({ abs: p2, rel: String(f2.path), content: f2.content });
         }
@@ -170234,7 +170308,7 @@ function fileTools() {
           const p2 = confinedPath(app, rel);
           if (typeof p2 !== "string") refused2.push({ path: rel, error: p2.error });
           else if (!existsSync76(p2)) refused2.push({ path: rel, error: "no such file" });
-          else if (!lstatSync23(p2).isFile()) refused2.push({ path: rel, error: "not a regular file" });
+          else if (!lstatSync25(p2).isFile()) refused2.push({ path: rel, error: "not a regular file" });
           else if (!planned2.includes(p2)) {
             planned2.push(p2);
             deleted.push(rel);
@@ -170265,7 +170339,7 @@ var init_file_tools = __esm({
 
 // src/mcp/iap-tools.ts
 import * as z3 from "zod";
-import { dirname as dirname45, relative as relative16, resolve as resolve61 } from "node:path";
+import { dirname as dirname45, relative as relative17, resolve as resolve61 } from "node:path";
 async function paths(args, deps) {
   const base = await deps.defaultDir();
   const result = { ...args, workspaceDir: base };
@@ -170281,7 +170355,7 @@ function workspaceInputRefusal(args, deps, context) {
       const why = workspaceRefusal(context.boundary, args[key3]);
       if (why) return `${key3} ${why}`;
       if (key3 !== "dir" && key3 !== "plist") {
-        const confined = confinedPath(context.boundary, relative16(context.boundary, args[key3]));
+        const confined = confinedPath(context.boundary, relative17(context.boundary, args[key3]));
         if (typeof confined !== "string") return `${key3} ${confined.error}`;
       }
     }
@@ -170915,7 +170989,7 @@ __export(server_exports, {
   protectStdout: () => protectStdout,
   startMcpServer: () => startMcpServer
 });
-import { mkdirSync as mkdirSync37, readFileSync as readFileSync89 } from "node:fs";
+import { mkdirSync as mkdirSync38, readFileSync as readFileSync89 } from "node:fs";
 import { fileURLToPath as fileURLToPath31 } from "node:url";
 import { McpServer } from "@modelcontextprotocol/server";
 import { serveStdio, StdioServerTransport } from "@modelcontextprotocol/server/stdio";
@@ -170954,7 +171028,7 @@ async function startMcpServer(opts) {
   const runCli = createCliBridge(opts.run);
   if (opts.workspace) {
     try {
-      mkdirSync37(opts.workspace, { recursive: true });
+      mkdirSync38(opts.workspace, { recursive: true });
     } catch (e2) {
       console.error(`[himi mcp] could not create the workspace folder ${opts.workspace}: ${e2.message}`);
     }
@@ -171035,7 +171109,7 @@ var init_open_url = __esm({
 
 // src/ux-audit.ts
 import { existsSync as existsSync79, readFileSync as readFileSync90, readdirSync as readdirSync36 } from "node:fs";
-import { join as join81, relative as relative17, resolve as resolve65 } from "node:path";
+import { join as join81, relative as relative18, resolve as resolve65 } from "node:path";
 function issue(issues, strict, code, message2, path2) {
   issues.push({ code, message: message2, ...path2 ? { path: path2 } : {}, severity: strict ? "error" : "warning" });
 }
@@ -171057,7 +171131,7 @@ function walkSource(dir, root = dir) {
     if (!SOURCE_EXTENSIONS.has(ext)) continue;
     const absolute = join81(dir, entry.name);
     const text13 = readText2(absolute);
-    if (text13 !== null) found.push({ path: relative17(root, absolute), text: text13 });
+    if (text13 !== null) found.push({ path: relative18(root, absolute), text: text13 });
   }
   return found;
 }
@@ -171190,7 +171264,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync6, spawnSync as spawnSync8 } from "node:child_process";
-import { existsSync as existsSync80, mkdirSync as mkdirSync40, mkdtempSync as mkdtempSync5, readFileSync as readFileSync91, rmSync as rmSync23, writeFileSync as writeFileSync35 } from "node:fs";
+import { existsSync as existsSync80, mkdirSync as mkdirSync41, mkdtempSync as mkdtempSync5, readFileSync as readFileSync91, rmSync as rmSync23, writeFileSync as writeFileSync35 } from "node:fs";
 import { homedir as homedir10, tmpdir as tmpdir6 } from "node:os";
 import { join as join83 } from "node:path";
 import { fileURLToPath as fileURLToPath32 } from "node:url";
@@ -171353,7 +171427,7 @@ function writeDecodeInputs(descriptorDir, descriptors, tokensJson) {
     writeFileSync35(join83(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
   }
   if (tokensJson === void 0) return void 0;
-  mkdirSync40(join83(descriptorDir, "tokens"));
+  mkdirSync41(join83(descriptorDir, "tokens"));
   const tokensPath = join83(descriptorDir, "tokens", NATIVE_TOKENS_DOCUMENT);
   writeFileSync35(tokensPath, tokensJson);
   return tokensPath;
@@ -171512,7 +171586,7 @@ __export(browser_authoring_exports, {
 import { createServer as createServer4 } from "node:http";
 import { createHash as createHash38, randomBytes as randomBytes4 } from "node:crypto";
 import { existsSync as existsSync81, readdirSync as readdirSync37, readFileSync as readFileSync92, realpathSync as realpathSync11, statSync as statSync22 } from "node:fs";
-import { join as join84, posix as posix3, relative as relative18, sep as sep19 } from "node:path";
+import { join as join84, posix as posix3, relative as relative19, sep as sep21 } from "node:path";
 function humanMs(ms2) {
   return ms2 < 1e3 ? `${ms2}ms` : `${Math.round(ms2 / 1e3)}s`;
 }
@@ -171562,7 +171636,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       ];
       for (const abs of candidates) {
         if (!existsSync81(abs) || statSync22(abs).isDirectory()) continue;
-        const key3 = `/tier5-src/${relative18(tier5SrcDir, abs).split(sep19).join(posix3.sep)}`;
+        const key3 = `/tier5-src/${relative19(tier5SrcDir, abs).split(sep21).join(posix3.sep)}`;
         if (key3 in files) break;
         files[key3] = readFileSync92(abs, "utf8");
         queue.push(key3);
@@ -171772,7 +171846,7 @@ __export(coverage_exports, {
   suppressedNativeKeys: () => suppressedNativeKeys,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync82, mkdirSync as mkdirSync41, readFileSync as readFileSync93, writeFileSync as writeFileSync36 } from "node:fs";
+import { existsSync as existsSync82, mkdirSync as mkdirSync42, readFileSync as readFileSync93, writeFileSync as writeFileSync36 } from "node:fs";
 import { dirname as dirname48, join as join85 } from "node:path";
 function suppressedNativeKeys(oracle) {
   return [...oracle.ios ? [] : ["native-decode|ios"], ...oracle.android ? [] : ["native-decode|android"]];
@@ -171965,7 +172039,7 @@ function trendAndStore(dir, entries, suppressed) {
   const current = entries.map((e2) => e2.key);
   const stored = [.../* @__PURE__ */ new Set([...current, ...(previous ?? []).filter((key3) => (suppressed ?? []).includes(key3))])];
   try {
-    mkdirSync41(dirname48(p2), { recursive: true });
+    mkdirSync42(dirname48(p2), { recursive: true });
     writeFileSync36(p2, JSON.stringify({ keys: stored, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -172010,7 +172084,7 @@ function diffAndStoreObservations(dir, current) {
   } catch {
   }
   try {
-    mkdirSync41(dirname48(p2), { recursive: true });
+    mkdirSync42(dirname48(p2), { recursive: true });
     writeFileSync36(p2, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -174604,7 +174678,7 @@ var init_brand_font = __esm({
 });
 
 // src/site-analyze/write-artifacts.ts
-import { mkdirSync as mkdirSync42, rmSync as rmSync25, writeFileSync as writeFileSync37 } from "node:fs";
+import { mkdirSync as mkdirSync43, rmSync as rmSync25, writeFileSync as writeFileSync37 } from "node:fs";
 import { join as join89 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s2) => [s2.path, s2.text]));
@@ -174760,12 +174834,12 @@ async function downloadMedia(book, fetchImpl, put) {
 }
 async function writeBusinessBook(result, opts) {
   const out2 = opts.outDir;
-  mkdirSync42(join89(out2, "evidence/pages"), { recursive: true });
-  mkdirSync42(join89(out2, "media/catalog"), { recursive: true });
+  mkdirSync43(join89(out2, "evidence/pages"), { recursive: true });
+  mkdirSync43(join89(out2, "media/catalog"), { recursive: true });
   const files = [];
   const put = (rel, body) => {
     const p2 = join89(out2, rel);
-    mkdirSync42(join89(p2, ".."), { recursive: true });
+    mkdirSync43(join89(p2, ".."), { recursive: true });
     writeFileSync37(p2, body);
     files.push(rel);
   };
@@ -175364,7 +175438,7 @@ __export(coverage_exports2, {
 });
 import { createHash as createHash39 } from "node:crypto";
 import { existsSync as existsSync85, readFileSync as readFileSync96, writeFileSync as writeFileSync38 } from "node:fs";
-import { isAbsolute as isAbsolute8, join as join90, resolve as resolve67 } from "node:path";
+import { isAbsolute as isAbsolute9, join as join90, resolve as resolve67 } from "node:path";
 function verifiedEvidence(evidenceDir) {
   const manifest2 = obj4(JSON.parse(readFileSync96(join90(evidenceDir, "manifest.json"), "utf8")));
   if (manifest2.workflow !== "one-app-to-himi-app" || manifest2.stage !== "collected") throw Error("One App evidence is not collected.");
@@ -175535,7 +175609,7 @@ function verifyNativeProof(contentDir2, releaseHash, requirementIds) {
       continue;
     }
     const artifact = record3.artifact;
-    if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync85(join90(root, artifact))) {
+    if (typeof artifact !== "string" || !artifact.trim() || isAbsolute9(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync85(join90(root, artifact))) {
       issues.push(`Native walkthrough check ${id} needs a reviewable artifact file.`);
     }
   }
@@ -175652,7 +175726,7 @@ function verifyCoverage(evidenceDir, contentDir2, releaseHash, builtScreenIds) {
     }
     for (const check of matching) {
       const path2 = check.evidence;
-      if (typeof path2 !== "string" || !path2.trim() || isAbsolute8(path2) || path2.split(/[\\/]/).includes("..")) {
+      if (typeof path2 !== "string" || !path2.trim() || isAbsolute9(path2) || path2.split(/[\\/]/).includes("..")) {
         issues.push({ id, message: `Check ${required3} needs a safe relative evidence path.` });
       } else if (!existsSync85(join90(resolve67(contentDir2), path2))) {
         issues.push({ id, message: `Check ${required3} evidence file is absent: ${path2}.` });
@@ -175665,14 +175739,14 @@ function verifyCoverage(evidenceDir, contentDir2, releaseHash, builtScreenIds) {
             issues.push({ id, message: `Check ${required3} has no latest passed record for this requirement and target.` });
           } else {
             const artifact = record3.artifact;
-            if (typeof artifact !== "string" || !artifact.trim() || isAbsolute8(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync85(join90(resolve67(contentDir2), artifact))) {
+            if (typeof artifact !== "string" || !artifact.trim() || isAbsolute9(artifact) || artifact.split(/[\\/]/).includes("..") || !existsSync85(join90(resolve67(contentDir2), artifact))) {
               issues.push({ id, message: `Check ${required3} needs a reviewable artifact file.` });
             }
             if (kind === "native-widget") {
               const baseline = obj4(record3.sourceBaseline);
               const context = obj4(record3.targetContext);
               const sourceArtifact = baseline.artifact;
-              if (baseline.kind !== "native-device" || typeof sourceArtifact !== "string" || !sourceArtifact.trim() || isAbsolute8(sourceArtifact) || sourceArtifact.split(/[\\/]/).includes("..") || !existsSync85(join90(resolve67(contentDir2), sourceArtifact))) {
+              if (baseline.kind !== "native-device" || typeof sourceArtifact !== "string" || !sourceArtifact.trim() || isAbsolute9(sourceArtifact) || sourceArtifact.split(/[\\/]/).includes("..") || !existsSync85(join90(resolve67(contentDir2), sourceArtifact))) {
                 issues.push({ id, message: "Native widget behavior needs a source-device baseline artifact; editor-only observations are unverified." });
               }
               if (!["siteId", "identityContext"].every((key3) => typeof baseline[key3] === "string" && String(baseline[key3]).trim() && baseline[key3] === context[key3]) || typeof sourceSiteId !== "string" || baseline.siteId !== sourceSiteId) {
@@ -176527,8 +176601,8 @@ __export(validate_design_exports, {
   validateDesign: () => validateDesign
 });
 import { randomBytes as randomBytes5 } from "node:crypto";
-import { closeSync as closeSync7, constants as constants6, existsSync as existsSync89, lstatSync as lstatSync24, openSync as openSync6, readFileSync as readFileSync100, realpathSync as realpathSync12, renameSync as renameSync14, unlinkSync as unlinkSync5, writeFileSync as writeFileSync40 } from "node:fs";
-import { dirname as dirname49, isAbsolute as isAbsolute9, join as join94, relative as relative19, resolve as resolve70, sep as sep20, win32 } from "node:path";
+import { closeSync as closeSync7, constants as constants6, existsSync as existsSync89, lstatSync as lstatSync26, openSync as openSync6, readFileSync as readFileSync100, realpathSync as realpathSync12, renameSync as renameSync14, unlinkSync as unlinkSync5, writeFileSync as writeFileSync40 } from "node:fs";
+import { dirname as dirname49, isAbsolute as isAbsolute10, join as join94, relative as relative20, resolve as resolve70, sep as sep22, win32 } from "node:path";
 import ts12 from "typescript";
 function readColorToken(tokens2, name) {
   const entry = obj5(tokens2.colors)?.[name];
@@ -176747,33 +176821,33 @@ function activeIdiomNames(contentDir2, tokens2) {
   return /* @__PURE__ */ new Set();
 }
 function writableTokensPath(contentDir2, location) {
-  if (isAbsolute9(location) || win32.isAbsolute(location) || location.split(/[\\/]/).includes("..")) {
+  if (isAbsolute10(location) || win32.isAbsolute(location) || location.split(/[\\/]/).includes("..")) {
     throw new Error("--fix requires a token path inside the content directory without traversal.");
   }
   const root = realpathSync12(contentDir2);
   const path2 = resolve70(root, location);
-  const rel = relative19(root, path2);
-  if (!rel || rel === ".." || rel.startsWith(`..${sep20}`) || isAbsolute9(rel)) {
+  const rel = relative20(root, path2);
+  if (!rel || rel === ".." || rel.startsWith(`..${sep22}`) || isAbsolute10(rel)) {
     throw new Error("--fix requires a token path inside the content directory.");
   }
   let current = root;
-  const parts = rel.split(sep20);
+  const parts = rel.split(sep22);
   for (const [index, part4] of parts.entries()) {
     current = join94(current, part4);
-    const stat2 = lstatSync24(current);
+    const stat2 = lstatSync26(current);
     if (stat2.isSymbolicLink() || (index === parts.length - 1 ? !stat2.isFile() : !stat2.isDirectory())) {
       throw new Error("--fix requires a regular token file under directories without symlinks.");
     }
   }
-  const real = relative19(root, realpathSync12(path2));
-  if (!real || real === ".." || real.startsWith(`..${sep20}`) || isAbsolute9(real)) {
+  const real = relative20(root, realpathSync12(path2));
+  if (!real || real === ".." || real.startsWith(`..${sep22}`) || isAbsolute10(real)) {
     throw new Error("--fix cannot write outside the content directory.");
   }
   return path2;
 }
 function writeFixedTokens(contentDir2, location, path2, tokens2) {
   const temp = join94(dirname49(path2), `.himi-design-${process.pid}-${randomBytes5(6).toString("hex")}.tmp`);
-  const mode = lstatSync24(path2).mode & 511;
+  const mode = lstatSync26(path2).mode & 511;
   const fd = openSync6(temp, constants6.O_WRONLY | constants6.O_CREAT | constants6.O_EXCL | (constants6.O_NOFOLLOW ?? 0), mode);
   try {
     try {
@@ -176965,12 +177039,12 @@ function safeEvidencePath(contentDir2, name) {
   const root = realpathSync12(contentDir2);
   const dir = realDirIn(root, ".himi/one-app");
   if (!dir) throw new Error("The design evidence directory is not a regular directory.");
-  const real = relative19(root, realpathSync12(dir));
-  if (!real || real === ".." || real.startsWith(`..${sep20}`) || isAbsolute9(real)) {
+  const real = relative20(root, realpathSync12(dir));
+  if (!real || real === ".." || real.startsWith(`..${sep22}`) || isAbsolute10(real)) {
     throw new Error("The design evidence directory is outside the content directory.");
   }
   const path2 = join94(dir, name);
-  const stat2 = lstatSync24(path2, { throwIfNoEntry: false });
+  const stat2 = lstatSync26(path2, { throwIfNoEntry: false });
   if (stat2 && !stat2.isFile()) throw new Error("The design evidence file is not a regular file.");
   return path2;
 }
@@ -180108,7 +180182,7 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync as cpSync2, existsSync as existsSync92, mkdirSync as mkdirSync43, mkdtempSync as mkdtempSync8, readFileSync as readFileSync102, rmSync as rmSync28, statSync as statSync26 } from "node:fs";
+import { cpSync as cpSync2, existsSync as existsSync92, mkdirSync as mkdirSync44, mkdtempSync as mkdtempSync8, readFileSync as readFileSync102, rmSync as rmSync28, statSync as statSync26 } from "node:fs";
 import { networkInterfaces as osNetworkInterfaces, tmpdir as tmpdir9 } from "node:os";
 import { dirname as dirname50, join as join97 } from "node:path";
 import { fileURLToPath as fileURLToPath34 } from "node:url";
@@ -180154,7 +180228,7 @@ async function resolvePackage(source, workDir) {
       const root2 = workDir ?? mkdtempSync8(join97(tmpdir9(), "himi-run-"));
       const target = join97(root2, app2);
       if (join97(source) !== target) {
-        mkdirSync43(root2, { recursive: true });
+        mkdirSync44(root2, { recursive: true });
         rmSync28(target, { recursive: true, force: true });
         cpSync2(source, target, { recursive: true });
       }
@@ -184476,7 +184550,7 @@ var init_store_iap_connect = __esm({
 });
 
 // src/store-iap-screenshots.ts
-import { dirname as dirname52, join as join103, relative as relative21 } from "node:path";
+import { dirname as dirname52, join as join103, relative as relative22 } from "node:path";
 function purchaseScreensFor(item) {
   const screen = item.wix && PURCHASE_SCREENS[item.wix.entityType];
   if (!screen || !item.wix) return [];
@@ -184604,7 +184678,7 @@ async function shoot(selected, run2, outDir) {
   } catch (e2) {
     return { ...report3, skipped: `could not save the screenshot: ${e2.message}` };
   }
-  return { ...report3, screenshot: relative21(dirname52(run2.manifestPath), path2) };
+  return { ...report3, screenshot: relative22(dirname52(run2.manifestPath), path2) };
 }
 function visibleText2(html) {
   return html.replace(/&nbsp;|&#160;|&#xa0;/gi, "\xA0").replace(/&amp;/g, "&");
@@ -184802,7 +184876,7 @@ __export(store_iap_exports, {
 });
 import { execFileSync as execFileSync8 } from "node:child_process";
 import { randomUUID as randomUUID11 } from "node:crypto";
-import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync44, readFileSync as readFileSync115, realpathSync as realpathSync15, renameSync as renameSync16, rmSync as rmSync31, writeFileSync as writeFileSync41 } from "node:fs";
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync45, readFileSync as readFileSync115, realpathSync as realpathSync15, renameSync as renameSync16, rmSync as rmSync31, writeFileSync as writeFileSync41 } from "node:fs";
 import { homedir as homedir13, hostname as hostname2 } from "node:os";
 import { dirname as dirname53, join as join105, resolve as resolve76 } from "node:path";
 function scrubDeep(value2, scrub) {
@@ -185432,7 +185506,7 @@ async function screenshotsCommand(flags, deps, out2) {
   return report3.complete ? 0 : 1;
 }
 function writeBinaryFile(path2, bytes2) {
-  mkdirSync44(dirname53(path2), { recursive: true });
+  mkdirSync45(dirname53(path2), { recursive: true });
   const partial = `${path2}.${process.pid}.partial`;
   writeFileSync41(partial, bytes2);
   renameSync16(partial, path2);
@@ -185494,7 +185568,7 @@ function acquireApplyLock(dir, appleAppId) {
 }
 function stateDir(appleAppId) {
   const dir = join105(homedir13(), ".himalaya", "store-iap", appleAppId);
-  mkdirSync44(dir, { recursive: true, mode: 448 });
+  mkdirSync45(dir, { recursive: true, mode: 448 });
   return dir;
 }
 async function confirmOnTerminal(question) {
@@ -186941,7 +187015,7 @@ __export(secrets_exports, {
   runRemoteSecretsCommand: () => runRemoteSecretsCommand,
   runSecretsCommand: () => runSecretsCommand
 });
-import { readFileSync as readFileSync119 } from "node:fs";
+import { readFileSync as readFileSync120 } from "node:fs";
 function environment(value2) {
   if (value2 === "preview" || value2 === "production") return value2;
   throw new Error("--environment must be preview or production");
@@ -186972,7 +187046,7 @@ async function runSecretsCommand(operation, flags, io2, options = {}) {
       io2.log(JSON.stringify(await vault.list({ app, environment: env })));
       return 0;
     }
-    const value2 = options.readValue ? options.readValue() : readFileSync119(0, "utf8").replace(/\r?\n$/, "");
+    const value2 = options.readValue ? options.readValue() : readFileSync120(0, "utf8").replace(/\r?\n$/, "");
     if (operation === "set") await vault.set({ app, environment: env, name, value: value2 });
     else if (operation === "rotate") await vault.rotate({ app, environment: env, name, value: value2 });
     else throw new Error(`unknown secrets operation ${operation}`);
@@ -187001,7 +187075,7 @@ async function runRemoteSecretsCommand(operation, flags, io2, options) {
     }
     let body;
     if (operation !== "list") {
-      const value2 = options.readValue ? options.readValue() : readFileSync119(0, "utf8").replace(/\r?\n$/, "");
+      const value2 = options.readValue ? options.readValue() : readFileSync120(0, "utf8").replace(/\r?\n$/, "");
       body = JSON.stringify({ value: value2 });
     }
     const response = await (options.fetchImpl ?? fetch)(url, { method: operation === "list" ? "GET" : operation === "set" ? "PUT" : "POST", headers: headers2, body });
@@ -187509,7 +187583,7 @@ __export(notify_exports, {
   runNotify: () => runNotify,
   saveAdminSession: () => saveAdminSession
 });
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync45, readFileSync as readFileSync122, writeFileSync as writeFileSync43 } from "node:fs";
+import { chmodSync as chmodSync3, mkdirSync as mkdirSync46, readFileSync as readFileSync123, writeFileSync as writeFileSync43 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
 import { dirname as dirname56, join as join111 } from "node:path";
 function defaultSessionsPath() {
@@ -187517,7 +187591,7 @@ function defaultSessionsPath() {
 }
 function loadSessionsFile(path2 = defaultSessionsPath()) {
   try {
-    return JSON.parse(readFileSync122(path2, "utf8"));
+    return JSON.parse(readFileSync123(path2, "utf8"));
   } catch {
     return {};
   }
@@ -187525,7 +187599,7 @@ function loadSessionsFile(path2 = defaultSessionsPath()) {
 function saveAdminSession(adminUrl, session, path2 = defaultSessionsPath()) {
   const file2 = loadSessionsFile(path2);
   file2.sessions = { ...file2.sessions, [adminUrl]: session };
-  mkdirSync45(dirname56(path2), { recursive: true, mode: 448 });
+  mkdirSync46(dirname56(path2), { recursive: true, mode: 448 });
   writeFileSync43(path2, JSON.stringify(file2, null, 2) + "\n", { mode: 384 });
   try {
     chmodSync3(dirname56(path2), 448);
@@ -187822,8 +187896,8 @@ __export(auth_gate_copy_exports, {
   scanThrownMessages: () => scanThrownMessages
 });
 import { createHash as createHash50 } from "node:crypto";
-import { existsSync as existsSync104, readdirSync as readdirSync43, readFileSync as readFileSync123, writeFileSync as writeFileSync44 } from "node:fs";
-import { dirname as dirname57, join as join112, relative as relative22, resolve as resolve79 } from "node:path";
+import { existsSync as existsSync104, readdirSync as readdirSync43, readFileSync as readFileSync124, writeFileSync as writeFileSync44 } from "node:fs";
+import { dirname as dirname57, join as join112, relative as relative23, resolve as resolve79 } from "node:path";
 import { fileURLToPath as fileURLToPath36 } from "node:url";
 function discoverMessageSources() {
   const roots2 = [
@@ -187843,7 +187917,7 @@ function discoverMessageSources() {
         if (/^(?:test|tests|Tests|androidTest|build|node_modules|\.build)$/.test(name.name)) continue;
         visit(child);
       } else if (/\.(?:swift|kt)$/.test(name.name) && !GATE_SOURCES.includes(child)) {
-        if (MESSAGE_FILE.test(readFileSync123(join112(REPO_ROOT8, child), "utf8"))) out2.push(child);
+        if (MESSAGE_FILE.test(readFileSync124(join112(REPO_ROOT8, child), "utf8"))) out2.push(child);
       }
     }
   };
@@ -187851,7 +187925,7 @@ function discoverMessageSources() {
   return out2.sort();
 }
 function loadTable(path2 = TABLE_PATH) {
-  const raw = JSON.parse(readFileSync123(path2, "utf8"));
+  const raw = JSON.parse(readFileSync124(path2, "utf8"));
   const out2 = {};
   for (const [k2, v2] of Object.entries(raw)) {
     if (k2.startsWith("_")) continue;
@@ -187925,7 +187999,7 @@ function nativeKeysPath(appDir3) {
 function loadNativeKeys(appDir3) {
   const p2 = nativeKeysPath(appDir3);
   if (!existsSync104(p2)) return void 0;
-  const raw = JSON.parse(readFileSync123(p2, "utf8"));
+  const raw = JSON.parse(readFileSync124(p2, "utf8"));
   if (!Array.isArray(raw.keys) || raw.keys.some((k2) => typeof k2 !== "string")) {
     throw new Error(`${p2}: expected { "keys": string[] }`);
   }
@@ -187934,7 +188008,7 @@ function loadNativeKeys(appDir3) {
 function loadAppTable(appDir3) {
   const p2 = join112(appDir3, "strings", "en.json");
   if (!existsSync104(p2)) return {};
-  const raw = JSON.parse(readFileSync123(p2, "utf8"));
+  const raw = JSON.parse(readFileSync124(p2, "utf8"));
   const out2 = {};
   for (const [k2, v2] of Object.entries(raw)) if (!k2.startsWith("_") && typeof v2 === "string") out2[k2] = v2;
   return out2;
@@ -188123,14 +188197,14 @@ function looksLikeCopy(text13) {
   return /^[A-Z][a-z]/.test(t2);
 }
 function loadAllow(section3, path2 = ALLOW_PATH) {
-  const raw = JSON.parse(readFileSync123(path2, "utf8"));
+  const raw = JSON.parse(readFileSync124(path2, "utf8"));
   const list2 = raw[section3] ?? [];
   for (const e2 of list2) {
     if (!e2.file || !e2.text || !e2.reason) throw new Error(`allowlist entry missing file/text/reason: ${JSON.stringify(e2)}`);
   }
   return list2;
 }
-function scanProse(files, allow = [], read = (rel) => readFileSync123(join112(REPO_ROOT8, rel), "utf8")) {
+function scanProse(files, allow = [], read = (rel) => readFileSync124(join112(REPO_ROOT8, rel), "utf8")) {
   const hits = [];
   const usedAllow = /* @__PURE__ */ new Set();
   for (const file2 of files) {
@@ -188154,12 +188228,12 @@ function expectedOutputs(table = loadTable()) {
     { path: KOTLIN_OUT, content: renderKotlin(table) }
   ];
   for (const p2 of appSourceCatalogs()) {
-    const committed = JSON.parse(readFileSync123(p2, "utf8"));
+    const committed = JSON.parse(readFileSync124(p2, "utf8"));
     out2.push({ path: p2, content: serializeCatalog(injectAllNativeRows(committed, dirname57(dirname57(p2)), table)) });
   }
   return out2;
 }
-function scanThrownMessages(files, read = (rel) => readFileSync123(join112(REPO_ROOT8, rel), "utf8")) {
+function scanThrownMessages(files, read = (rel) => readFileSync124(join112(REPO_ROOT8, rel), "utf8")) {
   const out2 = [];
   for (const file2 of files) {
     const src = read(file2);
@@ -188255,7 +188329,7 @@ var init_auth_gate_copy = __esm({
 });
 
 // ../l10n/extract.ts
-import { resolve as resolve80, join as join113, relative as relative23, dirname as dirname58 } from "node:path";
+import { resolve as resolve80, join as join113, relative as relative24, dirname as dirname58 } from "node:path";
 import { createHash as createHash51 } from "node:crypto";
 import { fileURLToPath as fileURLToPath37 } from "node:url";
 function keyOf(source) {
@@ -188640,7 +188714,7 @@ __export(base44_adopt_exports, {
   renderAdoptModule: () => renderAdoptModule,
   runBase44Adopt: () => runBase44Adopt
 });
-import { existsSync as existsSync106, readFileSync as readFileSync125, writeFileSync as writeFileSync46 } from "node:fs";
+import { existsSync as existsSync106, readFileSync as readFileSync126, writeFileSync as writeFileSync46 } from "node:fs";
 import { join as join115, resolve as resolve82 } from "node:path";
 function prop(entity, key3) {
   const props2 = entity.schema?.properties;
@@ -188735,7 +188809,7 @@ function runBase44Adopt(opts) {
   const bookPath = join115(bookDir, "book.json");
   let book;
   try {
-    book = JSON.parse(readFileSync125(bookPath, "utf8"));
+    book = JSON.parse(readFileSync126(bookPath, "utf8"));
     if (!book || typeof book !== "object" || !Array.isArray(book.entities)) throw new Error("not a Base44 app book (no entities[])");
   } catch (e2) {
     throw new AdoptError("book_unreadable", `could not read ${bookPath}: ${e2.message}. Run \`himi base44 analyze --app-id <id>\` first.`);
@@ -189000,7 +189074,7 @@ __export(generate_exports, {
   writeGenerated: () => writeGenerated
 });
 import { createHash as createHash52 } from "node:crypto";
-import { existsSync as existsSync107, mkdirSync as mkdirSync47, readdirSync as readdirSync45, readFileSync as readFileSync126, writeFileSync as writeFileSync47 } from "node:fs";
+import { existsSync as existsSync107, mkdirSync as mkdirSync48, readdirSync as readdirSync45, readFileSync as readFileSync127, writeFileSync as writeFileSync47 } from "node:fs";
 import { dirname as dirname60, join as join116 } from "node:path";
 function withHeader(body) {
   return `${GENERATED_HEADER}${sha2566(body)}
@@ -189129,13 +189203,13 @@ function writeGenerated(dir, files, opts = {}) {
     let outcome;
     if (!existsSync107(abs)) outcome = "written";
     else {
-      const cur = readFileSync126(abs, "utf8");
+      const cur = readFileSync127(abs, "utf8");
       if (cur === next) outcome = "unchanged";
       else if (isEdited(cur) && !opts.force) outcome = "skipped-edited";
       else outcome = "written";
     }
     if (outcome === "written" && !opts.dryRun) {
-      mkdirSync47(dirname60(abs), { recursive: true });
+      mkdirSync48(dirname60(abs), { recursive: true });
       writeFileSync47(abs, next);
     }
     out2.push({ path: f2.path, outcome });
@@ -189154,7 +189228,7 @@ function orphanedFiles(dir, current) {
   }
   for (const rel of candidates.sort()) {
     if (keep.has(rel) || !existsSync107(join116(dir, rel))) continue;
-    if (readFileSync126(join116(dir, rel), "utf8").startsWith(GENERATED_HEADER)) found.push(rel);
+    if (readFileSync127(join116(dir, rel), "utf8").startsWith(GENERATED_HEADER)) found.push(rel);
   }
   return found;
 }
@@ -189193,7 +189267,7 @@ __export(base44_auth_exports, {
   usableBase44Auth: () => usableBase44Auth,
   writeBase44Session: () => writeBase44Session
 });
-import { chmodSync as chmodSync4, existsSync as existsSync108, mkdirSync as mkdirSync48, readFileSync as readFileSync127, rmSync as rmSync33, writeFileSync as writeFileSync48 } from "node:fs";
+import { chmodSync as chmodSync4, existsSync as existsSync108, mkdirSync as mkdirSync49, readFileSync as readFileSync128, rmSync as rmSync33, writeFileSync as writeFileSync48 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
 import { dirname as dirname61, join as join117 } from "node:path";
 function base44ApiBase(env = process.env) {
@@ -189206,7 +189280,7 @@ function readBase44Session(home) {
   const p2 = base44SessionPath(home);
   if (!existsSync108(p2)) return void 0;
   try {
-    const s2 = JSON.parse(readFileSync127(p2, "utf8"));
+    const s2 = JSON.parse(readFileSync128(p2, "utf8"));
     return typeof s2.accessToken === "string" && s2.accessToken ? s2 : void 0;
   } catch {
     return void 0;
@@ -189214,7 +189288,7 @@ function readBase44Session(home) {
 }
 function writeBase44Session(session, home) {
   const p2 = base44SessionPath(home);
-  mkdirSync48(dirname61(p2), { recursive: true, mode: 448 });
+  mkdirSync49(dirname61(p2), { recursive: true, mode: 448 });
   writeFileSync48(p2, `${JSON.stringify(session, null, 2)}
 `, { mode: 384 });
   chmodSync4(p2, 384);
@@ -189326,7 +189400,7 @@ function hasBase44WriteScope(auth) {
 function importBase44CliSession(home = homedir15(), env = process.env) {
   const src = join117(home, ".base44", "auth", "auth.json");
   if (!existsSync108(src)) throw new Error(`no Base44 CLI session at ${src} \u2014 run \`npx base44 login\` first, or use \`himi base44 login\``);
-  const a2 = JSON.parse(readFileSync127(src, "utf8"));
+  const a2 = JSON.parse(readFileSync128(src, "utf8"));
   if (typeof a2.accessToken !== "string" || !a2.accessToken) throw new Error(`${src} holds no access token`);
   const session = {
     accessToken: a2.accessToken,
@@ -189425,14 +189499,14 @@ __export(seed_exports, {
   seedBase44Entities: () => seedBase44Entities,
   writeBase44SeedRows: () => writeBase44SeedRows
 });
-import { existsSync as existsSync109, readFileSync as readFileSync128, writeFileSync as writeFileSync49 } from "node:fs";
+import { existsSync as existsSync109, readFileSync as readFileSync129, writeFileSync as writeFileSync49 } from "node:fs";
 import { join as join118 } from "node:path";
 function readBase44SeedFile(dir) {
   const file2 = join118(dir, BASE44_SEED_FILE);
   if (!existsSync109(file2)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync128(file2, "utf8"));
+    parsed = JSON.parse(readFileSync129(file2, "utf8"));
   } catch (e2) {
     throw new SeedFileError(`${BASE44_SEED_FILE} is not valid JSON (${e2.message}). Fix or delete it.`);
   }
@@ -189592,7 +189666,7 @@ function writeBase44SeedRows(opts) {
   if (existsSync109(path2)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync128(path2, "utf8"));
+      parsed = JSON.parse(readFileSync129(path2, "utf8"));
     } catch (e2) {
       throw new SeedFileError(`${BASE44_SEED_FILE} is not valid JSON (${e2.message}). Refusing to regenerate, because overwriting it would discard the rows already in it.`);
     }
@@ -189946,7 +190020,7 @@ __export(functions_exports2, {
   markerContent: () => markerContent,
   readFunctionSource: () => readFunctionSource
 });
-import { existsSync as existsSync110, lstatSync as lstatSync26 } from "node:fs";
+import { existsSync as existsSync110, lstatSync as lstatSync28 } from "node:fs";
 import { join as join119 } from "node:path";
 function markerContent(app) {
   return `${JSON.stringify({ app, by: "himi" })}
@@ -189955,7 +190029,7 @@ function markerContent(app) {
 function readFunctionSource(appDir3, name, app) {
   const rel = `base44/functions/${name}/`;
   const folder = join119(appDir3, "base44", "functions", name);
-  if (!existsSync110(folder) || !lstatSync26(folder).isDirectory()) throw new FunctionSourceError("function_source_missing", `no source folder at ${rel}`);
+  if (!existsSync110(folder) || !lstatSync28(folder).isDirectory()) throw new FunctionSourceError("function_source_missing", `no source folder at ${rel}`);
   const { entries, skipped } = collectAppSource(folder);
   if (skipped.length) throw new FunctionSourceError("function_source_unsafe", `${rel} holds paths himi will not upload (symlinks or denied names): ${skipped.join(", ")} \u2014 remove them`);
   const secrets = secretFindings(entries);
@@ -190296,7 +190370,7 @@ __export(apply_exports, {
   createBase44Entities: () => createBase44Entities,
   fileLedger: () => fileLedger
 });
-import { existsSync as existsSync111, readFileSync as readFileSync129, writeFileSync as writeFileSync50 } from "node:fs";
+import { existsSync as existsSync111, readFileSync as readFileSync130, writeFileSync as writeFileSync50 } from "node:fs";
 import { join as join120 } from "node:path";
 function fileLedger(dir, appId2) {
   const path2 = join120(dir, LEDGER_FILE2);
@@ -190304,7 +190378,7 @@ function fileLedger(dir, appId2) {
     if (!existsSync111(path2)) return {};
     let v2;
     try {
-      v2 = JSON.parse(readFileSync129(path2, "utf8"));
+      v2 = JSON.parse(readFileSync130(path2, "utf8"));
     } catch (e2) {
       throw new LedgerError(`${LEDGER_FILE2} is not valid JSON (${e2.message}) \u2014 fix it (a merge conflict?) rather than let himi rewrite it`);
     }
@@ -190956,11 +191030,11 @@ var init_analyze = __esm({
 });
 
 // src/base44-analyze/write-artifacts.ts
-import { existsSync as existsSync112, mkdirSync as mkdirSync49, readFileSync as readFileSync130, rmSync as rmSync34, writeFileSync as writeFileSync51 } from "node:fs";
-import { dirname as dirname62, join as join121, resolve as resolve83, sep as sep21 } from "node:path";
+import { existsSync as existsSync112, mkdirSync as mkdirSync50, readFileSync as readFileSync131, rmSync as rmSync34, writeFileSync as writeFileSync51 } from "node:fs";
+import { dirname as dirname62, join as join121, resolve as resolve83, sep as sep23 } from "node:path";
 function isBookFolder(dir) {
   try {
-    return JSON.parse(readFileSync130(join121(dir, "book.json"), "utf8")).kind === "base44-app-book";
+    return JSON.parse(readFileSync131(join121(dir, "book.json"), "utf8")).kind === "base44-app-book";
   } catch {
     return false;
   }
@@ -191052,12 +191126,12 @@ function writeBase44Book(result, outDir, opts = {}) {
     if (!isBookFolder(out2)) throw new Error(`refusing to write the app book into ${out2}: it already has ${owned.join(", ")} that ${owned.length === 1 ? "is" : "are"} not from an app book \u2014 pick an empty --out`);
     for (const d2 of ["source", "screenshots"]) rmSync34(join121(out2, d2), { recursive: true, force: true });
   }
-  mkdirSync49(out2, { recursive: true });
+  mkdirSync50(out2, { recursive: true });
   writeFileSync51(join121(out2, "book.json"), json8);
   writeFileSync51(join121(out2, "BOOK.md"), md);
   files.push("book.json", "BOOK.md");
   for (const s2 of shots) {
-    mkdirSync49(join121(out2, "screenshots"), { recursive: true });
+    mkdirSync50(join121(out2, "screenshots"), { recursive: true });
     writeFileSync51(join121(out2, "screenshots", s2.filename), s2.bytes);
     files.push(`screenshots/${s2.filename}`);
   }
@@ -191065,8 +191139,8 @@ function writeBase44Book(result, outDir, opts = {}) {
   for (const f2 of result.sourceFiles) {
     if (!safeRel(f2.path)) continue;
     const dest = join121(sourceRoot, ...f2.path.split("/"));
-    if (!dest.startsWith(sourceRoot + sep21)) continue;
-    mkdirSync49(dirname62(dest), { recursive: true });
+    if (!dest.startsWith(sourceRoot + sep23)) continue;
+    mkdirSync50(dirname62(dest), { recursive: true });
     writeFileSync51(dest, f2.bytes);
   }
   if (result.sourceFiles.length) files.push(`source/ (${result.sourceFiles.length} files)`);
@@ -194613,7 +194687,7 @@ __export(cli_exports, {
   systemTar: () => systemTar
 });
 import { execFile as execFile2 } from "node:child_process";
-import { mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync11, rmSync as rmSync35, writeFileSync as writeFileSync52 } from "node:fs";
+import { mkdirSync as mkdirSync51, mkdtempSync as mkdtempSync11, rmSync as rmSync35, writeFileSync as writeFileSync52 } from "node:fs";
 import { tmpdir as tmpdir12 } from "node:os";
 import { join as join122, resolve as resolve84 } from "node:path";
 import { promisify } from "node:util";
@@ -194634,7 +194708,7 @@ function projectDownloader(apiFetch, apiBase, token, extract = systemTar) {
       const archive = join122(root, "project.tar");
       const dir = join122(root, "project");
       writeFileSync52(archive, bytes2);
-      mkdirSync50(dir);
+      mkdirSync51(dir);
       await extract(archive, dir);
       return { dir, cleanup };
     } catch (e2) {
@@ -195878,7 +195952,7 @@ var init_invite_plan = __esm({
 });
 
 // src/one-app/payment-review.ts
-import { readFileSync as readFileSync131 } from "node:fs";
+import { readFileSync as readFileSync132 } from "node:fs";
 import { join as join124, resolve as resolve86 } from "node:path";
 function initialPaymentReview(metaSiteId) {
   return {
@@ -195952,7 +196026,7 @@ function runPaymentReview(args, io2) {
     const { manifest: manifest2 } = verifiedEvidence(evidenceDir);
     const metaSiteId = obj6(manifest2.source).metaSiteId;
     if (typeof metaSiteId !== "string") throw Error("Missing site binding");
-    const review = JSON.parse(readFileSync131(join124(evidenceDir, "payment-review.json"), "utf8"));
+    const review = JSON.parse(readFileSync132(join124(evidenceDir, "payment-review.json"), "utf8"));
     const issues = paymentReviewIssues(review, metaSiteId);
     if (issues.length) return fail7("payment_decision_required", issues, 1);
     io2.log(JSON.stringify({ ok: true, stage: "payment-decisions-reviewed", evidenceDir, verification: "Recorded evidence and decisions checked; merchant readiness is not independently verified by this command." }));
@@ -196136,7 +196210,7 @@ __export(validate_identity_exports, {
   runOneAppIdentityValidation: () => runOneAppIdentityValidation
 });
 import { createHash as createHash55 } from "node:crypto";
-import { existsSync as existsSync114, readFileSync as readFileSync132 } from "node:fs";
+import { existsSync as existsSync114, readFileSync as readFileSync133 } from "node:fs";
 import { join as join125, resolve as resolve87 } from "node:path";
 function ricosTexts(documentJson) {
   let root;
@@ -196193,7 +196267,7 @@ function literalSlugFindings(slug, displayName3, screens, authoredText = []) {
 }
 function sourceIdentity(evidenceDir) {
   const { manifest: manifest2, raw } = verifiedEvidence(evidenceDir);
-  const bytes2 = readFileSync132(join125(evidenceDir, "business-context.json"));
+  const bytes2 = readFileSync133(join125(evidenceDir, "business-context.json"));
   const hash3 = createHash55("sha256").update(bytes2).digest("hex");
   if (obj7(manifest2.sha256)["business-context.json"] !== hash3) throw Error("business-context.json differs from the collected evidence.");
   const name = obj7(JSON.parse(bytes2.toString("utf8"))).displayName;
@@ -196214,7 +196288,7 @@ function sourceIdentity(evidenceDir) {
   }
   const pagesPath = join125(evidenceDir, "pages-content.json");
   if (existsSync114(pagesPath)) {
-    const pagesBytes = readFileSync132(pagesPath);
+    const pagesBytes = readFileSync133(pagesPath);
     if (obj7(manifest2.sha256)["pages-content.json"] !== createHash55("sha256").update(pagesBytes).digest("hex")) throw Error("pages-content.json differs from the collected evidence.");
     for (const document2 of obj7(JSON.parse(pagesBytes.toString("utf8"))).documents ?? []) authoredText.push(...ricosTexts(obj7(obj7(document2).page).documentJson));
   }
@@ -196308,7 +196382,7 @@ __export(cli_exports2, {
   ONE_APP_WORKFLOW: () => ONE_APP_WORKFLOW,
   runOneAppCommand: () => runOneAppCommand
 });
-import { closeSync as closeSync9, constants as constants9, lstatSync as lstatSync27, mkdirSync as mkdirSync51, openSync as openSync8, readFileSync as readFileSync133, realpathSync as realpathSync17, writeFileSync as writeFileSync53 } from "node:fs";
+import { closeSync as closeSync9, constants as constants9, lstatSync as lstatSync29, mkdirSync as mkdirSync52, openSync as openSync8, readFileSync as readFileSync134, realpathSync as realpathSync17, writeFileSync as writeFileSync53 } from "node:fs";
 import { createHash as createHash56 } from "node:crypto";
 import { isIP as isIP2 } from "node:net";
 import { dirname as dirname63, join as join126, parse as parse3, resolve as resolve88 } from "node:path";
@@ -196379,9 +196453,9 @@ function readOptions(argv, cwd, commandIncluded) {
   if (flags["prompt-file"] !== void 0) {
     try {
       const file2 = resolve88(cwd, flags["prompt-file"]);
-      const stat2 = lstatSync27(file2);
+      const stat2 = lstatSync29(file2);
       if (!stat2.isFile() || stat2.size > MAX_PROMPT_BYTES) throw new Error("invalid prompt file");
-      prompt = readFileSync133(file2, "utf8");
+      prompt = readFileSync134(file2, "utf8");
     } catch {
       throw new OneAppError("invalid_prompt", "Use a readable text file of at most 64 KiB for --prompt-file.");
     }
@@ -196404,7 +196478,7 @@ function readOptions(argv, cwd, commandIncluded) {
 }
 function pathExists(path2) {
   try {
-    lstatSync27(path2);
+    lstatSync29(path2);
     return true;
   } catch (error) {
     if (error.code === "ENOENT") return false;
@@ -196416,7 +196490,7 @@ function assertSafeParents(path2) {
   let current = path2;
   while (current !== root) {
     try {
-      const stat2 = lstatSync27(current);
+      const stat2 = lstatSync29(current);
       if (stat2.isSymbolicLink() || !stat2.isDirectory()) {
         throw new OneAppError("invalid_output_path", "Choose an output parent without symlinks or non-directory components.");
       }
@@ -196537,12 +196611,12 @@ validate-payments checks site-bound payment evidence and explicit paid-flow deci
     }
     stage = "input";
     try {
-      mkdirSync51(options.parentDir, { recursive: true, mode: 448 });
+      mkdirSync52(options.parentDir, { recursive: true, mode: 448 });
       assertSafeParents(options.parentDir);
-      mkdirSync51(options.workspace, { mode: 448 });
+      mkdirSync52(options.workspace, { mode: 448 });
       if (realpathSync17(options.workspace) !== options.workspace) throw new Error("destination changed");
       evidenceDir = join126(options.workspace, ".himi", "one-app");
-      mkdirSync51(evidenceDir, { recursive: true, mode: 448 });
+      mkdirSync52(evidenceDir, { recursive: true, mode: 448 });
     } catch (error) {
       if (error.code === "EEXIST") {
         throw new OneAppError("output_exists", "The destination already exists. Choose a new --name or --dir.");
@@ -198687,8 +198761,8 @@ var init_customer_build = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync115, readFileSync as readFileSync134, writeFileSync as writeFileSync54, copyFileSync as copyFileSync2, mkdirSync as mkdirSync52, realpathSync as realpathSync18, statSync as statSync31 } from "node:fs";
-import { dirname as dirname64, isAbsolute as isAbsolute10, join as join127, resolve as resolve89, sep as sep22 } from "node:path";
+import { existsSync as existsSync115, readFileSync as readFileSync135, writeFileSync as writeFileSync54, copyFileSync as copyFileSync2, mkdirSync as mkdirSync53, realpathSync as realpathSync18, statSync as statSync31 } from "node:fs";
+import { dirname as dirname64, isAbsolute as isAbsolute11, join as join127, resolve as resolve89, sep as sep24 } from "node:path";
 import { spawnSync as spawnSync10 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
@@ -198822,12 +198896,12 @@ function buildMergedContract(options) {
   if (!existsSync115(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
-  const committed = JSON.parse(readFileSync134(committedPath, "utf8"));
+  const committed = JSON.parse(readFileSync135(committedPath, "utf8"));
   const previousPath = join127(appDir3, LOCAL_CONTRACT_REL);
   let evidenceOverlay = overlay;
   if ((overlay.businessContact === void 0 || overlay.loyalty === void 0 || overlay.businessTimeZone === void 0) && existsSync115(previousPath)) {
     try {
-      const previous = JSON.parse(readFileSync134(previousPath, "utf8"));
+      const previous = JSON.parse(readFileSync135(previousPath, "utf8"));
       if (previous && typeof previous === "object" && !Array.isArray(previous) && sameKnownSite(previous, overlay)) {
         evidenceOverlay = {
           ...overlay,
@@ -198844,9 +198918,9 @@ function buildMergedContract(options) {
   const branding = merged.branding ?? {};
   const staged = [];
   const contained = (root, rel) => {
-    if (isAbsolute10(rel)) return void 0;
+    if (isAbsolute11(rel)) return void 0;
     const full = resolve89(root, rel);
-    return full.startsWith(resolve89(root) + sep22) ? full : void 0;
+    return full.startsWith(resolve89(root) + sep24) ? full : void 0;
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
@@ -198860,10 +198934,10 @@ function buildMergedContract(options) {
     } catch {
       return void 0;
     }
-    if (!real.startsWith(realRoot + sep22)) return void 0;
+    if (!real.startsWith(realRoot + sep24)) return void 0;
     try {
       if (!statSync31(real).isFile()) return void 0;
-      mkdirSync52(dirname64(to2), { recursive: true });
+      mkdirSync53(dirname64(to2), { recursive: true });
       copyFileSync2(real, to2);
     } catch {
       return void 0;
@@ -198877,7 +198951,7 @@ function buildMergedContract(options) {
   if (existsSync115(facesPath)) {
     let faces = [];
     try {
-      const parsed = JSON.parse(readFileSync134(facesPath, "utf8"));
+      const parsed = JSON.parse(readFileSync135(facesPath, "utf8"));
       faces = Array.isArray(parsed) ? parsed : [];
     } catch {
       faces = [];
@@ -198901,7 +198975,7 @@ function buildMergedContract(options) {
   const path2 = join127(packageDir, "provisioning.contract.json");
   writeFileSync54(path2, body);
   const localPath2 = join127(appDir3, LOCAL_CONTRACT_REL);
-  mkdirSync52(dirname64(localPath2), { recursive: true });
+  mkdirSync53(dirname64(localPath2), { recursive: true });
   writeFileSync54(localPath2, body);
   staged.push(localPath2);
   return { path: path2, staged };
@@ -198938,7 +199012,7 @@ function staticFaqFor(overlay, overlayPath) {
   const bookPath = join127(dirname64(resolve89(overlayPath)), "book.json");
   if (!existsSync115(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync134(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync135(bookPath, "utf8"));
     const copy = book?.copy;
     if (!copy || typeof copy !== "object" || copy.unavailable) return void 0;
     const pairs = deriveStaticFaq(copy.faq);
@@ -198955,7 +199029,7 @@ function staticGalleriesFor(overlay, overlayPath) {
   const bookPath = join127(dirname64(resolve89(overlayPath)), "book.json");
   if (!existsSync115(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync134(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync135(bookPath, "utf8"));
     if (!book.look || book.look.unavailable || !Array.isArray(book.look.pages)) return void 0;
     const galleries = deriveStaticGalleries(book.look.pages);
     return galleries.length || book.look.complete === true ? galleries : void 0;
@@ -198967,8 +199041,8 @@ async function applyOverlays(input) {
   const cwd = resolve89(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
-  const overlay = JSON.parse(readFileSync134(input.overlayPath, "utf8"));
-  const tokens2 = JSON.parse(readFileSync134(input.tokensPath, "utf8"));
+  const overlay = JSON.parse(readFileSync135(input.overlayPath, "utf8"));
+  const tokens2 = JSON.parse(readFileSync135(input.tokensPath, "utf8"));
   const faq = staticFaqFor(overlay, input.overlayPath);
   if (faq !== void 0) overlay.faq = faq;
   const galleries = staticGalleriesFor(overlay, input.overlayPath);
@@ -198987,7 +199061,7 @@ async function applyOverlays(input) {
     }
     const appDir3 = join127(repoRoot2, shellAppDir(shell));
     const committedPath = join127(appDir3, "provisioning.json");
-    const committedSite = existsSync115(committedPath) ? JSON.parse(readFileSync134(committedPath, "utf8")).site : void 0;
+    const committedSite = existsSync115(committedPath) ? JSON.parse(readFileSync135(committedPath, "utf8")).site : void 0;
     if (committedSite !== void 0 && overlay.site === void 0) {
       throw new Error(
         `shell "${shell}" is a site shell: its contract names the customer's website (a \`site\` block), and this overlay has none. Re-run \`himi site analyze --url <site> --shell ${shell}\` to derive the site's page map (edit \`site.pages\` in provisioning.overlay.json if needed), then --apply.`
@@ -199029,7 +199103,7 @@ async function applyOverlays(input) {
   let packageFaq = faq;
   let packageGalleries = galleries;
   if (existsSync115(pkgProv)) {
-    const cur = JSON.parse(readFileSync134(pkgProv, "utf8"));
+    const cur = JSON.parse(readFileSync135(pkgProv, "utf8"));
     if (galleries === void 0 && !sameKnownSite(cur, overlay)) overlay.galleries = [];
     const merged = deepMerge4(cur, overlay);
     if (overlay.businessContact !== void 0) merged.businessContact = overlay.businessContact;
@@ -199053,7 +199127,7 @@ async function applyOverlays(input) {
   }
   const pkgTokens = join127(cwd, "tokens.json");
   if (existsSync115(pkgTokens) && (tokens2.colors || tokens2.typography)) {
-    const cur = JSON.parse(readFileSync134(pkgTokens, "utf8"));
+    const cur = JSON.parse(readFileSync135(pkgTokens, "utf8"));
     let tokensIn = tokens2;
     if (tokens2.typography) {
       const fonts = catalogTypography(tokens2.typography, cur.typography);
@@ -199080,7 +199154,7 @@ async function applyOverlays(input) {
   const homeAction = homeRefreshActionId(shell);
   const homeSrc = join127(cwd, "dev/index.ts");
   if (homeAction && existsSync115(homeSrc)) {
-    const prev = readFileSync134(homeSrc, "utf8");
+    const prev = readFileSync135(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
     if (!patched.foreign && faq?.length && prev.includes('"tier5.himiBrandedFaq.load"') && !prev.includes('"staticFaq"')) {
@@ -200083,7 +200157,7 @@ __export(cli_exports3, {
   runSiteAnalyze: () => runSiteAnalyze,
   runSiteFunctionCli: () => runSiteFunctionCli
 });
-import { existsSync as existsSync116, readFileSync as readFileSync135 } from "node:fs";
+import { existsSync as existsSync116, readFileSync as readFileSync136 } from "node:fs";
 import { resolve as resolve90 } from "node:path";
 function applyNeedsClient(shell) {
   if (shell === void 0 || !SHELL_NAMES.includes(shell)) return true;
@@ -200153,7 +200227,7 @@ async function runSiteAnalyze(opts) {
       const prevOverlayPath = resolve90(outDir, "provisioning.overlay.json");
       const prevSite = existsSync116(prevOverlayPath) ? (() => {
         try {
-          return JSON.parse(readFileSync135(prevOverlayPath, "utf8")).site;
+          return JSON.parse(readFileSync136(prevOverlayPath, "utf8")).site;
         } catch {
           return void 0;
         }
@@ -200172,7 +200246,7 @@ async function runSiteAnalyze(opts) {
   }
   const previousOverlay = resolve90(outDir, "provisioning.overlay.json");
   carryOverGoals(
-    existsSync116(previousOverlay) ? readFileSync135(previousOverlay, "utf8") : void 0,
+    existsSync116(previousOverlay) ? readFileSync136(previousOverlay, "utf8") : void 0,
     result.provisioningOverlay
   );
   const ownerCall = ownerAuth ? ownerTransportFrom(fetchImpl, ownerAuth) : void 0;
@@ -200230,7 +200304,7 @@ async function runSiteFunctionCli(opts) {
   let source;
   if (opts.sourcePath) {
     const p2 = resolve90(opts.cwd ?? process.cwd(), opts.sourcePath);
-    source = readFileSync135(p2, "utf8");
+    source = readFileSync136(p2, "utf8");
   }
   let body;
   if (opts.bodyRaw != null) {
@@ -200260,7 +200334,7 @@ async function runSiteFunctionCli(opts) {
 function base44BookRoutes(bookPath, siteUrl) {
   if (!existsSync116(bookPath)) return void 0;
   try {
-    const book = JSON.parse(readFileSync135(bookPath, "utf8"));
+    const book = JSON.parse(readFileSync136(bookPath, "utf8"));
     if (book.kind !== "base44-app-book" || !Array.isArray(book.routes)) return void 0;
     const host = (u2) => {
       try {
@@ -200518,7 +200592,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync117, readFileSync as readFileSync136, writeFileSync as writeFileSync55 } from "node:fs";
+import { existsSync as existsSync117, readFileSync as readFileSync137, writeFileSync as writeFileSync55 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -200667,7 +200741,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync117, readFileSync: readFileSync136, writeFileSync: writeFileSync55 }) {
+function writeProvisioningBinding(target, binding2, fs2 = { existsSync: existsSync117, readFileSync: readFileSync137, writeFileSync: writeFileSync55 }) {
   const msid = binding2.siteId;
   const path2 = resolvePath2(target);
   const committed = committedShellProvisioning(path2);
@@ -201451,14 +201525,14 @@ __export(capture_exports, {
   nativeNotConfigured: () => nativeNotConfigured,
   variantWidth: () => variantWidth
 });
-import { existsSync as existsSync118, mkdirSync as mkdirSync53, rmSync as rmSync36, writeFileSync as writeFileSync56 } from "node:fs";
+import { existsSync as existsSync118, mkdirSync as mkdirSync54, rmSync as rmSync36, writeFileSync as writeFileSync56 } from "node:fs";
 import { join as join128 } from "node:path";
 import { pathToFileURL as pathToFileURL10 } from "node:url";
 function variantWidth(variant) {
   return variant === "tablet" ? renderDeviceWidths().tablet : PHONE_WIDTH;
 }
 function frameFile(outDir, screen, variant, surface) {
-  mkdirSync53(outDir, { recursive: true });
+  mkdirSync54(outDir, { recursive: true });
   return join128(outDir, `${screen}.${variant}.${surface}.png`);
 }
 async function captureMockup(root, screen, entry, variant, outDir, session) {
@@ -201603,7 +201677,7 @@ var init_capture = __esm({
 
 // src/fidelity/judge.ts
 import { spawn as spawn7 } from "node:child_process";
-import { copyFileSync as copyFileSync3, mkdtempSync as mkdtempSync12, readFileSync as readFileSync137, rmSync as rmSync37 } from "node:fs";
+import { copyFileSync as copyFileSync3, mkdtempSync as mkdtempSync12, readFileSync as readFileSync138, rmSync as rmSync37 } from "node:fs";
 import { tmpdir as tmpdir13 } from "node:os";
 import { basename as basename29, dirname as dirname65, join as join129, resolve as resolve91 } from "node:path";
 import { fileURLToPath as fileURLToPath38 } from "node:url";
@@ -201639,8 +201713,8 @@ async function judgeStrip(strip3, screen, variant, opts = {}) {
   const judgeDir = opts.judgeDir ?? SOURCE_JUDGE_DIR;
   let prompt, schema;
   try {
-    prompt = readFileSync137(resolve91(judgeDir, "JUDGE.md"), "utf8");
-    schema = readFileSync137(resolve91(judgeDir, "verdict.schema.json"), "utf8");
+    prompt = readFileSync138(resolve91(judgeDir, "JUDGE.md"), "utf8");
+    schema = readFileSync138(resolve91(judgeDir, "verdict.schema.json"), "utf8");
   } catch (e2) {
     return cannotTell(`the judge prompt could not be read from ${judgeDir}: ${e2.message}`);
   }
@@ -201864,7 +201938,7 @@ __export(run_exports2, {
   runFidelity: () => runFidelity,
   runId: () => runId
 });
-import { mkdirSync as mkdirSync54, writeFileSync as writeFileSync57 } from "node:fs";
+import { mkdirSync as mkdirSync55, writeFileSync as writeFileSync57 } from "node:fs";
 import { basename as basename30, join as join132 } from "node:path";
 function runId(now = /* @__PURE__ */ new Date()) {
   return now.toISOString().replace(/[-:]/g, "").replace(/\..*/, "").replace("T", "-");
@@ -201899,7 +201973,7 @@ async function runFidelity(root, opts = {}) {
   const run2 = opts.run ?? runId();
   const dir = join132(opts.outRoot ?? join132(root, ".himi", "fidelity"), run2);
   const framesDir = join132(dir, "frames");
-  mkdirSync54(framesDir, { recursive: true });
+  mkdirSync55(framesDir, { recursive: true });
   const session = opts.capture?.mockup ? void 0 : new MockupSession();
   const mockup = opts.capture?.mockup ?? ((r3, s2, e2, v2, o2) => captureMockup(r3, s2, e2, v2, o2, session));
   const web = opts.capture?.web ?? captureWebVariant;
@@ -202035,7 +202109,7 @@ __export(fidelity_exports, {
 });
 import { execFileSync as execFileSync10 } from "node:child_process";
 import { existsSync as existsSync120, realpathSync as realpathSync19 } from "node:fs";
-import { join as join133, relative as relative25, sep as sep23 } from "node:path";
+import { join as join133, relative as relative26, sep as sep25 } from "node:path";
 function himalayaRepoRoot(dir) {
   let top;
   try {
@@ -202044,8 +202118,8 @@ function himalayaRepoRoot(dir) {
     return null;
   }
   if (!existsSync120(join133(top, "tools/judges/fidelity/JUDGE.md"))) return null;
-  const rel = relative25(realpathSync19(top), realpathSync19(dir));
-  return rel.startsWith(`..${sep23}`) || rel === ".." ? null : top;
+  const rel = relative26(realpathSync19(top), realpathSync19(dir));
+  return rel.startsWith(`..${sep25}`) || rel === ".." ? null : top;
 }
 function fidelityEnvelope(report3) {
   return report3.status === "fail" ? { ok: false, code: "fidelity_rows_failed", ...report3 } : { ok: true, ...report3 };
@@ -202893,7 +202967,8 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                              minBinaryVersion \u2014 all named in the output.
   himi dist [--app <a>] [--platform ios,android] [--release <id>] [--allow-draft] [--target <t>]
             [--shell branded-lite|owner-lite|brandy|base44|player|demo-app] [--signing wix-managed|byo]
-            [--android-signing qa-keystore|wix-keystore|debug] [--aab]
+            [--android-signing qa-keystore|wix-keystore|debug|owner] [--aab]
+            [--package-name <id> --google-services <file>]
             [--app-name <name> --app-icon-url <url>]
             [--borrow-ios-id <bundleId>] [--no-wait] [--force] [--plan]
                                            build an INSTALLABLE QA binary (signed IPA / APK) on
@@ -202939,10 +203014,16 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            link and QR for the APK. Android only. The bundle is
                                            signed with the Wix production key (wix-keystore, the
                                            upload key Branded apps use; any other
-                                           --android-signing is refused), the APK with the QA
+                                           --android-signing but owner is refused), the APK with the QA
                                            key. The default stays an APK only. For a Containers
                                            app, --aab --version <x.y.z> makes that the bundle's
                                            versionName, which Google Play shows.
+                                           --aab --android-signing owner --package-name <id>
+                                           --google-services <file> builds an UNSIGNED bundle
+                                           under your own package name and Firebase project,
+                                           for an app bound to no Wix site, with no APK beside
+                                           it. Sign it before uploading. Off until a plane
+                                           switches it on (501 owner_bundles_unconfigured).
                                            --app-name / --app-icon-url (together) give the binary
                                            a name and icon in place of the release's; the icon is
                                            a https://static.wixstatic.com/media/<file> URL. A
@@ -204733,7 +204814,7 @@ async function functionsCommand(ctx) {
 // src/commands/mcp.ts
 init_define_HHP_CATALOG();
 init_guides();
-import { mkdirSync as mkdirSync38, writeFileSync as writeFileSync33 } from "node:fs";
+import { mkdirSync as mkdirSync39, writeFileSync as writeFileSync33 } from "node:fs";
 import { join as join78, resolve as resolve63, dirname as dirname46 } from "node:path";
 init_cli_shared();
 async function mcpCommand(ctx) {
@@ -204750,7 +204831,7 @@ async function mcpCommand(ctx) {
       const dir2 = resolve63(out2);
       const files2 = himiStudioPluginFiles2();
       for (const f2 of files2) {
-        mkdirSync38(dirname46(join78(dir2, f2.path)), { recursive: true });
+        mkdirSync39(dirname46(join78(dir2, f2.path)), { recursive: true });
         writeFileSync33(join78(dir2, f2.path), f2.text);
       }
       print({ ok: true, dir: dir2, files: files2.map((f2) => f2.path), next: [`claude plugin validate ${dir2}`, `claude --plugin-dir ${dir2}`] });
@@ -204766,7 +204847,7 @@ async function mcpCommand(ctx) {
     const dir = resolve63(out2);
     const files = himiPluginFiles2(skills.skillMd);
     for (const f2 of files) {
-      mkdirSync38(dirname46(join78(dir, f2.path)), { recursive: true });
+      mkdirSync39(dirname46(join78(dir, f2.path)), { recursive: true });
       writeFileSync33(join78(dir, f2.path), f2.text);
     }
     print({ ok: true, dir, files: files.map((f2) => f2.path), next: [`claude plugin validate ${dir}`, `claude --plugin-dir ${dir}`] });
@@ -204785,7 +204866,7 @@ async function mcpCommand(ctx) {
 // src/commands/studio.ts
 init_define_HHP_CATALOG();
 init_cli_shared();
-import { mkdirSync as mkdirSync39, writeFileSync as writeFileSync34, existsSync as existsSync77 } from "node:fs";
+import { mkdirSync as mkdirSync40, writeFileSync as writeFileSync34, existsSync as existsSync77 } from "node:fs";
 import { join as join79, resolve as resolve64, basename as basename22, dirname as dirname47 } from "node:path";
 async function studioCommand(ctx) {
   const { io: io2, pos, flags, print } = ctx;
@@ -204799,7 +204880,7 @@ async function studioCommand(ctx) {
     const { buildReel: buildReel2 } = await Promise.resolve().then(() => (init_studio_reel(), studio_reel_exports));
     const out2 = resolve64(str3(flags.out) ?? join79(dir, ".himi", "making-of.html"));
     const { html, plan } = buildReel2(dir);
-    mkdirSync39(dirname47(out2), { recursive: true });
+    mkdirSync40(dirname47(out2), { recursive: true });
     writeFileSync34(out2, html);
     const { pathToFileURL: pathToFileURL11 } = await import("node:url");
     const url2 = pathToFileURL11(out2).href;
@@ -205902,7 +205983,7 @@ init_preview_surfaces();
 init_lint_report();
 import { createHash as createHash41 } from "node:crypto";
 import { existsSync as existsSync90 } from "node:fs";
-import { join as join95, relative as relative20 } from "node:path";
+import { join as join95, relative as relative21 } from "node:path";
 init_owner_claim();
 init_surface_lint();
 init_token_lint();
@@ -205924,8 +206005,8 @@ function pushAuthHint(status, token, target, hasOwnerIssuer = true) {
 }
 async function contentVisibility(dir) {
   try {
-    const { readFileSync: readFileSync138 } = await import("node:fs");
-    const m2 = JSON.parse(readFileSync138(join95(dir, "himalaya.content.json"), "utf8"));
+    const { readFileSync: readFileSync139 } = await import("node:fs");
+    const m2 = JSON.parse(readFileSync139(join95(dir, "himalaya.content.json"), "utf8"));
     if (m2.visibility === "public" || m2.visibility === "unlisted") return m2.visibility;
   } catch {
   }
@@ -206119,7 +206200,7 @@ async function pushCommand(ctx) {
     }
   }
   const { shellQuote: shellQuote3 } = await Promise.resolve().then(() => (init_shell_quote(), shell_quote_exports));
-  const contentRel = relative20(process.cwd(), dir) || ".";
+  const contentRel = relative21(process.cwd(), dir) || ".";
   const contentArg2 = shellQuote3(contentRel);
   if (onlyRaw !== void 0) {
     const onlyDraft = flags.draft === true;
@@ -208622,7 +208703,7 @@ async function testflightCommand(ctx) {
 
 // src/commands/dist.ts
 init_define_HHP_CATALOG();
-import { existsSync as existsSync101 } from "node:fs";
+import { existsSync as existsSync101, readFileSync as readFileSync118 } from "node:fs";
 import { join as join107 } from "node:path";
 init_wix_owner();
 init_cli_shared();
@@ -208951,6 +209032,21 @@ ${label3}`);
       }
     }
   }
+  let googleServicesJson;
+  const googleServicesPath = str3(flags["google-services"]);
+  if (googleServicesPath) {
+    try {
+      googleServicesJson = readFileSync118(googleServicesPath, "utf8");
+    } catch {
+      print({
+        ok: false,
+        error: "google_services_unreadable",
+        code: "google_services_unreadable",
+        message: `could not read ${googleServicesPath}`
+      });
+      return 1;
+    }
+  }
   let wixAuthorization;
   const testflight = str3(flags.destination) === "testflight";
   const customerTestflight = str3(flags.signing)?.trim().toLowerCase() === "byo" && testflight;
@@ -208966,7 +209062,7 @@ ${label3}`);
       });
       return 1;
     }
-  } else if (flags.aab === true || testflight && app !== "himi-player") {
+  } else if (flags.aab === true && !["owner", "unsigned"].includes(str3(flags["android-signing"])?.trim().toLowerCase() ?? "") || testflight && app !== "himi-player") {
     try {
       c2.assertWixAuthorizationTarget();
       wixAuthorization = await accountToken();
@@ -209020,6 +209116,9 @@ ${label3}`);
       // A Play bundle instead of an APK. The plane validates it (Android only, link destination,
       // a stable key) so every caller of the route gets the same refusal.
       ...flags.aab === true ? { androidFormat: "aab" } : {},
+      // An owner bundle (--android-signing owner): the plane leaves it unsigned, under this name.
+      ...str3(flags["package-name"]) ? { androidPackageName: str3(flags["package-name"]) } : {},
+      ...googleServicesJson !== void 0 ? { googleServicesJson } : {},
       // The App name and icon (a Wix Media file) a Containers app's store build ships under, in place
       // of the release's; a store build needs both. Sent as typed, so the plane gives the refusals.
       ...str3(flags["app-name"]) !== void 0 ? { appName: str3(flags["app-name"]) } : {},
@@ -209106,7 +209205,7 @@ ${label3}`);
         const installUrl = rec.platform === "ios" ? artifact?.installPageUrl : artifact?.downloadUrl ?? artifact?.installLink;
         const handoff = rec.customerAppStore;
         const handoffText = typeof handoff?.status === "string" ? `  testflight ${handoff.status}${handoff.error ? ` (${handoff.error})` : ""}` : "";
-        io2.log(`  ${rec.platform}  ${rec.status}${handoffText}${installUrl ? isAab ? `  .aab for Google Play (not installable) \u2192 ${installUrl}` : `  install \u2192 ${installUrl}` : ""}`);
+        io2.log(`  ${rec.platform}  ${rec.status}${handoffText}${installUrl ? isAab ? `  .aab for Google Play (${rec.ownerBundle ? "UNSIGNED: sign it before uploading" : "not installable"}) \u2192 ${installUrl}` : `  install \u2192 ${installUrl}` : ""}`);
         if (isAab && artifact?.apk?.downloadUrl) io2.log(`  ${rec.platform}  install APK (same build, QA key) \u2192 ${artifact.apk.downloadUrl}`);
         if (artifact?.caveat) io2.log(`  \u26A0 ${artifact.caveat}`);
       }
@@ -209128,7 +209227,7 @@ ${label3}`);
 // src/commands/login.ts
 init_define_HHP_CATALOG();
 init_config();
-import { readFileSync as readFileSync118 } from "node:fs";
+import { readFileSync as readFileSync119 } from "node:fs";
 init_browser_login();
 init_wix_owner();
 init_owner_claim();
@@ -209349,7 +209448,7 @@ async function loginCommand(ctx) {
     const dpxPath = dpxSessionTokenPath();
     let dpx;
     try {
-      dpx = readFileSync118(dpxPath, "utf8").trim();
+      dpx = readFileSync119(dpxPath, "utf8").trim();
     } catch {
       io2.error(JSON.stringify({ error: `no dpx session at ${dpxPath} \u2014 run \`dpx auth login\` then \`dpx auth token > ${dpxPath}\` (dpx 2.x keeps its own state in ~/.dpx/auth.json and does NOT write the legacy session file), or omit --dpx` }));
       return 1;
@@ -210219,7 +210318,7 @@ async function guideCommand(ctx) {
 
 // src/commands/secrets.ts
 init_define_HHP_CATALOG();
-import { readFileSync as readFileSync120 } from "node:fs";
+import { readFileSync as readFileSync121 } from "node:fs";
 init_cli_shared();
 async function secretsCommand(ctx) {
   const { io: io2, pos, flags } = ctx;
@@ -210240,7 +210339,7 @@ async function secretsCommand(ctx) {
     const path2 = dpxSessionTokenPath();
     let raw;
     try {
-      raw = readFileSync120(path2, "utf8");
+      raw = readFileSync121(path2, "utf8");
     } catch {
       io2.error(JSON.stringify({ error: `no DPX BO session at ${path2}` }));
       return 1;
@@ -210263,7 +210362,7 @@ init_schema2();
 init_define_HHP_CATALOG();
 init_cms_schema();
 init_wix_owner();
-import { existsSync as existsSync103, readFileSync as readFileSync121, writeFileSync as writeFileSync42 } from "node:fs";
+import { existsSync as existsSync103, readFileSync as readFileSync122, writeFileSync as writeFileSync42 } from "node:fs";
 import { join as join110 } from "node:path";
 var FOREIGN_DETAIL_LIMIT = 25;
 var MAX_COLLECTION_PAGES = 40;
@@ -210788,7 +210887,7 @@ function readSeedFile(dir) {
   if (!existsSync103(file2)) return {};
   let parsed;
   try {
-    parsed = JSON.parse(readFileSync121(file2, "utf8"));
+    parsed = JSON.parse(readFileSync122(file2, "utf8"));
   } catch (e2) {
     throw new Error(`cms-seed.json is not valid JSON (${e2.message}). Fix or delete it.`);
   }
@@ -210850,7 +210949,7 @@ async function writeSeedRows(opts) {
   if (existsSync103(file2)) {
     let parsed;
     try {
-      parsed = JSON.parse(readFileSync121(file2, "utf8"));
+      parsed = JSON.parse(readFileSync122(file2, "utf8"));
     } catch (e2) {
       throw new Error(
         `cms-seed.json is not valid JSON (${e2.message}). Refusing to regenerate, because overwriting it would discard the rows already in it. Fix the JSON, or delete the file if you want a fresh set.`
@@ -211176,10 +211275,10 @@ import {
   constants as constants8,
   existsSync as existsSync105,
   fstatSync as fstatSync2,
-  lstatSync as lstatSync25,
-  mkdirSync as mkdirSync46,
+  lstatSync as lstatSync27,
+  mkdirSync as mkdirSync47,
   openSync as openSync7,
-  readFileSync as readFileSync124,
+  readFileSync as readFileSync125,
   readdirSync as readdirSync44,
   realpathSync as realpathSync16,
   renameSync as renameSync17,
@@ -211187,20 +211286,20 @@ import {
   statSync as statSync30,
   writeFileSync as writeFileSync45
 } from "node:fs";
-import { basename as basename28, dirname as dirname59, join as join114, relative as relative24, resolve as resolve81 } from "node:path";
+import { basename as basename28, dirname as dirname59, join as join114, relative as relative25, resolve as resolve81 } from "node:path";
 var L10N_USAGE = "usage: himi l10n import --format oneapp <dir> (--app <slug> | --content <app dir>) [--locales en,he] [--source en] [--overwrite] [--json]";
 var MESSAGES_FILE = /^messages_(.+)\.json$/;
 var UnsafePath = class extends Error {
 };
 var isUnsafe2 = (e2) => e2 instanceof UnsafePath || e2?.code === "ELOOP";
 function readRegularFile(path2) {
-  const st2 = lstatSync25(path2);
+  const st2 = lstatSync27(path2);
   if (st2.isSymbolicLink()) throw new UnsafePath(`${path2} is a symbolic link`);
   if (!st2.isFile()) throw new Error(`${path2} is not a regular file`);
   const fd = openSync7(path2, constants8.O_RDONLY | (constants8.O_NOFOLLOW ?? 0));
   try {
     if (!fstatSync2(fd).isFile()) throw new Error(`${path2} is not a regular file`);
-    return readFileSync124(fd);
+    return readFileSync125(fd);
   } finally {
     closeSync8(fd);
   }
@@ -211209,7 +211308,7 @@ function unsafeDestination(appDir3, tags) {
   const l10nDir = join114(appDir3, "l10n");
   for (const path2 of [l10nDir, ...tags.map((t2) => join114(l10nDir, `${t2}.json`))]) {
     try {
-      if (lstatSync25(path2).isSymbolicLink()) return `${relative24(process.cwd(), path2)} is a symbolic link`;
+      if (lstatSync27(path2).isSymbolicLink()) return `${relative25(process.cwd(), path2)} is a symbolic link`;
     } catch (e2) {
       const code = e2.code;
       if (code !== "ENOENT" && code !== "ENOTDIR") throw e2;
@@ -211314,27 +211413,27 @@ async function l10nCommand(ctx) {
       buf = readRegularFile(path2);
     } catch (e2) {
       if (isUnsafe2(e2)) {
-        return fail7("unsafe_path", { error: `${relative24(process.cwd(), path2)} is a symbolic link \u2014 the import does not follow links in the messages directory`, file: path2, hint: "copy the real file into the directory, or point <dir> at where the files actually live" }, 1);
+        return fail7("unsafe_path", { error: `${relative25(process.cwd(), path2)} is a symbolic link \u2014 the import does not follow links in the messages directory`, file: path2, hint: "copy the real file into the directory, or point <dir> at where the files actually live" }, 1);
       }
-      return fail7("messages_unreadable", { error: `${relative24(process.cwd(), path2)}: ${e2.message}`, file: path2 }, 1);
+      return fail7("messages_unreadable", { error: `${relative25(process.cwd(), path2)}: ${e2.message}`, file: path2 }, 1);
     }
     const text13 = buf.toString("utf8");
     const utf16Bom = buf.length >= 2 && (buf[0] === 255 && buf[1] === 254 || buf[0] === 254 && buf[1] === 255);
     if (utf16Bom || buf.includes(0) || Buffer.compare(Buffer.from(text13, "utf8"), buf) !== 0) {
-      return fail7("messages_not_utf8", { error: `${relative24(process.cwd(), path2)} is not valid UTF-8`, file: path2, hint: "re-encode the file as UTF-8 (UTF-16 exports are the usual cause)" }, 1);
+      return fail7("messages_not_utf8", { error: `${relative25(process.cwd(), path2)} is not valid UTF-8`, file: path2, hint: "re-encode the file as UTF-8 (UTF-16 exports are the usual cause)" }, 1);
     }
     let parsed;
     try {
       parsed = JSON.parse(text13.replace(/^\uFEFF/, ""));
     } catch (e2) {
-      return fail7("messages_unreadable", { error: `${relative24(process.cwd(), path2)}: ${e2.message}`, file: path2 }, 1);
+      return fail7("messages_unreadable", { error: `${relative25(process.cwd(), path2)}: ${e2.message}`, file: path2 }, 1);
     }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      return fail7("messages_unreadable", { error: `${relative24(process.cwd(), path2)} is not an object of key \u2192 message`, file: path2 }, 1);
+      return fail7("messages_unreadable", { error: `${relative25(process.cwd(), path2)} is not an object of key \u2192 message`, file: path2 }, 1);
     }
     const bad2 = Object.entries(parsed).filter(([, v2]) => typeof v2 !== "string").map(([k2]) => k2);
     if (bad2.length > 0) {
-      return fail7("messages_unreadable", { error: `${relative24(process.cwd(), path2)} has non-string values`, file: path2, keys: bad2.slice(0, 5) }, 1);
+      return fail7("messages_unreadable", { error: `${relative25(process.cwd(), path2)} has non-string values`, file: path2, keys: bad2.slice(0, 5) }, 1);
     }
     files[tag] = parsed;
   }
@@ -211344,7 +211443,7 @@ async function l10nCommand(ctx) {
   try {
     unsafe2 = unsafeDestination(appDir3, requested);
   } catch (e2) {
-    return fail7("catalog_write_failed", { error: `cannot inspect ${relative24(process.cwd(), join114(appDir3, "l10n"))}: ${e2.message}`, written: [] }, 1);
+    return fail7("catalog_write_failed", { error: `cannot inspect ${relative25(process.cwd(), join114(appDir3, "l10n"))}: ${e2.message}`, written: [] }, 1);
   }
   if (unsafe2 !== void 0) {
     return fail7("unsafe_path", { error: `${unsafe2} \u2014 the import does not read or write through links`, hint: "replace the link with a real directory/file inside the app, then re-run" }, 1);
@@ -211360,7 +211459,7 @@ async function l10nCommand(ctx) {
       existing[tag] = parsed;
     } catch (e2) {
       return fail7("catalog_unreadable", {
-        error: `existing catalog ${relative24(process.cwd(), path2)} cannot be parsed \u2014 refusing to overwrite it`,
+        error: `existing catalog ${relative25(process.cwd(), path2)} cannot be parsed \u2014 refusing to overwrite it`,
         file: path2,
         cause: e2.message
       }, 1);
@@ -211419,7 +211518,7 @@ async function l10nCommand(ctx) {
   }
   const written = [];
   try {
-    mkdirSync46(join114(appDir3, "l10n"), { recursive: true });
+    mkdirSync47(join114(appDir3, "l10n"), { recursive: true });
     const swapped = unsafeDestination(appDir3, requested);
     const l10nReal = realpathSync16(join114(appDir3, "l10n"));
     if (swapped !== void 0 || l10nReal !== join114(realpathSync16(appDir3), "l10n")) {
@@ -211428,7 +211527,7 @@ async function l10nCommand(ctx) {
     for (const tag of requested) {
       const path2 = join114(appDir3, "l10n", `${tag}.json`);
       writeCatalog(path2, JSON.stringify(catalogs[tag], null, 2) + "\n");
-      written.push({ tag, path: relative24(process.cwd(), path2), count: Object.keys(catalogs[tag].messages).length });
+      written.push({ tag, path: relative25(process.cwd(), path2), count: Object.keys(catalogs[tag].messages).length });
     }
   } catch (e2) {
     if (isUnsafe2(e2)) return fail7("unsafe_path", { error: `${e2.message} \u2014 nothing more was written`, written }, 1);