@wix/himalaya-cli 0.808.0 → 0.810.0

package/dist/cli.mjs

@@ -807,7 +807,13 @@ var init_source_deny = __esm({
       /^\.env\./,
       /^\.DS_Store$/,
       /^id_rsa($|\.)/,
-      /\.(pem|p8|p12|keystore|jks|mobileprovision)$/i
+      /\.(pem|p8|p12|keystore|jks|mobileprovision)$/i,
+      // `.git` IS NOT ALWAYS A DIRECTORY. In a linked worktree or a submodule it is a FILE holding
+      // `gitdir: …`, and DENY_DIRS is consulted for directories only — so at a package root it was
+      // denied by nothing: `himi push` archived the pointer, and `himi pull --replace` would delete
+      // it back out of a checkout whose release predates it (#2437). The guarantee that a restore
+      // cannot cost you a git history has to hold for both shapes of `.git`, not just the common one.
+      /^\.git$/
     ];
   }
 });
@@ -1014,7 +1020,7 @@ function sentinelizeIdentity(body, identity) {
   }
   if (identity.name) {
     const re = new RegExp(`\\b(${NAME_FIELDS.join("|")})(["']?\\s*[:=]\\s*)(["'])${escapeRe(identity.name)}\\3`, "g");
-    out = out.replace(re, (_m, key2, sep10, q) => `${key2}${sep10}${q}__HIMI_APP_NAME__${q}`);
+    out = out.replace(re, (_m, key2, sep11, q) => `${key2}${sep11}${q}__HIMI_APP_NAME__${q}`);
   }
   return out;
 }
@@ -1954,7 +1960,7 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     tokenCache.set(cacheKey, fromEnv);
     return fromEnv;
   }
-  const token = await new Promise((resolve40, reject) => {
+  const token = await new Promise((resolve41, reject) => {
     let child;
     try {
       child = spawnImpl("wix", [...args]);
@@ -1983,12 +1989,12 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     child.stdout?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     });
     child.stderr?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     });
     child.on("error", (e) => done(() => reject(new Error(mintHelp(label2, e.message)))));
     child.on("exit", (code) => done(() => reject(new Error(
@@ -2496,8 +2502,8 @@ var init_splash = __esm({
 
 // ../../core/dev-server/tier5-bundles-src/build-lib.mjs
 import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL2 } from "node:url";
-import { dirname as dirname8, resolve as resolve8 } from "node:path";
-import { readdirSync as readdirSync6, existsSync as existsSync8, readFileSync as readFileSync10 } from "node:fs";
+import { dirname as dirname8, join as join12, resolve as resolve8, sep as sep2 } from "node:path";
+import { readdirSync as readdirSync6, existsSync as existsSync8, readFileSync as readFileSync10, realpathSync as realpathSync2, statSync as statSync2 } from "node:fs";
 async function loadCompiler() {
   try {
     const nativeCompiler = ["es", "build"].join("");
@@ -2530,6 +2536,259 @@ function isOffRepo() {
   if (process.env.HIMI_OFF_REPO === "1") return true;
   return !existsSync8(alias["@himalaya/state"]);
 }
+function buildConfinementRequired() {
+  return _confinementRequired;
+}
+function realpathOrSelf(p) {
+  try {
+    return realpathSync2(resolve8(p));
+  } catch {
+    return resolve8(p);
+  }
+}
+function isUnder(p, root) {
+  return p === root || p.startsWith(root + sep2);
+}
+function confinementRoots(contentRoot) {
+  const roots = /* @__PURE__ */ new Set();
+  const add = (p) => {
+    if (!p) return;
+    roots.add(realpathOrSelf(p));
+    roots.add(resolve8(p));
+  };
+  const real = realpathOrSelf(contentRoot);
+  add(real);
+  for (let d = real, up; ; d = up) {
+    add(join12(d, "node_modules"));
+    up = dirname8(d);
+    if (up === d) break;
+  }
+  add(process.env.HIMI_AUTHORING_RUNTIME_DIR);
+  add(process.env.HIMI_CLI_RUNTIME_DIR);
+  if (!isOffRepo()) add(REPO_ROOT4);
+  return [...roots];
+}
+function confinementMatcher(contentRoot, extraRoots = []) {
+  const roots = [...confinementRoots(contentRoot), ...extraRoots.filter(Boolean).flatMap((r) => [realpathOrSelf(r), resolve8(r)])];
+  let linked;
+  const linkedRoots = () => {
+    if (linked) return linked;
+    linked = [];
+    const scanned = /* @__PURE__ */ new Set();
+    const queue = [...roots];
+    const CAP3 = 4096;
+    const take = (abs) => {
+      const target = realpathOrSelf(abs);
+      if (scanned.has(target) || linked.length >= CAP3) return;
+      linked.push(target);
+      queue.push(target);
+    };
+    while (queue.length && linked.length < CAP3) {
+      const r = queue.shift();
+      for (const nm of [r, join12(r, "node_modules")]) {
+        if (scanned.has(nm)) continue;
+        scanned.add(nm);
+        let entries;
+        try {
+          entries = readdirSync6(nm, { withFileTypes: true });
+        } catch {
+          continue;
+        }
+        for (const e of entries) {
+          const abs = join12(nm, e.name);
+          if (e.isSymbolicLink()) take(abs);
+          else if (e.isDirectory() && e.name.startsWith("@")) {
+            let scoped;
+            try {
+              scoped = readdirSync6(abs, { withFileTypes: true });
+            } catch {
+              continue;
+            }
+            for (const sc of scoped) if (sc.isSymbolicLink()) take(join12(abs, sc.name));
+          }
+        }
+      }
+    }
+    return linked;
+  };
+  return (p) => {
+    const direct = resolve8(p);
+    if (roots.some((r) => isUnder(direct, r))) return true;
+    const real = realpathOrSelf(direct);
+    if (real !== direct && roots.some((r) => isUnder(real, r))) return true;
+    return linkedRoots().some((r) => isUnder(real, r) || isUnder(direct, r));
+  };
+}
+function confinementPlugin(contentRoot) {
+  const allows = confinementMatcher(contentRoot);
+  return {
+    name: "himalaya-confine-import-graph",
+    setup(b) {
+      b.onResolve({ filter: /^[./]/ }, (args) => {
+        const base = args.path.startsWith("/") ? args.path : args.resolveDir ? resolve8(args.resolveDir, args.path) : void 0;
+        if (!base || allows(base)) return void 0;
+        return {
+          errors: [{
+            text: `refused to resolve ${args.path}: it is outside this content package. A worker or app config may import files from its own package, the Himalaya SDK, and its installed dependencies \u2014 nothing else.`
+          }]
+        };
+      });
+      b.onLoad({ filter: /.*/ }, (args) => {
+        if (args.namespace && args.namespace !== "file") return void 0;
+        if (allows(args.path)) return void 0;
+        return {
+          errors: [{
+            text: `refused to read ${args.path}: it is outside this content package. A worker or app config may import files from its own package, the Himalaya SDK, and its installed dependencies \u2014 nothing else.`
+          }]
+        };
+      });
+    }
+  };
+}
+function assertConfinedTsconfig(entry, contentRoot, allows) {
+  const seen = /* @__PURE__ */ new Set();
+  const refuse = (p, why) => {
+    throw new Error(
+      `refused to read ${p}: ${why}. A tsconfig may extend a file from its own package or an installed dependency \u2014 nothing else.`
+    );
+  };
+  const stripJsonc = (text2) => {
+    if (text2.charCodeAt(0) === 65279) text2 = text2.slice(1);
+    let out = "";
+    let inStr = false;
+    let esc = false;
+    for (let i = 0; i < text2.length; i++) {
+      const c = text2[i];
+      if (inStr) {
+        out += c;
+        if (esc) esc = false;
+        else if (c === "\\") esc = true;
+        else if (c === '"') inStr = false;
+        continue;
+      }
+      if (c === '"') {
+        inStr = true;
+        out += c;
+        continue;
+      }
+      if (c === "/" && text2[i + 1] === "/") {
+        while (i < text2.length && text2[i] !== "\n") i++;
+        continue;
+      }
+      if (c === "/" && text2[i + 1] === "*") {
+        i += 2;
+        while (i < text2.length && !(text2[i] === "*" && text2[i + 1] === "/")) i++;
+        i++;
+        continue;
+      }
+      if (c === "}" || c === "]") {
+        const trimmed = out.replace(/\s+$/, "");
+        if (trimmed.endsWith(",")) out = trimmed.slice(0, -1);
+      }
+      out += c;
+    }
+    return out;
+  };
+  const isFile = (p) => {
+    try {
+      return statSync2(p).isFile();
+    } catch {
+      return false;
+    }
+  };
+  const asConfigFile = (t) => {
+    if (isFile(t)) return t;
+    const inDir = join12(t, "tsconfig.json");
+    if (isFile(inDir)) return inDir;
+    if (isFile(`${t}.json`)) return `${t}.json`;
+    return t;
+  };
+  const resolveBare = (spec, fromDir) => {
+    for (let d = fromDir, up; ; d = up) {
+      const base = join12(d, "node_modules", spec);
+      for (const cand of [base, `${base}.json`]) if (isFile(cand)) return cand;
+      const pj = join12(base, "package.json");
+      if (isFile(pj)) {
+        let manifest;
+        try {
+          manifest = JSON.parse(stripJsonc(readFileSync10(pj, "utf8")));
+        } catch {
+          refuse(pj, "its package.json could not be parsed, so its `tsconfig` field cannot be checked");
+        }
+        const field = manifest?.tsconfig;
+        if (typeof field === "string" && field) {
+          return asConfigFile(field.startsWith("/") ? field : resolve8(base, field));
+        }
+      }
+      if (isFile(join12(base, "tsconfig.json"))) return join12(base, "tsconfig.json");
+      up = dirname8(d);
+      if (up === d) return void 0;
+    }
+  };
+  const follow = (file) => {
+    const real = realpathOrSelf(file);
+    if (seen.has(real)) return;
+    seen.add(real);
+    if (!allows(real)) refuse(file, "it is outside this content package");
+    let raw;
+    try {
+      raw = readFileSync10(real, "utf8");
+    } catch {
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(stripJsonc(raw));
+    } catch {
+      refuse(file, "its tsconfig could not be parsed, so its `extends` cannot be checked");
+    }
+    const ext = parsed?.extends;
+    for (const one of Array.isArray(ext) ? ext : ext ? [ext] : []) {
+      if (typeof one !== "string" || !one) continue;
+      if (one.startsWith(".") || one.startsWith("/")) {
+        const target = asConfigFile(one.startsWith("/") ? one : resolve8(dirname8(real), one));
+        if (target) follow(target);
+      } else {
+        const target = resolveBare(one, dirname8(real));
+        if (target) follow(target);
+      }
+    }
+  };
+  const scan = (dir) => {
+    let entries;
+    try {
+      entries = readdirSync6(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      const abs = join12(dir, e.name);
+      if (e.isDirectory()) scan(abs);
+      else if (e.name === "tsconfig.json" && e.isFile()) follow(abs);
+    }
+  };
+  scan(realpathOrSelf(contentRoot));
+  for (let d = dirname8(realpathOrSelf(entry)), up; ; d = up) {
+    const cfg = join12(d, "tsconfig.json");
+    if (existsSync8(cfg)) {
+      follow(cfg);
+      return;
+    }
+    up = dirname8(d);
+    if (up === d) return;
+  }
+}
+function confinementFor(contentRoot, where, entry) {
+  if (!_confinementRequired) return void 0;
+  if (!contentRoot) {
+    throw new Error(
+      `${where}: this process compiles untrusted uploads (requireBuildConfinement) but no content root was given, so the import graph would be unconfined. Pass \`confineTo: <content dir>\`.`
+    );
+  }
+  const allows = confinementMatcher(contentRoot);
+  if (entry) assertConfinedTsconfig(entry, contentRoot, allows);
+  return confinementPlugin(contentRoot);
+}
 function umbrellaRewritePlugin({ external = false } = {}) {
   return {
     name: "himalaya-umbrella-rewrite",
@@ -2597,7 +2856,8 @@ function importMetaUrlPlugin() {
   };
 }
 async function buildBundleFromEntry(entry, outfile, opts = {}) {
-  const { resolution = "source", name = "bundle", absWorkingDir = REPO_ROOT4 } = opts;
+  const { resolution = "source", name = "bundle", absWorkingDir = REPO_ROOT4, confineTo } = opts;
+  const confine = confinementFor(confineTo, "buildBundleFromEntry", entry);
   if (!existsSync8(entry)) throw new Error(`no bundle entry: ${entry}`);
   const buildOpts = {
     entryPoints: [entry],
@@ -2620,11 +2880,13 @@ async function buildBundleFromEntry(entry, outfile, opts = {}) {
   else if (isOffRepo()) {
     buildOpts.plugins = process.env.HIMI_CLI_RUNTIME_DIR ? [cliRuntimeUmbrellaPlugin()] : [umbrellaRewritePlugin({ external: false })];
   }
+  if (confine) buildOpts.plugins = [confine, ...buildOpts.plugins ?? []];
   await build(buildOpts);
   return outfile;
 }
 async function buildAppEntry(entry, outfile, opts = {}) {
-  const { umbrella = false, resolveTsExtensions = false, absWorkingDir = REPO_ROOT4 } = opts;
+  const { umbrella = false, resolveTsExtensions = false, absWorkingDir = REPO_ROOT4, confineTo } = opts;
+  const confine = confinementFor(confineTo, "buildAppEntry", entry);
   if (!existsSync8(entry)) throw new Error(`unknown app entry: ${entry}`);
   await build({
     entryPoints: [entry],
@@ -2648,6 +2910,9 @@ async function buildAppEntry(entry, outfile, opts = {}) {
     // -- a single global `define` here pinned the whole graph to the entry and broke
     // every app whose config.ts reads a file relative to itself.
     plugins: [
+      // FIRST, and here it is load-bearing: `importMetaUrlPlugin` registers an onLoad and CLAIMS
+      // every file containing `import.meta.url`, so a confinement behind it would never see them.
+      ...confine ? [confine] : [],
       importMetaUrlPlugin(),
       ...resolveTsExtensions ? [tsExtResolvePlugin()] : [],
       ...process.env.HIMI_CLI_RUNTIME_DIR ? [cliRuntimeUmbrellaPlugin()] : [],
@@ -2656,7 +2921,7 @@ async function buildAppEntry(entry, outfile, opts = {}) {
   });
   return outfile;
 }
-var _compilerP, __dirname, REPO_ROOT4, SDK, alias, sourceAliases, OUT_DIR, HERMES_SAFE_SUPPORTED, HERMES_UNSAFE_BUNDLES, APP_ENTRY_TARGET;
+var _compilerP, __dirname, REPO_ROOT4, SDK, alias, sourceAliases, OUT_DIR, HERMES_SAFE_SUPPORTED, HERMES_UNSAFE_BUNDLES, _confinementRequired, APP_ENTRY_TARGET;
 var init_build_lib = __esm({
   "../../core/dev-server/tier5-bundles-src/build-lib.mjs"() {
     "use strict";
@@ -2805,6 +3070,7 @@ var init_build_lib = __esm({
       // worker-safe wix-auth showcase pulls ~11 classes from stdlib/auth-providers.
       "demo-app-wix-platform"
     ]);
+    _confinementRequired = false;
     APP_ENTRY_TARGET = ["node18"];
   }
 });
@@ -2829,7 +3095,7 @@ var init_tier5_dir = __esm({
 
 // src/tier5-typecheck.ts
 import { existsSync as existsSync9, readFileSync as readFileSync11 } from "node:fs";
-import { relative as relative2, resolve as resolve10, sep as sep2 } from "node:path";
+import { relative as relative2, resolve as resolve10, sep as sep3 } from "node:path";
 import { pathToFileURL as pathToFileURL3 } from "node:url";
 async function loadTypeScript() {
   const runtime = process.env.HIMI_AUTHORING_RUNTIME_DIR;
@@ -2868,7 +3134,7 @@ function pathsFor(options) {
   return declarationPaths(options.umbrellaDir);
 }
 function relativeFile(contentDir2, fileName) {
-  return relative2(contentDir2, fileName).split(sep2).join("/");
+  return relative2(contentDir2, fileName).split(sep3).join("/");
 }
 function belongsToContentWorkers(contentDir2, diagnostic) {
   if (!diagnostic.file) return true;
@@ -2890,6 +3156,19 @@ function toIssue(ts, contentDir2, diagnostic) {
     message: ts.flattenDiagnosticMessageText(diagnostic.messageText, "\n")
   };
 }
+function confinedHost(ts, contentDir2, options) {
+  if (!buildConfinementRequired()) return void 0;
+  const host = ts.createCompilerHost(options);
+  const libDir = resolve10(ts.getDefaultLibFilePath(options), "..");
+  const allows = confinementMatcher(contentDir2, [libDir]);
+  const getSourceFile = host.getSourceFile.bind(host);
+  const readFile3 = host.readFile.bind(host);
+  const fileExists = host.fileExists.bind(host);
+  host.getSourceFile = (fileName, ...rest) => allows(fileName) ? getSourceFile(fileName, ...rest) : void 0;
+  host.readFile = (fileName) => allows(fileName) ? readFile3(fileName) : void 0;
+  host.fileExists = (fileName) => allows(fileName) && fileExists(fileName);
+  return host;
+}
 async function typecheckContentWorkers(contentDir2, options) {
   if (!existsSync9(resolve10(contentDir2, "tier5-src"))) return [];
   const ts = await compiler2();
@@ -2907,7 +3186,11 @@ async function typecheckContentWorkers(contentDir2, options) {
   };
   const parsed = ts.parseJsonConfigFileContent(config, ts.sys, contentDir2);
   if (parsed.fileNames.length === 0) return [];
-  const program = ts.createProgram({ rootNames: parsed.fileNames, options: parsed.options });
+  const program = ts.createProgram({
+    rootNames: parsed.fileNames,
+    options: parsed.options,
+    host: confinedHost(ts, contentDir2, parsed.options)
+  });
   return [...parsed.errors, ...ts.getPreEmitDiagnostics(program)].filter((diagnostic) => diagnostic.category === ts.DiagnosticCategory.Error && belongsToContentWorkers(contentDir2, diagnostic)).map((diagnostic) => toIssue(ts, contentDir2, diagnostic));
 }
 var compilerPromise;
@@ -2936,31 +3219,31 @@ __export(build_exports, {
   umbrellaVersion: () => umbrellaVersion,
   umbrellaVersionIssue: () => umbrellaVersionIssue
 });
-import { existsSync as existsSync10, readdirSync as readdirSync8, mkdirSync as mkdirSync6, statSync as statSync2, symlinkSync, readFileSync as readFileSync12 } from "node:fs";
-import { resolve as resolve11, join as join12, dirname as dirname9 } from "node:path";
+import { existsSync as existsSync10, readdirSync as readdirSync8, mkdirSync as mkdirSync6, statSync as statSync3, symlinkSync, readFileSync as readFileSync12 } from "node:fs";
+import { resolve as resolve11, join as join13, dirname as dirname9 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function bundledRuntimeDir() {
   const configured = process.env.HIMI_CLI_RUNTIME_DIR;
-  if (configured && existsSync10(join12(configured, "node_modules", "@wix", "himalaya", "package.json"))) {
+  if (configured && existsSync10(join13(configured, "node_modules", "@wix", "himalaya", "package.json"))) {
     return configured;
   }
   const candidate = resolve11(dirname9(fileURLToPath6(import.meta.url)), "authoring-runtime");
-  if (!existsSync10(join12(candidate, "node_modules", "@wix", "himalaya", "package.json"))) return null;
+  if (!existsSync10(join13(candidate, "node_modules", "@wix", "himalaya", "package.json"))) return null;
   process.env.HIMI_CLI_RUNTIME_DIR = candidate;
   return candidate;
 }
 function bundledUmbrella() {
   const runtime = bundledRuntimeDir();
-  return runtime ? join12(runtime, "node_modules", "@wix", "himalaya") : null;
+  return runtime ? join13(runtime, "node_modules", "@wix", "himalaya") : null;
 }
 function umbrellaDir(fromDir) {
   const bundled = bundledUmbrella();
   if (bundled) return bundled;
   let d = resolve11(fromDir);
   for (; ; ) {
-    const pkg = join12(d, "node_modules", "@wix", "himalaya");
-    if (existsSync10(join12(pkg, "package.json"))) return pkg;
+    const pkg = join13(d, "node_modules", "@wix", "himalaya");
+    if (existsSync10(join13(pkg, "package.json"))) return pkg;
     const parent = dirname9(d);
     if (parent === d) return null;
     d = parent;
@@ -2973,8 +3256,8 @@ function globalUmbrella() {
   try {
     const root = execFileSync3("npm", ["root", "-g"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
     if (!root) return null;
-    const pkg = join12(root, "@wix", "himalaya");
-    return existsSync10(join12(pkg, "package.json")) ? pkg : null;
+    const pkg = join13(root, "@wix", "himalaya");
+    return existsSync10(join13(pkg, "package.json")) ? pkg : null;
   } catch {
     return null;
   }
@@ -2983,11 +3266,11 @@ function ensureUmbrella(contentDir2, globalPath = globalUmbrella()) {
   if (umbrellaInstalled(contentDir2)) return true;
   if (!globalPath) return false;
   try {
-    const scope = join12(contentDir2, "node_modules", "@wix");
+    const scope = join13(contentDir2, "node_modules", "@wix");
     mkdirSync6(scope, { recursive: true });
-    const link = join12(scope, "himalaya");
+    const link = join13(scope, "himalaya");
     if (!existsSync10(link)) symlinkSync(globalPath, link, "dir");
-    return existsSync10(join12(link, "package.json"));
+    return existsSync10(join13(link, "package.json"));
   } catch {
     return false;
   }
@@ -3005,7 +3288,7 @@ function umbrellaVersion(fromDir) {
   const dir = umbrellaDir(fromDir);
   if (!dir) return null;
   try {
-    const v = JSON.parse(readFileSync12(join12(dir, "package.json"), "utf8")).version;
+    const v = JSON.parse(readFileSync12(join13(dir, "package.json"), "utf8")).version;
     return typeof v === "string" && v ? v : null;
   } catch {
     return null;
@@ -3026,7 +3309,7 @@ function umbrellaDistIssue(contentDir2) {
   if (!dir) return null;
   let exportsMap;
   try {
-    exportsMap = JSON.parse(readFileSync12(join12(dir, "package.json"), "utf8")).exports;
+    exportsMap = JSON.parse(readFileSync12(join13(dir, "package.json"), "utf8")).exports;
   } catch {
     return null;
   }
@@ -3080,14 +3363,19 @@ async function buildContentBundles(contentDir2, opts = {}) {
   if (!existsSync10(srcDir)) return { built, outDir, compileErrors, ...sdkVersionIssue ? { sdkVersionIssue } : {} };
   mkdirSync6(outDir, { recursive: true });
   for (const name of readdirSync8(srcDir).sort()) {
-    const entry = join12(srcDir, name, "index.ts");
-    if (!statSync2(join12(srcDir, name)).isDirectory() || !existsSync10(entry)) continue;
+    const entry = join13(srcDir, name, "index.ts");
+    if (!statSync3(join13(srcDir, name)).isDirectory() || !existsSync10(entry)) continue;
     try {
-      await buildBundleFromEntry(entry, join12(outDir, `${name}.bundle.js`), {
+      await buildBundleFromEntry(entry, join13(outDir, `${name}.bundle.js`), {
         resolution,
         name,
         // Off-repo, resolve the umbrella from the content package's own node_modules.
-        ...offRepo ? { absWorkingDir: contentDir2 } : {}
+        ...offRepo ? { absWorkingDir: contentDir2 } : {},
+        // Bounds the import graph in a process that compiles untrusted uploads
+        // (core/serve-authoring); inert everywhere else. Always passed, so the authoring guest
+        // cannot reach this build without a root — build-lib throws rather than compile
+        // unconfined.
+        confineTo: contentDir2
       });
       built.push(name);
     } catch (err) {
@@ -3125,11 +3413,11 @@ __export(app_config_loader_exports, {
   loadAppConfigModule: () => loadAppConfigModule
 });
 import { existsSync as existsSync11, mkdirSync as mkdirSync7 } from "node:fs";
-import { dirname as dirname10, join as join13, resolve as resolve12 } from "node:path";
+import { dirname as dirname10, join as join14, resolve as resolve12 } from "node:path";
 import { pathToFileURL as pathToFileURL4 } from "node:url";
 function configEntry(dir) {
   for (const f of ["config.ts", "config.js", "config.mjs"]) {
-    const p = join13(dir, f);
+    const p = join14(dir, f);
     if (existsSync11(p)) return p;
   }
   return null;
@@ -3141,7 +3429,7 @@ async function buildConfigModuleUrl(entry, dir) {
   bundledRuntimeDir2();
   const out = resolve12(dir, "dist/.himi/config.mjs");
   mkdirSync7(dirname10(out), { recursive: true });
-  await buildAppEntry(entry, out, { umbrella: true, resolveTsExtensions: true, absWorkingDir: dir });
+  await buildAppEntry(entry, out, { umbrella: true, resolveTsExtensions: true, absWorkingDir: dir, confineTo: dir });
   return pathToFileURL4(out).href;
 }
 function rememberBuild(key2, pending) {
@@ -3889,10 +4177,10 @@ var init_app_icon_rules = __esm({
 
 // ../../core/dev-server/src/app-icon.ts
 import { existsSync as existsSync14, readFileSync as readFileSync17, readdirSync as readdirSync9 } from "node:fs";
-import { dirname as dirname13, join as join17, resolve as resolve13 } from "node:path";
+import { dirname as dirname13, join as join18, resolve as resolve13 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 function findAppIconPath(appDir2) {
-  const iosDir = join17(appDir2, "ios");
+  const iosDir = join18(appDir2, "ios");
   let children;
   try {
     children = readdirSync9(iosDir);
@@ -3900,7 +4188,7 @@ function findAppIconPath(appDir2) {
     return null;
   }
   for (const child of children) {
-    const p = join17(iosDir, child, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join18(iosDir, child, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     if (existsSync14(p)) return p;
   }
   return null;
@@ -3908,7 +4196,7 @@ function findAppIconPath(appDir2) {
 function findContentIconPath(appDir2) {
   let rel;
   try {
-    rel = JSON.parse(readFileSync17(join17(appDir2, "himalaya.content.json"), "utf8")).icon;
+    rel = JSON.parse(readFileSync17(join18(appDir2, "himalaya.content.json"), "utf8")).icon;
   } catch {
     return null;
   }
@@ -3933,7 +4221,7 @@ function readIconFromDir(appDir2) {
 function resolveAppDir(appId2) {
   if (!/^[a-z0-9][a-z0-9._-]*$/i.test(appId2)) return null;
   for (const base of APP_ROOTS) {
-    const dir = join17(ROOT, base, appId2);
+    const dir = join18(ROOT, base, appId2);
     if (existsSync14(dir)) return dir;
   }
   return null;
@@ -4226,11 +4514,11 @@ __export(icon_exports, {
   summarize: () => summarize
 });
 import { createHash as createHash5 } from "node:crypto";
-import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync18, statSync as statSync3, writeFileSync as writeFileSync8 } from "node:fs";
-import { basename as basename4, dirname as dirname14, join as join18, resolve as resolve14, sep as sep3 } from "node:path";
+import { existsSync as existsSync15, mkdirSync as mkdirSync9, readFileSync as readFileSync18, statSync as statSync4, writeFileSync as writeFileSync8 } from "node:fs";
+import { basename as basename4, dirname as dirname14, join as join19, resolve as resolve14, sep as sep4 } from "node:path";
 function readManifest(dir) {
   try {
-    return JSON.parse(readFileSync18(join18(dir, MANIFEST), "utf8"));
+    return JSON.parse(readFileSync18(join19(dir, MANIFEST), "utf8"));
   } catch {
     return null;
   }
@@ -4244,7 +4532,7 @@ function declaredIconName(dir) {
 function iconDest(dir, name) {
   const base = resolve14(dir);
   const abs = resolve14(base, name);
-  if (!abs.startsWith(base + sep3)) {
+  if (!abs.startsWith(base + sep4)) {
     throw new Error(
       `himi icon: himalaya.content.json declares "icon": "${name}", which resolves outside the package (${abs}). Declare a path inside it, e.g. "${DEFAULT_CONTENT_ICON}".`
     );
@@ -4254,9 +4542,9 @@ function iconDest(dir, name) {
 }
 function templateIconMatch(png) {
   for (const template of availableTemplates()) {
-    const candidate = join18(templateSourceDir(template), DEFAULT_CONTENT_ICON);
+    const candidate = join19(templateSourceDir(template), DEFAULT_CONTENT_ICON);
     try {
-      if (statSync3(candidate).size !== png.length) continue;
+      if (statSync4(candidate).size !== png.length) continue;
       if (readFileSync18(candidate).equals(png)) return template;
     } catch {
     }
@@ -4264,10 +4552,10 @@ function templateIconMatch(png) {
   return null;
 }
 function playState(dir) {
-  const p = join18(resolve14(dir), PLAY_LISTING_ICON);
+  const p = join19(resolve14(dir), PLAY_LISTING_ICON);
   if (!existsSync15(p)) return null;
   try {
-    if (!statSync3(p).isFile()) return { path: p, issues: ["is a directory, not a PNG file"] };
+    if (!statSync4(p).isFile()) return { path: p, issues: ["is a directory, not a PNG file"] };
     return { path: p, issues: playListingIconIssues(readFileSync18(p)) };
   } catch (err) {
     return { path: p, issues: [`could not be read (${err.message.split("\n")[0]})`] };
@@ -4294,7 +4582,7 @@ async function iconStatus(dir) {
   if (!path || !existsSync15(path)) return base;
   let png;
   try {
-    if (!statSync3(path).isFile()) {
+    if (!statSync4(path).isFile()) {
       return {
         ...base,
         byteIssues: [`at ${path} is a directory, not a PNG file`],
@@ -4371,7 +4659,7 @@ function summarize(status) {
 }
 function backdropFromTokens(dir, fallback = "#1F2933") {
   try {
-    const tokens = JSON.parse(readFileSync18(join18(dir, "tokens.json"), "utf8"));
+    const tokens = JSON.parse(readFileSync18(join19(dir, "tokens.json"), "utf8"));
     const accent = tokens.colors?.accentPrimary;
     const hex2 = typeof accent === "string" ? accent : accent?.light;
     return typeof hex2 === "string" && HEX_COLOR2.test(hex2) ? hex2 : fallback;
@@ -4430,15 +4718,15 @@ function declareIcon(dir, name) {
     if (k === "name") next.icon = name;
   }
   next.icon = name;
-  writeFileSync8(join18(dir, MANIFEST), JSON.stringify(next, null, 2) + "\n");
-  return [join18(dir, MANIFEST)];
+  writeFileSync8(join19(dir, MANIFEST), JSON.stringify(next, null, 2) + "\n");
+  return [join19(dir, MANIFEST)];
 }
 function siteBookIcon(bookDir) {
-  const p = join18(resolve14(bookDir), SITE_BOOK_ICON_REL);
+  const p = join19(resolve14(bookDir), SITE_BOOK_ICON_REL);
   return existsSync15(p) ? p : null;
 }
 function siteLogoAbsence(bookDir) {
-  const bookJson = join18(resolve14(bookDir), "book.json");
+  const bookJson = join19(resolve14(bookDir), "book.json");
   if (!existsSync15(bookJson)) {
     return { reason: "no-book", hint: `no business book at ${bookDir} \u2014 run \`himi site analyze --out <dir>\` first, or pass --book <dir>` };
   }
@@ -4520,7 +4808,7 @@ var init_icon = __esm({
 // ../fonts/catalog.ts
 import { existsSync as existsSync17, readFileSync as readFileSync19 } from "node:fs";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 function loadCatalog() {
   if (cached) return cached;
   const path = CATALOG_CANDIDATES.find((p) => existsSync17(p));
@@ -4589,9 +4877,9 @@ var init_catalog = __esm({
   "../fonts/catalog.ts"() {
     CATALOG_CANDIDATES = [
       // in-repo: tools/fonts/catalog.ts → <repo>/stdlib/fonts/catalog.json
-      join20(fileURLToPath8(new URL("../..", import.meta.url)), "stdlib", "fonts", "catalog.json"),
+      join21(fileURLToPath8(new URL("../..", import.meta.url)), "stdlib", "fonts", "catalog.json"),
       // published CLI: <pkg>/dist/cli.mjs → <pkg>/stdlib/fonts/catalog.json
-      join20(fileURLToPath8(new URL("..", import.meta.url)), "stdlib", "fonts", "catalog.json")
+      join21(fileURLToPath8(new URL("..", import.meta.url)), "stdlib", "fonts", "catalog.json")
     ];
     cached = null;
     normalizeFamily = (name) => name.toLowerCase().replace(/[^a-z0-9]/g, "");
@@ -4696,17 +4984,17 @@ var init_plan_fonts = __esm({
 import { createHash as createHash6 } from "node:crypto";
 import { existsSync as existsSync18, readFileSync as readFileSync20 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
-import { basename as basename5, join as join21 } from "node:path";
+import { basename as basename5, join as join22 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 function hasVendoredFloor() {
   return existsSync18(VENDORED_DIR);
 }
 function faceSource(file, sha2565) {
-  const vendored = join21(VENDORED_DIR, basename5(file));
+  const vendored = join22(VENDORED_DIR, basename5(file));
   if (existsSync18(vendored) && createHash6("sha256").update(readFileSync20(vendored)).digest("hex") === sha2565) {
     return vendored;
   }
-  const cached3 = join21(CACHE_DIR, sha2565);
+  const cached3 = join22(CACHE_DIR, sha2565);
   if (existsSync18(cached3)) return cached3;
   return null;
 }
@@ -4714,8 +5002,8 @@ var REPO_ROOT5, VENDORED_DIR, CACHE_DIR;
 var init_face_source = __esm({
   "../font-bake/face-source.ts"() {
     REPO_ROOT5 = fileURLToPath9(new URL("../..", import.meta.url));
-    VENDORED_DIR = process.env.HIMI_FONTS_VENDORED_DIR || join21(REPO_ROOT5, "stdlib", "fonts", "vendored", "wix-madefor");
-    CACHE_DIR = join21(process.env.XDG_CACHE_HOME || join21(homedir4(), ".cache"), "himi", "fonts");
+    VENDORED_DIR = process.env.HIMI_FONTS_VENDORED_DIR || join22(REPO_ROOT5, "stdlib", "fonts", "vendored", "wix-madefor");
+    CACHE_DIR = join22(process.env.XDG_CACHE_HOME || join22(homedir4(), ".cache"), "himi", "fonts");
   }
 });
 
@@ -4729,7 +5017,7 @@ __export(fonts_exports, {
   resolveFamilyName: () => resolveFamilyName
 });
 import { existsSync as existsSync19, readFileSync as readFileSync21 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 function readJson(path, fallback) {
   try {
     return JSON.parse(readFileSync21(path, "utf8"));
@@ -4761,11 +5049,11 @@ function listReport(opts = {}) {
   return { ok: true, count: families.length, totalBytes, families };
 }
 function fontFindings(appDir2) {
-  const tokensPath = join22(appDir2, "tokens.json");
+  const tokensPath = join23(appDir2, "tokens.json");
   if (!existsSync19(tokensPath)) return null;
   const catalog = loadCatalog();
   const tokens = readJson(tokensPath, {});
-  const policy = readJson(join22(appDir2, "fonts.json"), {});
+  const policy = readJson(join23(appDir2, "fonts.json"), {});
   const plan = planFonts(tokens, policy, catalog);
   const findings = [];
   for (const family of plan.unresolved) {
@@ -4851,7 +5139,7 @@ function addReport(appDir2, family) {
     totalBytes: bytes2,
     problems: [],
     families: [{ family: resolved, license: fam?.license.id ?? "system", copyright: fam?.license.copyright, kb: Math.round(bytes2 / 1024) }],
-    hint: `add "${resolved}" to ${join22(appDir2, "fonts.json")} under "families" (or name it in tokens.json typography), then run gen.sh. Licence: ${fam?.license.id ?? "system"}${fam?.license.copyright ? ` \u2014 ${fam.license.copyright}` : ""}`
+    hint: `add "${resolved}" to ${join23(appDir2, "fonts.json")} under "families" (or name it in tokens.json typography), then run gen.sh. Licence: ${fam?.license.id ?? "system"}${fam?.license.copyright ? ` \u2014 ${fam.license.copyright}` : ""}`
   };
 }
 var DEFAULT_ASSET_BUDGET_BYTES;
@@ -5773,7 +6061,7 @@ var init_src = __esm({
 // ../app-icons/plan.ts
 import { existsSync as existsSync23, readFileSync as readFileSync25, readdirSync as readdirSync12 } from "node:fs";
 import { createHash as createHash7 } from "node:crypto";
-import { dirname as dirname16, join as join26, resolve as resolve17 } from "node:path";
+import { dirname as dirname16, join as join27, resolve as resolve17 } from "node:path";
 function stripComments(src) {
   let out = "";
   let i = 0;
@@ -5903,10 +6191,10 @@ function rotateHue(hex2, deg) {
 function resolveTokensPath(app, configTs) {
   const literal = /^ {2}designTokensPath\s*:\s*["']([^"']+)["']/m.exec(stripComments(configTs))?.[1];
   if (literal) return { path: resolve17(appDir(app), literal), source: "declared" };
-  return { path: join26(appDir(app), "tokens.json"), source: "assumed" };
+  return { path: join27(appDir(app), "tokens.json"), source: "assumed" };
 }
 function resolveToken(app, token, tokensPathOverride) {
-  const tokensPath = tokensPathOverride ?? join26(appDir(app), "tokens.json");
+  const tokensPath = tokensPathOverride ?? join27(appDir(app), "tokens.json");
   if (!existsSync23(tokensPath)) {
     throw new Error(`app-icons: ${app} has no tokens.json at ${tokensPath} (needed to resolve "${token}").`);
   }
@@ -5989,17 +6277,17 @@ function iconSpec(app, configTs, id, tokensPathOverride) {
   };
 }
 function iosAssetCatalog2(app) {
-  return assetCatalogIn(join26(appDir(app), "ios"));
+  return assetCatalogIn(join27(appDir(app), "ios"));
 }
 function assetCatalogIn(platformDir) {
   if (!existsSync23(platformDir)) return void 0;
   const children = readdirSync12(platformDir).filter((c) => !c.startsWith("build")).sort();
-  const catalogs = children.map((c) => join26(platformDir, c, "Assets.xcassets")).filter(existsSync23);
+  const catalogs = children.map((c) => join27(platformDir, c, "Assets.xcassets")).filter(existsSync23);
   if (catalogs.length === 1) return catalogs[0];
   if (catalogs.length > 1) return void 0;
   const targets = [];
   for (const child of children) {
-    const dir = join26(platformDir, child);
+    const dir = join27(platformDir, child);
     let entries;
     try {
       entries = readdirSync12(dir);
@@ -6007,20 +6295,20 @@ function assetCatalogIn(platformDir) {
       continue;
     }
     if (entries.includes("Info.plist") || entries.some((e) => e.endsWith(".swift"))) {
-      targets.push(join26(dir, "Assets.xcassets"));
+      targets.push(join27(dir, "Assets.xcassets"));
     }
   }
   return targets.length === 1 ? targets[0] : void 0;
 }
 function androidResDir2(manifestPath) {
-  return join26(dirname16(manifestPath), "res");
+  return join27(dirname16(manifestPath), "res");
 }
 function androidManifestPath(app) {
-  const androidDir = join26(appDir(app), "android");
+  const androidDir = join27(appDir(app), "android");
   if (!existsSync23(androidDir)) return void 0;
-  const preferred = join26(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
+  const preferred = join27(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
   if (existsSync23(preferred)) return preferred;
-  const candidates = readdirSync12(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join26(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync23);
+  const candidates = readdirSync12(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join27(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync23);
   return candidates.length === 1 ? candidates[0] : void 0;
 }
 function androidOptedIn2(manifestPath) {
@@ -6029,7 +6317,7 @@ function androidOptedIn2(manifestPath) {
 }
 function templateIconSha256() {
   const cat = iosAssetCatalog2("_template");
-  return cat ? fileSha256(join26(cat, "AppIcon.appiconset", "icon_1024.png")) : null;
+  return cat ? fileSha256(join27(cat, "AppIcon.appiconset", "icon_1024.png")) : null;
 }
 function placeholderHashes() {
   const current = templateIconSha256();
@@ -6048,7 +6336,7 @@ function generationAllowed(app, configTs, opts = {}) {
     return { allowed: true, reason: "declares an icon block" };
   }
   const iosCat = iosAssetCatalog2(app);
-  const iosIcon = iosCat ? join26(iosCat, "AppIcon.appiconset", "icon_1024.png") : void 0;
+  const iosIcon = iosCat ? join27(iosCat, "AppIcon.appiconset", "icon_1024.png") : void 0;
   if (!iosIcon || !existsSync23(iosIcon)) return { allowed: true, reason: "no icon yet" };
   const hash = fileSha256(iosIcon);
   const placeholders = opts.placeholderHashes ?? placeholderHashes();
@@ -6074,7 +6362,7 @@ var init_plan2 = __esm({
 
 // ../native-config/icon.ts
 import { existsSync as existsSync24, readFileSync as readFileSync26 } from "node:fs";
-import { join as join27 } from "node:path";
+import { join as join28 } from "node:path";
 function androidAdaptiveIconXml() {
   return [
     '<?xml version="1.0" encoding="utf-8"?>',
@@ -6101,7 +6389,7 @@ function androidIconArtifacts(app, configTs) {
   if (!androidOptedIn2(manifest)) return [];
   if (!generationAllowed(app, configTs).allowed) return [];
   const res = androidResDir2(manifest);
-  const foreground = join27(res, "mipmap-mdpi", "ic_launcher_foreground.png");
+  const foreground = join28(res, "mipmap-mdpi", "ic_launcher_foreground.png");
   if (!existsSync24(foreground)) {
     throw new Error(
       `native-config icon: ${app} opts into @mipmap/ic_launcher but has no mipmap-*/ic_launcher_foreground.png. Run \`npm run app-icons -- ${app}\` first \u2014 the XML emitted here points at those rasters.`
@@ -6111,11 +6399,11 @@ function androidIconArtifacts(app, configTs) {
   const spec = iconSpec(app, configTs, id, resolveTokensPath(app, configTs).path);
   return [
     ...ANDROID_ADAPTIVE_FILES.map((name) => ({
-      path: join27(res, "mipmap-anydpi-v26", name),
+      path: join28(res, "mipmap-anydpi-v26", name),
       content: androidAdaptiveIconXml()
     })),
     {
-      path: join27(res, "values", ANDROID_ICON_BACKGROUND_FILE),
+      path: join28(res, "values", ANDROID_ICON_BACKGROUND_FILE),
       content: androidIconBackgroundXml(spec.background)
     }
   ];
@@ -6350,7 +6638,7 @@ __export(gen_native_config_exports, {
   watchInfoPlan: () => watchInfoPlan
 });
 import { existsSync as existsSync25, mkdirSync as mkdirSync12, readFileSync as readFileSync27, readdirSync as readdirSync13, rmSync as rmSync3, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname17, join as join28 } from "node:path";
+import { dirname as dirname17, join as join29 } from "node:path";
 function parseStringArray(configTs, field) {
   const m = new RegExp(`${field}:\\s*\\[([^\\]]*)\\]`).exec(configTs);
   if (!m) return [];
@@ -6422,7 +6710,7 @@ function buildSet(capabilities, envelope = []) {
   return [...new Set([...capabilities, ...envelope].map(catalogKey))].sort();
 }
 function loadOverrides(app) {
-  const p = join28(appDir(app), "native-config.overrides.json");
+  const p = join29(appDir(app), "native-config.overrides.json");
   if (!existsSync25(p)) return {};
   return JSON.parse(readFileSync27(p, "utf8"));
 }
@@ -6479,14 +6767,14 @@ function endText(kind, label2, indent) {
   return kind === "yaml" ? `${indent}# <<< ${label2} <<<` : `${indent}<!-- <<< ${label2} <<< -->`;
 }
 function hostAppliesDeferredWidgetActions(app) {
-  const root = join28(appDir(app), "ios");
+  const root = join29(appDir(app), "ios");
   if (!existsSync25(root)) return false;
   const stack = [root];
   while (stack.length) {
     const dir = stack.pop();
     for (const entry of readdirSync13(dir, { withFileTypes: true })) {
       if (entry.name.startsWith(".") || entry.name === "GeneratedLiveActivity") continue;
-      const path = join28(dir, entry.name);
+      const path = join29(dir, entry.name);
       if (entry.isDirectory()) {
         if (entry.name.endsWith(".xcodeproj") || entry.name === "build") continue;
         stack.push(path);
@@ -6513,14 +6801,14 @@ function injectBlock(text2, kind, label2, render) {
   return [...lines.slice(0, beginIdx), ...block, ...lines.slice(endIdx + 1)].join("\n");
 }
 function androidManifestPath2(app) {
-  const androidDir = join28(appDir(app), "android");
-  const preferred = join28(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
+  const androidDir = join29(appDir(app), "android");
+  const preferred = join29(androidDir, `${app}-app`, "src", "main", "AndroidManifest.xml");
   if (existsSync25(preferred)) return preferred;
-  const candidates = existsSync25(androidDir) ? readdirSync13(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join28(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync25) : [];
+  const candidates = existsSync25(androidDir) ? readdirSync13(androidDir, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.endsWith("-app")).map((d) => join29(androidDir, d.name, "src", "main", "AndroidManifest.xml")).filter(existsSync25) : [];
   return candidates.length === 1 ? candidates[0] : preferred;
 }
 function automotiveAppDescPath(app) {
-  return join28(dirname17(androidManifestPath2(app)), "res", "xml", "automotive_app_desc.xml");
+  return join29(dirname17(androidManifestPath2(app)), "res", "xml", "automotive_app_desc.xml");
 }
 function applyToFile(path, kind, label2, render, check) {
   if (!existsSync25(path)) return { path, outcome: "skipped" };
@@ -6619,9 +6907,9 @@ function genNativeConfig(app, opts = {}) {
     const plan = live2;
     files.push(applyToFile(iosYml, "yaml", LABEL_LIVE_TARGET, (i) => plan.target.map((line) => i + line), check));
     files.push(applyToFile(iosYml, "yaml", LABEL_LIVE_EMBED, (i) => plan.embed.map((line) => i + line), check));
-    const source = join28(dirname17(iosYml), LIVE_SOURCE_PATH);
+    const source = join29(dirname17(iosYml), LIVE_SOURCE_PATH);
     files.push(plan.source ? applyWholeFile(source, plan.source, check) : removeWholeFile(source, check));
-    const entitlements = join28(dirname17(iosYml), LIVE_ENTITLEMENTS_PATH);
+    const entitlements = join29(dirname17(iosYml), LIVE_ENTITLEMENTS_PATH);
     files.push(plan.entitlements ? applyWholeFile(entitlements, plan.entitlements, check) : removeWholeFile(entitlements, check));
   }
   const iosSplashManaged = existsSync25(iosYml) && hasMarkers(readFileSync27(iosYml, "utf8"), "yaml", LABEL_IOS_SPLASH);
@@ -6759,7 +7047,8 @@ async function devModuleUrl(entry, dir) {
     // intentionally point at `.ts` sources, which are only loadable under tsx.
     umbrella: true,
     resolveTsExtensions: true,
-    absWorkingDir: dir
+    absWorkingDir: dir,
+    confineTo: dir
   });
   return pathToFileURL5(out).href;
 }
@@ -6881,8 +7170,8 @@ var init_build_sha = __esm({
 
 // ../../core/dev-server/src/app-assets.ts
 import { createHash as createHash8 } from "node:crypto";
-import { existsSync as existsSync27, lstatSync as lstatSync3, readFileSync as readFileSync29, readdirSync as readdirSync15, realpathSync as realpathSync2, statSync as statSync5 } from "node:fs";
-import { join as join29, resolve as resolve19, sep as sep4 } from "node:path";
+import { existsSync as existsSync27, lstatSync as lstatSync3, readFileSync as readFileSync29, readdirSync as readdirSync15, realpathSync as realpathSync3, statSync as statSync6 } from "node:fs";
+import { join as join30, resolve as resolve19, sep as sep5 } from "node:path";
 function contentTypeFor(name) {
   const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
   return CONTENT_TYPES[ext] ?? "application/octet-stream";
@@ -6896,19 +7185,19 @@ function assetSha256(bytes2) {
 function findAssetsDir(appDir2) {
   let declared;
   try {
-    declared = JSON.parse(readFileSync29(join29(appDir2, "himalaya.content.json"), "utf8")).assets;
+    declared = JSON.parse(readFileSync29(join30(appDir2, "himalaya.content.json"), "utf8")).assets;
   } catch {
     declared = void 0;
   }
   const rel = typeof declared === "string" && declared ? declared : "assets";
   const abs = resolve19(appDir2, rel);
   const base = resolve19(appDir2);
-  if (abs !== base && !abs.startsWith(base + sep4)) return null;
-  return existsSync27(abs) && statSync5(abs).isDirectory() ? abs : null;
+  if (abs !== base && !abs.startsWith(base + sep5)) return null;
+  return existsSync27(abs) && statSync6(abs).isDirectory() ? abs : null;
 }
 function readOtaOnlyPatterns(appDir2) {
   try {
-    const raw = JSON.parse(readFileSync29(join29(appDir2, "assets.json"), "utf8"));
+    const raw = JSON.parse(readFileSync29(join30(appDir2, "assets.json"), "utf8"));
     return Array.isArray(raw.otaOnly) ? raw.otaOnly.filter((p) => typeof p === "string") : [];
   } catch {
     return [];
@@ -6926,7 +7215,7 @@ function collectAssets(appDir2) {
   const walk2 = (abs, prefix) => {
     for (const entry of readdirSync15(abs, { withFileTypes: true })) {
       if (entry.name.startsWith(".")) continue;
-      const child = join29(abs, entry.name);
+      const child = join30(abs, entry.name);
       const name = prefix ? `${prefix}/${entry.name}` : entry.name;
       if (entry.isDirectory()) {
         walk2(child, name);
@@ -6935,7 +7224,7 @@ function collectAssets(appDir2) {
       if (!entry.isFile()) continue;
       const ext = name.includes(".") ? name.slice(name.lastIndexOf(".") + 1).toLowerCase() : "";
       const baked = !OTA_ONLY_BY_DEFAULT.has(ext) && !otaOnly.some((p) => matchesPattern(name, p));
-      out.push({ name, path: child, bytes: statSync5(child).size, contentType: contentTypeFor(name), baked });
+      out.push({ name, path: child, bytes: statSync6(child).size, contentType: contentTypeFor(name), baked });
     }
   };
   walk2(dir, "");
@@ -6944,7 +7233,7 @@ function collectAssets(appDir2) {
 function collectBrandFonts(appDir2) {
   let faces;
   try {
-    faces = JSON.parse(readFileSync29(join29(appDir2, "media/fonts/faces.json"), "utf8"));
+    faces = JSON.parse(readFileSync29(join30(appDir2, "media/fonts/faces.json"), "utf8"));
   } catch {
     return [];
   }
@@ -6957,11 +7246,11 @@ function collectBrandFonts(appDir2) {
     const rel = typeof raw?.file === "string" ? raw.file : "";
     if (!family || !postscriptName || !rel) continue;
     if (rel.startsWith("/") || rel.split("/").includes("..")) continue;
-    const path = join29(appDir2, rel);
+    const path = join30(appDir2, rel);
     try {
       if (!lstatSync3(path).isFile()) continue;
-      const root = realpathSync2(appDir2);
-      if (!realpathSync2(path).startsWith(root + sep4)) continue;
+      const root = realpathSync3(appDir2);
+      if (!realpathSync3(path).startsWith(root + sep5)) continue;
     } catch {
       continue;
     }
@@ -7067,7 +7356,7 @@ async function injectRequest(listener, request) {
   req.headers.host ??= url.host;
   if (body && body.length > 0) req.push(body);
   req.push(null);
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     const streamed = () => {
       queueMicrotask(() => {
         req.emit("close");
@@ -7083,7 +7372,7 @@ async function injectRequest(listener, request) {
         else headers2.set(name, value);
       }
       const bodyless = out.status === 204 || out.status === 304 || request.method === "HEAD";
-      resolve40(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
+      resolve41(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
     }, streamed);
     res.on("inject-error", reject);
     try {
@@ -8782,7 +9071,7 @@ var init_stable_ids = __esm({
 // ../../core/dev-server/src/preview.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash11 } from "node:crypto";
-import { existsSync as existsSync30, createReadStream, statSync as statSync6, readFileSync as readFileSync33, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { existsSync as existsSync30, createReadStream, statSync as statSync7, readFileSync as readFileSync33, renameSync, unlinkSync as unlinkSync2 } from "node:fs";
 import { homedir as homedir5, tmpdir as tmpdir2 } from "node:os";
 import { resolve as resolvePath, dirname as dirname20 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
@@ -9455,12 +9744,12 @@ function finalizeRecording(key2, rec) {
   if (rec.finalize) return rec.finalize;
   rec.finalize = (async () => {
     clearTimeout(rec.autoStop);
-    await new Promise((resolve40) => {
+    await new Promise((resolve41) => {
       let done = false;
       const finish2 = () => {
         if (!done) {
           done = true;
-          resolve40();
+          resolve41();
         }
       };
       rec.child.once("close", finish2);
@@ -9480,7 +9769,7 @@ function finalizeRecording(key2, rec) {
       } catch {
       }
     }
-    const sizeBytes = existsSync30(rec.localPath) ? statSync6(rec.localPath).size : 0;
+    const sizeBytes = existsSync30(rec.localPath) ? statSync7(rec.localPath).size : 0;
     clips.set(rec.id, { path: rec.localPath, mime: rec.mime });
     recordings.delete(key2);
     return { sizeBytes };
@@ -9557,7 +9846,7 @@ async function handlePreviewClip(res, url) {
     res.setHeader("content-type", "application/json");
     return void res.end(JSON.stringify({ error: "clip_not_found", id }));
   }
-  const size = statSync6(clip.path).size;
+  const size = statSync7(clip.path).size;
   res.statusCode = 200;
   res.setHeader("content-type", clip.mime);
   res.setHeader("content-length", String(size));
@@ -9571,7 +9860,7 @@ var init_preview = __esm({
     DEVICE_LIST_TIMEOUT_MS = 5e3;
     defaultRunner2 = {
       capture(cmd, args, timeoutMs = DEFAULT_CAPTURE_TIMEOUT_MS) {
-        return new Promise((resolve40, reject) => {
+        return new Promise((resolve41, reject) => {
           const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
           const out = [];
           const err = [];
@@ -9593,7 +9882,7 @@ var init_preview = __esm({
           child.stderr.on("data", (b) => err.push(b));
           child.on("error", (e) => settle(reject, e));
           child.on("close", (code) => {
-            if (code === 0) settle(resolve40, Buffer.concat(out));
+            if (code === 0) settle(resolve41, Buffer.concat(out));
             else settle(reject, new Error(`${cmd} exited ${code}: ${Buffer.concat(err).toString("utf8")}`));
           });
         });
@@ -11170,7 +11459,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -14516,7 +14804,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -14736,8 +15023,8 @@ function ensureCountUpRuntime() {
     const neg = fixed.startsWith("-");
     const body = neg ? fixed.slice(1) : fixed;
     const [int, frac] = body.split(".");
-    const sep10 = int.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
-    return (neg ? "-" : "") + sep10 + (frac ? "." + frac : "");
+    const sep11 = int.replace(/\B(?=(\d{3})+(?!\d))/g, ",");
+    return (neg ? "-" : "") + sep11 + (frac ? "." + frac : "");
   };
   const animateEl = (el) => {
     const node = el;
@@ -19902,7 +20189,7 @@ async function stabilizePngPage(page, scheme) {
     const browser = globalThis;
     browser.document.documentElement.style.colorScheme = selected;
     await browser.document.fonts?.ready;
-    await new Promise((resolve40) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve40())));
+    await new Promise((resolve41) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve41())));
   }, scheme);
 }
 async function renderPngBatch(items) {
@@ -21914,18 +22201,18 @@ var init_motion_flags = __esm({
 
 // ../../core/dev-server/src/kits.ts
 import { readdirSync as readdirSync16, readFileSync as readFileSync36 } from "node:fs";
-import { resolve as resolve25, join as join30 } from "node:path";
+import { resolve as resolve25, join as join31 } from "node:path";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
 function listKits() {
   return readdirSync16(CATALOG).filter((f) => f.endsWith(".json")).map((f) => {
-    const { tokens, ...meta } = JSON.parse(readFileSync36(join30(CATALOG, f), "utf8"));
+    const { tokens, ...meta } = JSON.parse(readFileSync36(join31(CATALOG, f), "utf8"));
     return meta;
   });
 }
 function readKit(id) {
   if (!/^[a-z0-9-]+$/.test(id)) return null;
   try {
-    return JSON.parse(readFileSync36(join30(CATALOG, `${id}.json`), "utf8"));
+    return JSON.parse(readFileSync36(join31(CATALOG, `${id}.json`), "utf8"));
   } catch {
     return null;
   }
@@ -21934,7 +22221,7 @@ var ROOT5, CATALOG;
 var init_kits = __esm({
   "../../core/dev-server/src/kits.ts"() {
     ROOT5 = resolve25(fileURLToPath15(new URL("../../..", import.meta.url)));
-    CATALOG = join30(ROOT5, "stdlib/design-kits");
+    CATALOG = join31(ROOT5, "stdlib/design-kits");
   }
 });
 
@@ -24137,7 +24424,7 @@ __export(config_exports, {
   validateOverlayPatch: () => validateOverlayPatch
 });
 import { mkdirSync as mkdirSync15, readFileSync as readFileSync38, writeFileSync as writeFileSync12 } from "node:fs";
-import { dirname as dirname21, join as join31, resolve as resolve27 } from "node:path";
+import { dirname as dirname21, join as join32, resolve as resolve27 } from "node:path";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
 function strip(line) {
   const h = line.indexOf("#");
@@ -24202,14 +24489,14 @@ function parseRevocationsYaml(text2) {
 function appConfigPath(app, file, root = REPO_ROOT6) {
   assertAppId(app, "appConfigPath");
   for (const base of ["apps", "test-apps"]) {
-    const p = join31(root, base, app, file);
+    const p = join32(root, base, app, file);
     try {
       readFileSync38(p);
       return p;
     } catch {
     }
   }
-  return join31(root, "apps", app, file);
+  return join32(root, "apps", app, file);
 }
 function serializeRolloutYaml(cfg) {
   const lines = [`app: ${cfg.app}`, "rings:"];
@@ -24353,7 +24640,7 @@ var init_config2 = __esm({
 import { createServer as createServer2 } from "node:http";
 import { readFile as readFile2, stat } from "node:fs/promises";
 import { readFileSync as readFileSync39, existsSync as existsSync33, watch, mkdirSync as mkdirSync16, rmSync as rmSync4 } from "node:fs";
-import { extname, resolve as resolve28, normalize as normalize3, sep as sep5, join as join32 } from "node:path";
+import { extname, resolve as resolve28, normalize as normalize3, sep as sep6, join as join33 } from "node:path";
 import { createHash as createHash15, randomUUID } from "node:crypto";
 import { fileURLToPath as fileURLToPath17, pathToFileURL as pathToFileURL6 } from "node:url";
 function deepMerge2(base, patch) {
@@ -24528,7 +24815,7 @@ async function runScreenDiagnostics(state, screenId, descriptor) {
 }
 function servedFontFaces(appDir2, tokens) {
   try {
-    const policyPath = join32(appDir2, "fonts.json");
+    const policyPath = join33(appDir2, "fonts.json");
     const policy = existsSync33(policyPath) ? JSON.parse(readFileSync39(policyPath, "utf8")) : {};
     const plan = planFonts(tokens, policy);
     if (plan.families.length === 0) return void 0;
@@ -25171,7 +25458,7 @@ function startBundleSourceWatcher(state) {
   try {
     const watcher = watch(TIER5_SRC_ROOT, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename || !/\.(ts|tsx)$/.test(filename)) return;
-      const name = filename.split(sep5)[0];
+      const name = filename.split(sep6)[0];
       if (!name || name.startsWith(".")) return;
       pending.add(name);
       if (timer) clearTimeout(timer);
@@ -25201,7 +25488,7 @@ async function reloadAppModule(state, opts) {
   const outfile = resolve28(HMR_TMP_DIR, `${current.name}-${++appReloadSeq}.mjs`);
   try {
     const lib = await import(pathToFileURL6(resolve28(TIER5_SRC_ROOT, "build-lib.mjs")).href);
-    await lib.buildAppEntry(entry, outfile);
+    await lib.buildAppEntry(entry, outfile, { confineTo: current.dir });
     const mod = await import(pathToFileURL6(outfile).href);
     const next = mod.default;
     if (!next || !next.config || typeof next.homeScreenId !== "string" || !next.screens || typeof next.screens.exact !== "object" || Object.keys(next.screens.exact).length === 0 || !Array.isArray(next.actions) || !next.seed) {
@@ -25286,7 +25573,7 @@ function startAppSourceWatcher(state) {
   try {
     const watcher = watch(appDir2, { persistent: false, recursive: true }, (_event, filename) => {
       if (!filename) return;
-      const rel = String(filename).split(sep5).join("/");
+      const rel = String(filename).split(sep6).join("/");
       if (!classifyAppPath(rel)) return;
       pending.add(rel);
       if (timer) clearTimeout(timer);
@@ -25468,7 +25755,7 @@ async function handleWebWix(req, res, state) {
     const match = state.wix.mode === "mock" ? matchRuleEx(state.wix.rules, method, target.pathname, { host: target.host, query, body }) : void 0;
     if (match && (match.rule.kind ?? "mock") === "mock") {
       const mocked = match.rule.response;
-      if (mocked.delayMs) await new Promise((resolve40) => setTimeout(resolve40, mocked.delayMs));
+      if (mocked.delayMs) await new Promise((resolve41) => setTimeout(resolve41, mocked.delayMs));
       const responseBody = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
         ts: started,
@@ -27448,7 +27735,7 @@ __export(build_exports2, {
 });
 import { createHash as createHash18 } from "node:crypto";
 import { readFileSync as readFileSync40, readdirSync as readdirSync18, existsSync as existsSync34 } from "node:fs";
-import { dirname as dirname22, join as join33, resolve as resolve29 } from "node:path";
+import { dirname as dirname22, join as join34, resolve as resolve29 } from "node:path";
 import { fileURLToPath as fileURLToPath18 } from "node:url";
 import { createRequire as createRequire2 } from "node:module";
 import { execFileSync as execFileSync4 } from "node:child_process";
@@ -27486,7 +27773,7 @@ function l10nLintOptions(locale, appDir2) {
   const tags = (locale.translations ?? []).filter((t) => t !== locale.default);
   const catalog = /* @__PURE__ */ new Set();
   for (const tag of tags) {
-    const path = join33(appDir2, "l10n", `${tag}.json`);
+    const path = join34(appDir2, "l10n", `${tag}.json`);
     if (!existsSync34(path)) continue;
     try {
       const parsed = JSON.parse(readFileSync40(path, "utf8"));
@@ -27583,7 +27870,7 @@ function shellSha(root = REPO_ROOT7) {
 function isMonorepoCheckout(dir) {
   try {
     const top = execFileSync4("git", ["rev-parse", "--show-toplevel"], { cwd: dir, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-    return top.length > 0 && existsSync34(join33(top, "core", "schema", "core.proto"));
+    return top.length > 0 && existsSync34(join34(top, "core", "schema", "core.proto"));
   } catch {
     return false;
   }
@@ -27813,7 +28100,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
     if (addrCache.has(name)) return addrCache.get(name);
     let bytes2;
     try {
-      bytes2 = readFileSync40(join33(tier5Dir, `${name}.bundle.js`));
+      bytes2 = readFileSync40(join34(tier5Dir, `${name}.bundle.js`));
     } catch {
       return null;
     }
@@ -27834,7 +28121,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const MAX_AUTHORING_DOC_BYTES = 128 * 1024;
   if (store.putDoc) {
     for (const [name, file] of [["spec", "SPEC.md"], ["mobile-ux", "MOBILE-UX.md"]]) {
-      const path = join33(preloaded.dir, file);
+      const path = join34(preloaded.dir, file);
       if (!existsSync34(path)) continue;
       const bytes2 = readFileSync40(path);
       if (bytes2.length === 0 || bytes2.length > MAX_AUTHORING_DOC_BYTES) {
@@ -27894,7 +28181,7 @@ async function buildFromLoaded(preloaded, dest, opts = {}) {
   const canEmitFonts = hasVendoredFloor();
   try {
     const appTokens = readTokensForLint(preloaded) ?? {};
-    const policy = existsSync34(join33(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync40(join33(preloaded.dir, "fonts.json"), "utf8")) : {};
+    const policy = existsSync34(join34(preloaded.dir, "fonts.json")) ? JSON.parse(readFileSync40(join34(preloaded.dir, "fonts.json"), "utf8")) : {};
     fontPlan = planFonts(appTokens, policy);
   } catch (err) {
     throw new Error(
@@ -28359,7 +28646,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   await store.reset(app);
   const sources = {};
   for (const definition of config.functions.functions) {
-    const candidates = [".ts", ".js", ".mts", ".mjs"].map((extension) => join33(preloaded.dir, "functions", `${definition.name}${extension}`));
+    const candidates = [".ts", ".js", ".mts", ".mjs"].map((extension) => join34(preloaded.dir, "functions", `${definition.name}${extension}`));
     const source = candidates.find((candidate) => existsSync34(candidate));
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
     sources[definition.name] = readFileSync40(source, "utf8");
@@ -28390,7 +28677,7 @@ async function buildFunctionsOnlyRelease(preloaded, dest) {
   return { manifest, failedToBuild: [], missingBundles: [], auth: {} };
 }
 function listBuildableApps() {
-  const appsDir = join33(REPO_ROOT7, "apps");
+  const appsDir = join34(REPO_ROOT7, "apps");
   return readdirSync18(appsDir, { withFileTypes: true }).filter((d) => d.isDirectory() && !d.name.startsWith("_")).map((d) => d.name);
 }
 var BAKE_OFFLINE_BASE, KNOWN_ICON_NAMES, KNOWN_ICONS, REPO_ROOT7, TIER5_DIR, requireFromHere, SOURCEMAP_ON_DEMAND_PATH, BAKED_SERVER_BASE_URL;
@@ -28421,9 +28708,9 @@ var init_build3 = __esm({
     KNOWN_ICON_NAMES = [...ICON_NAMES].sort();
     KNOWN_ICONS = new Set(KNOWN_ICON_NAMES);
     REPO_ROOT7 = resolve29(dirname22(fileURLToPath18(import.meta.url)), "../..");
-    TIER5_DIR = join33(REPO_ROOT7, "core/dev-server/tier5-bundles");
+    TIER5_DIR = join34(REPO_ROOT7, "core/dev-server/tier5-bundles");
     requireFromHere = createRequire2(import.meta.url);
-    SOURCEMAP_ON_DEMAND_PATH = join33(REPO_ROOT7, "core/dev-server/tier5-bundles-src/sourcemap-on-demand.mjs");
+    SOURCEMAP_ON_DEMAND_PATH = join34(REPO_ROOT7, "core/dev-server/tier5-bundles-src/sourcemap-on-demand.mjs");
     BAKED_SERVER_BASE_URL = "http://baked.himalaya.invalid";
   }
 });
@@ -28470,6 +28757,133 @@ var init_net_scenario = __esm({
   }
 });
 
+// ../../core/dev-server/src/crawl-relations.ts
+function inversePartner(action, declared) {
+  if (/^toggle/i.test(action)) return null;
+  const candidates = [];
+  if (/^un[A-Z_a-z]/.test(action)) {
+    candidates.push(lowerFirst(action.slice(2)), action.slice(2));
+  } else {
+    candidates.push("un" + action, "un" + upperFirst(action));
+  }
+  for (const c of candidates) if (c !== action && declared.includes(c)) return c;
+  for (const [a, b] of PREFIX_PAIRS) {
+    for (const [from, to] of [
+      [a, b],
+      [b, a]
+    ]) {
+      if (!action.toLowerCase().startsWith(from)) continue;
+      const rest = action.slice(from.length);
+      for (const c of [to + rest, to + upperFirst(rest), to]) {
+        if (c !== action && declared.includes(c)) return c;
+      }
+    }
+  }
+  return null;
+}
+function isUndoAction(action) {
+  if (/^toggle/i.test(action)) return false;
+  if (/^un[A-Z]/.test(action) || /^un[a-z]/.test(action)) return true;
+  return PREFIX_PAIRS.some(([, undo]) => action.toLowerCase().startsWith(undo));
+}
+function isOptionSelection(params) {
+  return Object.keys(params).some((k) => /^(selected|tab|segment|mode|scope)/i.test(k) || /Id$/.test(k) || k === "id");
+}
+function stripVolatile(value, depth = 0) {
+  if (depth > 8 || value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map((v) => stripVolatile(v, depth + 1));
+  const out = {};
+  for (const k of Object.keys(value).sort()) {
+    if (VOLATILE_KEY.test(k)) continue;
+    out[k] = stripVolatile(value[k], depth + 1);
+  }
+  return out;
+}
+function relationalSignature(state) {
+  return JSON.stringify(stripVolatile(state));
+}
+function listLengths(state, depth = 4) {
+  const out = {};
+  const walk2 = (node, path, left) => {
+    if (left < 0 || node === null || typeof node !== "object") return;
+    if (Array.isArray(node)) {
+      out[path] = node.length;
+      return;
+    }
+    for (const [k, v] of Object.entries(node)) {
+      walk2(v, path ? `${path}.${k}` : k, left - 1);
+    }
+  };
+  walk2(state, "", depth);
+  return out;
+}
+function summarizeDiff(aSig, bSig, limit = 3) {
+  let a;
+  let b;
+  try {
+    a = JSON.parse(aSig);
+    b = JSON.parse(bSig);
+  } catch {
+    return aSig === bSig ? "" : "states differ (unparseable signature)";
+  }
+  const diffs = [];
+  const brief = (v) => {
+    const t = JSON.stringify(v);
+    if (t === void 0) return "undefined";
+    return t.length > 80 ? `${t.slice(0, 77)}\u2026` : t;
+  };
+  const walk2 = (x, y, path) => {
+    if (diffs.length >= limit) return;
+    const bothObjects = x !== null && y !== null && typeof x === "object" && typeof y === "object" && !Array.isArray(x) && !Array.isArray(y);
+    if (bothObjects) {
+      for (const k of /* @__PURE__ */ new Set([...Object.keys(x), ...Object.keys(y)])) {
+        walk2(x[k], y[k], path ? `${path}.${k}` : k);
+      }
+      return;
+    }
+    if (Array.isArray(x) && Array.isArray(y)) {
+      if (x.length !== y.length) {
+        diffs.push(`${path || "state"}: ${x.length} \u2192 ${y.length} items`);
+        return;
+      }
+      for (let i = 0; i < x.length && diffs.length < limit; i++) walk2(x[i], y[i], `${path}[${i}]`);
+      return;
+    }
+    const xs = brief(x);
+    const ys = brief(y);
+    if (xs !== ys) diffs.push(`${path || "state"}: ${xs} \u2192 ${ys}`);
+  };
+  walk2(a, b, "");
+  return diffs.slice(0, limit).join("; ");
+}
+var PREFIX_PAIRS, upperFirst, lowerFirst, REFRESH_ACTION, LOAD_MORE_ACTION, FILTER_ACTION, VOLATILE_KEY;
+var init_crawl_relations = __esm({
+  "../../core/dev-server/src/crawl-relations.ts"() {
+    PREFIX_PAIRS = [
+      ["add", "remove"],
+      ["add", "delete"],
+      // NOT ["start", "stop"]. Measured 2026-09-16: it produced 2 warnings on unmutated, correct code
+      // (voice-journal, `start → stop` and `startBackground → stop`, both leaving
+      // `statusLabel: "Ready" → "Ready — recording stopped"`). start/stop is a LIFECYCLE pair, not an
+      // algebraic inverse: stopping does not unmake the recording that was started, and an app is right
+      // to say so. Only pairs where the undo genuinely restores the prior value belong here.
+      ["open", "close"],
+      ["show", "hide"],
+      ["expand", "collapse"],
+      ["select", "deselect"],
+      ["increment", "decrement"],
+      ["follow", "unfollow"],
+      ["save", "unsave"]
+    ];
+    upperFirst = (s) => s ? s[0].toUpperCase() + s.slice(1) : s;
+    lowerFirst = (s) => s ? s[0].toLowerCase() + s.slice(1) : s;
+    REFRESH_ACTION = /^(refresh|reload|retry|sync|pullToRefresh)/i;
+    LOAD_MORE_ACTION = /^(loadMore|nextPage|fetchMore)|^more$|More$|NextPage$/;
+    FILTER_ACTION = /^(filter|search|query|sort)|(Filter|Search|Query|Sort)/;
+    VOLATILE_KEY = /^_|^(id|uuid|guid|nonce|seed|token|timestamp|now|revision|etag)$|(Id|ID|Uuid|Guid|Nonce|Seed|Token|At|Timestamp|Ms|Revision|ETag)$/;
+  }
+});
+
 // ../../core/dev-server/src/screen-crawl.ts
 var screen_crawl_exports = {};
 __export(screen_crawl_exports, {
@@ -28482,6 +28896,7 @@ __export(screen_crawl_exports, {
   crawlScreenDeep: () => crawlScreenDeep,
   crawlScreenHostile: () => crawlScreenHostile,
   crawlScreenJourney: () => crawlScreenJourney,
+  crawlScreenRelations: () => crawlScreenRelations,
   crawlSignature: () => crawlSignature,
   deepStateSignature: () => deepStateSignature,
   emptiedArrays: () => emptiedArrays,
@@ -28492,6 +28907,7 @@ __export(screen_crawl_exports, {
   parseWorkerAction: () => parseWorkerAction,
   recordScreenTraffic: () => recordScreenTraffic,
   rootOnAppear: () => rootOnAppear,
+  snapshot: () => snapshot,
   structuralSignature: () => structuralSignature,
   unverifiableNodes: () => unverifiableNodes,
   workerArgs: () => workerArgs
@@ -29727,7 +30143,209 @@ async function crawlScreenDeep(opts, deep) {
     return { findings: dedupe(findings), nodesVisited: visited.size, dispatches, capped };
   });
 }
-var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, BLANK_WHEN_BOUND;
+function effectiveSiteForRow(site, row) {
+  const merged = { ...site.params ?? {}, ...site.args ?? {} };
+  const substituted = {};
+  for (const [k, v] of Object.entries(merged)) {
+    substituted[k] = typeof v === "string" && v.startsWith("$item.") ? pathValue(row, v.slice("$item.".length)) : v === "$item" ? row : v;
+  }
+  return { ...site, params: substituted, args: void 0 };
+}
+function isRowBound(site) {
+  const payload = { ...site.params ?? {}, ...site.args ?? {} };
+  return Object.values(payload).some((v) => typeof v === "string" && (v === "$item" || v.startsWith("$item.")));
+}
+function collectItemsPaths(node, out = /* @__PURE__ */ new Set()) {
+  if (!node || typeof node !== "object") return out;
+  if (Array.isArray(node)) {
+    for (const n of node) collectItemsPaths(n, out);
+    return out;
+  }
+  const rec = node;
+  const body = rec.body;
+  if (body && typeof body === "object" && typeof body.type === "string" && body.props && typeof body.props === "object") {
+    const itemsPath = body.props.itemsPath;
+    if (typeof itemsPath === "string") out.add(itemsPath);
+  }
+  for (const v of Object.values(rec)) collectItemsPaths(v, out);
+  return out;
+}
+function newlyAddedRow(before, after, itemsPath) {
+  if (!itemsPath || itemsPath === UNTRACKED_ITEMS) return null;
+  const rowsOf = (s) => {
+    const provider = new FakeServiceProvider(s);
+    const v = resolveSiteRows(itemsPath, (p) => provider.value(p));
+    return Array.isArray(v) ? v.filter((r) => r && typeof r === "object") : [];
+  };
+  const seen = new Set(rowsOf(before).map((r) => relationalSignature(r)));
+  const fresh = rowsOf(after).filter((r) => !seen.has(relationalSignature(r)));
+  return fresh.length === 1 ? fresh[0] : null;
+}
+async function crawlScreenRelations(opts) {
+  return withSwallowedRejections(async () => {
+    const { screenId, descriptor, bundleJs } = opts;
+    const findings = [];
+    const byKind = { inverse: 0, refresh: 0, loadMore: 0, filter: 0 };
+    let checked = 0;
+    if (!bundleJs) return { findings, checked, byKind };
+    const layered = layeredTransport({ rules: opts.rules, cmsSeed: opts.cmsSeed, canned: opts.canned });
+    const wixCall = opts.transportWrap ? opts.transportWrap(layered.call) : layered.call;
+    const sites = actionSitesForDescriptor(descriptor).filter(
+      (s) => parseWorkerAction(s.actionId) && !opts.skipAction?.(s.actionId, s.componentId)
+    );
+    const nameOf = (s) => parseWorkerAction(s.actionId).action;
+    const serviceOf = (s) => parseWorkerAction(s.actionId).service;
+    const boot = () => bootScreenWorker({
+      bundleJs,
+      descriptor,
+      wixCall,
+      screenId,
+      inputOverride: opts.inputOverride,
+      budgetMs: opts.budgetMs,
+      clock: opts.clock,
+      seed: opts.seed,
+      localDbSchema: opts.localDbSchema,
+      ...opts.evaluator ? { evaluator: opts.evaluator } : {}
+    });
+    const replay = async (path, rowFor = () => null) => {
+      const w = await boot();
+      try {
+        if (w.errors.length) return null;
+        let prev = snapshot(w).state;
+        const bootState = prev;
+        for (const [i, site] of path.entries()) {
+          const parsed = parseWorkerAction(site.actionId);
+          const h = w.handles[parsed.service];
+          if (!h || !h.actionNames().includes(parsed.action)) return null;
+          const pinned = rowFor(i, bootState, prev);
+          if (pinned === UNBINDABLE_ROW) return null;
+          const eff = pinned ? effectiveSiteForRow(site, pinned) : effectiveSiteFor(site, prev);
+          if (!eff) return null;
+          try {
+            await h.dispatch(parsed.action, ...workerArgs(eff));
+          } catch {
+            return null;
+          }
+          for (let k = 0; k < 20; k++) await yieldMacrotask();
+          if (w.errors.length) return null;
+          prev = snapshot(w).state;
+        }
+        return prev;
+      } finally {
+        w.dispose();
+      }
+    };
+    const base = await replay([]);
+    if (!base || Object.values(base).some(hasOwnError)) return { findings, checked, byKind };
+    const baseSig = relationalSignature(base);
+    const baseLens = listLengths(base);
+    const listPathOf = (itemsPath) => {
+      if (!itemsPath || itemsPath === UNTRACKED_ITEMS || itemsPath.includes("[]")) return null;
+      const m = /^\$service:(.+)$/.exec(itemsPath);
+      return m && baseLens[m[1]] !== void 0 ? m[1] : null;
+    };
+    const screenListPaths = [
+      ...new Set(
+        [...collectItemsPaths(descriptor)].map(listPathOf).filter((x) => x !== null)
+      )
+    ];
+    const trig = (s) => ({ tap: s.componentId, key: s.key, action: s.actionId });
+    for (const s of sites.filter((s2) => REFRESH_ACTION.test(nameOf(s2)) || s2.key === "onPullToRefresh")) {
+      const after = await replay([s]);
+      if (!after) continue;
+      checked++;
+      byKind.refresh++;
+      const sig = relationalSignature(after);
+      if (sig !== baseSig) {
+        findings.push({
+          screen: screenId,
+          trigger: trig(s),
+          invariant: "refresh-not-idempotent",
+          severity: "warning",
+          axis: "relation",
+          message: `${nameOf(s)} from a fresh boot settles on a different state than the boot itself, under identical data: ${summarizeDiff(baseSig, sig)}`,
+          hint: "a refresh that appends instead of replacing, or clears a flag the loader set \u2014 REPLACE collections on refresh; ids, *At and _counters are already ignored by this comparison"
+        });
+      }
+    }
+    for (const s of sites.filter((s2) => LOAD_MORE_ACTION.test(nameOf(s2)) || s2.key === "onLoadMore")) {
+      const target = listPathOf(s.itemsPath);
+      const after = target ? await replay([s]) : null;
+      if (!after) continue;
+      checked++;
+      byKind.loadMore++;
+      for (const [p, n] of Object.entries(listLengths(after))) {
+        if (p === target && baseLens[p] !== void 0 && n < baseLens[p]) {
+          findings.push({
+            screen: screenId,
+            trigger: trig(s),
+            invariant: "list-shrank-on-load-more",
+            severity: "warning",
+            axis: "relation",
+            at: p,
+            actual: `${baseLens[p]} \u2192 ${n}`,
+            message: `${nameOf(s)} shrank ${p} from ${baseLens[p]} to ${n} rows \u2014 a "load more" that replaces the page instead of appending it`,
+            hint: "append the new page to the existing rows (and de-duplicate by id); the user scrolled to see MORE"
+          });
+        }
+      }
+    }
+    for (const s of sites.filter((s2) => FILTER_ACTION.test(nameOf(s2)) && !isOptionSelection({ ...s2.params, ...s2.args }))) {
+      if (screenListPaths.length !== 1) continue;
+      const after = await replay([s]);
+      if (!after) continue;
+      checked++;
+      byKind.filter++;
+      for (const [p, n] of Object.entries(listLengths(after))) {
+        if (screenListPaths.includes(p) && baseLens[p] !== void 0 && n > baseLens[p]) {
+          findings.push({
+            screen: screenId,
+            trigger: trig(s),
+            invariant: "list-grew-on-filter",
+            severity: "warning",
+            axis: "relation",
+            at: p,
+            actual: `${baseLens[p]} \u2192 ${n}`,
+            message: `${nameOf(s)} grew ${p} from ${baseLens[p]} to ${n} rows \u2014 a filter/search/sort can narrow or reorder a list, never enlarge it`,
+            hint: "filter from the FULL set you keep aside, and assign the narrowed result \u2014 not a concatenation"
+          });
+        }
+      }
+    }
+    const declaredNames = sites.map(nameOf);
+    for (const a of sites) {
+      const partner = inversePartner(nameOf(a), declaredNames);
+      if (!partner) continue;
+      if (isUndoAction(nameOf(a))) continue;
+      const b = sites.find((s) => nameOf(s) === partner && serviceOf(s) === serviceOf(a) && s !== a);
+      if (!b) continue;
+      const undoIsRowBound = isRowBound(b);
+      const after = await replay([a, b], (i, bootState, prev) => {
+        if (i !== 1) return null;
+        const row = newlyAddedRow(bootState, prev, b.itemsPath);
+        if (row) return row;
+        return undoIsRowBound ? UNBINDABLE_ROW : null;
+      });
+      if (!after) continue;
+      checked++;
+      byKind.inverse++;
+      const sig = relationalSignature(after);
+      if (sig !== baseSig) {
+        findings.push({
+          screen: screenId,
+          trigger: trig(b),
+          invariant: "inverse-pair-diverges",
+          severity: "warning",
+          axis: "relation",
+          message: `${nameOf(a)} \u2192 ${nameOf(b)} does not return to the boot state: ${summarizeDiff(baseSig, sig)}`,
+          hint: `${nameOf(b)} should undo exactly what ${nameOf(a)} did \u2014 check which row it removes (by the id it was given) and every field ${nameOf(a)} touched; ids, *At and _counters are already ignored`
+        });
+      }
+    }
+    return { findings: dedupe(findings), checked, byKind };
+  });
+}
+var ACTION_KEYS, UNTRACKED_ITEMS, NESTED_ITEMS_SEP, REJECT_ALL_MESSAGE, VLQ, WIX_DATA_QUERY, WIX_DATA_ANY, CAPABILITY_ACTION, BLANK_WHEN_BOUND, UNBINDABLE_ROW;
 var init_screen_crawl = __esm({
   "../../core/dev-server/src/screen-crawl.ts"() {
     init_validate_descriptor_core();
@@ -29737,6 +30355,7 @@ var init_screen_crawl = __esm({
     init_FakeServiceProvider();
     init_actionParams();
     init_implications();
+    init_crawl_relations();
     ACTION_KEYS = [
       "action",
       "onTap",
@@ -29760,6 +30379,7 @@ var init_screen_crawl = __esm({
       Marquee: ["items", "itemsPath", "text"],
       MediaPlayer: ["items", "itemsPath"]
     };
+    UNBINDABLE_ROW = Symbol("unbindable-row");
   }
 });
 
@@ -30315,8 +30935,8 @@ __export(pack_exports, {
 });
 import { createHash as createHash19 } from "node:crypto";
 import { deflateRawSync, inflateRawSync } from "node:zlib";
-import { existsSync as existsSync35, mkdirSync as mkdirSync17, readFileSync as readFileSync42, readdirSync as readdirSync19, rmSync as rmSync5, statSync as statSync7, writeFileSync as writeFileSync13 } from "node:fs";
-import { dirname as dirname23, join as join34, resolve as resolve31 } from "node:path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync17, readFileSync as readFileSync42, readdirSync as readdirSync19, rmSync as rmSync5, statSync as statSync8, writeFileSync as writeFileSync13 } from "node:fs";
+import { dirname as dirname23, join as join35, resolve as resolve31 } from "node:path";
 function writeZip(entries) {
   const sorted = entries.slice().sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   const total = sorted.reduce((n, e) => n + e.bytes.length, 0);
@@ -30410,13 +31030,13 @@ function inflateEntry(buf, entry) {
   return bytes2;
 }
 function readIf(path) {
-  return existsSync35(path) && statSync7(path).isFile() ? readFileSync42(path) : null;
+  return existsSync35(path) && statSync8(path).isFile() ? readFileSync42(path) : null;
 }
 function listDir(dir) {
-  return existsSync35(dir) ? readdirSync19(dir).filter((f) => statSync7(join34(dir, f)).isFile()) : [];
+  return existsSync35(dir) ? readdirSync19(dir).filter((f) => statSync8(join35(dir, f)).isFile()) : [];
 }
 function gatherReleaseEntries(appDir2) {
-  const manifestPath = join34(appDir2, HIMI_PACKAGE_MANIFEST_PATH);
+  const manifestPath = join35(appDir2, HIMI_PACKAGE_MANIFEST_PATH);
   const manifestBytes = readIf(manifestPath);
   if (!manifestBytes) throw new Error(`no ${HIMI_PACKAGE_MANIFEST_PATH} in ${appDir2} \u2014 build a release there first`);
   const manifest = JSON.parse(manifestBytes.toString("utf8"));
@@ -30440,7 +31060,7 @@ function gatherReleaseEntries(appDir2) {
   }
   const missing = [];
   for (const rel of wanted) {
-    const bytes2 = readIf(join34(appDir2, rel));
+    const bytes2 = readIf(join35(appDir2, rel));
     if (bytes2) entries.push({ path: rel, bytes: bytes2 });
     else missing.push(rel);
   }
@@ -30451,12 +31071,12 @@ function gatherReleaseEntries(appDir2) {
     );
   }
   for (const name of SINGLETONS) {
-    const bytes2 = readIf(join34(appDir2, name));
+    const bytes2 = readIf(join35(appDir2, name));
     if (bytes2) entries.push({ path: name, bytes: bytes2 });
   }
   const skipped = [];
   for (const sub of ["screens", "bundles", "assets", "widgets"]) {
-    for (const f of listDir(join34(appDir2, sub))) {
+    for (const f of listDir(join35(appDir2, sub))) {
       if (!wanted.has(`${sub}/${f}`)) skipped.push(`${sub}/${f}`);
     }
   }
@@ -30487,18 +31107,18 @@ function buildEntries(appDir2, app, opts) {
   return { all, header, manifest, skipped };
 }
 function packRelease(releaseRoot, app, out, opts = {}) {
-  const appDir2 = join34(resolve31(releaseRoot), app);
+  const appDir2 = join35(resolve31(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir2, app, opts);
   const buf = writeZip(all);
-  const isDir = existsSync35(out) && statSync7(out).isDirectory();
-  const outFile = isDir ? join34(resolve31(out), packageFileName(app, header.releaseId)) : resolve31(out);
+  const isDir = existsSync35(out) && statSync8(out).isDirectory();
+  const outFile = isDir ? join35(resolve31(out), packageFileName(app, header.releaseId)) : resolve31(out);
   mkdirSync17(dirname23(outFile), { recursive: true });
   writeFileSync13(outFile, buf);
   return { app, releaseId: header.releaseId, header, out: outFile, bytes: buf.length, entryCount: all.length, skipped };
 }
 function resolvePackageDirDest(outDir, app, releaseId) {
   const packagedApp = (dir) => {
-    const bytes2 = readIf(join34(dir, HIMI_PACKAGE_HEADER_PATH));
+    const bytes2 = readIf(join35(dir, HIMI_PACKAGE_HEADER_PATH));
     if (!bytes2) return void 0;
     try {
       return JSON.parse(bytes2.toString("utf8")).app;
@@ -30508,14 +31128,14 @@ function resolvePackageDirDest(outDir, app, releaseId) {
   };
   const replaceable = (dir) => {
     if (!existsSync35(dir)) return true;
-    if (!statSync7(dir).isDirectory()) return false;
+    if (!statSync8(dir).isDirectory()) return false;
     return readdirSync19(dir).length === 0 || packagedApp(dir) === app;
   };
-  if (existsSync35(outDir) && !statSync7(outDir).isDirectory()) {
+  if (existsSync35(outDir) && !statSync8(outDir).isDirectory()) {
     throw new Error(`refusing to write a package tree over ${outDir} \u2014 it is a file, not a directory`);
   }
   if (replaceable(outDir)) return outDir;
-  const child = join34(outDir, packageDirName(app, releaseId));
+  const child = join35(outDir, packageDirName(app, releaseId));
   if (!replaceable(child)) {
     throw new Error(
       `refusing to replace ${child}: it is not empty and is not a ${app} package (no ${HIMI_PACKAGE_HEADER_PATH}). Pass --out to a new or empty directory.`
@@ -30524,13 +31144,13 @@ function resolvePackageDirDest(outDir, app, releaseId) {
   return child;
 }
 function packReleaseToDir(releaseRoot, app, outDir, opts = {}) {
-  const appDir2 = join34(resolve31(releaseRoot), app);
+  const appDir2 = join35(resolve31(releaseRoot), app);
   const { all, header, skipped } = buildEntries(appDir2, app, opts);
   const dest = resolvePackageDirDest(resolve31(outDir), app, header.releaseId);
   rmSync5(dest, { recursive: true, force: true });
   let bytes2 = 0;
   for (const entry of all) {
-    const target = join34(dest, entry.path);
+    const target = join35(dest, entry.path);
     mkdirSync17(dirname23(target), { recursive: true });
     writeFileSync13(target, entry.bytes);
     bytes2 += entry.bytes.length;
@@ -30559,11 +31179,11 @@ function openPackageDir(dir) {
   const root = resolve31(dir);
   const entries = /* @__PURE__ */ new Map();
   const walk2 = (rel) => {
-    const abs = rel ? join34(root, rel) : root;
+    const abs = rel ? join35(root, rel) : root;
     for (const name of readdirSync19(abs)) {
       const childRel = rel ? `${rel}/${name}` : name;
-      const childAbs = join34(abs, name);
-      if (statSync7(childAbs).isDirectory()) walk2(childRel);
+      const childAbs = join35(abs, name);
+      if (statSync8(childAbs).isDirectory()) walk2(childRel);
       else if (isSafeEntryName(childRel)) entries.set(childRel, readFileSync42(childAbs));
     }
   };
@@ -30601,10 +31221,10 @@ function unpackTo(buf, dest, appFallback) {
   if (!app) throw new Error("package declares no app id (no himi-package.json and no manifest.app)");
   if (!isSafeAppId(app)) throw new Error(`package declares an unsafe app id ${JSON.stringify(app)} \u2014 refusing to unpack it`);
   const root = resolve31(dest);
-  const appDir2 = join34(root, app);
+  const appDir2 = join35(root, app);
   rmSync5(appDir2, { recursive: true, force: true });
   for (const [rel, bytes2] of entries) {
-    const target = join34(appDir2, rel);
+    const target = join35(appDir2, rel);
     mkdirSync17(dirname23(target), { recursive: true });
     writeFileSync13(target, bytes2);
   }
@@ -30629,38 +31249,49 @@ var app_source_exports = {};
 __export(app_source_exports, {
   MAX_APP_SOURCE_BYTES: () => MAX_APP_SOURCE_BYTES,
   collectAppSource: () => collectAppSource,
+  deniedArchivePaths: () => deniedArchivePaths,
   isDeniedSourcePath: () => isDeniedSourcePath,
   readAppSource: () => readAppSource,
+  removeStaleSource: () => removeStaleSource,
   secretFindings: () => secretFindings,
+  staleSourcePaths: () => staleSourcePaths,
   writeAppSource: () => writeAppSource,
+  writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join35, dirname as dirname24, sep as sep6 } from "node:path";
-function collectAppSource(dir) {
-  const entries = [];
-  const skipped = [];
+import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync36, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join36, resolve as resolve32, sep as sep7 } from "node:path";
+function walkSourceTree(dir, file, skip) {
   const walk2 = (relDir) => {
-    for (const name of readdirSync20(join35(dir, relDir))) {
-      const rel = relDir ? join35(relDir, name) : name;
-      const st = lstatSync4(join35(dir, rel));
+    for (const name of readdirSync20(join36(dir, relDir))) {
+      const rel = relDir ? join36(relDir, name) : name;
+      const st = lstatSync4(join36(dir, rel));
       if (st.isSymbolicLink()) {
-        skipped.push(rel);
+        skip(rel);
         continue;
       }
       if (st.isDirectory()) {
-        if (isDeniedSourceDir(name)) skipped.push(rel);
+        if (isDeniedSourceDir(name)) skip(rel);
         else walk2(rel);
         continue;
       }
       if (isDeniedSourcePath(rel)) {
-        skipped.push(rel);
+        skip(rel);
         continue;
       }
-      entries.push({ path: rel.split(sep6).join("/"), bytes: readFileSync43(join35(dir, rel)) });
+      file(rel.split(sep7).join("/"), rel);
     }
   };
   walk2("");
+}
+function collectAppSource(dir) {
+  const entries = [];
+  const skipped = [];
+  walkSourceTree(
+    dir,
+    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync43(join36(dir, hostRel)) }),
+    (hostRel) => skipped.push(hostRel)
+  );
   entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   skipped.sort();
   return { entries, skipped };
@@ -30680,16 +31311,115 @@ function zipAppSource(entries) {
 function readAppSource(zip) {
   return [...readZip(zip)].map(([path, bytes2]) => ({ path, bytes: bytes2 }));
 }
+function pathKind(p) {
+  try {
+    return lstatSync4(p);
+  } catch {
+    return null;
+  }
+}
 function writeAppSource(entries, destDir) {
+  const root = resolve32(destDir);
+  mkdirSync18(root, { recursive: true });
   const written = [];
   for (const entry of entries) {
-    const target = join35(destDir, ...entry.path.split("/"));
-    mkdirSync18(dirname24(target), { recursive: true });
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    let dir = root;
+    for (const segment of segments.slice(0, -1)) {
+      dir = join36(dir, segment);
+      const kind = pathKind(dir);
+      if (kind?.isSymbolicLink()) unlinkSync3(dir);
+      else if (kind) continue;
+      mkdirSync18(dir);
+    }
+    const target = join36(root, ...segments);
+    if (pathKind(target)?.isSymbolicLink()) unlinkSync3(target);
     writeFileSync14(target, entry.bytes);
     written.push(entry.path);
   }
   return written;
 }
+function staleSourcePaths(entries, destDir) {
+  if (!existsSync36(destDir)) return [];
+  const archived = new Set(entries.map((e) => e.path));
+  const stale = [];
+  walkSourceTree(destDir, (archivePath) => {
+    if (!archived.has(archivePath)) stale.push(archivePath);
+  }, () => {
+  });
+  return stale.sort();
+}
+function deniedArchivePaths(entries) {
+  return entries.filter((e) => isDeniedSourcePath(e.path)).map((e) => e.path).sort();
+}
+function writeConflicts(entries, destDir) {
+  const root = resolve32(destDir);
+  const conflicts = [];
+  const seen = /* @__PURE__ */ new Set();
+  const say = (rel, what) => {
+    if (seen.has(rel)) return;
+    seen.add(rel);
+    conflicts.push(`${rel} ${what}`);
+  };
+  for (const entry of entries) {
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    let dir = root;
+    let stop = false;
+    for (const [i, segment] of segments.slice(0, -1).entries()) {
+      dir = join36(dir, segment);
+      const kind2 = pathKind(dir);
+      if (!kind2 || kind2.isSymbolicLink()) {
+        stop = true;
+        break;
+      }
+      if (kind2.isDirectory()) continue;
+      say(segments.slice(0, i + 1).join("/"), "is a file here, but the release has a directory at that path");
+      stop = true;
+      break;
+    }
+    if (stop) continue;
+    const kind = pathKind(join36(root, ...segments));
+    if (kind && !kind.isSymbolicLink() && kind.isDirectory()) {
+      say(entry.path, "is a directory here, but the release has a file at that path");
+    }
+  }
+  return conflicts;
+}
+function removeStaleSource(entries, destDir) {
+  const root = resolve32(destDir);
+  const removed = staleSourcePaths(entries, root);
+  for (const rel of removed) rmSync6(join36(root, ...rel.split("/")), { force: true });
+  const needed = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    for (let i = 1; i < segments.length; i++) needed.add(segments.slice(0, i).join("/"));
+  }
+  if (existsSync36(root)) pruneEmptyDirs(root, "", needed, removed);
+  return removed.sort();
+}
+function pruneEmptyDirs(root, rel, needed, removed) {
+  let empty = true;
+  for (const name of readdirSync20(rel ? join36(root, rel) : root)) {
+    const childRel = rel ? join36(rel, name) : name;
+    const posix3 = childRel.split(sep7).join("/");
+    const kind = lstatSync4(join36(root, childRel));
+    if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name)) {
+      empty = false;
+      continue;
+    }
+    const childEmpty = pruneEmptyDirs(root, childRel, needed, removed);
+    if (!childEmpty || needed.has(posix3)) {
+      empty = false;
+      continue;
+    }
+    rmdirSync(join36(root, childRel));
+    removed.push(`${posix3}/`);
+  }
+  return empty;
+}
 var MAX_APP_SOURCE_BYTES, SECRET_PATTERNS;
 var init_app_source = __esm({
   "src/app-source.ts"() {
@@ -30713,13 +31443,13 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync36, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname25, join as join36, relative as relative4, resolve as resolve32, sep as sep7 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname24, join as join37, relative as relative4, resolve as resolve33, sep as sep8 } from "node:path";
 function locate(repoRootOrCwd, mod) {
-  const inRepo = resolve32(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
-  if (existsSync36(inRepo)) return { path: inRepo, form: "source" };
-  const dist = resolve32(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
-  if (existsSync36(dist)) return { path: dist, form: "bundle" };
+  const inRepo = resolve33(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
+  if (existsSync37(inRepo)) return { path: inRepo, form: "source" };
+  const dist = resolve33(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
+  if (existsSync37(dist)) return { path: dist, form: "bundle" };
   return null;
 }
 function specifiersFor(mod) {
@@ -30743,8 +31473,8 @@ function ejectModule(opts) {
     };
   }
   const ext = found.form === "source" ? "ts" : "mjs";
-  const target = join36(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
-  mkdirSync19(dirname25(target), { recursive: true });
+  const target = join37(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
+  mkdirSync19(dirname24(target), { recursive: true });
   const banner = `// EJECTED from @wix/himalaya/${mod}. This app owns this file now.
 //
 // Central fixes to @wix/himalaya/${mod} NO LONGER REACH THIS APP \u2014 including any
@@ -30764,10 +31494,10 @@ function ejectModule(opts) {
   writeFileSync15(target, banner + normalized);
   const rewired = [];
   for (const f of files) {
-    if (!existsSync36(f)) continue;
+    if (!existsSync37(f)) continue;
     const before = readFileSync44(f, "utf8");
     let after = before;
-    let rel = relative4(dirname25(f), target).split(sep7).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative4(dirname24(f), target).split(sep8).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -30813,11 +31543,11 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync37, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join37, resolve as resolve33 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join38, resolve as resolve34 } from "node:path";
 function readTestConfig(dir) {
-  const p = resolve33(dir, TEST_CONFIG_FILE);
-  if (!existsSync37(p)) return {};
+  const p = resolve34(dir, TEST_CONFIG_FILE);
+  if (!existsSync38(p)) return {};
   let parsed;
   try {
     parsed = JSON.parse(readFileSync45(p, "utf8"));
@@ -30833,8 +31563,8 @@ function readTestConfig(dir) {
       if (typeof s.reason !== "string" || !s.reason.trim()) {
         throw new Error(`${TEST_CONFIG_FILE}: skip[${i}] needs a non-empty "reason" \u2014 suppressions have to stay auditable`);
       }
-      if (!s.screen && !s.action && !s.component) {
-        throw new Error(`${TEST_CONFIG_FILE}: skip[${i}] matches everything \u2014 give it a "screen", "action", or "component"`);
+      if (!s.screen && !s.action && !s.component && !s.invariant) {
+        throw new Error(`${TEST_CONFIG_FILE}: skip[${i}] matches everything \u2014 give it a "screen", "action", "component", or "invariant"`);
       }
     });
   }
@@ -30883,8 +31613,8 @@ function readNetRules(path) {
 }
 function defaultNetRules(dir) {
   for (const rel of ["dev/net-mocks.json", "tests/net-mocks.json"]) {
-    const p = resolve33(dir, rel);
-    if (existsSync37(p)) {
+    const p = resolve34(dir, rel);
+    if (existsSync38(p)) {
       const rules = readNetRules(p);
       if (rules.length) return { rules, from: rel };
     }
@@ -30992,8 +31722,8 @@ function writeRecordedMocks(opts) {
     mkdir: (p) => mkdirSync20(p, { recursive: true }),
     write: (p, s) => writeFileSync16(p, s)
   };
-  fs.mkdir(join37(opts.dir, "dev"));
-  fs.write(join37(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
+  fs.mkdir(join38(opts.dir, "dev"));
+  fs.write(join38(opts.dir, "dev", "net-mocks.json"), JSON.stringify(opts.mocks, null, 2) + "\n");
   return { ok: true, rules, to: "dev/net-mocks.json" };
 }
 function scopeDescriptors(descriptors, requestedIds, invalidScreens) {
@@ -31056,15 +31786,18 @@ async function runCrawl(opts) {
       if (list.length > 1) collapsed.push({ representative: rep.screenId, instances: list.length });
     }
   }
-  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve33(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
+  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve34(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
   const suppressions = opts.config?.skip ?? [];
   const suppressed = [];
-  const matchSuppression = (screen, actionId, componentId) => suppressions.find((s) => (s.screen === void 0 || s.screen === screen) && (s.action === void 0 || s.action === actionId) && (s.component === void 0 || s.component === componentId));
+  const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s) => (s.screen === void 0 || s.screen === screen) && (s.action === void 0 || s.action === actionId) && (s.component === void 0 || s.component === componentId) && (s.invariant === void 0 || s.invariant === invariant));
   const results = [];
   const uncoveredByScreen = /* @__PURE__ */ new Map();
   const coverageFns = /* @__PURE__ */ new Map();
   const bundleOf = new Map(descriptors.map((d) => [d.screenId, d]));
   const hostileFindings = [];
+  const relationFindings = [];
+  let relationsChecked = 0;
+  const relationsByKind = { inverse: 0, refresh: 0, loadMore: 0, filter: 0 };
   const deepFindings = [];
   const journeyFindings = [];
   const journeyResults = [];
@@ -31134,14 +31867,22 @@ async function runCrawl(opts) {
         hostileFindings.push(...hs.filter((f) => !already.has(keyOf(f))));
       }
     }
+    if (deps.crawlScreenRelations && baked.bundleJs) {
+      const rr = await deps.crawlScreenRelations(args);
+      relationsChecked += rr.checked;
+      for (const [k, n] of Object.entries(rr.byKind ?? {})) relationsByKind[k] = (relationsByKind[k] ?? 0) + n;
+      const keyOf = deps.findingKey ?? ((f) => `${f.invariant}|${f.at ?? ""}|${f.screen}|${f.message}`);
+      const already = new Set(r.findings.map(keyOf));
+      for (const f of rr.findings) if (!already.has(keyOf(f))) relationFindings.push(f);
+    }
     await finishScreenCoverage();
   }
   const keep = (f) => {
     const actionId = typeof f.trigger === "object" ? f.trigger.action : "boot";
     const componentId = typeof f.trigger === "object" ? f.trigger.tap : null;
-    const s = matchSuppression(f.screen, actionId, componentId);
-    if (s && !suppressed.some((x) => x.screen === f.screen && x.action === actionId && x.component === (componentId ?? void 0))) {
-      suppressed.push({ screen: f.screen, action: actionId, ...componentId ? { component: componentId } : {}, reason: s.reason });
+    const s = matchSuppression(f.screen, actionId, componentId, f.invariant);
+    if (s && !suppressed.some((x) => x.screen === f.screen && x.action === actionId && x.component === (componentId ?? void 0) && x.invariant === s.invariant)) {
+      suppressed.push({ screen: f.screen, action: actionId, ...componentId ? { component: componentId } : {}, ...s.invariant ? { invariant: s.invariant } : {}, reason: s.reason });
     }
     return !s;
   };
@@ -31222,7 +31963,7 @@ async function runCrawl(opts) {
       if (uncovered.length) uncoveredByScreen.set(screen, uncovered);
     }
   }
-  const all = [...results.flatMap((r) => r.findings), ...hostileFindings, ...deepFindings, ...journeyFindings, ...edgeFindings].filter((f) => {
+  const all = [...results.flatMap((r) => r.findings), ...hostileFindings, ...deepFindings, ...journeyFindings, ...edgeFindings, ...relationFindings].filter((f) => {
     if (f.invariant === "no-request-issued" && !f.axis && fetchProven.has(f.screen)) {
       const by = fetchProven.get(f.screen);
       if (!retired.some((x) => x.screen === f.screen)) retired.push({ screen: f.screen, from: by.from, params: by.params });
@@ -31242,7 +31983,15 @@ async function runCrawl(opts) {
     ...blockedReasons.length ? { blockedReasons } : {},
     app: opts.app,
     releaseId: opts.releaseId,
-    transport: describeTransport(net, opts),
+    // Whether the axis RAN, not whether it was injected. The engine is gated on `baked.bundleJs`,
+    // so a run over static or bundle-less screens injects the dependency and replays nothing —
+    // and the label then advertised "+ relations" beside `relations.checked: 0`. This is the
+    // second time this line has overstated itself: it first claimed the axis unconditionally.
+    transport: describeTransport(net, opts, {
+      relations: relationsChecked > 0,
+      hostile: opts.hostile !== false && Boolean(deps.crawlScreenHostile),
+      deep: Boolean(opts.deep && opts.deep >= 2 && deps.crawlScreenDeep)
+    }),
     screens: { total: targets.length, clean: targets.length - failedScreens.size, failed: failedScreens.size },
     actions: { exercised: results.reduce((n, r) => n + r.actionsExercised, 0) },
     counts: { errors: failures.length, warnings: warnings.length },
@@ -31265,22 +32014,22 @@ async function runCrawl(opts) {
     ...edgesCapped.length ? { edgesCapped } : {},
     ...retired.length ? { retired } : {},
     ...opts.deep && opts.deep >= 2 ? { deep: { depth: opts.deep, ...deepTotals } } : {},
+    ...deps.crawlScreenRelations ? { relations: { checked: relationsChecked, byKind: relationsByKind } } : {},
     ...journeyResults.length ? { journeys: journeyResults } : {},
     ...results.some((r) => r.observations) ? { observations: Object.fromEntries(results.filter((r) => r.observations).map((r) => [r.screen, r.observations])) } : {}
   };
 }
-function describeTransport(net, opts) {
+function describeTransport(net, opts, ran) {
   const layers = [];
   if (net) layers.push(`mocked (${net.from})`);
   const cmsCount = Object.keys(opts.cmsSeed ?? {}).length;
   if (cmsCount) layers.push(`cms (${cmsCount} seeded collection${cmsCount === 1 ? "" : "s"})`);
   if (opts.canned?.count) layers.push(`canned (${opts.canned.count} frozen endpoints, ${opts.canned.from} \u2014 exercises code paths, not API-contract truth)`);
-  if (!layers.length) {
-    return "offline (no net fixture \u2014 screens are crawled against a rejecting transport, which exercises their failure UI)";
-  }
-  const hostile = opts.hostile !== false ? " + hostile boot passes (empty-lists, all-500)" : "";
-  const deep = opts.deep && opts.deep >= 2 ? ` + deep chains (depth ${opts.deep})` : "";
-  return layers.join(" + ") + hostile + deep;
+  const base = layers.length ? layers.join(" + ") : "offline (no net fixture \u2014 screens are crawled against a rejecting transport, which exercises their failure UI)";
+  const hostile = ran.hostile ? " + hostile boot passes (empty-lists, all-500)" : "";
+  const relations = ran.relations ? " + relations" : "";
+  const deep = ran.deep ? ` + deep chains (depth ${opts.deep})` : "";
+  return base + hostile + relations + deep;
 }
 function formatReport(r) {
   const out = [];
@@ -31414,11 +32163,11 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync38, readFileSync as readFileSync46 } from "node:fs";
-import { join as join38 } from "node:path";
+import { existsSync as existsSync39, readFileSync as readFileSync46 } from "node:fs";
+import { join as join39 } from "node:path";
 function mobileUxIssues(dir, strict) {
-  const file = join38(dir, "MOBILE-UX.md");
-  if (!existsSync38(file)) return [];
+  const file = join39(dir, "MOBILE-UX.md");
+  if (!existsSync39(file)) return [];
   let text2;
   try {
     text2 = readFileSync46(file, "utf8");
@@ -31700,7 +32449,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
   const headers2 = Object.fromEntries(new Headers(init.headers).entries());
   const request = url.protocol === "https:" ? httpsRequest : httpRequest;
   const hostname = url.hostname.replace(/^\[|\]$/g, "");
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     const finish2 = (fn) => {
       if (settled) return;
@@ -31737,7 +32486,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
         }
         const responseHeaders = new Headers();
         for (const [key2, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(key2, Array.isArray(value) ? value.join(", ") : value);
-        resolve40(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
+        resolve41(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
       }));
     });
     req.once("error", (error) => finish2(() => reject(error)));
@@ -32037,7 +32786,7 @@ function createLocalTestSandbox() {
           }
         })();
       `;
-      return await new Promise((resolve40, reject) => {
+      return await new Promise((resolve41, reject) => {
         const { port1, port2 } = new MessageChannel();
         const serializableContext = {
           auth: context.auth,
@@ -32113,7 +32862,7 @@ function createLocalTestSandbox() {
             timer = setTimeout(() => finish2(() => reject(new SandboxError("timeout", `execution exceeded ${limits.timeoutMs}ms`))), Math.max(1, limits.timeoutMs));
             return;
           }
-          if (message.ok) finish2(() => resolve40({ value: message.value, durationMs: Date.now() - started }));
+          if (message.ok) finish2(() => resolve41({ value: message.value, durationMs: Date.now() - started }));
           else finish2(() => reject(new SandboxError("execution_failed", message.message ?? "handler failed")));
         });
         worker.once("error", (error) => finish2(() => reject(new SandboxError("execution_failed", error.message))));
@@ -33080,8 +33829,8 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync47, existsSync as existsSync39 } from "node:fs";
-import { join as join39, resolve as resolve34 } from "node:path";
+import { readFileSync as readFileSync47, existsSync as existsSync40 } from "node:fs";
+import { join as join40, resolve as resolve35 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
   if (explicitUrl) return { mode: "remote", baseUrl: explicitUrl };
@@ -33093,14 +33842,14 @@ function resolveFunctionsTarget(input) {
   return { mode: "local" };
 }
 async function loadFunctionsApp(dir) {
-  const loaded = await loadContent(resolve34(dir));
+  const loaded = await loadContent(resolve35(dir));
   const config = loaded.module.config;
   if (config.kind !== "functions" || !Array.isArray(config.functions?.functions)) {
     throw new Error(`content package "${dir}" is not a functions-only app`);
   }
   const sources = {};
   for (const definition of config.functions.functions) {
-    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join39(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync39);
+    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join40(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync40);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
     sources[definition.name] = readFileSync47(source, "utf8");
   }
@@ -33256,9 +34005,9 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join40 } from "node:path";
+import { join as join41 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
 function nativeDecodePackageDir() {
   return fileURLToPath19(new URL("../../../core/runtime/ios/HimalayaCore/", import.meta.url));
@@ -33274,7 +34023,7 @@ function detectNativeDecode(options = {}) {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
   if (!swiftAvailable) return { platform: "ios", available: false, reason: "swift is not on PATH" };
-  const packageAvailable = options.packageAvailable ?? existsSync40(join40(packageDir, "Package.swift"));
+  const packageAvailable = options.packageAvailable ?? existsSync41(join41(packageDir, "Package.swift"));
   if (!packageAvailable) {
     return {
       platform: "ios",
@@ -33286,7 +34035,7 @@ function detectNativeDecode(options = {}) {
 }
 function localPropertiesSdk(harnessDir) {
   try {
-    const match = readFileSync48(join40(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
+    const match = readFileSync48(join41(harnessDir, "local.properties"), "utf8").match(/^sdk\.dir\s*=\s*(.+)$/m);
     return match?.[1]?.trim().replace(/\\([ :\\])/g, "$1") ?? null;
   } catch {
     return null;
@@ -33294,8 +34043,8 @@ function localPropertiesSdk(harnessDir) {
 }
 function detectAndroidNativeDecode(options = {}) {
   const harnessDir = options.harnessDir ?? nativeDecodeAndroidHarnessDir();
-  const gradlew = join40(harnessDir, "gradlew");
-  const gradlewAvailable = options.gradlewAvailable ?? existsSync40(gradlew);
+  const gradlew = join41(harnessDir, "gradlew");
+  const gradlewAvailable = options.gradlewAvailable ?? existsSync41(gradlew);
   if (!gradlewAvailable) {
     return {
       platform: "android",
@@ -33305,7 +34054,7 @@ function detectAndroidNativeDecode(options = {}) {
   }
   const androidHome = options.androidHome ?? process.env.ANDROID_HOME ?? "";
   const sdk = androidHome.trim() || (options.localPropertiesSdk !== void 0 ? options.localPropertiesSdk : localPropertiesSdk(harnessDir));
-  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync40(sdk));
+  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync41(sdk));
   if (!sdkAvailable) {
     return {
       platform: "android",
@@ -33377,14 +34126,14 @@ function parseNativeDecodeOutput(stdout, expectedScreenIds, platform = "ios") {
   return verdicts;
 }
 function runNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join40(tmpdir3(), "himi-native-decode-"));
+  const descriptorDir = mkdtempSync2(join41(tmpdir3(), "himi-native-decode-"));
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join40(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync17(join41(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.("building cached Swift oracle");
     execFileSync5("swift", ["build", "--package-path", options.packageDir, "--product", "himi-decode-oracle"], {
@@ -33396,7 +34145,7 @@ function runNativeDecode(options) {
       encoding: "utf8"
     }).trim();
     options.progress?.(`running real Swift decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
-    const stdout = execFileSync5(join40(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
+    const stdout = execFileSync5(join41(binPath, "himi-decode-oracle"), ["--dir", descriptorDir], {
       stdio: ["ignore", "pipe", "pipe"],
       encoding: "utf8"
     });
@@ -33410,19 +34159,19 @@ function runNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`iOS decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync6(descriptorDir, { recursive: true, force: true });
+    rmSync7(descriptorDir, { recursive: true, force: true });
   }
 }
 function runAndroidNativeDecode(options) {
-  const descriptorDir = mkdtempSync2(join40(tmpdir3(), "himi-native-decode-android-"));
-  const outputPath = join40(descriptorDir, "verdicts.ndjson");
+  const descriptorDir = mkdtempSync2(join41(tmpdir3(), "himi-native-decode-android-"));
+  const outputPath = join41(descriptorDir, "verdicts.ndjson");
   const startedAt = Date.now();
   try {
     for (const descriptor of options.descriptors) {
       if (typeof descriptor.descriptorJson !== "string") {
         throw new Error(`native decode cannot judge ${descriptor.screenId}: the release builder did not return its exact baked JSON bytes`);
       }
-      writeFileSync17(join40(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
+      writeFileSync17(join41(descriptorDir, `${encodeURIComponent(descriptor.screenId)}.json`), descriptor.descriptorJson);
     }
     options.progress?.(`running real Kotlin decoder over ${options.descriptors.length} screen${options.descriptors.length === 1 ? "" : "s"}`);
     execFileSync5(options.gradlew, [
@@ -33448,7 +34197,7 @@ function runAndroidNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`Android decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync6(descriptorDir, { recursive: true, force: true });
+    rmSync7(descriptorDir, { recursive: true, force: true });
   }
 }
 function fieldAt(path) {
@@ -33508,30 +34257,30 @@ __export(browser_authoring_exports, {
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash22, randomBytes as randomBytes5 } from "node:crypto";
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync41, readdirSync as readdirSync21, readFileSync as readFileSync49, realpathSync as realpathSync3, statSync as statSync8 } from "node:fs";
-import { join as join41, posix, relative as relative5, sep as sep8 } from "node:path";
+import { existsSync as existsSync42, readdirSync as readdirSync21, readFileSync as readFileSync49, realpathSync as realpathSync4, statSync as statSync9 } from "node:fs";
+import { join as join42, posix, relative as relative5, sep as sep9 } from "node:path";
 function humanMs(ms) {
   return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
 }
 function collectWorkerSources(tier5SrcDir, bundleName) {
-  const root = join41(tier5SrcDir, bundleName);
+  const root = join42(tier5SrcDir, bundleName);
   const files = {};
   const visitedDirs = /* @__PURE__ */ new Set();
   const walk2 = (abs, rel) => {
-    const real = realpathSync3(abs);
+    const real = realpathSync4(abs);
     if (visitedDirs.has(real)) return;
     visitedDirs.add(real);
     for (const name of readdirSync21(abs).sort()) {
-      const childAbs = join41(abs, name);
+      const childAbs = join42(abs, name);
       const childRel = posix.join(rel, name);
-      if (statSync8(childAbs).isDirectory()) {
+      if (statSync9(childAbs).isDirectory()) {
         walk2(childAbs, childRel);
       } else if (/\.(ts|tsx|js|mjs|json)$/.test(name)) {
         files[childRel] = readFileSync49(childAbs, "utf8");
       }
     }
   };
-  if (!existsSync41(root)) return null;
+  if (!existsSync42(root)) return null;
   walk2(root, `/tier5-src/${bundleName}`);
   const entry = [`/tier5-src/${bundleName}/index.ts`, `/tier5-src/${bundleName}/index.js`].find((p) => p in files);
   if (!entry) return null;
@@ -33548,18 +34297,18 @@ function collectRelativeSiblings(files, tier5SrcDir) {
       const spec = m[1];
       const virtual = posix.normalize(posix.join(dir, spec));
       if (!virtual.startsWith("/tier5-src/")) continue;
-      const onDisk = join41(tier5SrcDir, virtual.slice("/tier5-src/".length));
+      const onDisk = join42(tier5SrcDir, virtual.slice("/tier5-src/".length));
       const candidates = [
         onDisk,
         `${onDisk}.ts`,
         `${onDisk}.js`,
         onDisk.replace(/\.js$/, ".ts"),
-        join41(onDisk, "index.ts"),
-        join41(onDisk, "index.js")
+        join42(onDisk, "index.ts"),
+        join42(onDisk, "index.js")
       ];
       for (const abs of candidates) {
-        if (!existsSync41(abs) || statSync8(abs).isDirectory()) continue;
-        const key2 = `/tier5-src/${relative5(tier5SrcDir, abs).split(sep8).join(posix.sep)}`;
+        if (!existsSync42(abs) || statSync9(abs).isDirectory()) continue;
+        const key2 = `/tier5-src/${relative5(tier5SrcDir, abs).split(sep9).join(posix.sep)}`;
         if (key2 in files) break;
         files[key2] = readFileSync49(abs, "utf8");
         queue.push(key2);
@@ -33593,10 +34342,10 @@ function collectSdkModules(files, resolveSubpath) {
   for (const source of Object.values(files)) visit(source);
   return { modules, unsupported };
 }
-function sdkSubpathReader(resolve40) {
+function sdkSubpathReader(resolve41) {
   return (sub) => {
     try {
-      return readFileSync49(resolve40(`@wix/himalaya/${sub}`), "utf8");
+      return readFileSync49(resolve41(`@wix/himalaya/${sub}`), "utf8");
     } catch {
       return null;
     }
@@ -33677,7 +34426,7 @@ async function runBrowserAuthoring(opts) {
   const token = mintToken2(payload);
   const unusable = await probeAuthoringPage(opts.authoringBase, opts.fetchImpl, opts.probeTimeoutMs);
   if (unusable) throw new Error(unusable);
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     let url = "";
     const server = createServer3();
@@ -33729,7 +34478,7 @@ async function runBrowserAuthoring(opts) {
         }
         res.writeHead(200, { "content-type": "text/plain" }).end("ok");
         const report = body.result;
-        finish2(() => resolve40({ report, url }));
+        finish2(() => resolve41({ report, url }));
       })();
     });
     server.on("error", (e) => finish2(() => reject(e)));
@@ -33769,8 +34518,8 @@ __export(coverage_exports, {
   formatLedger: () => formatLedger,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync42, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname26, join as join42 } from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname25, join as join43 } from "node:path";
 function assembleLedger(r) {
   const out = [];
   for (const c of r.crawled ?? []) {
@@ -33936,10 +34685,10 @@ function assembleLedger(r) {
   return out;
 }
 function trendAndStore(dir, entries) {
-  const p = join42(dir, LEDGER_FILE);
+  const p = join43(dir, LEDGER_FILE);
   let previous = null;
   try {
-    if (existsSync42(p)) {
+    if (existsSync43(p)) {
       const parsed = JSON.parse(readFileSync50(p, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k) => typeof k === "string");
     }
@@ -33947,7 +34696,7 @@ function trendAndStore(dir, entries) {
   }
   const current = entries.map((e) => e.key);
   try {
-    mkdirSync21(dirname26(p), { recursive: true });
+    mkdirSync21(dirname25(p), { recursive: true });
     writeFileSync18(p, JSON.stringify({ keys: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -33977,10 +34726,10 @@ function formatLedger(entries, trend) {
   return out.join("\n");
 }
 function diffAndStoreObservations(dir, current) {
-  const p = join42(dir, OBS_FILE);
+  const p = join43(dir, OBS_FILE);
   let previous = null;
   try {
-    if (existsSync42(p)) {
+    if (existsSync43(p)) {
       const parsed = JSON.parse(readFileSync50(p, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v) => Array.isArray(v) && v.every((l) => typeof l === "string")
@@ -33991,7 +34740,7 @@ function diffAndStoreObservations(dir, current) {
   } catch {
   }
   try {
-    mkdirSync21(dirname26(p), { recursive: true });
+    mkdirSync21(dirname25(p), { recursive: true });
     writeFileSync18(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -34029,8 +34778,8 @@ function formatDelta(delta) {
 var LEDGER_FILE, OBS_FILE;
 var init_coverage = __esm({
   "src/coverage.ts"() {
-    LEDGER_FILE = join42(".himi", "test-ledger.json");
-    OBS_FILE = join42(".himi", "test-observations.json");
+    LEDGER_FILE = join43(".himi", "test-ledger.json");
+    OBS_FILE = join43(".himi", "test-observations.json");
   }
 });
 
@@ -35234,9 +35983,9 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync, existsSync as existsSync43, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync52, rmSync as rmSync7, statSync as statSync9 } from "node:fs";
+import { cpSync, existsSync as existsSync44, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync52, rmSync as rmSync8, statSync as statSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join43 } from "node:path";
+import { join as join44 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 function makePackageRunHandler(opts) {
   return makeRunHandler({
@@ -35254,9 +36003,9 @@ async function fetchBytes(url) {
 }
 async function resolvePackage(source, workDir) {
   const isUrl2 = /^https?:\/\//i.test(source);
-  if (!isUrl2 && existsSync43(source) && statSync9(source).isDirectory()) {
-    const appDirManifest = join43(source, "release-manifest.json");
-    if (existsSync43(appDirManifest)) {
+  if (!isUrl2 && existsSync44(source) && statSync10(source).isDirectory()) {
+    const appDirManifest = join44(source, "release-manifest.json");
+    if (existsSync44(appDirManifest)) {
       const opened2 = openPackageDir(source);
       if (!opened2.validation.ok) {
         throw new Error(`package is not valid:
@@ -35265,11 +36014,11 @@ async function resolvePackage(source, workDir) {
       const app2 = opened2.header?.app ?? opened2.manifest?.app;
       if (!app2) throw new Error(`${source} has no app id (no himi-package.json and no manifest.app)`);
       if (!isSafeAppId(app2)) throw new Error(`${source} declares an unsafe app id ${JSON.stringify(app2)} \u2014 refusing to open it`);
-      const root2 = workDir ?? mkdtempSync3(join43(tmpdir4(), "himi-run-"));
-      const target = join43(root2, app2);
-      if (join43(source) !== target) {
+      const root2 = workDir ?? mkdtempSync3(join44(tmpdir4(), "himi-run-"));
+      const target = join44(root2, app2);
+      if (join44(source) !== target) {
         mkdirSync22(root2, { recursive: true });
-        rmSync7(target, { recursive: true, force: true });
+        rmSync8(target, { recursive: true, force: true });
         cpSync(source, target, { recursive: true });
       }
       return {
@@ -35285,11 +36034,11 @@ async function resolvePackage(source, workDir) {
     throw new Error(`${source} is a directory but has no release-manifest.json \u2014 is it a package?`);
   }
   const bytes2 = isUrl2 ? await fetchBytes(source) : readFileSync52(source);
-  const root = workDir ?? mkdtempSync3(join43(tmpdir4(), "himi-run-"));
+  const root = workDir ?? mkdtempSync3(join44(tmpdir4(), "himi-run-"));
   const { app, appDir: appDir2 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir2);
   if (!opened.validation.ok) {
-    rmSync7(workDir ? appDir2 : root, { recursive: true, force: true });
+    rmSync8(workDir ? appDir2 : root, { recursive: true, force: true });
     throw new Error(`package is not valid:
   ${opened.validation.errors.join("\n  ")}`);
   }
@@ -35328,7 +36077,7 @@ async function runPackage(source, opts = {}) {
   const resolved = await resolvePackage(source, opts.workDir);
   const assets = opts.assets ?? (opts.spa ? /* @__PURE__ */ new Map() : await loadPreviewAssets());
   if (!opts.spa && assets.size === 0) {
-    if (resolved.temp) rmSync7(resolved.temp, { recursive: true, force: true });
+    if (resolved.temp) rmSync8(resolved.temp, { recursive: true, force: true });
     throw new Error(NO_SPA_MESSAGE);
   }
   const handler = makePackageRunHandler({
@@ -35358,7 +36107,7 @@ async function runPackage(source, opts = {}) {
     warnings: resolved.warnings,
     close: () => new Promise((done) => {
       server.close(() => {
-        if (resolved.temp) rmSync7(resolved.temp, { recursive: true, force: true });
+        if (resolved.temp) rmSync8(resolved.temp, { recursive: true, force: true });
         done();
       });
     })
@@ -35385,19 +36134,19 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer5 } from "node:http";
-import { existsSync as existsSync44, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync53 } from "node:fs";
 import { spawnSync as spawnSync3, execFile as execFile3 } from "node:child_process";
-import { dirname as dirname27, resolve as resolve35 } from "node:path";
+import { dirname as dirname26, resolve as resolve36 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function stagedDir() {
-  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve35(process.env.HIMI_BROWSER_PLANE_OUT) : resolve35(REPO, "packages", "serve", "dist", "browser-plane");
+  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve36(process.env.HIMI_BROWSER_PLANE_OUT) : resolve36(REPO, "packages", "serve", "dist", "browser-plane");
 }
 function missingStaged() {
-  return [...SERVED].filter((f) => !existsSync44(resolve35(stagedDir(), f))).sort();
+  return [...SERVED].filter((f) => !existsSync45(resolve36(stagedDir(), f))).sort();
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
-  const r = spawnSync3(process.execPath, [resolve35(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
+  const r = spawnSync3(process.execPath, [resolve36(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
     cwd: REPO,
     encoding: "utf8"
   });
@@ -35483,7 +36232,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
     }
     const name = path === "/" || path === "/index.html" ? "host.html" : path.slice(1);
     if (SERVED.has(name)) {
-      if (!existsSync44(resolve35(stagedDir(), name))) {
+      if (!existsSync45(resolve36(stagedDir(), name))) {
         const restaged = ensureBrowserPlaneStaged();
         if (!restaged.ok) {
           res.writeHead(503, { "content-type": "application/json" });
@@ -35493,7 +36242,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
       }
       let bytes2;
       try {
-        bytes2 = readFileSync53(resolve35(stagedDir(), name));
+        bytes2 = readFileSync53(resolve36(stagedDir(), name));
       } catch (e) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "browser_plane_unstaged", file: name, detail: String(e) }));
@@ -35536,8 +36285,8 @@ var HERE, REPO, SERVED;
 var init_run_browser = __esm({
   "src/run-browser.ts"() {
     init_file_store();
-    HERE = dirname27(fileURLToPath20(import.meta.url));
-    REPO = resolve35(HERE, "..", "..", "..");
+    HERE = dirname26(fileURLToPath20(import.meta.url));
+    REPO = resolve36(HERE, "..", "..", "..");
     SERVED = /* @__PURE__ */ new Set(["host.html", "sw.js", "package-reader.js"]);
   }
 });
@@ -35911,10 +36660,10 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync45, readFileSync as readFileSync54 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve36 } from "node:path";
+import { existsSync as existsSync46, readFileSync as readFileSync54 } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve37 } from "node:path";
 function isInsideRepo(p) {
-  const rel = relative6(REPO_ROOT3, resolve36(p));
+  const rel = relative6(REPO_ROOT3, resolve37(p));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function assertCredentialOutsideRepo(label2, p) {
@@ -35968,7 +36717,7 @@ function parseStoreConfig(text2) {
 }
 function loadStoreConfig(app) {
   const p = storeConfigPath(app);
-  if (!existsSync45(p)) {
+  if (!existsSync46(p)) {
     throw new Error(`No store config at ${p}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
   return parseStoreConfig(readFileSync54(p, "utf8"));
@@ -35994,9 +36743,9 @@ __export(preflight_app_exports, {
   pngSize: () => pngSize,
   preflightApp: () => preflightApp
 });
-import { readFileSync as readFileSync55, existsSync as existsSync46, readdirSync as readdirSync22, statSync as statSync10 } from "node:fs";
+import { readFileSync as readFileSync55, existsSync as existsSync47, readdirSync as readdirSync22, statSync as statSync11 } from "node:fs";
 import { createHash as createHash23 } from "node:crypto";
-import { join as join44 } from "node:path";
+import { join as join45 } from "node:path";
 function analyze(projectYml, storeConfig, icon) {
   const f = [];
   const has = (re, s) => re.test(s);
@@ -36044,10 +36793,10 @@ function analyze(projectYml, storeConfig, icon) {
   return f;
 }
 async function preflightApp(app) {
-  const projectYml = existsSync46(iosProjectYml(app)) ? readFileSync55(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync46(storeConfigPath(app)) ? readFileSync55(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync47(iosProjectYml(app)) ? readFileSync55(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync47(storeConfigPath(app)) ? readFileSync55(storeConfigPath(app), "utf8") : "";
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }];
-  const findings = analyze(projectYml, storeConfig, await appIconState(join44(appDir(app), "ios")));
+  const findings = analyze(projectYml, storeConfig, await appIconState(join45(appDir(app), "ios")));
   findings.push(...analyzeListing(metadataFilesPresent(app), listScreenshots(app)));
   findings.push(
     ...analyzePlayListing(playListingAssets(app)).map((finding) => ({ ...finding, level: "warn" }))
@@ -36074,17 +36823,17 @@ function analyzeSubmissionRecord(appLevel, review, opts) {
   return f;
 }
 function appLevelMetadataFiles(app, locale = "en-US") {
-  const root = join44(storeDir(app), "metadata");
+  const root = join45(storeDir(app), "metadata");
   const out = /* @__PURE__ */ new Set();
-  if (existsSync46(root)) {
+  if (existsSync47(root)) {
     for (const n of readdirSync22(root)) if (n.endsWith(".txt")) out.add(n);
   }
-  if (existsSync46(join44(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
+  if (existsSync47(join45(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
   return out;
 }
 function reviewInfoFiles(app) {
-  const dir = join44(storeDir(app), "review_information");
-  if (!existsSync46(dir)) return /* @__PURE__ */ new Set();
+  const dir = join45(storeDir(app), "review_information");
+  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function isValidAppStoreSize(w, h) {
@@ -36194,12 +36943,12 @@ function analyzePlayListing(assets) {
   return f;
 }
 function playListingAssets(app, locale = "en-US") {
-  const dir = join44(storeDir(app), "play", locale, "images");
+  const dir = join45(storeDir(app), "play", locale, "images");
   const read = (names) => {
     for (const name of names) {
-      const p = join44(dir, name);
+      const p = join45(dir, name);
       try {
-        if (statSync10(p).isFile()) return { name, bytes: readFileSync55(p) };
+        if (statSync11(p).isFile()) return { name, bytes: readFileSync55(p) };
       } catch {
       }
     }
@@ -36230,26 +36979,26 @@ function analyzeListing(metaFiles, shots) {
   return f;
 }
 function metadataFilesPresent(app, locale = "en-US") {
-  const dir = join44(storeDir(app), "metadata", locale);
-  if (!existsSync46(dir)) return /* @__PURE__ */ new Set();
+  const dir = join45(storeDir(app), "metadata", locale);
+  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function listScreenshots(app, locale = "en-US") {
   const out = [];
-  const flat = join44(storeDir(app), "screenshots", locale);
-  if (existsSync46(flat)) {
+  const flat = join45(storeDir(app), "screenshots", locale);
+  if (existsSync47(flat)) {
     for (const png of readdirSync22(flat).filter((n) => n.endsWith(".png"))) {
-      const sz = pngSize(readFileSync55(join44(flat, png)));
+      const sz = pngSize(readFileSync55(join45(flat, png)));
       if (sz) out.push({ name: png, w: sz.w, h: sz.h });
     }
   }
-  const legacy = join44(storeDir(app), "metadata", locale, "screenshots");
-  if (existsSync46(legacy)) {
+  const legacy = join45(storeDir(app), "metadata", locale, "screenshots");
+  if (existsSync47(legacy)) {
     for (const deviceDir of readdirSync22(legacy)) {
-      const d = join44(legacy, deviceDir);
-      if (!statSync10(d).isDirectory()) continue;
+      const d = join45(legacy, deviceDir);
+      if (!statSync11(d).isDirectory()) continue;
       for (const png of readdirSync22(d).filter((n) => n.endsWith(".png"))) {
-        const sz = pngSize(readFileSync55(join44(d, png)));
+        const sz = pngSize(readFileSync55(join45(d, png)));
         if (sz) out.push({ name: `${deviceDir}/${png}`, w: sz.w, h: sz.h });
       }
     }
@@ -36257,12 +37006,12 @@ function listScreenshots(app, locale = "en-US") {
   return out;
 }
 function placeholderHashes2() {
-  const templateIos = join44(appDir("_template"), "ios");
-  if (!existsSync46(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
+  const templateIos = join45(appDir("_template"), "ios");
+  if (!existsSync47(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
   for (const target of readdirSync22(templateIos)) {
-    const p = join44(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join45(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
-      if (!statSync10(p).isFile()) continue;
+      if (!statSync11(p).isFile()) continue;
       return [LEGACY_PLACEHOLDER_SHA2562, createHash23("sha256").update(readFileSync55(p)).digest("hex")];
     } catch {
     }
@@ -36294,11 +37043,11 @@ async function pixelIssues(bytes2) {
   }
 }
 async function appIconState(iosDir) {
-  if (!existsSync46(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
+  if (!existsSync47(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
   for (const target of readdirSync22(iosDir)) {
-    const p = join44(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
+    const p = join45(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
-      if (!statSync10(p).isFile()) continue;
+      if (!statSync11(p).isFile()) continue;
       const bytes2 = readFileSync55(p);
       const hash = createHash23("sha256").update(bytes2).digest("hex");
       const pixels = await pixelIssues(bytes2);
@@ -36369,14 +37118,14 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync47, readFileSync as readFileSync56 } from "node:fs";
+import { existsSync as existsSync48, readFileSync as readFileSync56 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
-import { join as join45 } from "node:path";
+import { join as join46 } from "node:path";
 function credentialsDir(home = homedir6()) {
-  return join45(home, ".himalaya", "store-credentials");
+  return join46(home, ".himalaya", "store-credentials");
 }
 function profilePath(name, home = homedir6()) {
-  return join45(credentialsDir(home), `${name}.json`);
+  return join46(credentialsDir(home), `${name}.json`);
 }
 function parseProfile(text2, label2) {
   let doc;
@@ -36404,7 +37153,7 @@ function resolveStoreCredentials(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homedir6();
   const read = opts.readProfile ?? ((p) => readFileSync56(p, "utf8"));
-  const exists = opts.profileExists ?? existsSync47;
+  const exists = opts.profileExists ?? existsSync48;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
   const named = flagName || ios.credentialProfile?.trim();
@@ -39696,10 +40445,10 @@ function isFetchableFontUrl(raw) {
   return true;
 }
 function resolveAll(hostname) {
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     dnsLookup(hostname, { all: true, verbatim: true }, (err, addresses) => {
       if (err) reject(err);
-      else resolve40(addresses);
+      else resolve41(addresses);
     });
   });
 }
@@ -39707,13 +40456,13 @@ function withAbort(start, signal, what) {
   if (signal?.aborted) return Promise.reject(new Error(`${what} aborted`));
   const work = start();
   if (!signal) return work;
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     const onAbort = () => reject(new Error(`${what} aborted`));
     signal.addEventListener("abort", onAbort, { once: true });
-    work.then(resolve40, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    work.then(resolve41, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
-async function pinAddress(url, resolve40 = resolveAll, signal) {
+async function pinAddress(url, resolve41 = resolveAll, signal) {
   const host = url.hostname.replace(/^\[|\]$/g, "");
   if (ipv4Octets(host)) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
@@ -39723,7 +40472,7 @@ async function pinAddress(url, resolve40 = resolveAll, signal) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
     return { address: host, family: 6 };
   }
-  const addresses = await withAbort(() => resolve40(host), signal, `${host} lookup`);
+  const addresses = await withAbort(() => resolve41(host), signal, `${host} lookup`);
   if (!addresses.length) throw new Error(`${host} resolved to no address`);
   const blocked = addresses.filter((a) => isBlockedAddress(a.address)).map((a) => a.address);
   if (blocked.length) throw new Error(`${host} resolves to a blocked address (${blocked.join(", ")})`);
@@ -39746,7 +40495,7 @@ function decodedBody(res, hasBody) {
   return out;
 }
 function requestOnce(url, pinned, init) {
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     const headers2 = { host: url.host, "accept-encoding": "identity" };
     new Headers(init.headers ?? {}).forEach((value, key2) => {
       if (key2.toLowerCase() !== "host") headers2[key2] = value;
@@ -39780,7 +40529,7 @@ function requestOnce(url, pinned, init) {
           reject(err);
           return;
         }
-        resolve40(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
+        resolve41(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
       }
     );
     req.on("error", reject);
@@ -39889,7 +40638,7 @@ var init_brand_font = __esm({
 
 // src/site-analyze/write-artifacts.ts
 import { mkdirSync as mkdirSync23, writeFileSync as writeFileSync20 } from "node:fs";
-import { join as join46 } from "node:path";
+import { join as join47 } from "node:path";
 function attachVeloSources(book, sources, put) {
   const byPath = new Map((sources ?? []).map((s) => [s.path, s.text]));
   for (const f of book.velo.files) {
@@ -40044,12 +40793,12 @@ async function downloadMedia(book, fetchImpl, put) {
 }
 async function writeBusinessBook(result, opts) {
   const out = opts.outDir;
-  mkdirSync23(join46(out, "evidence/pages"), { recursive: true });
-  mkdirSync23(join46(out, "media/catalog"), { recursive: true });
+  mkdirSync23(join47(out, "evidence/pages"), { recursive: true });
+  mkdirSync23(join47(out, "media/catalog"), { recursive: true });
   const files = [];
   const put = (rel, body) => {
-    const p = join46(out, rel);
-    mkdirSync23(join46(p, ".."), { recursive: true });
+    const p = join47(out, rel);
+    mkdirSync23(join47(p, ".."), { recursive: true });
     writeFileSync20(p, body);
     files.push(rel);
   };
@@ -40380,15 +41129,15 @@ var init_home_descriptor = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync48, readFileSync as readFileSync60, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync4, statSync as statSync11 } from "node:fs";
-import { dirname as dirname28, isAbsolute as isAbsolute3, join as join47, resolve as resolve37, sep as sep9 } from "node:path";
+import { existsSync as existsSync49, readFileSync as readFileSync60, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
+import { dirname as dirname27, isAbsolute as isAbsolute3, join as join48, resolve as resolve38, sep as sep10 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
   return `no OAuth redirect paired with client ${overlay.wix.clientId} \u2014 the app (and prepare:customer) will refuse to start until one is set. Register it with \`himi site client ensure --site ${overlay.siteId?.trim() || "<msid>"} --redirect-uri <uri> --yes\`, then re-run analyze with \`--redirect-uri <uri>\` (or export HIMI_BRANDED_LITE_WIX_REDIRECT_URI)`;
 }
 function posix2(p) {
-  return resolve37(p).replace(/\\/g, "/");
+  return resolve38(p).replace(/\\/g, "/");
 }
 function committedShellProvisioning(path) {
   return committedShellFor(posix2(path));
@@ -40396,8 +41145,8 @@ function committedShellProvisioning(path) {
 function findRepoRoot(cwd) {
   let dir = cwd;
   for (let i = 0; i < 8; i++) {
-    if (SHELL_NAMES2.some((name) => existsSync48(join47(dir, shellAppDir(name), "package.json")))) return dir;
-    const next = dirname28(dir);
+    if (SHELL_NAMES2.some((name) => existsSync49(join48(dir, shellAppDir(name), "package.json")))) return dir;
+    const next = dirname27(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -40422,7 +41171,7 @@ function assertNotCommitted(path, forbidden) {
       `refusing to overwrite committed ${committedProvisioningPath(committed)} \u2014 use prepare:customer --contract`
     );
   }
-  if (forbidden && resolve37(path) === resolve37(forbidden)) {
+  if (forbidden && resolve38(path) === resolve38(forbidden)) {
     const named = committedShellProvisioning(forbidden);
     throw new Error(
       `refusing to overwrite committed ${named ? committedProvisioningPath(named) : forbidden} \u2014 pass a content-package provisioning.json or use prepare:customer --contract`
@@ -40464,8 +41213,8 @@ function mergeCustomerOwned(committed, overlay) {
 }
 function buildMergedContract(options) {
   const { appDir: appDir2, packageDir, overlay } = options;
-  const committedPath = join47(appDir2, "provisioning.json");
-  if (!existsSync48(committedPath)) {
+  const committedPath = join48(appDir2, "provisioning.json");
+  if (!existsSync49(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
   const committed = JSON.parse(readFileSync60(committedPath, "utf8"));
@@ -40475,25 +41224,25 @@ function buildMergedContract(options) {
   const staged = [];
   const contained = (root, rel) => {
     if (isAbsolute3(rel)) return void 0;
-    const full = resolve37(root, rel);
-    return full.startsWith(resolve37(root) + sep9) ? full : void 0;
+    const full = resolve38(root, rel);
+    return full.startsWith(resolve38(root) + sep10) ? full : void 0;
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
-    const to = contained(join47(appDir2, STAGED), toRel.slice(STAGED.length + 1));
-    if (!from || !to || !existsSync48(from)) return void 0;
+    const to = contained(join48(appDir2, STAGED), toRel.slice(STAGED.length + 1));
+    if (!from || !to || !existsSync49(from)) return void 0;
     let real;
     let realRoot;
     try {
-      real = realpathSync4(from);
-      realRoot = realpathSync4(packageDir);
+      real = realpathSync5(from);
+      realRoot = realpathSync5(packageDir);
     } catch {
       return void 0;
     }
-    if (!real.startsWith(realRoot + sep9)) return void 0;
+    if (!real.startsWith(realRoot + sep10)) return void 0;
     try {
-      if (!statSync11(real).isFile()) return void 0;
-      mkdirSync24(dirname28(to), { recursive: true });
+      if (!statSync12(real).isFile()) return void 0;
+      mkdirSync24(dirname27(to), { recursive: true });
       copyFileSync3(real, to);
     } catch {
       return void 0;
@@ -40503,8 +41252,8 @@ function buildMergedContract(options) {
   };
   const icon = stage("media/icon.png", `${STAGED}/icon.png`);
   if (icon) branding.appIconPath = icon;
-  const facesPath = join47(packageDir, "media/fonts/faces.json");
-  if (existsSync48(facesPath)) {
+  const facesPath = join48(packageDir, "media/fonts/faces.json");
+  if (existsSync49(facesPath)) {
     let faces = [];
     try {
       const parsed = JSON.parse(readFileSync60(facesPath, "utf8"));
@@ -40528,16 +41277,16 @@ function buildMergedContract(options) {
   merged.branding = branding;
   const body = `${JSON.stringify(merged, null, 2)}
 `;
-  const path = join47(packageDir, "provisioning.contract.json");
+  const path = join48(packageDir, "provisioning.contract.json");
   writeFileSync21(path, body);
-  const localPath = join47(appDir2, LOCAL_CONTRACT_REL);
-  mkdirSync24(dirname28(localPath), { recursive: true });
+  const localPath = join48(appDir2, LOCAL_CONTRACT_REL);
+  mkdirSync24(dirname27(localPath), { recursive: true });
   writeFileSync21(localPath, body);
   staged.push(localPath);
   return { path, staged };
 }
 async function applyOverlays(input) {
-  const cwd = resolve37(input.cwd);
+  const cwd = resolve38(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
   const overlay = JSON.parse(readFileSync60(input.overlayPath, "utf8"));
@@ -40551,8 +41300,8 @@ async function applyOverlays(input) {
         `shell "${shell}" cannot bake a customer brand \u2014 it ships no prepare:customer script`
       );
     }
-    const appDir2 = join47(repoRoot2, shellAppDir(shell));
-    const packageDir = dirname28(resolve37(input.overlayPath));
+    const appDir2 = join48(repoRoot2, shellAppDir(shell));
+    const packageDir = dirname27(resolve38(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir2, packageDir, overlay });
     wrote.push(...staged);
     const r = spawnSync4("npm", ["run", "prepare:customer", "--", "--contract", contract], {
@@ -40573,9 +41322,9 @@ async function applyOverlays(input) {
       note: `prepare:customer --contract with a merged contract (committed provisioning.json untouched)${unpairedInRepo ? ` \xB7 ${unpairedInRepo}` : ""}`
     };
   }
-  const pkgProv = join47(cwd, "provisioning.json");
+  const pkgProv = join48(cwd, "provisioning.json");
   assertNotCommitted(pkgProv, input.forbiddenProvisioning);
-  if (existsSync48(pkgProv)) {
+  if (existsSync49(pkgProv)) {
     const cur = JSON.parse(readFileSync60(pkgProv, "utf8"));
     const merged = deepMerge3(cur, overlay);
     writeFileSync21(pkgProv, JSON.stringify(merged, null, 2) + "\n");
@@ -40584,16 +41333,16 @@ async function applyOverlays(input) {
     writeFileSync21(pkgProv, JSON.stringify(overlay, null, 2) + "\n");
     wrote.push(pkgProv);
   }
-  const pkgTokens = join47(cwd, "tokens.json");
-  if (existsSync48(pkgTokens) && (tokens.colors || tokens.typography)) {
+  const pkgTokens = join48(cwd, "tokens.json");
+  if (existsSync49(pkgTokens) && (tokens.colors || tokens.typography)) {
     const cur = JSON.parse(readFileSync60(pkgTokens, "utf8"));
     const merged = deepMerge3(cur, tokens);
     writeFileSync21(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
     wrote.push(pkgTokens);
   }
   const homeAction = homeRefreshActionId(shell);
-  const homeSrc = join47(cwd, "dev/index.ts");
-  if (homeAction && existsSync48(homeSrc)) {
+  const homeSrc = join48(cwd, "dev/index.ts");
+  if (homeAction && existsSync49(homeSrc)) {
     const prev = readFileSync60(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
@@ -40614,13 +41363,13 @@ async function applyOverlays(input) {
       notes.push(`${patched.unparsed} onAppear params block(s) in ${homeSrc} could not be read \u2014 any brand values inside them were not applied`);
     }
   }
-  if (!input.iconPath || !existsSync48(input.iconPath)) {
-    const book = input.iconPath ? dirname28(dirname28(resolve37(input.iconPath))) : void 0;
+  if (!input.iconPath || !existsSync49(input.iconPath)) {
+    const book = input.iconPath ? dirname27(dirname27(resolve38(input.iconPath))) : void 0;
     notes.push(
       book ? `no icon installed \u2014 ${siteLogoAbsence(book).hint}` : "no icon installed and no business book to say why \u2014 `himi icon generate` draws one from the accent, or `himi icon set <file.png>` installs the customer's own mark"
     );
   }
-  if (input.iconPath && existsSync48(input.iconPath)) {
+  if (input.iconPath && existsSync49(input.iconPath)) {
     try {
       const installed = await installIcon(cwd, input.iconPath, { derivePlay: true });
       wrote.push(...installed.wrote);
@@ -41755,12 +42504,12 @@ __export(cli_exports, {
   runSiteFunctionCli: () => runSiteFunctionCli
 });
 import { readFileSync as readFileSync61 } from "node:fs";
-import { resolve as resolve38 } from "node:path";
+import { resolve as resolve39 } from "node:path";
 async function runSiteAnalyze(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const assetFetch = opts.fetchImpl ?? pinnedFetch2;
   const cwd = opts.cwd ?? process.cwd();
-  const outDir = resolve38(cwd, opts.outDir ?? ".himi/business-book");
+  const outDir = resolve39(cwd, opts.outDir ?? ".himi/business-book");
   let ownerAuth;
   let msid;
   try {
@@ -41797,9 +42546,9 @@ async function runSiteAnalyze(opts) {
   if (opts.apply) {
     applied = await applyOverlays({
       cwd,
-      overlayPath: resolve38(outDir, "provisioning.overlay.json"),
-      tokensPath: resolve38(outDir, "tokens.overlay.json"),
-      iconPath: resolve38(outDir, "media/icon.png"),
+      overlayPath: resolve39(outDir, "provisioning.overlay.json"),
+      tokensPath: resolve39(outDir, "tokens.overlay.json"),
+      iconPath: resolve39(outDir, "media/icon.png"),
       shell: opts.shell
     });
     const note = noteWithWarnings(applied.note, warnings);
@@ -41835,7 +42584,7 @@ async function runSiteFunctionCli(opts) {
   const token = opts.token ?? await siteToken(msid);
   let source;
   if (opts.sourcePath) {
-    const p = resolve38(opts.cwd ?? process.cwd(), opts.sourcePath);
+    const p = resolve39(opts.cwd ?? process.cwd(), opts.sourcePath);
     source = readFileSync61(p, "utf8");
   }
   let body;
@@ -41887,7 +42636,7 @@ async function accountToken2(spawnImpl = spawn4) {
     cached2 = fromEnv;
     return fromEnv;
   }
-  const token = await new Promise((resolve40, reject) => {
+  const token = await new Promise((resolve41, reject) => {
     let child;
     try {
       child = spawnImpl("wix", ["token"]);
@@ -41916,7 +42665,7 @@ async function accountToken2(spawnImpl = spawn4) {
     const scan = (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE2);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     };
     child.stdout?.on("data", scan);
     child.stderr?.on("data", scan);
@@ -42093,7 +42842,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync49, readFileSync as readFileSync62, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync62, writeFileSync as writeFileSync22 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -42242,7 +42991,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync49, readFileSync: readFileSync62, writeFileSync: writeFileSync22 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync50, readFileSync: readFileSync62, writeFileSync: writeFileSync22 }) {
   const msid = binding2.siteId;
   const path = resolvePath2(target);
   const committed = committedShellProvisioning(path);
@@ -42576,11 +43325,11 @@ var init_site_oauth_client = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync50, rmSync as rmSync8, readdirSync as readdirSync23, statSync as statSync12 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync51, rmSync as rmSync9, readdirSync as readdirSync23, statSync as statSync13 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash24 } from "node:crypto";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join48, resolve as resolve39, basename as basename8, dirname as dirname29 } from "node:path";
+import { join as join49, resolve as resolve40, basename as basename8, dirname as dirname28 } from "node:path";
 import { fileURLToPath as fileURLToPath21 } from "node:url";
 
 // ../serve-cli/src/client.ts
@@ -44089,7 +44838,7 @@ async function browserLogin(opts) {
   const log = opts.log ?? (() => {
   });
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     let loginUrl = "";
     const server = createServer();
@@ -44153,7 +44902,7 @@ async function browserLogin(opts) {
           return;
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" }).end(CLOSE_PAGE);
-        finish2(() => resolve40({ token, loginUrl }));
+        finish2(() => resolve41({ token, loginUrl }));
       });
     });
     server.on("error", (err) => finish2(() => reject(err)));
@@ -45088,10 +45837,10 @@ async function runRemoteSecretsCommand(operation, flags, io, options) {
 // src/notify.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname12, join as join14 } from "node:path";
+import { dirname as dirname12, join as join15 } from "node:path";
 var DEFAULT_ADMIN_URL = "http://127.0.0.1:8888";
 function defaultSessionsPath() {
-  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join14(homedir3(), ".himalaya", "admin-sessions.json");
+  return process.env.HIMI_ADMIN_SESSIONS_FILE ?? join15(homedir3(), ".himalaya", "admin-sessions.json");
 }
 function loadSessionsFile(path = defaultSessionsPath()) {
   try {
@@ -45330,7 +46079,7 @@ NOTE: ${simulated} of those went to the booted iOS Simulator, NOT to the device
 init_car();
 init_preview_surfaces();
 import { existsSync as existsSync12, readFileSync as readFileSync15 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 var VALID_PLATFORM_KEYS = /* @__PURE__ */ new Set([
   ...PREVIEW_SURFACES.map((s) => s.platformKey).filter((k) => k !== null),
   ...PREVIEW_EXEMPT_PLATFORM_KEYS
@@ -45341,7 +46090,7 @@ function surfaceIssues(dir, surfaceNav, strict) {
   const error = (message) => issues.push({ screen: null, pass: "surfaces", severity: "error", message });
   let platforms = {};
   let envelopeUnreadable = false;
-  const p = join15(dir, "platforms.json");
+  const p = join16(dir, "platforms.json");
   if (existsSync12(p)) {
     let raw;
     try {
@@ -45374,7 +46123,7 @@ function surfaceIssues(dir, surfaceNav, strict) {
     });
   }
   if (envelopeUnreadable) return issues;
-  const configTs = join15(dir, "config.ts");
+  const configTs = join16(dir, "config.ts");
   if (existsSync12(configTs)) {
     const declared = parseCarConfig(readFileSync15(configTs, "utf8")).category;
     const inEnvelope = platforms.androidauto === true;
@@ -45400,7 +46149,7 @@ function surfaceIssues(dir, surfaceNav, strict) {
 }
 function readLocalPlatforms(dir) {
   try {
-    const raw = JSON.parse(readFileSync15(join15(dir, "platforms.json"), "utf8"));
+    const raw = JSON.parse(readFileSync15(join16(dir, "platforms.json"), "utf8"));
     return Object.fromEntries(
       Object.entries(raw).filter(([k, v]) => VALID_PLATFORM_KEYS.has(k) && typeof v === "boolean")
     );
@@ -45412,10 +46161,10 @@ function readLocalPlatforms(dir) {
 // src/token-lint.ts
 init_token_colors();
 import { existsSync as existsSync13, readFileSync as readFileSync16 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 function configuredTokensPath(dir) {
   for (const name of ["config.ts", "config.js", "himi.config.ts"]) {
-    const f = join16(dir, name);
+    const f = join17(dir, name);
     if (!existsSync13(f)) continue;
     const src = readFileSync16(f, "utf8");
     const m = /designTokensPath\s*:\s*["'`]([^"'`]+)["'`]/.exec(src);
@@ -45435,7 +46184,7 @@ function tokenColorIssues(dir, tokensPathOverride) {
     );
   }
   const tokensPath = configured.path ?? "tokens.json";
-  const p = join16(dir, tokensPath);
+  const p = join17(dir, tokensPath);
   if (!existsSync13(p)) {
     if (tokensPath !== "tokens.json") {
       warn(`config designTokensPath points at ${tokensPath}, which does not exist -- colour tokens were not checked`);
@@ -45483,9 +46232,9 @@ function tokenColorIssues(dir, tokensPathOverride) {
 // src/icon-lint.ts
 init_icon();
 import { existsSync as existsSync16 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 async function iconIssues(dir, strict, opts = {}) {
-  if (!existsSync16(join19(dir, "himalaya.content.json"))) return [];
+  if (!existsSync16(join20(dir, "himalaya.content.json"))) return [];
   const status = await iconStatus(dir);
   const issue2 = (severity, message) => ({
     screen: null,
@@ -45553,13 +46302,13 @@ function fontIssues(dir, strict) {
 
 // src/stores-api-lint.ts
 import { existsSync as existsSync20, readdirSync as readdirSync10, readFileSync as readFileSync22 } from "node:fs";
-import { join as join23 } from "node:path";
+import { join as join24 } from "node:path";
 function storesV1Issues(contentDir2, strict) {
-  const roots = [join23(contentDir2, "tier5-src"), join23(contentDir2, "dev")].filter(existsSync20);
+  const roots = [join24(contentDir2, "tier5-src"), join24(contentDir2, "dev")].filter(existsSync20);
   const files = [];
   const visit = (dir) => {
     for (const entry of readdirSync10(dir, { withFileTypes: true })) {
-      const path = join23(dir, entry.name);
+      const path = join24(dir, entry.name);
       if (entry.isDirectory()) visit(path);
       else if (/\.(?:[cm]?[jt]sx?)$/i.test(entry.name)) files.push(path);
     }
@@ -45580,7 +46329,7 @@ init_crawl_layers();
 init_wix_gateway_rules();
 init_mobile_ux_contract();
 import { existsSync as existsSync21, mkdirSync as mkdirSync10, readFileSync as readFileSync23, readdirSync as readdirSync11, writeFileSync as writeFileSync9 } from "node:fs";
-import { join as join24, relative as relative3, resolve as resolve15 } from "node:path";
+import { join as join25, relative as relative3, resolve as resolve15 } from "node:path";
 var EVIDENCE_RELATIVE_PATH = ".himi/ux-audit.json";
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".json"]);
 var IGNORED_DIRECTORIES = /* @__PURE__ */ new Set([".git", "node_modules", "dist", ".himi", "coverage"]);
@@ -45598,12 +46347,12 @@ function walkSource(dir, root = dir) {
   const found = [];
   for (const entry of readdirSync11(dir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
-      if (!IGNORED_DIRECTORIES.has(entry.name)) found.push(...walkSource(join24(dir, entry.name), root));
+      if (!IGNORED_DIRECTORIES.has(entry.name)) found.push(...walkSource(join25(dir, entry.name), root));
       continue;
     }
     const ext = entry.name.slice(entry.name.lastIndexOf("."));
     if (!SOURCE_EXTENSIONS.has(ext)) continue;
-    const absolute = join24(dir, entry.name);
+    const absolute = join25(dir, entry.name);
     const text2 = readText(absolute);
     if (text2 !== null) found.push({ path: relative3(root, absolute), text: text2 });
   }
@@ -45633,9 +46382,9 @@ function usesAppNetwork(source) {
 function auditUx(content, strict = false) {
   const dir = resolve15(content);
   const issues = [];
-  const evidencePath = join24(dir, EVIDENCE_RELATIVE_PATH);
-  const spec = readText(join24(dir, "SPEC.md"));
-  const mobile = readText(join24(dir, "MOBILE-UX.md"));
+  const evidencePath = join25(dir, EVIDENCE_RELATIVE_PATH);
+  const spec = readText(join25(dir, "SPEC.md"));
+  const mobile = readText(join25(dir, "MOBILE-UX.md"));
   if (!spec) issue(issues, strict, "missing-spec", "SPEC.md is missing; define the customer task before calling this UX-ready.", "SPEC.md");
   if (!mobile) {
     issue(issues, strict, "missing-mobile-ux", "MOBILE-UX.md is missing; add the mobile state and platform contract.", "MOBILE-UX.md");
@@ -45674,7 +46423,7 @@ function auditUx(content, strict = false) {
   const preview = matches(previewControl);
   if (preview) issue(issues, strict, "possible-preview-control", "Possible customer-visible test/demo state control found. Keep scenario controls out of shipping UI, or document a capability-limited fallback.", preview.path);
   if (usesAppNetwork(source)) {
-    const mocksPath = join24(dir, "dev", "net-mocks.json");
+    const mocksPath = join25(dir, "dev", "net-mocks.json");
     if (!existsSync21(mocksPath)) {
       issue(issues, strict, "missing-app-mocks", "This package uses a Wix/network client but has no app-specific dev/net-mocks.json. Add fixtures for dynamic, entitlement, or recovery flows.", "dev/net-mocks.json");
     } else {
@@ -45696,12 +46445,12 @@ function recordNativeAudit(content, platform, status, checks, reason) {
   if (!normalizedChecks.length) throw new Error("--checks needs at least one comma-separated check (for example: back,keyboard,voiceover)");
   if (status === "unavailable" && !reason?.trim()) throw new Error("--reason is required when --status unavailable");
   const dir = resolve15(content);
-  const path = join24(dir, EVIDENCE_RELATIVE_PATH);
+  const path = join25(dir, EVIDENCE_RELATIVE_PATH);
   const parsed = parseEvidence(path);
   if (parsed.error) throw new Error(`${EVIDENCE_RELATIVE_PATH} ${parsed.error}`);
   const evidence = parsed.evidence ?? { version: 1, platforms: {} };
   evidence.platforms[platform] = { status, checks: normalizedChecks, ...reason?.trim() ? { reason: reason.trim() } : {}, recordedAt: (/* @__PURE__ */ new Date()).toISOString() };
-  mkdirSync10(join24(dir, ".himi"), { recursive: true });
+  mkdirSync10(join25(dir, ".himi"), { recursive: true });
   writeFileSync9(path, JSON.stringify(evidence, null, 2) + "\n");
   return evidence;
 }
@@ -45710,26 +46459,26 @@ function recordNativeAudit(content, platform, status, checks, reason) {
 init_mobile_ux_contract();
 import { readFileSync as readFileSync24, existsSync as existsSync22, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10, copyFileSync as copyFileSync2 } from "node:fs";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
-import { dirname as dirname15, join as join25, resolve as resolve16 } from "node:path";
+import { dirname as dirname15, join as join26, resolve as resolve16 } from "node:path";
 var GUIDES_DIR = resolve16(dirname15(fileURLToPath10(import.meta.url)), "../guides");
 function guidesAvailable() {
-  return existsSync22(join25(GUIDES_DIR, "index.json"));
+  return existsSync22(join26(GUIDES_DIR, "index.json"));
 }
 function loadIndex() {
-  return JSON.parse(readFileSync24(join25(GUIDES_DIR, "index.json"), "utf8"));
+  return JSON.parse(readFileSync24(join26(GUIDES_DIR, "index.json"), "utf8"));
 }
 function readGuide(id) {
   const meta = loadIndex().guides.find((g) => g.id === id);
   if (!meta) return null;
-  return readFileSync24(join25(GUIDES_DIR, meta.file), "utf8");
+  return readFileSync24(join26(GUIDES_DIR, meta.file), "utf8");
 }
 function loadComponentReference() {
   const idx = loadIndex();
-  return JSON.parse(readFileSync24(join25(GUIDES_DIR, idx.componentReferenceFile), "utf8"));
+  return JSON.parse(readFileSync24(join26(GUIDES_DIR, idx.componentReferenceFile), "utf8"));
 }
 function loadSdkReference() {
   const idx = loadIndex();
-  return JSON.parse(readFileSync24(join25(GUIDES_DIR, idx.sdkReferenceFile), "utf8"));
+  return JSON.parse(readFileSync24(join26(GUIDES_DIR, idx.sdkReferenceFile), "utf8"));
 }
 function buildAgentPrimer() {
   const idx = loadIndex();
@@ -45837,19 +46586,19 @@ function writeAgentContext(targetDir) {
   const idx = loadIndex();
   const files = [];
   const write2 = (rel, body) => {
-    const p = join25(targetDir, rel);
+    const p = join26(targetDir, rel);
     mkdirSync11(dirname15(p), { recursive: true });
     writeFileSync10(p, body);
     files.push(rel);
   };
   const copy = (srcRel, destRel) => {
-    const p = join25(targetDir, destRel);
+    const p = join26(targetDir, destRel);
     mkdirSync11(dirname15(p), { recursive: true });
-    copyFileSync2(join25(GUIDES_DIR, srcRel), p);
+    copyFileSync2(join26(GUIDES_DIR, srcRel), p);
     files.push(destRel);
   };
   const writeIfMissing = (rel, body) => {
-    if (existsSync22(join25(targetDir, rel))) return;
+    if (existsSync22(join26(targetDir, rel))) return;
     write2(rel, body);
   };
   write2("HIMALAYA.md", buildAgentPrimer());
@@ -45877,7 +46626,7 @@ function writeAgentContext(targetDir) {
 // src/cli.ts
 init_wix_placeholders();
 var defaultIO = { log: (l) => console.log(l), error: (l) => console.error(l), isTTY: process.stdout.isTTY === true };
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["browser", "no-open", "yes", "json", "deep", "quiet", "force", "watch", "no-claim", "new"]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["browser", "no-open", "yes", "json", "deep", "quiet", "force", "replace", "watch", "no-claim", "new"]);
 var SHELL_ENUM = SHELL_NAMES2.join("|");
 function parseFlags(argv) {
   const _ = [];
@@ -45910,7 +46659,7 @@ var str5 = (v) => typeof v === "string" ? v : void 0;
 var num = (v) => typeof v === "string" && v !== "" && Number.isFinite(Number(v)) ? Number(v) : void 0;
 function embeddedTemplateCatalog() {
   return availableTemplates().map((name) => {
-    const path = join48(templateSourceDir(name), TEMPLATE_META_FILE);
+    const path = join49(templateSourceDir(name), TEMPLATE_META_FILE);
     const meta = JSON.parse(readFileSync63(path, "utf8"));
     if (!meta || typeof meta.title !== "string" || typeof meta.description !== "string" || !Array.isArray(meta.tags)) {
       throw new Error(`${path} must be { title: string, description: string, tags: string[], category?: string }`);
@@ -46066,7 +46815,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                              Never archives .himi/, .env*, node_modules/, dist/ or key
                                              material, and REFUSES the push if a file it would archive
                                              looks like it holds a credential.
-  himi pull <app> [--release <id>] [--out <dir>] [--name <new>] [--force] [--target <t>]
+  himi pull <app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]
                                            restore an app's SOURCE from the serve plane into an editable
                                            content package \u2014 the other half of push, which archives it.
                                            Owner or editor only: a viewer may download the running app,
@@ -46074,6 +46823,14 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            retention window prune() keeps (current + newest ~20).
                                            --name re-substitutes the app identity, so the restored tree is
                                            a NEW app rather than a second copy of the same one.
+                                           A non-empty destination is refused unless you say which you mean:
+                                           --force MERGES \u2014 it keeps files the release does not have and
+                                             NAMES them (left: [...]), so a hybrid tree is never silent.
+                                           --replace restores exactly what was archived: it removes those
+                                             files first (removed: [...]) and implies --force. It refuses
+                                             a directory with no himalaya.content.json, and can only remove
+                                             what a push would have archived \u2014 .git/, node_modules/, dist/,
+                                             .env* and key material are never touched.
   himi pack [--content <dir>] [--out <file|dir>] [--format zip|dir] [--name <title>] [--snapshot]
                                            write the app as a PORTABLE .himi package \u2014 one self-contained
                                            file (screens, T5 bundles, tokens, assets, app-config) you can
@@ -46321,7 +47078,7 @@ var COMMANDS = [
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "push", summary: "lint + build + publish a release (default --draft: servable via ?release= but NOT live). REFUSES to publish on any error unless --force; --strict promotes warnings. Prints preview + agent-context links. The published slug is NAMESPACED per owner \u2014 `<ownerPrefix>.<name>`, composed offline from the control token's ownerPrefix claim, so the CLI and the server derive the identical string and himalaya.content.json is NOT rewritten (a legacy token with no ownerPrefix publishes the declared name unchanged). An app claimed BEFORE namespacing is stored under its FLAT slug, so the claim route answers `alreadyYours` naming that slug and the push adopts it \u2014 reported as `adoptedSlug`, since it is the one case where the published `app` differs from what the declared name composes to. `--no-claim` skips the route that knows this, so a pre-namespacing app pushed with it still fails 403. --visibility public|unlisted decides whether /v1/apps + the Himi Player picker LIST the app (also declarable as `visibility` in himalaya.content.json; omitted, a brand-new app defaults to unlisted \u2014 share by link \u2014 and an existing setting is kept). --account-id names which account owns the app when your Wix session resolves to several (the auto-claim of a brand-new slug cannot guess \u2014 without it a multi-account caller is told to name one).", required: "[--content <dir>] [--draft] [--force] [--strict] [--label] [--notes] [--visibility public|unlisted] [--no-claim] [--account-id <id>] (--control-token)" },
   { name: "pack", summary: "write the app as a PORTABLE .himi package \u2014 one self-contained file holding every screen, Tier-5 bundle, token, asset and the app-config. Packages are live by default: they boot bundled content offline, then Himi Player follows its baked-in production ring. `--snapshot` makes a frozen reproducible artifact. Package-supplied origins are never trusted. --format dir writes the same tree unpacked, for static hosting. --release-dir packs a release that is already built on disk (needs --app) instead of rebuilding from source.", required: "[--content <dir>] [--out <file|dir>] [--format zip|dir] [--name <title>] [--snapshot] [--strict] [--force] | --release-dir <dir> --app <a>" },
-  { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force] [--target <t>]" },
+  { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A NON-EMPTY destination is refused unless you say which you mean: `--force` merges and reports \u2014 it writes the archive over what is there, keeps files the release does not carry, and NAMES every one of them as `left: [...]` so a tree that matches no release is never silent (#2437); `--replace` restores exactly what was archived, removing those files first (`removed: [...]`) and implying `--force`. `--replace` refuses a directory holding no `himalaya.content.json`, so a mistyped `--out` cannot clear an unrelated tree, and the only paths it can remove are the ones a push would have archived \u2014 `.git/`, `node_modules/`, `dist/`, `.env*` and key material are out of its reach by construction.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]" },
   { name: "share", summary: "publish or revoke a content-addressed `.himi` share link. The package must be a validated archive for an already-published release; the resulting https URL is safe to QR, copy, or open in Himi Player.", required: "--file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>" },
   { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod.", required: "[<package.himi|dir|url>] [--browser] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
   { name: "preview", summary: "print the shareable web URL + himi:// deep link + agent /v1/preview JSON URLs for an app+release; --surface frames the web preview as any catalog surface (?surface=)", required: "--app --release [--screen] [--surface]" },
@@ -46375,11 +47132,11 @@ function packageVersion(path) {
   }
 }
 function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("./authoring-runtime/node_modules/@wix/himalaya/package.json", import.meta.url)) {
-  let dir = resolve39(fromDir);
+  let dir = resolve40(fromDir);
   for (; ; ) {
-    const version = packageVersion(join48(dir, "node_modules", "@wix", "himalaya", "package.json"));
+    const version = packageVersion(join49(dir, "node_modules", "@wix", "himalaya", "package.json"));
     if (version) return { version, source: "local" };
-    const parent = dirname29(dir);
+    const parent = dirname28(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -46387,7 +47144,7 @@ function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("
   if (bundled) return { version: bundled, source: "bundled" };
   try {
     const root = execFileSync6("npm", ["root", "-g"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
-    const version = root ? packageVersion(join48(root, "@wix", "himalaya", "package.json")) : void 0;
+    const version = root ? packageVersion(join49(root, "@wix", "himalaya", "package.json")) : void 0;
     return version ? { version, source: "global" } : {};
   } catch {
     return {};
@@ -46748,7 +47505,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync50(iosYmlPath) ? readFileSync63(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync51(iosYmlPath) ? readFileSync63(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -46762,19 +47519,19 @@ async function nativeConfigAdvisories(app, configSource) {
 }
 function readConfigSource(dir) {
   try {
-    return readFileSync63(join48(dir, "config.ts"), "utf8");
+    return readFileSync63(join49(dir, "config.ts"), "utf8");
   } catch {
     return null;
   }
 }
 function writePngFile(path, base64) {
-  mkdirSync25(dirname29(path), { recursive: true });
+  mkdirSync25(dirname28(path), { recursive: true });
   writeFileSync23(path, Buffer.from(base64, "base64"));
   return path;
 }
 async function initFromRemoteTemplate(name, parentDir, template, c) {
-  const dir = resolve39(parentDir, name);
-  if (existsSync50(join48(dir, "himalaya.content.json"))) {
+  const dir = resolve40(parentDir, name);
+  if (existsSync51(join49(dir, "himalaya.content.json"))) {
     throw new Error(`content package already exists at ${dir}`);
   }
   const r = await c.fetchTemplateSource(TEMPLATE_APP_PREFIX + template);
@@ -46786,13 +47543,13 @@ async function initFromRemoteTemplate(name, parentDir, template, c) {
   return finishScaffold(materializeSource(archive.files, name, dir), template);
 }
 function contentDir(flags) {
-  return resolve39(str5(flags.content) ?? process.cwd());
+  return resolve40(str5(flags.content) ?? process.cwd());
 }
 function isHimalayaMonorepoCheckout(start) {
-  let dir = resolve39(start);
+  let dir = resolve40(start);
   for (; ; ) {
-    if (existsSync50(join48(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync50(join48(dir, "core", "serve", "src", "server.ts"))) return true;
-    const parent = dirname29(dir);
+    if (existsSync51(join49(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync51(join49(dir, "core", "serve", "src", "server.ts"))) return true;
+    const parent = dirname28(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -46821,9 +47578,9 @@ function materializeForPreview(appDir2, slug, displayName) {
   const forBuild = Object.fromEntries(
     Object.entries(files).map(([rel, body]) => [rel, rel === "himalaya.content.json" ? substituteIdentity(body, slug) : body])
   );
-  const repoRoot2 = resolve39(fileURLToPath21(new URL("../../..", import.meta.url)));
-  const dest = join48(repoRoot2, "node_modules", ".cache", "himi-template-preview", slug);
-  rmSync8(dest, { recursive: true, force: true });
+  const repoRoot2 = resolve40(fileURLToPath21(new URL("../../..", import.meta.url)));
+  const dest = join49(repoRoot2, "node_modules", ".cache", "himi-template-preview", slug);
+  rmSync9(dest, { recursive: true, force: true });
   mkdirSync25(dest, { recursive: true });
   materializeSource(forBuild, displayName, dest, slug);
   return dest;
@@ -46831,7 +47588,7 @@ function materializeForPreview(appDir2, slug, displayName) {
 async function appId(dir) {
   try {
     const { readFileSync: readFileSync64 } = await import("node:fs");
-    const m = JSON.parse(readFileSync64(join48(dir, "himalaya.content.json"), "utf8"));
+    const m = JSON.parse(readFileSync64(join49(dir, "himalaya.content.json"), "utf8"));
     if (m.name) return m.name;
   } catch {
   }
@@ -46840,7 +47597,7 @@ async function appId(dir) {
 async function contentVisibility(dir) {
   try {
     const { readFileSync: readFileSync64 } = await import("node:fs");
-    const m = JSON.parse(readFileSync64(join48(dir, "himalaya.content.json"), "utf8"));
+    const m = JSON.parse(readFileSync64(join49(dir, "himalaya.content.json"), "utf8"));
     if (m.visibility === "public" || m.visibility === "unlisted") return m.visibility;
   } catch {
   }
@@ -47041,7 +47798,7 @@ Seed your coding agent with \`himi agent-init\`. Portal: ${idx.portalUrl}`);
       return 0;
     }
     case "agent-init": {
-      const dir = resolve39(str5(flags.dir) ?? process.cwd());
+      const dir = resolve40(str5(flags.dir) ?? process.cwd());
       const res = writeAgentContext(dir);
       print({ ok: true, dir: res.dir, files: res.files, portalUrl: idx.portalUrl });
       return 0;
@@ -47079,6 +47836,7 @@ async function loadAuthoring() {
       crawlScreen: crawl.crawlScreen,
       crawlScreenJourney: crawl.crawlScreenJourney,
       crawlScreenHostile: crawl.crawlScreenHostile,
+      crawlScreenRelations: crawl.crawlScreenRelations,
       findingKey: crawl.findingKey,
       startWorkerCoverage: cov.startWorkerCoverage,
       uncoveredFunctions: cov.uncoveredFunctions,
@@ -47146,7 +47904,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 2;
         }
         const template = str5(flags.template);
-        const parentDir = resolve39(str5(flags.dir) ?? process.cwd());
+        const parentDir = resolve40(str5(flags.dir) ?? process.cwd());
         if (template && flags.remote === true) {
           try {
             const res2 = await initFromRemoteTemplate(name, parentDir, template, client3());
@@ -47237,11 +47995,11 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 0;
         }
         if (sub === "publish") {
-          const appDir2 = resolve39(str5(flags.dir) ?? process.cwd());
-          const sourceDir = resolve39(str5(flags["source-dir"]) ?? appDir2);
+          const appDir2 = resolve40(str5(flags.dir) ?? process.cwd());
+          const sourceDir = resolve40(str5(flags["source-dir"]) ?? appDir2);
           let meta;
           try {
-            meta = JSON.parse(readFileSync63(join48(sourceDir, TEMPLATE_META_FILE), "utf8"));
+            meta = JSON.parse(readFileSync63(join49(sourceDir, TEMPLATE_META_FILE), "utf8"));
           } catch {
             io.error(JSON.stringify({ error: `no ${TEMPLATE_META_FILE} in ${sourceDir} \u2014 a template must declare { title, description, tags } to be published`, hint: `add ${TEMPLATE_META_FILE} next to himalaya.content.json (or pass --source-dir <dir>)` }));
             return 2;
@@ -47251,7 +48009,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             return 2;
           }
           try {
-            const appearance = extractTemplateAppearance(JSON.parse(readFileSync63(join48(sourceDir, "tokens.json"), "utf8")));
+            const appearance = extractTemplateAppearance(JSON.parse(readFileSync63(join49(sourceDir, "tokens.json"), "utf8")));
             meta = { ...appearance, ...meta };
           } catch {
           }
@@ -47263,7 +48021,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           const force = flags.force === true;
           const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
           const bres = await buildContentForValidation2(buildDir, { resolution: resolutionFlag(flags) });
-          const out = mkdtempSync4(join48(tmpdir5(), "himi-template-"));
+          const out = mkdtempSync4(join49(tmpdir5(), "himi-template-"));
           const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
           const outcome = await buildReleaseFromContent2(buildDir, out, {
             ...hasWorkers ? { tier5Dir: bundleOutDir2(buildDir) } : {},
@@ -47292,7 +48050,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             }));
             return 1;
           }
-          const iconPath = str5(flags.icon) ? resolve39(str5(flags.icon)) : templateIconPath(name);
+          const iconPath = str5(flags.icon) ? resolve40(str5(flags.icon)) : templateIconPath(name);
           let iconHash;
           if (iconPath) {
             try {
@@ -47422,7 +48180,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         const { mobileUxIssues: mobileUxIssues2 } = await Promise.resolve().then(() => (init_mobile_ux_lint(), mobile_ux_lint_exports));
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join48(tmpdir5(), "himi-validate-"));
+        const out = mkdtempSync4(join49(tmpdir5(), "himi-validate-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -47610,7 +48368,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       case "test": {
         const dir = contentDir(flags);
         const structuredOutput = flags.json === true || io.isTTY !== true;
-        if (existsSync50(join48(dir, "functions"))) {
+        if (existsSync51(join49(dir, "functions"))) {
           const { invokeLocalFunction: invokeLocalFunction2, loadFunctionsApp: loadFunctionsApp2 } = await Promise.resolve().then(() => (init_functions(), functions_exports));
           const loaded = await loadFunctionsApp2(dir);
           const results = [];
@@ -47624,7 +48382,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return results.every((result2) => result2.ok) ? 0 : 1;
         }
         const app = await appId(dir);
-        const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2, crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2, recordScreenTraffic: recordScreenTraffic2, mintVisitor: mintVisitor2, webWixCall: webWixCall2, freezeTrafficToMocks: freezeTrafficToMocks2, bootAndSnapshotState: bootAndSnapshotState2, renderDescriptorWeb: renderDescriptorWeb2, renderPngBatch: renderPngBatch2, pngAvailable: pngAvailable2, crawlBlockingPasses } = await loadAuthoring();
+        const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2, crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, crawlScreenRelations: crawlScreenRelations2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2, recordScreenTraffic: recordScreenTraffic2, mintVisitor: mintVisitor2, webWixCall: webWixCall2, freezeTrafficToMocks: freezeTrafficToMocks2, bootAndSnapshotState: bootAndSnapshotState2, renderDescriptorWeb: renderDescriptorWeb2, renderPngBatch: renderPngBatch2, pngAvailable: pngAvailable2, crawlBlockingPasses } = await loadAuthoring();
         const { readTestConfig: readTestConfig2, runCrawl: runCrawl2, formatReport: formatReport2, readCannedResponses: readCannedResponses2, makeRecordingWixCall: makeRecordingWixCall2, runRecordPass: runRecordPass2, runShotsPass: runShotsPass2, defaultNetRules: defaultNetRules2, readNetRules: readNetRules2, scopeDescriptors: scopeDescriptors2, writeRecordedMocks: writeRecordedMocks2 } = await Promise.resolve().then(() => (init_test(), test_exports));
         let config;
         try {
@@ -47697,7 +48455,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           }
         }
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join48(tmpdir5(), "himi-test-"));
+        const out = mkdtempSync4(join49(tmpdir5(), "himi-test-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -47742,7 +48500,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             io.error(JSON.stringify({ error: `screen "${screen.screenId}" has no Tier-5 worker, so there is nothing for the browser loop to build` }));
             return 2;
           }
-          const sources = collectWorkerSources2(join48(dir, "tier5-src"), screen.bundleName);
+          const sources = collectWorkerSources2(join49(dir, "tier5-src"), screen.bundleName);
           if (!sources) {
             io.error(JSON.stringify({ error: `no worker source found at tier5-src/${screen.bundleName} \u2014 the browser loop compiles SOURCE, not the built bundle` }));
             return 2;
@@ -47862,7 +48620,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             ...deep ? { deep } : {},
             ...offline ? { offline: true } : {},
             ...offline || flags["no-hostile"] === true ? { hostile: false } : {},
-            deps: { crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2 }
+            deps: { crawlScreen: crawlScreen2, crawlScreenJourney: crawlScreenJourney2, crawlScreenHostile: crawlScreenHostile2, crawlScreenRelations: crawlScreenRelations2, findingKey: findingKey2, startWorkerCoverage: startWorkerCoverage2, uncoveredFunctions: uncoveredFunctions2, crawlScreenDeep: crawlScreenDeep2, crawlSignature: crawlSignature2 }
           });
         } catch (e) {
           io.error(JSON.stringify({ error: e.message }));
@@ -47899,7 +48657,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             const sp = await runShotsPass2({
               descriptors: scopeDescriptors2(outcome.descriptors ?? [], pos.slice(1), invalidScreens),
               tokens: outcome.tokens,
-              outDir: join48(dir, ".himi", "shots"),
+              outDir: join49(dir, ".himi", "shots"),
               width: 390,
               layers: { rules: shotRules, ...cmsSeed ? { cmsSeed } : {}, ...canned ? { canned: canned.byKey } : {} },
               ...budgetMs ? { budgetMs } : {},
@@ -47909,7 +48667,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
                 renderDescriptorWeb: renderDescriptorWeb2,
                 renderPngBatch: renderPngBatch2,
                 writePng: (path, base64) => writePngFile(path, base64),
-                clearDir: (d) => rmSync8(d, { recursive: true, force: true })
+                clearDir: (d) => rmSync9(d, { recursive: true, force: true })
               }
             });
             writtenShots = sp.written;
@@ -47935,7 +48693,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           releaseId: result.releaseId,
           releasePayload: release,
           descriptors: attestedDescriptors,
-          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join48(dir, ".himi", "shots", name)])),
+          screenshots: Object.fromEntries(writtenShots.filter((name) => crawledScreens.has(name.replace(/\.png$/, ""))).map((name) => [name.replace(/\.png$/, ""), join49(dir, ".himi", "shots", name)])),
           coverage: {
             screens: crawledScreens.size,
             actionsDispatched: result.actions.exercised,
@@ -48077,7 +48835,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         }
         const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join48(tmpdir5(), "himi-render-"));
+        const out = mkdtempSync4(join49(tmpdir5(), "himi-render-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -48093,7 +48851,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
         let attestationPngFile;
         if (typeof flags.png === "string" && r.pngBase64) {
           pngFile = writePngFile(str5(flags.png), r.pngBase64);
-          attestationPngFile = writePngFile(join48(dir, ".himi", "shots", `${screenId}.png`), r.pngBase64);
+          attestationPngFile = writePngFile(join49(dir, ".himi", "shots", `${screenId}.png`), r.pngBase64);
         }
         const legacyRender = {
           ok: r.renderable,
@@ -48398,17 +49156,27 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const renamed = str5(flags.name);
-        const dest = resolve39(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
-        if (existsSync50(dest)) {
-          if (!statSync12(dest).isDirectory()) {
+        const dest = resolve40(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
+        const replace = flags.replace === true;
+        const force = replace || flags.force === true;
+        if (existsSync51(dest)) {
+          if (!statSync13(dest).isDirectory()) {
             io.error(JSON.stringify({
               error: `${dest} exists and is not a directory`,
               hint: "pass --out/--name to land somewhere else, or remove the file"
             }));
             return 1;
           }
-          if (readdirSync23(dest).length > 0 && flags.force !== true) {
-            io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway, or --out/--name to land somewhere else" }));
+          const occupied = readdirSync23(dest).length > 0;
+          if (occupied && !force) {
+            io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway (merging, and naming what it keeps), --replace to restore exactly what was archived, or --out/--name to land somewhere else" }));
+            return 1;
+          }
+          if (replace && occupied && !existsSync51(join49(dest, "himalaya.content.json"))) {
+            io.error(JSON.stringify({
+              error: `${dest} is not a content package \u2014 refusing to --replace it`,
+              hint: "--replace only clears a directory that holds himalaya.content.json. Check --out/--name, or pass --force to merge into it instead."
+            }));
             return 1;
           }
         }
@@ -48417,7 +49185,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ ok: false, app: wanted, status: pulled.status, ...pulled.json ?? {} }));
           return 1;
         }
-        const { readAppSource: readAppSource2, writeAppSource: writeAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
+        const { readAppSource: readAppSource2, writeAppSource: writeAppSource2, staleSourcePaths: staleSourcePaths2, removeStaleSource: removeStaleSource2, deniedArchivePaths: deniedArchivePaths2, writeConflicts: writeConflicts2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
         let restored;
         try {
           restored = readAppSource2(pulled.bytes);
@@ -48444,6 +49212,31 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             if (body !== void 0) entry.bytes = Buffer.from(substituteIdentity(body, renamed), "utf8");
           }
         }
+        if (restored.length === 0) {
+          io.error(JSON.stringify({
+            ok: false,
+            app: wanted,
+            error: "app_source_empty",
+            hint: "the plane returned an archive with no entries \u2014 nothing was changed. Re-push the app, then pull again"
+          }));
+          return 1;
+        }
+        const conflicts = writeConflicts2(restored, dest);
+        if (conflicts.length) {
+          io.error(JSON.stringify({
+            ok: false,
+            app: wanted,
+            error: "destination_shape_conflicts",
+            conflicts,
+            hint: "nothing was changed \u2014 remove or rename those paths, or pass --out/--name to land somewhere else"
+          }));
+          return 1;
+        }
+        let left = [];
+        let removed = [];
+        if (replace) removed = removeStaleSource2(restored, dest);
+        else left = staleSourcePaths2(restored, dest);
+        const refused = deniedArchivePaths2(restored);
         const written = writeAppSource2(restored, dest);
         print({
           ok: true,
@@ -48451,6 +49244,18 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           dir: dest,
           files: written.length,
           ...renamed ? { renamedTo: renamed } : {},
+          ...removed.length ? { removed } : {},
+          ...refused.length ? {
+            refused,
+            refusedNote: "this archive carries paths a restore will not write (the deny-list has grown since it was published) \u2014 they were skipped, not written over"
+          } : {},
+          // EVERY path, not a count and not a sample: the whole failure was that a hybrid tree
+          // looked like a restore, and a list you have to go and generate yourself is the same
+          // silence with extra steps.
+          ...left.length ? {
+            left,
+            warning: `${left.length} file(s) already in ${dest} are not in this release and were KEPT \u2014 this tree is a merge of both, and matches no release. Remove them, or re-run with --replace.`
+          } : {},
           next: `cd ${dest} && himi validate`
         });
         return 0;
@@ -48473,7 +49278,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const force = flags.force === true;
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const out = mkdtempSync4(join48(tmpdir5(), "himi-push-"));
+        const out = mkdtempSync4(join49(tmpdir5(), "himi-push-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, out, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -48740,7 +49545,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             return 2;
           }
           try {
-            const res = writePack(resolve39(releaseDir), only, resolve39(str5(flags.out) ?? process.cwd()));
+            const res = writePack(resolve40(releaseDir), only, resolve40(str5(flags.out) ?? process.cwd()));
             print({
               ok: true,
               app: res.app,
@@ -48765,7 +49570,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         const force = flags.force === true;
         const { buildContentForValidation: buildContentForValidation2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
         const bres = await buildContentForValidation2(dir, { resolution: resolutionFlag(flags) });
-        const built = mkdtempSync4(join48(tmpdir5(), "himi-pack-"));
+        const built = mkdtempSync4(join49(tmpdir5(), "himi-pack-"));
         const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
         const outcome = await buildReleaseFromContent2(dir, built, {
           ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {},
@@ -48778,12 +49583,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...fontIssues(dir, strict)
         ]);
         if (hasErrors && !force) {
-          rmSync8(built, { recursive: true, force: true });
+          rmSync9(built, { recursive: true, force: true });
           print({ ...report, packed: false, hint: "lint found errors \u2014 fix them, or re-run `himi pack --force` to pack anyway" });
           return 1;
         }
         try {
-          const res = writePack(built, app, resolve39(str5(flags.out) ?? dir));
+          const res = writePack(built, app, resolve40(str5(flags.out) ?? dir));
           print({
             ok: true,
             app: res.app,
@@ -48808,7 +49613,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          rmSync8(built, { recursive: true, force: true });
+          rmSync9(built, { recursive: true, force: true });
         }
       }
       // ---- himi share — publish/revoke a content-addressed package link ----
@@ -48836,12 +49641,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         try {
           const { openPackageFile: openPackageFile2 } = await Promise.resolve().then(() => (init_pack(), pack_exports));
-          const opened = openPackageFile2(resolve39(file));
+          const opened = openPackageFile2(resolve40(file));
           if (!opened.validation.ok || !opened.header) {
             io.error(JSON.stringify({ error: "refusing to share an invalid package", issues: opened.validation.errors }));
             return 1;
           }
-          const archive = readFileSync63(resolve39(file));
+          const archive = readFileSync63(resolve40(file));
           const result = await client3().createPackageShare({
             app: opened.header.app,
             releaseId: opened.header.releaseId,
@@ -48878,10 +49683,10 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             const app = await appId(dir);
             const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
             const bres = await buildContentBundles2(dir, { resolution: resolutionFlag(flags) });
-            temp = mkdtempSync4(join48(tmpdir5(), "himi-run-build-"));
+            temp = mkdtempSync4(join49(tmpdir5(), "himi-run-build-"));
             const hasWorkers = bres.built.length > 0 || bres.compileErrors.length > 0;
             await buildReleaseFromContent2(dir, temp, { ...hasWorkers ? { tier5Dir: bundleOutDir2(dir) } : {} });
-            source = join48(temp, app);
+            source = join49(temp, app);
           }
           const chromeArg = str5(flags.chrome) ?? "preview";
           if (chromeArg !== "preview" && chromeArg !== "app") {
@@ -48906,9 +49711,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               open: flags["no-open"] !== true
             });
             print({ ok: true, app: run2.app, url: run2.url, port: run2.port, plane: "browser" });
-            await new Promise((resolve40) => {
+            await new Promise((resolve41) => {
               const stop = () => {
-                void run2.close().finally(() => resolve40());
+                void run2.close().finally(() => resolve41());
               };
               process.once("SIGINT", stop);
               process.once("SIGTERM", stop);
@@ -48944,7 +49749,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          if (temp) rmSync8(temp, { recursive: true, force: true });
+          if (temp) rmSync9(temp, { recursive: true, force: true });
         }
       }
       case "preview": {
@@ -49679,7 +50484,7 @@ ${label2}`);
         const platform = str5(flags.platform)?.split(",").map((p) => p.trim()).filter(Boolean);
         {
           const distDir = contentDir(flags);
-          if (existsSync50(join48(distDir, "himalaya.content.json"))) {
+          if (existsSync51(join49(distDir, "himalaya.content.json"))) {
             const issues = await iconIssues(distDir, flags.strict === true, { requireDeclared: true, requireVerified: true });
             const errors = issues.filter((i) => i.severity === "error");
             for (const i of issues.filter((i2) => i2.severity === "warning")) {