@wix/himalaya-cli 0.809.0 → 0.811.0

package/dist/cli.mjs

@@ -445,7 +445,7 @@ var WIX_COLLECTION_ID_MAX_LENGTH, SAFE_APP_ID, KV_NAME;
 var init_ownership = __esm({
   "../../core/data-resources/src/ownership.ts"() {
     init_schema();
-    WIX_COLLECTION_ID_MAX_LENGTH = 36;
+    WIX_COLLECTION_ID_MAX_LENGTH = 256;
     SAFE_APP_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*(?:\.[a-z0-9]+(?:-[a-z0-9]+)*)?$/;
     KV_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
   }
@@ -807,7 +807,13 @@ var init_source_deny = __esm({
       /^\.env\./,
       /^\.DS_Store$/,
       /^id_rsa($|\.)/,
-      /\.(pem|p8|p12|keystore|jks|mobileprovision)$/i
+      /\.(pem|p8|p12|keystore|jks|mobileprovision)$/i,
+      // `.git` IS NOT ALWAYS A DIRECTORY. In a linked worktree or a submodule it is a FILE holding
+      // `gitdir: …`, and DENY_DIRS is consulted for directories only — so at a package root it was
+      // denied by nothing: `himi push` archived the pointer, and `himi pull --replace` would delete
+      // it back out of a checkout whose release predates it (#2437). The guarantee that a restore
+      // cannot cost you a git history has to hold for both shapes of `.git`, not just the common one.
+      /^\.git$/
     ];
   }
 });
@@ -1954,7 +1960,7 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     tokenCache.set(cacheKey, fromEnv);
     return fromEnv;
   }
-  const token = await new Promise((resolve40, reject) => {
+  const token = await new Promise((resolve41, reject) => {
     let child;
     try {
       child = spawnImpl("wix", [...args]);
@@ -1983,12 +1989,12 @@ async function mintToken(args, label2, cacheKey, spawnImpl) {
     child.stdout?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     });
     child.stderr?.on("data", (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     });
     child.on("error", (e) => done(() => reject(new Error(mintHelp(label2, e.message)))));
     child.on("exit", (code) => done(() => reject(new Error(
@@ -7350,7 +7356,7 @@ async function injectRequest(listener, request) {
   req.headers.host ??= url.host;
   if (body && body.length > 0) req.push(body);
   req.push(null);
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     const streamed = () => {
       queueMicrotask(() => {
         req.emit("close");
@@ -7366,7 +7372,7 @@ async function injectRequest(listener, request) {
         else headers2.set(name, value);
       }
       const bodyless = out.status === 204 || out.status === 304 || request.method === "HEAD";
-      resolve40(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
+      resolve41(new Response(bodyless ? null : out.body, { status: out.status, headers: headers2 }));
     }, streamed);
     res.on("inject-error", reject);
     try {
@@ -9738,12 +9744,12 @@ function finalizeRecording(key2, rec) {
   if (rec.finalize) return rec.finalize;
   rec.finalize = (async () => {
     clearTimeout(rec.autoStop);
-    await new Promise((resolve40) => {
+    await new Promise((resolve41) => {
       let done = false;
       const finish2 = () => {
         if (!done) {
           done = true;
-          resolve40();
+          resolve41();
         }
       };
       rec.child.once("close", finish2);
@@ -9854,7 +9860,7 @@ var init_preview = __esm({
     DEVICE_LIST_TIMEOUT_MS = 5e3;
     defaultRunner2 = {
       capture(cmd, args, timeoutMs = DEFAULT_CAPTURE_TIMEOUT_MS) {
-        return new Promise((resolve40, reject) => {
+        return new Promise((resolve41, reject) => {
           const child = spawn2(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
           const out = [];
           const err = [];
@@ -9876,7 +9882,7 @@ var init_preview = __esm({
           child.stderr.on("data", (b) => err.push(b));
           child.on("error", (e) => settle(reject, e));
           child.on("close", (code) => {
-            if (code === 0) settle(resolve40, Buffer.concat(out));
+            if (code === 0) settle(resolve41, Buffer.concat(out));
             else settle(reject, new Error(`${cmd} exited ${code}: ${Buffer.concat(err).toString("utf8")}`));
           });
         });
@@ -11453,7 +11459,6 @@ function shouldRevealError(args) {
 var EMAIL_RE, URL_HOST_RE, INTEGER_RE, NUMBER_RE;
 var init_validation = __esm({
   "../../core/ts/src/validation.ts"() {
-    "use strict";
     EMAIL_RE = /^[A-Za-z0-9._%+-]+@[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}$/;
     URL_HOST_RE = /^[A-Za-z0-9-]+(\.[A-Za-z0-9-]+)*(:[0-9]+)?$/;
     INTEGER_RE = /^[+-]?[0-9]+$/;
@@ -14799,7 +14804,6 @@ function validateWorkerSubtree(raw, slotId, policy, actionCatalog) {
 var WORKER_SUBTREE_CEILINGS, ID_PART, ACTION_ID;
 var init_worker_subtree = __esm({
   "../../core/ts/src/worker-subtree.ts"() {
-    "use strict";
     init_worker_subtree_safe_types_generated();
     WORKER_SUBTREE_CEILINGS = Object.freeze({
       maxEncodedBytes: 65536,
@@ -20185,7 +20189,7 @@ async function stabilizePngPage(page, scheme) {
     const browser = globalThis;
     browser.document.documentElement.style.colorScheme = selected;
     await browser.document.fonts?.ready;
-    await new Promise((resolve40) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve40())));
+    await new Promise((resolve41) => browser.requestAnimationFrame(() => browser.requestAnimationFrame(() => resolve41())));
   }, scheme);
 }
 async function renderPngBatch(items) {
@@ -25751,7 +25755,7 @@ async function handleWebWix(req, res, state) {
     const match = state.wix.mode === "mock" ? matchRuleEx(state.wix.rules, method, target.pathname, { host: target.host, query, body }) : void 0;
     if (match && (match.rule.kind ?? "mock") === "mock") {
       const mocked = match.rule.response;
-      if (mocked.delayMs) await new Promise((resolve40) => setTimeout(resolve40, mocked.delayMs));
+      if (mocked.delayMs) await new Promise((resolve41) => setTimeout(resolve41, mocked.delayMs));
       const responseBody = mocked.template ? renderTemplate(mocked.body, match.captures) : mocked.body;
       recordWixTraffic(state.wix, state.appName, state.adminUrl, {
         ts: started,
@@ -31245,38 +31249,49 @@ var app_source_exports = {};
 __export(app_source_exports, {
   MAX_APP_SOURCE_BYTES: () => MAX_APP_SOURCE_BYTES,
   collectAppSource: () => collectAppSource,
+  deniedArchivePaths: () => deniedArchivePaths,
   isDeniedSourcePath: () => isDeniedSourcePath,
   readAppSource: () => readAppSource,
+  removeStaleSource: () => removeStaleSource,
   secretFindings: () => secretFindings,
+  staleSourcePaths: () => staleSourcePaths,
   writeAppSource: () => writeAppSource,
+  writeConflicts: () => writeConflicts,
   zipAppSource: () => zipAppSource
 });
-import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join36, dirname as dirname24, sep as sep7 } from "node:path";
-function collectAppSource(dir) {
-  const entries = [];
-  const skipped = [];
+import { readdirSync as readdirSync20, lstatSync as lstatSync4, readFileSync as readFileSync43, mkdirSync as mkdirSync18, writeFileSync as writeFileSync14, existsSync as existsSync36, rmSync as rmSync6, rmdirSync, unlinkSync as unlinkSync3 } from "node:fs";
+import { join as join36, resolve as resolve32, sep as sep7 } from "node:path";
+function walkSourceTree(dir, file, skip) {
   const walk2 = (relDir) => {
     for (const name of readdirSync20(join36(dir, relDir))) {
       const rel = relDir ? join36(relDir, name) : name;
       const st = lstatSync4(join36(dir, rel));
       if (st.isSymbolicLink()) {
-        skipped.push(rel);
+        skip(rel);
         continue;
       }
       if (st.isDirectory()) {
-        if (isDeniedSourceDir(name)) skipped.push(rel);
+        if (isDeniedSourceDir(name)) skip(rel);
         else walk2(rel);
         continue;
       }
       if (isDeniedSourcePath(rel)) {
-        skipped.push(rel);
+        skip(rel);
         continue;
       }
-      entries.push({ path: rel.split(sep7).join("/"), bytes: readFileSync43(join36(dir, rel)) });
+      file(rel.split(sep7).join("/"), rel);
     }
   };
   walk2("");
+}
+function collectAppSource(dir) {
+  const entries = [];
+  const skipped = [];
+  walkSourceTree(
+    dir,
+    (archivePath, hostRel) => entries.push({ path: archivePath, bytes: readFileSync43(join36(dir, hostRel)) }),
+    (hostRel) => skipped.push(hostRel)
+  );
   entries.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
   skipped.sort();
   return { entries, skipped };
@@ -31296,16 +31311,115 @@ function zipAppSource(entries) {
 function readAppSource(zip) {
   return [...readZip(zip)].map(([path, bytes2]) => ({ path, bytes: bytes2 }));
 }
+function pathKind(p) {
+  try {
+    return lstatSync4(p);
+  } catch {
+    return null;
+  }
+}
 function writeAppSource(entries, destDir) {
+  const root = resolve32(destDir);
+  mkdirSync18(root, { recursive: true });
   const written = [];
   for (const entry of entries) {
-    const target = join36(destDir, ...entry.path.split("/"));
-    mkdirSync18(dirname24(target), { recursive: true });
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    let dir = root;
+    for (const segment of segments.slice(0, -1)) {
+      dir = join36(dir, segment);
+      const kind = pathKind(dir);
+      if (kind?.isSymbolicLink()) unlinkSync3(dir);
+      else if (kind) continue;
+      mkdirSync18(dir);
+    }
+    const target = join36(root, ...segments);
+    if (pathKind(target)?.isSymbolicLink()) unlinkSync3(target);
     writeFileSync14(target, entry.bytes);
     written.push(entry.path);
   }
   return written;
 }
+function staleSourcePaths(entries, destDir) {
+  if (!existsSync36(destDir)) return [];
+  const archived = new Set(entries.map((e) => e.path));
+  const stale = [];
+  walkSourceTree(destDir, (archivePath) => {
+    if (!archived.has(archivePath)) stale.push(archivePath);
+  }, () => {
+  });
+  return stale.sort();
+}
+function deniedArchivePaths(entries) {
+  return entries.filter((e) => isDeniedSourcePath(e.path)).map((e) => e.path).sort();
+}
+function writeConflicts(entries, destDir) {
+  const root = resolve32(destDir);
+  const conflicts = [];
+  const seen = /* @__PURE__ */ new Set();
+  const say = (rel, what) => {
+    if (seen.has(rel)) return;
+    seen.add(rel);
+    conflicts.push(`${rel} ${what}`);
+  };
+  for (const entry of entries) {
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    let dir = root;
+    let stop = false;
+    for (const [i, segment] of segments.slice(0, -1).entries()) {
+      dir = join36(dir, segment);
+      const kind2 = pathKind(dir);
+      if (!kind2 || kind2.isSymbolicLink()) {
+        stop = true;
+        break;
+      }
+      if (kind2.isDirectory()) continue;
+      say(segments.slice(0, i + 1).join("/"), "is a file here, but the release has a directory at that path");
+      stop = true;
+      break;
+    }
+    if (stop) continue;
+    const kind = pathKind(join36(root, ...segments));
+    if (kind && !kind.isSymbolicLink() && kind.isDirectory()) {
+      say(entry.path, "is a directory here, but the release has a file at that path");
+    }
+  }
+  return conflicts;
+}
+function removeStaleSource(entries, destDir) {
+  const root = resolve32(destDir);
+  const removed = staleSourcePaths(entries, root);
+  for (const rel of removed) rmSync6(join36(root, ...rel.split("/")), { force: true });
+  const needed = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (isDeniedSourcePath(entry.path)) continue;
+    const segments = entry.path.split("/");
+    for (let i = 1; i < segments.length; i++) needed.add(segments.slice(0, i).join("/"));
+  }
+  if (existsSync36(root)) pruneEmptyDirs(root, "", needed, removed);
+  return removed.sort();
+}
+function pruneEmptyDirs(root, rel, needed, removed) {
+  let empty = true;
+  for (const name of readdirSync20(rel ? join36(root, rel) : root)) {
+    const childRel = rel ? join36(rel, name) : name;
+    const posix3 = childRel.split(sep7).join("/");
+    const kind = lstatSync4(join36(root, childRel));
+    if (kind.isSymbolicLink() || !kind.isDirectory() || isDeniedSourceDir(name)) {
+      empty = false;
+      continue;
+    }
+    const childEmpty = pruneEmptyDirs(root, childRel, needed, removed);
+    if (!childEmpty || needed.has(posix3)) {
+      empty = false;
+      continue;
+    }
+    rmdirSync(join36(root, childRel));
+    removed.push(`${posix3}/`);
+  }
+  return empty;
+}
 var MAX_APP_SOURCE_BYTES, SECRET_PATTERNS;
 var init_app_source = __esm({
   "src/app-source.ts"() {
@@ -31329,13 +31443,13 @@ __export(eject_exports, {
   EJECTABLE: () => EJECTABLE,
   ejectModule: () => ejectModule
 });
-import { existsSync as existsSync36, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
-import { dirname as dirname25, join as join37, relative as relative4, resolve as resolve32, sep as sep8 } from "node:path";
+import { existsSync as existsSync37, mkdirSync as mkdirSync19, readFileSync as readFileSync44, writeFileSync as writeFileSync15 } from "node:fs";
+import { dirname as dirname24, join as join37, relative as relative4, resolve as resolve33, sep as sep8 } from "node:path";
 function locate(repoRootOrCwd, mod) {
-  const inRepo = resolve32(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
-  if (existsSync36(inRepo)) return { path: inRepo, form: "source" };
-  const dist = resolve32(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
-  if (existsSync36(dist)) return { path: dist, form: "bundle" };
+  const inRepo = resolve33(repoRootOrCwd, `stdlib/flows/${mod}/src/index.ts`);
+  if (existsSync37(inRepo)) return { path: inRepo, form: "source" };
+  const dist = resolve33(repoRootOrCwd, `node_modules/@wix/himalaya/dist/${mod}.mjs`);
+  if (existsSync37(dist)) return { path: dist, form: "bundle" };
   return null;
 }
 function specifiersFor(mod) {
@@ -31360,7 +31474,7 @@ function ejectModule(opts) {
   }
   const ext = found.form === "source" ? "ts" : "mjs";
   const target = join37(contentDir2, "tier5-src", "_ejected", `${mod}.${ext}`);
-  mkdirSync19(dirname25(target), { recursive: true });
+  mkdirSync19(dirname24(target), { recursive: true });
   const banner = `// EJECTED from @wix/himalaya/${mod}. This app owns this file now.
 //
 // Central fixes to @wix/himalaya/${mod} NO LONGER REACH THIS APP \u2014 including any
@@ -31380,10 +31494,10 @@ function ejectModule(opts) {
   writeFileSync15(target, banner + normalized);
   const rewired = [];
   for (const f of files) {
-    if (!existsSync36(f)) continue;
+    if (!existsSync37(f)) continue;
     const before = readFileSync44(f, "utf8");
     let after = before;
-    let rel = relative4(dirname25(f), target).split(sep8).join("/").replace(/\.tsx?$/, ".js");
+    let rel = relative4(dirname24(f), target).split(sep8).join("/").replace(/\.tsx?$/, ".js");
     if (!rel.startsWith(".")) rel = `./${rel}`;
     for (const spec of specifiersFor(mod)) {
       const q = spec.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -31429,11 +31543,11 @@ __export(test_exports, {
   scopeDescriptors: () => scopeDescriptors,
   writeRecordedMocks: () => writeRecordedMocks
 });
-import { existsSync as existsSync37, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join38, resolve as resolve33 } from "node:path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync16 } from "node:fs";
+import { join as join38, resolve as resolve34 } from "node:path";
 function readTestConfig(dir) {
-  const p = resolve33(dir, TEST_CONFIG_FILE);
-  if (!existsSync37(p)) return {};
+  const p = resolve34(dir, TEST_CONFIG_FILE);
+  if (!existsSync38(p)) return {};
   let parsed;
   try {
     parsed = JSON.parse(readFileSync45(p, "utf8"));
@@ -31499,8 +31613,8 @@ function readNetRules(path) {
 }
 function defaultNetRules(dir) {
   for (const rel of ["dev/net-mocks.json", "tests/net-mocks.json"]) {
-    const p = resolve33(dir, rel);
-    if (existsSync37(p)) {
+    const p = resolve34(dir, rel);
+    if (existsSync38(p)) {
       const rules = readNetRules(p);
       if (rules.length) return { rules, from: rel };
     }
@@ -31672,7 +31786,7 @@ async function runCrawl(opts) {
       if (list.length > 1) collapsed.push({ representative: rep.screenId, instances: list.length });
     }
   }
-  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve33(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
+  const net = opts.offline ? null : opts.netPath ? { rules: readNetRules(resolve34(opts.netPath)), from: opts.netPath } : defaultNetRules(opts.dir);
   const suppressions = opts.config?.skip ?? [];
   const suppressed = [];
   const matchSuppression = (screen, actionId, componentId, invariant) => suppressions.find((s) => (s.screen === void 0 || s.screen === screen) && (s.action === void 0 || s.action === actionId) && (s.component === void 0 || s.component === componentId) && (s.invariant === void 0 || s.invariant === invariant));
@@ -32049,11 +32163,11 @@ var mobile_ux_lint_exports = {};
 __export(mobile_ux_lint_exports, {
   mobileUxIssues: () => mobileUxIssues
 });
-import { existsSync as existsSync38, readFileSync as readFileSync46 } from "node:fs";
+import { existsSync as existsSync39, readFileSync as readFileSync46 } from "node:fs";
 import { join as join39 } from "node:path";
 function mobileUxIssues(dir, strict) {
   const file = join39(dir, "MOBILE-UX.md");
-  if (!existsSync38(file)) return [];
+  if (!existsSync39(file)) return [];
   let text2;
   try {
     text2 = readFileSync46(file, "utf8");
@@ -32335,7 +32449,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
   const headers2 = Object.fromEntries(new Headers(init.headers).entries());
   const request = url.protocol === "https:" ? httpsRequest : httpRequest;
   const hostname = url.hostname.replace(/^\[|\]$/g, "");
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     const finish2 = (fn) => {
       if (settled) return;
@@ -32372,7 +32486,7 @@ async function pinnedFetch(url, init, addresses, maxResponseBytes) {
         }
         const responseHeaders = new Headers();
         for (const [key2, value] of Object.entries(response.headers)) if (value !== void 0) responseHeaders.set(key2, Array.isArray(value) ? value.join(", ") : value);
-        resolve40(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
+        resolve41(new Response(bytes2, { status: response.statusCode, statusText: response.statusMessage, headers: responseHeaders }));
       }));
     });
     req.once("error", (error) => finish2(() => reject(error)));
@@ -32672,7 +32786,7 @@ function createLocalTestSandbox() {
           }
         })();
       `;
-      return await new Promise((resolve40, reject) => {
+      return await new Promise((resolve41, reject) => {
         const { port1, port2 } = new MessageChannel();
         const serializableContext = {
           auth: context.auth,
@@ -32748,7 +32862,7 @@ function createLocalTestSandbox() {
             timer = setTimeout(() => finish2(() => reject(new SandboxError("timeout", `execution exceeded ${limits.timeoutMs}ms`))), Math.max(1, limits.timeoutMs));
             return;
           }
-          if (message.ok) finish2(() => resolve40({ value: message.value, durationMs: Date.now() - started }));
+          if (message.ok) finish2(() => resolve41({ value: message.value, durationMs: Date.now() - started }));
           else finish2(() => reject(new SandboxError("execution_failed", message.message ?? "handler failed")));
         });
         worker.once("error", (error) => finish2(() => reject(new SandboxError("execution_failed", error.message))));
@@ -33715,8 +33829,8 @@ __export(functions_exports, {
   resolveFunctionsTarget: () => resolveFunctionsTarget,
   runRemoteFunctionOperation: () => runRemoteFunctionOperation
 });
-import { readFileSync as readFileSync47, existsSync as existsSync39 } from "node:fs";
-import { join as join40, resolve as resolve34 } from "node:path";
+import { readFileSync as readFileSync47, existsSync as existsSync40 } from "node:fs";
+import { join as join40, resolve as resolve35 } from "node:path";
 function resolveFunctionsTarget(input) {
   const explicitUrl = input.functionsUrl?.trim();
   if (explicitUrl) return { mode: "remote", baseUrl: explicitUrl };
@@ -33728,14 +33842,14 @@ function resolveFunctionsTarget(input) {
   return { mode: "local" };
 }
 async function loadFunctionsApp(dir) {
-  const loaded = await loadContent(resolve34(dir));
+  const loaded = await loadContent(resolve35(dir));
   const config = loaded.module.config;
   if (config.kind !== "functions" || !Array.isArray(config.functions?.functions)) {
     throw new Error(`content package "${dir}" is not a functions-only app`);
   }
   const sources = {};
   for (const definition of config.functions.functions) {
-    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join40(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync39);
+    const source = [".ts", ".js", ".mts", ".mjs"].map((extension) => join40(loaded.dir, "functions", `${definition.name}${extension}`)).find(existsSync40);
     if (!source) throw new Error(`missing source for function ${definition.name}; expected functions/${definition.name}.ts`);
     sources[definition.name] = readFileSync47(source, "utf8");
   }
@@ -33891,7 +34005,7 @@ __export(native_decode_exports, {
   runNativeDecode: () => runNativeDecode
 });
 import { execFileSync as execFileSync5, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync40, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync6, writeFileSync as writeFileSync17 } from "node:fs";
+import { existsSync as existsSync41, mkdtempSync as mkdtempSync2, readFileSync as readFileSync48, rmSync as rmSync7, writeFileSync as writeFileSync17 } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join41 } from "node:path";
 import { fileURLToPath as fileURLToPath19 } from "node:url";
@@ -33909,7 +34023,7 @@ function detectNativeDecode(options = {}) {
     return { platform: "ios", available: false, reason: `the iOS decoder oracle requires macOS (darwin); this host is ${hostPlatform}` };
   }
   if (!swiftAvailable) return { platform: "ios", available: false, reason: "swift is not on PATH" };
-  const packageAvailable = options.packageAvailable ?? existsSync40(join41(packageDir, "Package.swift"));
+  const packageAvailable = options.packageAvailable ?? existsSync41(join41(packageDir, "Package.swift"));
   if (!packageAvailable) {
     return {
       platform: "ios",
@@ -33930,7 +34044,7 @@ function localPropertiesSdk(harnessDir) {
 function detectAndroidNativeDecode(options = {}) {
   const harnessDir = options.harnessDir ?? nativeDecodeAndroidHarnessDir();
   const gradlew = join41(harnessDir, "gradlew");
-  const gradlewAvailable = options.gradlewAvailable ?? existsSync40(gradlew);
+  const gradlewAvailable = options.gradlewAvailable ?? existsSync41(gradlew);
   if (!gradlewAvailable) {
     return {
       platform: "android",
@@ -33940,7 +34054,7 @@ function detectAndroidNativeDecode(options = {}) {
   }
   const androidHome = options.androidHome ?? process.env.ANDROID_HOME ?? "";
   const sdk = androidHome.trim() || (options.localPropertiesSdk !== void 0 ? options.localPropertiesSdk : localPropertiesSdk(harnessDir));
-  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync40(sdk));
+  const sdkAvailable = options.sdkAvailable ?? (typeof sdk === "string" && sdk.length > 0 && existsSync41(sdk));
   if (!sdkAvailable) {
     return {
       platform: "android",
@@ -34045,7 +34159,7 @@ function runNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`iOS decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync6(descriptorDir, { recursive: true, force: true });
+    rmSync7(descriptorDir, { recursive: true, force: true });
   }
 }
 function runAndroidNativeDecode(options) {
@@ -34083,7 +34197,7 @@ function runAndroidNativeDecode(options) {
     const stderr = failure.stderr ? ` \u2014 ${String(failure.stderr).trim().slice(0, 2e3)}` : "";
     throw new Error(`Android decoder oracle failed: ${failure.message}${stderr}`);
   } finally {
-    rmSync6(descriptorDir, { recursive: true, force: true });
+    rmSync7(descriptorDir, { recursive: true, force: true });
   }
 }
 function fieldAt(path) {
@@ -34143,7 +34257,7 @@ __export(browser_authoring_exports, {
 import { createServer as createServer3 } from "node:http";
 import { createHash as createHash22, randomBytes as randomBytes5 } from "node:crypto";
 import { execFile as execFile2 } from "node:child_process";
-import { existsSync as existsSync41, readdirSync as readdirSync21, readFileSync as readFileSync49, realpathSync as realpathSync4, statSync as statSync9 } from "node:fs";
+import { existsSync as existsSync42, readdirSync as readdirSync21, readFileSync as readFileSync49, realpathSync as realpathSync4, statSync as statSync9 } from "node:fs";
 import { join as join42, posix, relative as relative5, sep as sep9 } from "node:path";
 function humanMs(ms) {
   return ms < 1e3 ? `${ms}ms` : `${Math.round(ms / 1e3)}s`;
@@ -34166,7 +34280,7 @@ function collectWorkerSources(tier5SrcDir, bundleName) {
       }
     }
   };
-  if (!existsSync41(root)) return null;
+  if (!existsSync42(root)) return null;
   walk2(root, `/tier5-src/${bundleName}`);
   const entry = [`/tier5-src/${bundleName}/index.ts`, `/tier5-src/${bundleName}/index.js`].find((p) => p in files);
   if (!entry) return null;
@@ -34193,7 +34307,7 @@ function collectRelativeSiblings(files, tier5SrcDir) {
         join42(onDisk, "index.js")
       ];
       for (const abs of candidates) {
-        if (!existsSync41(abs) || statSync9(abs).isDirectory()) continue;
+        if (!existsSync42(abs) || statSync9(abs).isDirectory()) continue;
         const key2 = `/tier5-src/${relative5(tier5SrcDir, abs).split(sep9).join(posix.sep)}`;
         if (key2 in files) break;
         files[key2] = readFileSync49(abs, "utf8");
@@ -34228,10 +34342,10 @@ function collectSdkModules(files, resolveSubpath) {
   for (const source of Object.values(files)) visit(source);
   return { modules, unsupported };
 }
-function sdkSubpathReader(resolve40) {
+function sdkSubpathReader(resolve41) {
   return (sub) => {
     try {
-      return readFileSync49(resolve40(`@wix/himalaya/${sub}`), "utf8");
+      return readFileSync49(resolve41(`@wix/himalaya/${sub}`), "utf8");
     } catch {
       return null;
     }
@@ -34312,7 +34426,7 @@ async function runBrowserAuthoring(opts) {
   const token = mintToken2(payload);
   const unusable = await probeAuthoringPage(opts.authoringBase, opts.fetchImpl, opts.probeTimeoutMs);
   if (unusable) throw new Error(unusable);
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     let url = "";
     const server = createServer3();
@@ -34364,7 +34478,7 @@ async function runBrowserAuthoring(opts) {
         }
         res.writeHead(200, { "content-type": "text/plain" }).end("ok");
         const report = body.result;
-        finish2(() => resolve40({ report, url }));
+        finish2(() => resolve41({ report, url }));
       })();
     });
     server.on("error", (e) => finish2(() => reject(e)));
@@ -34404,8 +34518,8 @@ __export(coverage_exports, {
   formatLedger: () => formatLedger,
   trendAndStore: () => trendAndStore
 });
-import { existsSync as existsSync42, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname26, join as join43 } from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync21, readFileSync as readFileSync50, writeFileSync as writeFileSync18 } from "node:fs";
+import { dirname as dirname25, join as join43 } from "node:path";
 function assembleLedger(r) {
   const out = [];
   for (const c of r.crawled ?? []) {
@@ -34574,7 +34688,7 @@ function trendAndStore(dir, entries) {
   const p = join43(dir, LEDGER_FILE);
   let previous = null;
   try {
-    if (existsSync42(p)) {
+    if (existsSync43(p)) {
       const parsed = JSON.parse(readFileSync50(p, "utf8"));
       if (Array.isArray(parsed.keys)) previous = parsed.keys.filter((k) => typeof k === "string");
     }
@@ -34582,7 +34696,7 @@ function trendAndStore(dir, entries) {
   }
   const current = entries.map((e) => e.key);
   try {
-    mkdirSync21(dirname26(p), { recursive: true });
+    mkdirSync21(dirname25(p), { recursive: true });
     writeFileSync18(p, JSON.stringify({ keys: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -34615,7 +34729,7 @@ function diffAndStoreObservations(dir, current) {
   const p = join43(dir, OBS_FILE);
   let previous = null;
   try {
-    if (existsSync42(p)) {
+    if (existsSync43(p)) {
       const parsed = JSON.parse(readFileSync50(p, "utf8"));
       if (parsed.screens && typeof parsed.screens === "object" && !Array.isArray(parsed.screens) && Object.values(parsed.screens).every(
         (v) => Array.isArray(v) && v.every((l) => typeof l === "string")
@@ -34626,7 +34740,7 @@ function diffAndStoreObservations(dir, current) {
   } catch {
   }
   try {
-    mkdirSync21(dirname26(p), { recursive: true });
+    mkdirSync21(dirname25(p), { recursive: true });
     writeFileSync18(p, JSON.stringify({ screens: current, ts: (/* @__PURE__ */ new Date()).toISOString() }, null, 2));
   } catch {
     return null;
@@ -35869,7 +35983,7 @@ __export(run_exports, {
   runPackage: () => runPackage,
   withoutProdServe: () => withoutProdServe
 });
-import { cpSync, existsSync as existsSync43, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync52, rmSync as rmSync7, statSync as statSync10 } from "node:fs";
+import { cpSync, existsSync as existsSync44, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, readFileSync as readFileSync52, rmSync as rmSync8, statSync as statSync10 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join44 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
@@ -35889,9 +36003,9 @@ async function fetchBytes(url) {
 }
 async function resolvePackage(source, workDir) {
   const isUrl2 = /^https?:\/\//i.test(source);
-  if (!isUrl2 && existsSync43(source) && statSync10(source).isDirectory()) {
+  if (!isUrl2 && existsSync44(source) && statSync10(source).isDirectory()) {
     const appDirManifest = join44(source, "release-manifest.json");
-    if (existsSync43(appDirManifest)) {
+    if (existsSync44(appDirManifest)) {
       const opened2 = openPackageDir(source);
       if (!opened2.validation.ok) {
         throw new Error(`package is not valid:
@@ -35904,7 +36018,7 @@ async function resolvePackage(source, workDir) {
       const target = join44(root2, app2);
       if (join44(source) !== target) {
         mkdirSync22(root2, { recursive: true });
-        rmSync7(target, { recursive: true, force: true });
+        rmSync8(target, { recursive: true, force: true });
         cpSync(source, target, { recursive: true });
       }
       return {
@@ -35924,7 +36038,7 @@ async function resolvePackage(source, workDir) {
   const { app, appDir: appDir2 } = unpackTo(bytes2, root);
   const opened = openPackageDir(appDir2);
   if (!opened.validation.ok) {
-    rmSync7(workDir ? appDir2 : root, { recursive: true, force: true });
+    rmSync8(workDir ? appDir2 : root, { recursive: true, force: true });
     throw new Error(`package is not valid:
   ${opened.validation.errors.join("\n  ")}`);
   }
@@ -35963,7 +36077,7 @@ async function runPackage(source, opts = {}) {
   const resolved = await resolvePackage(source, opts.workDir);
   const assets = opts.assets ?? (opts.spa ? /* @__PURE__ */ new Map() : await loadPreviewAssets());
   if (!opts.spa && assets.size === 0) {
-    if (resolved.temp) rmSync7(resolved.temp, { recursive: true, force: true });
+    if (resolved.temp) rmSync8(resolved.temp, { recursive: true, force: true });
     throw new Error(NO_SPA_MESSAGE);
   }
   const handler = makePackageRunHandler({
@@ -35993,7 +36107,7 @@ async function runPackage(source, opts = {}) {
     warnings: resolved.warnings,
     close: () => new Promise((done) => {
       server.close(() => {
-        if (resolved.temp) rmSync7(resolved.temp, { recursive: true, force: true });
+        if (resolved.temp) rmSync8(resolved.temp, { recursive: true, force: true });
         done();
       });
     })
@@ -36020,19 +36134,19 @@ __export(run_browser_exports, {
   runInBrowser: () => runInBrowser
 });
 import { createServer as createServer5 } from "node:http";
-import { existsSync as existsSync44, readFileSync as readFileSync53 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync53 } from "node:fs";
 import { spawnSync as spawnSync3, execFile as execFile3 } from "node:child_process";
-import { dirname as dirname27, resolve as resolve35 } from "node:path";
+import { dirname as dirname26, resolve as resolve36 } from "node:path";
 import { fileURLToPath as fileURLToPath20 } from "node:url";
 function stagedDir() {
-  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve35(process.env.HIMI_BROWSER_PLANE_OUT) : resolve35(REPO, "packages", "serve", "dist", "browser-plane");
+  return process.env.HIMI_BROWSER_PLANE_OUT ? resolve36(process.env.HIMI_BROWSER_PLANE_OUT) : resolve36(REPO, "packages", "serve", "dist", "browser-plane");
 }
 function missingStaged() {
-  return [...SERVED].filter((f) => !existsSync44(resolve35(stagedDir(), f))).sort();
+  return [...SERVED].filter((f) => !existsSync45(resolve36(stagedDir(), f))).sort();
 }
 function ensureBrowserPlaneStaged() {
   if (missingStaged().length === 0) return { ok: true, detail: "already staged" };
-  const r = spawnSync3(process.execPath, [resolve35(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
+  const r = spawnSync3(process.execPath, [resolve36(REPO, "core/serve/scripts/stage-browser-plane.mjs")], {
     cwd: REPO,
     encoding: "utf8"
   });
@@ -36118,7 +36232,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
     }
     const name = path === "/" || path === "/index.html" ? "host.html" : path.slice(1);
     if (SERVED.has(name)) {
-      if (!existsSync44(resolve35(stagedDir(), name))) {
+      if (!existsSync45(resolve36(stagedDir(), name))) {
         const restaged = ensureBrowserPlaneStaged();
         if (!restaged.ok) {
           res.writeHead(503, { "content-type": "application/json" });
@@ -36128,7 +36242,7 @@ async function runInBrowser(releaseRoot, app, header, opts = {}) {
       }
       let bytes2;
       try {
-        bytes2 = readFileSync53(resolve35(stagedDir(), name));
+        bytes2 = readFileSync53(resolve36(stagedDir(), name));
       } catch (e) {
         res.writeHead(503, { "content-type": "application/json" });
         res.end(JSON.stringify({ error: "browser_plane_unstaged", file: name, detail: String(e) }));
@@ -36171,8 +36285,8 @@ var HERE, REPO, SERVED;
 var init_run_browser = __esm({
   "src/run-browser.ts"() {
     init_file_store();
-    HERE = dirname27(fileURLToPath20(import.meta.url));
-    REPO = resolve35(HERE, "..", "..", "..");
+    HERE = dirname26(fileURLToPath20(import.meta.url));
+    REPO = resolve36(HERE, "..", "..", "..");
     SERVED = /* @__PURE__ */ new Set(["host.html", "sw.js", "package-reader.js"]);
   }
 });
@@ -36546,10 +36660,10 @@ __export(preflight_exports, {
   parseStoreConfig: () => parseStoreConfig,
   requireEnv: () => requireEnv
 });
-import { existsSync as existsSync45, readFileSync as readFileSync54 } from "node:fs";
-import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve36 } from "node:path";
+import { existsSync as existsSync46, readFileSync as readFileSync54 } from "node:fs";
+import { isAbsolute as isAbsolute2, relative as relative6, resolve as resolve37 } from "node:path";
 function isInsideRepo(p) {
-  const rel = relative6(REPO_ROOT3, resolve36(p));
+  const rel = relative6(REPO_ROOT3, resolve37(p));
   return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
 }
 function assertCredentialOutsideRepo(label2, p) {
@@ -36603,7 +36717,7 @@ function parseStoreConfig(text2) {
 }
 function loadStoreConfig(app) {
   const p = storeConfigPath(app);
-  if (!existsSync45(p)) {
+  if (!existsSync46(p)) {
     throw new Error(`No store config at ${p}. Create apps/${app}/store/store.config.yaml first (see /setup-store-signing).`);
   }
   return parseStoreConfig(readFileSync54(p, "utf8"));
@@ -36629,7 +36743,7 @@ __export(preflight_app_exports, {
   pngSize: () => pngSize,
   preflightApp: () => preflightApp
 });
-import { readFileSync as readFileSync55, existsSync as existsSync46, readdirSync as readdirSync22, statSync as statSync11 } from "node:fs";
+import { readFileSync as readFileSync55, existsSync as existsSync47, readdirSync as readdirSync22, statSync as statSync11 } from "node:fs";
 import { createHash as createHash23 } from "node:crypto";
 import { join as join45 } from "node:path";
 function analyze(projectYml, storeConfig, icon) {
@@ -36679,8 +36793,8 @@ function analyze(projectYml, storeConfig, icon) {
   return f;
 }
 async function preflightApp(app) {
-  const projectYml = existsSync46(iosProjectYml(app)) ? readFileSync55(iosProjectYml(app), "utf8") : "";
-  const storeConfig = existsSync46(storeConfigPath(app)) ? readFileSync55(storeConfigPath(app), "utf8") : "";
+  const projectYml = existsSync47(iosProjectYml(app)) ? readFileSync55(iosProjectYml(app), "utf8") : "";
+  const storeConfig = existsSync47(storeConfigPath(app)) ? readFileSync55(storeConfigPath(app), "utf8") : "";
   if (!storeConfig) return [{ level: "error", message: `no apps/${app}/store/store.config.yaml \u2014 run /setup-store-signing first.` }];
   const findings = analyze(projectYml, storeConfig, await appIconState(join45(appDir(app), "ios")));
   findings.push(...analyzeListing(metadataFilesPresent(app), listScreenshots(app)));
@@ -36711,15 +36825,15 @@ function analyzeSubmissionRecord(appLevel, review, opts) {
 function appLevelMetadataFiles(app, locale = "en-US") {
   const root = join45(storeDir(app), "metadata");
   const out = /* @__PURE__ */ new Set();
-  if (existsSync46(root)) {
+  if (existsSync47(root)) {
     for (const n of readdirSync22(root)) if (n.endsWith(".txt")) out.add(n);
   }
-  if (existsSync46(join45(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
+  if (existsSync47(join45(root, locale, "privacy_url.txt"))) out.add("privacy_url.txt");
   return out;
 }
 function reviewInfoFiles(app) {
   const dir = join45(storeDir(app), "review_information");
-  if (!existsSync46(dir)) return /* @__PURE__ */ new Set();
+  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function isValidAppStoreSize(w, h) {
@@ -36866,20 +36980,20 @@ function analyzeListing(metaFiles, shots) {
 }
 function metadataFilesPresent(app, locale = "en-US") {
   const dir = join45(storeDir(app), "metadata", locale);
-  if (!existsSync46(dir)) return /* @__PURE__ */ new Set();
+  if (!existsSync47(dir)) return /* @__PURE__ */ new Set();
   return new Set(readdirSync22(dir).filter((n) => n.endsWith(".txt")));
 }
 function listScreenshots(app, locale = "en-US") {
   const out = [];
   const flat = join45(storeDir(app), "screenshots", locale);
-  if (existsSync46(flat)) {
+  if (existsSync47(flat)) {
     for (const png of readdirSync22(flat).filter((n) => n.endsWith(".png"))) {
       const sz = pngSize(readFileSync55(join45(flat, png)));
       if (sz) out.push({ name: png, w: sz.w, h: sz.h });
     }
   }
   const legacy = join45(storeDir(app), "metadata", locale, "screenshots");
-  if (existsSync46(legacy)) {
+  if (existsSync47(legacy)) {
     for (const deviceDir of readdirSync22(legacy)) {
       const d = join45(legacy, deviceDir);
       if (!statSync11(d).isDirectory()) continue;
@@ -36893,7 +37007,7 @@ function listScreenshots(app, locale = "en-US") {
 }
 function placeholderHashes2() {
   const templateIos = join45(appDir("_template"), "ios");
-  if (!existsSync46(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
+  if (!existsSync47(templateIos)) return [LEGACY_PLACEHOLDER_SHA2562];
   for (const target of readdirSync22(templateIos)) {
     const p = join45(templateIos, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
@@ -36929,7 +37043,7 @@ async function pixelIssues(bytes2) {
   }
 }
 async function appIconState(iosDir) {
-  if (!existsSync46(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
+  if (!existsSync47(iosDir)) return { exists: false, isPlaceholder: false, storeIssues: [] };
   for (const target of readdirSync22(iosDir)) {
     const p = join45(iosDir, target, "Assets.xcassets", "AppIcon.appiconset", "icon_1024.png");
     try {
@@ -37004,7 +37118,7 @@ __export(credential_profile_exports, {
   profilePath: () => profilePath,
   resolveStoreCredentials: () => resolveStoreCredentials
 });
-import { existsSync as existsSync47, readFileSync as readFileSync56 } from "node:fs";
+import { existsSync as existsSync48, readFileSync as readFileSync56 } from "node:fs";
 import { homedir as homedir6 } from "node:os";
 import { join as join46 } from "node:path";
 function credentialsDir(home = homedir6()) {
@@ -37039,7 +37153,7 @@ function resolveStoreCredentials(opts) {
   const env = opts.env ?? process.env;
   const home = opts.home ?? homedir6();
   const read = opts.readProfile ?? ((p) => readFileSync56(p, "utf8"));
-  const exists = opts.profileExists ?? existsSync47;
+  const exists = opts.profileExists ?? existsSync48;
   const ios = cfg.ios ?? {};
   const flagName = opts.profileFlag?.trim();
   const named = flagName || ios.credentialProfile?.trim();
@@ -40331,10 +40445,10 @@ function isFetchableFontUrl(raw) {
   return true;
 }
 function resolveAll(hostname) {
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     dnsLookup(hostname, { all: true, verbatim: true }, (err, addresses) => {
       if (err) reject(err);
-      else resolve40(addresses);
+      else resolve41(addresses);
     });
   });
 }
@@ -40342,13 +40456,13 @@ function withAbort(start, signal, what) {
   if (signal?.aborted) return Promise.reject(new Error(`${what} aborted`));
   const work = start();
   if (!signal) return work;
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     const onAbort = () => reject(new Error(`${what} aborted`));
     signal.addEventListener("abort", onAbort, { once: true });
-    work.then(resolve40, reject).finally(() => signal.removeEventListener("abort", onAbort));
+    work.then(resolve41, reject).finally(() => signal.removeEventListener("abort", onAbort));
   });
 }
-async function pinAddress(url, resolve40 = resolveAll, signal) {
+async function pinAddress(url, resolve41 = resolveAll, signal) {
   const host = url.hostname.replace(/^\[|\]$/g, "");
   if (ipv4Octets(host)) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
@@ -40358,7 +40472,7 @@ async function pinAddress(url, resolve40 = resolveAll, signal) {
     if (isBlockedAddress(host)) throw new Error(`${host} is a blocked address`);
     return { address: host, family: 6 };
   }
-  const addresses = await withAbort(() => resolve40(host), signal, `${host} lookup`);
+  const addresses = await withAbort(() => resolve41(host), signal, `${host} lookup`);
   if (!addresses.length) throw new Error(`${host} resolved to no address`);
   const blocked = addresses.filter((a) => isBlockedAddress(a.address)).map((a) => a.address);
   if (blocked.length) throw new Error(`${host} resolves to a blocked address (${blocked.join(", ")})`);
@@ -40381,7 +40495,7 @@ function decodedBody(res, hasBody) {
   return out;
 }
 function requestOnce(url, pinned, init) {
-  return new Promise((resolve40, reject) => {
+  return new Promise((resolve41, reject) => {
     const headers2 = { host: url.host, "accept-encoding": "identity" };
     new Headers(init.headers ?? {}).forEach((value, key2) => {
       if (key2.toLowerCase() !== "host") headers2[key2] = value;
@@ -40415,7 +40529,7 @@ function requestOnce(url, pinned, init) {
           reject(err);
           return;
         }
-        resolve40(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
+        resolve41(new Response(body, { status, statusText: res.statusMessage ?? "", headers: out }));
       }
     );
     req.on("error", reject);
@@ -41015,15 +41129,15 @@ var init_home_descriptor = __esm({
 });
 
 // src/site-analyze/apply.ts
-import { existsSync as existsSync48, readFileSync as readFileSync60, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
-import { dirname as dirname28, isAbsolute as isAbsolute3, join as join48, resolve as resolve37, sep as sep10 } from "node:path";
+import { existsSync as existsSync49, readFileSync as readFileSync60, writeFileSync as writeFileSync21, copyFileSync as copyFileSync3, mkdirSync as mkdirSync24, realpathSync as realpathSync5, statSync as statSync12 } from "node:fs";
+import { dirname as dirname27, isAbsolute as isAbsolute3, join as join48, resolve as resolve38, sep as sep10 } from "node:path";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function unpairedRedirectNote(overlay) {
   if (!overlay.wix?.clientId || overlay.wix.redirectUri) return void 0;
   return `no OAuth redirect paired with client ${overlay.wix.clientId} \u2014 the app (and prepare:customer) will refuse to start until one is set. Register it with \`himi site client ensure --site ${overlay.siteId?.trim() || "<msid>"} --redirect-uri <uri> --yes\`, then re-run analyze with \`--redirect-uri <uri>\` (or export HIMI_BRANDED_LITE_WIX_REDIRECT_URI)`;
 }
 function posix2(p) {
-  return resolve37(p).replace(/\\/g, "/");
+  return resolve38(p).replace(/\\/g, "/");
 }
 function committedShellProvisioning(path) {
   return committedShellFor(posix2(path));
@@ -41031,8 +41145,8 @@ function committedShellProvisioning(path) {
 function findRepoRoot(cwd) {
   let dir = cwd;
   for (let i = 0; i < 8; i++) {
-    if (SHELL_NAMES2.some((name) => existsSync48(join48(dir, shellAppDir(name), "package.json")))) return dir;
-    const next = dirname28(dir);
+    if (SHELL_NAMES2.some((name) => existsSync49(join48(dir, shellAppDir(name), "package.json")))) return dir;
+    const next = dirname27(dir);
     if (next === dir) break;
     dir = next;
   }
@@ -41057,7 +41171,7 @@ function assertNotCommitted(path, forbidden) {
       `refusing to overwrite committed ${committedProvisioningPath(committed)} \u2014 use prepare:customer --contract`
     );
   }
-  if (forbidden && resolve37(path) === resolve37(forbidden)) {
+  if (forbidden && resolve38(path) === resolve38(forbidden)) {
     const named = committedShellProvisioning(forbidden);
     throw new Error(
       `refusing to overwrite committed ${named ? committedProvisioningPath(named) : forbidden} \u2014 pass a content-package provisioning.json or use prepare:customer --contract`
@@ -41100,7 +41214,7 @@ function mergeCustomerOwned(committed, overlay) {
 function buildMergedContract(options) {
   const { appDir: appDir2, packageDir, overlay } = options;
   const committedPath = join48(appDir2, "provisioning.json");
-  if (!existsSync48(committedPath)) {
+  if (!existsSync49(committedPath)) {
     throw new Error(`shell has no committed provisioning.json at ${committedPath} to build a contract from`);
   }
   const committed = JSON.parse(readFileSync60(committedPath, "utf8"));
@@ -41110,13 +41224,13 @@ function buildMergedContract(options) {
   const staged = [];
   const contained = (root, rel) => {
     if (isAbsolute3(rel)) return void 0;
-    const full = resolve37(root, rel);
-    return full.startsWith(resolve37(root) + sep10) ? full : void 0;
+    const full = resolve38(root, rel);
+    return full.startsWith(resolve38(root) + sep10) ? full : void 0;
   };
   const stage = (fromRel, toRel) => {
     const from = contained(packageDir, fromRel);
     const to = contained(join48(appDir2, STAGED), toRel.slice(STAGED.length + 1));
-    if (!from || !to || !existsSync48(from)) return void 0;
+    if (!from || !to || !existsSync49(from)) return void 0;
     let real;
     let realRoot;
     try {
@@ -41128,7 +41242,7 @@ function buildMergedContract(options) {
     if (!real.startsWith(realRoot + sep10)) return void 0;
     try {
       if (!statSync12(real).isFile()) return void 0;
-      mkdirSync24(dirname28(to), { recursive: true });
+      mkdirSync24(dirname27(to), { recursive: true });
       copyFileSync3(real, to);
     } catch {
       return void 0;
@@ -41139,7 +41253,7 @@ function buildMergedContract(options) {
   const icon = stage("media/icon.png", `${STAGED}/icon.png`);
   if (icon) branding.appIconPath = icon;
   const facesPath = join48(packageDir, "media/fonts/faces.json");
-  if (existsSync48(facesPath)) {
+  if (existsSync49(facesPath)) {
     let faces = [];
     try {
       const parsed = JSON.parse(readFileSync60(facesPath, "utf8"));
@@ -41166,13 +41280,13 @@ function buildMergedContract(options) {
   const path = join48(packageDir, "provisioning.contract.json");
   writeFileSync21(path, body);
   const localPath = join48(appDir2, LOCAL_CONTRACT_REL);
-  mkdirSync24(dirname28(localPath), { recursive: true });
+  mkdirSync24(dirname27(localPath), { recursive: true });
   writeFileSync21(localPath, body);
   staged.push(localPath);
   return { path, staged };
 }
 async function applyOverlays(input) {
-  const cwd = resolve37(input.cwd);
+  const cwd = resolve38(input.cwd);
   const shell = input.shell ?? DEFAULT_BRANDABLE_SHELL;
   assertKnownShell(shell);
   const overlay = JSON.parse(readFileSync60(input.overlayPath, "utf8"));
@@ -41187,7 +41301,7 @@ async function applyOverlays(input) {
       );
     }
     const appDir2 = join48(repoRoot2, shellAppDir(shell));
-    const packageDir = dirname28(resolve37(input.overlayPath));
+    const packageDir = dirname27(resolve38(input.overlayPath));
     const { path: contract, staged } = buildMergedContract({ appDir: appDir2, packageDir, overlay });
     wrote.push(...staged);
     const r = spawnSync4("npm", ["run", "prepare:customer", "--", "--contract", contract], {
@@ -41210,7 +41324,7 @@ async function applyOverlays(input) {
   }
   const pkgProv = join48(cwd, "provisioning.json");
   assertNotCommitted(pkgProv, input.forbiddenProvisioning);
-  if (existsSync48(pkgProv)) {
+  if (existsSync49(pkgProv)) {
     const cur = JSON.parse(readFileSync60(pkgProv, "utf8"));
     const merged = deepMerge3(cur, overlay);
     writeFileSync21(pkgProv, JSON.stringify(merged, null, 2) + "\n");
@@ -41220,7 +41334,7 @@ async function applyOverlays(input) {
     wrote.push(pkgProv);
   }
   const pkgTokens = join48(cwd, "tokens.json");
-  if (existsSync48(pkgTokens) && (tokens.colors || tokens.typography)) {
+  if (existsSync49(pkgTokens) && (tokens.colors || tokens.typography)) {
     const cur = JSON.parse(readFileSync60(pkgTokens, "utf8"));
     const merged = deepMerge3(cur, tokens);
     writeFileSync21(pkgTokens, JSON.stringify(merged, null, 2) + "\n");
@@ -41228,7 +41342,7 @@ async function applyOverlays(input) {
   }
   const homeAction = homeRefreshActionId(shell);
   const homeSrc = join48(cwd, "dev/index.ts");
-  if (homeAction && existsSync48(homeSrc)) {
+  if (homeAction && existsSync49(homeSrc)) {
     const prev = readFileSync60(homeSrc, "utf8");
     const patched = patchBrandParams(prev, overlay, homeAction);
     let next = patched.src;
@@ -41249,13 +41363,13 @@ async function applyOverlays(input) {
       notes.push(`${patched.unparsed} onAppear params block(s) in ${homeSrc} could not be read \u2014 any brand values inside them were not applied`);
     }
   }
-  if (!input.iconPath || !existsSync48(input.iconPath)) {
-    const book = input.iconPath ? dirname28(dirname28(resolve37(input.iconPath))) : void 0;
+  if (!input.iconPath || !existsSync49(input.iconPath)) {
+    const book = input.iconPath ? dirname27(dirname27(resolve38(input.iconPath))) : void 0;
     notes.push(
       book ? `no icon installed \u2014 ${siteLogoAbsence(book).hint}` : "no icon installed and no business book to say why \u2014 `himi icon generate` draws one from the accent, or `himi icon set <file.png>` installs the customer's own mark"
     );
   }
-  if (input.iconPath && existsSync48(input.iconPath)) {
+  if (input.iconPath && existsSync49(input.iconPath)) {
     try {
       const installed = await installIcon(cwd, input.iconPath, { derivePlay: true });
       wrote.push(...installed.wrote);
@@ -42390,12 +42504,12 @@ __export(cli_exports, {
   runSiteFunctionCli: () => runSiteFunctionCli
 });
 import { readFileSync as readFileSync61 } from "node:fs";
-import { resolve as resolve38 } from "node:path";
+import { resolve as resolve39 } from "node:path";
 async function runSiteAnalyze(opts) {
   const fetchImpl = opts.fetchImpl ?? fetch;
   const assetFetch = opts.fetchImpl ?? pinnedFetch2;
   const cwd = opts.cwd ?? process.cwd();
-  const outDir = resolve38(cwd, opts.outDir ?? ".himi/business-book");
+  const outDir = resolve39(cwd, opts.outDir ?? ".himi/business-book");
   let ownerAuth;
   let msid;
   try {
@@ -42432,9 +42546,9 @@ async function runSiteAnalyze(opts) {
   if (opts.apply) {
     applied = await applyOverlays({
       cwd,
-      overlayPath: resolve38(outDir, "provisioning.overlay.json"),
-      tokensPath: resolve38(outDir, "tokens.overlay.json"),
-      iconPath: resolve38(outDir, "media/icon.png"),
+      overlayPath: resolve39(outDir, "provisioning.overlay.json"),
+      tokensPath: resolve39(outDir, "tokens.overlay.json"),
+      iconPath: resolve39(outDir, "media/icon.png"),
       shell: opts.shell
     });
     const note = noteWithWarnings(applied.note, warnings);
@@ -42470,7 +42584,7 @@ async function runSiteFunctionCli(opts) {
   const token = opts.token ?? await siteToken(msid);
   let source;
   if (opts.sourcePath) {
-    const p = resolve38(opts.cwd ?? process.cwd(), opts.sourcePath);
+    const p = resolve39(opts.cwd ?? process.cwd(), opts.sourcePath);
     source = readFileSync61(p, "utf8");
   }
   let body;
@@ -42522,7 +42636,7 @@ async function accountToken2(spawnImpl = spawn4) {
     cached2 = fromEnv;
     return fromEnv;
   }
-  const token = await new Promise((resolve40, reject) => {
+  const token = await new Promise((resolve41, reject) => {
     let child;
     try {
       child = spawnImpl("wix", ["token"]);
@@ -42551,7 +42665,7 @@ async function accountToken2(spawnImpl = spawn4) {
     const scan = (d) => {
       out += String(d);
       const m = out.match(TOKEN_RE2);
-      if (m) done(() => resolve40(m[0]));
+      if (m) done(() => resolve41(m[0]));
     };
     child.stdout?.on("data", scan);
     child.stderr?.on("data", scan);
@@ -42728,7 +42842,7 @@ __export(site_create_exports, {
   runSiteList: () => runSiteList,
   writeProvisioningBinding: () => writeProvisioningBinding
 });
-import { existsSync as existsSync49, readFileSync as readFileSync62, writeFileSync as writeFileSync22 } from "node:fs";
+import { existsSync as existsSync50, readFileSync as readFileSync62, writeFileSync as writeFileSync22 } from "node:fs";
 import { resolve as resolvePath2 } from "node:path";
 function oauthClientName(projectName) {
   return `${projectName} client`;
@@ -42877,7 +42991,7 @@ async function runSiteCreate(opts) {
   if (!wantOauthApp) return { ...base, nextSteps: nextSteps(metaSiteId) };
   return { ...base, clientId, redirectUri, nextSteps: nextSteps(metaSiteId, clientId) };
 }
-function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync49, readFileSync: readFileSync62, writeFileSync: writeFileSync22 }) {
+function writeProvisioningBinding(target, binding2, fs = { existsSync: existsSync50, readFileSync: readFileSync62, writeFileSync: writeFileSync22 }) {
   const msid = binding2.siteId;
   const path = resolvePath2(target);
   const committed = committedShellProvisioning(path);
@@ -43211,11 +43325,11 @@ var init_site_oauth_client = __esm({
 });
 
 // src/cli.ts
-import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync50, rmSync as rmSync8, readdirSync as readdirSync23, statSync as statSync13 } from "node:fs";
+import { mkdtempSync as mkdtempSync4, readFileSync as readFileSync63, mkdirSync as mkdirSync25, writeFileSync as writeFileSync23, existsSync as existsSync51, rmSync as rmSync9, readdirSync as readdirSync23, statSync as statSync13 } from "node:fs";
 import { execFileSync as execFileSync6 } from "node:child_process";
 import { createHash as createHash24 } from "node:crypto";
 import { tmpdir as tmpdir5 } from "node:os";
-import { join as join49, resolve as resolve39, basename as basename8, dirname as dirname29 } from "node:path";
+import { join as join49, resolve as resolve40, basename as basename8, dirname as dirname28 } from "node:path";
 import { fileURLToPath as fileURLToPath21 } from "node:url";
 
 // ../serve-cli/src/client.ts
@@ -44724,7 +44838,7 @@ async function browserLogin(opts) {
   const log = opts.log ?? (() => {
   });
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  return await new Promise((resolve40, reject) => {
+  return await new Promise((resolve41, reject) => {
     let settled = false;
     let loginUrl = "";
     const server = createServer();
@@ -44788,7 +44902,7 @@ async function browserLogin(opts) {
           return;
         }
         res.writeHead(200, { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", connection: "close" }).end(CLOSE_PAGE);
-        finish2(() => resolve40({ token, loginUrl }));
+        finish2(() => resolve41({ token, loginUrl }));
       });
     });
     server.on("error", (err) => finish2(() => reject(err)));
@@ -46512,7 +46626,7 @@ function writeAgentContext(targetDir) {
 // src/cli.ts
 init_wix_placeholders();
 var defaultIO = { log: (l) => console.log(l), error: (l) => console.error(l), isTTY: process.stdout.isTTY === true };
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["browser", "no-open", "yes", "json", "deep", "quiet", "force", "watch", "no-claim", "new"]);
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["browser", "no-open", "yes", "json", "deep", "quiet", "force", "replace", "watch", "no-claim", "new"]);
 var SHELL_ENUM = SHELL_NAMES2.join("|");
 function parseFlags(argv) {
   const _ = [];
@@ -46701,7 +46815,7 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                              Never archives .himi/, .env*, node_modules/, dist/ or key
                                              material, and REFUSES the push if a file it would archive
                                              looks like it holds a credential.
-  himi pull <app> [--release <id>] [--out <dir>] [--name <new>] [--force] [--target <t>]
+  himi pull <app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]
                                            restore an app's SOURCE from the serve plane into an editable
                                            content package \u2014 the other half of push, which archives it.
                                            Owner or editor only: a viewer may download the running app,
@@ -46709,6 +46823,14 @@ var USAGE = `himi \u2014 the Himalaya authoring CLI (remote dev loop)
                                            retention window prune() keeps (current + newest ~20).
                                            --name re-substitutes the app identity, so the restored tree is
                                            a NEW app rather than a second copy of the same one.
+                                           A non-empty destination is refused unless you say which you mean:
+                                           --force MERGES \u2014 it keeps files the release does not have and
+                                             NAMES them (left: [...]), so a hybrid tree is never silent.
+                                           --replace restores exactly what was archived: it removes those
+                                             files first (removed: [...]) and implies --force. It refuses
+                                             a directory with no himalaya.content.json, and can only remove
+                                             what a push would have archived \u2014 .git/, node_modules/, dist/,
+                                             .env* and key material are never touched.
   himi pack [--content <dir>] [--out <file|dir>] [--format zip|dir] [--name <title>] [--snapshot]
                                            write the app as a PORTABLE .himi package \u2014 one self-contained
                                            file (screens, T5 bundles, tokens, assets, app-config) you can
@@ -46956,7 +47078,7 @@ var COMMANDS = [
   { name: "doctor", summary: 'off-VPN preflight in one shot: probe the PUBLIC data plane (www.wixapis.com \u2014 reachable off-VPN), the INTERNAL serve/control plane for the selected target (VPN-gated), and report auth state (dpx session on disk + stored control token). --dpx additionally runs a live, EADDRINUSE-safe `dpx whoami`. Machine-readable with --json (an unreachable internal plane carries a stable code:"needs_vpn" so an agent branches on the code, not the prose); human-readable otherwise. Never loads the authoring runtime \u2014 works off-repo.', required: "[--target <t>] [--dpx] [--json] [--data-url <url>] [--timeout <ms>]" },
   { name: "push", summary: "lint + build + publish a release (default --draft: servable via ?release= but NOT live). REFUSES to publish on any error unless --force; --strict promotes warnings. Prints preview + agent-context links. The published slug is NAMESPACED per owner \u2014 `<ownerPrefix>.<name>`, composed offline from the control token's ownerPrefix claim, so the CLI and the server derive the identical string and himalaya.content.json is NOT rewritten (a legacy token with no ownerPrefix publishes the declared name unchanged). An app claimed BEFORE namespacing is stored under its FLAT slug, so the claim route answers `alreadyYours` naming that slug and the push adopts it \u2014 reported as `adoptedSlug`, since it is the one case where the published `app` differs from what the declared name composes to. `--no-claim` skips the route that knows this, so a pre-namespacing app pushed with it still fails 403. --visibility public|unlisted decides whether /v1/apps + the Himi Player picker LIST the app (also declarable as `visibility` in himalaya.content.json; omitted, a brand-new app defaults to unlisted \u2014 share by link \u2014 and an existing setting is kept). --account-id names which account owns the app when your Wix session resolves to several (the auto-claim of a brand-new slug cannot guess \u2014 without it a multi-account caller is told to name one).", required: "[--content <dir>] [--draft] [--force] [--strict] [--label] [--notes] [--visibility public|unlisted] [--no-claim] [--account-id <id>] (--control-token)" },
   { name: "pack", summary: "write the app as a PORTABLE .himi package \u2014 one self-contained file holding every screen, Tier-5 bundle, token, asset and the app-config. Packages are live by default: they boot bundled content offline, then Himi Player follows its baked-in production ring. `--snapshot` makes a frozen reproducible artifact. Package-supplied origins are never trusted. --format dir writes the same tree unpacked, for static hosting. --release-dir packs a release that is already built on disk (needs --app) instead of rebuilding from source.", required: "[--content <dir>] [--out <file|dir>] [--format zip|dir] [--name <title>] [--snapshot] [--strict] [--force] | --release-dir <dir> --app <a>" },
-  { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force] [--target <t>]" },
+  { name: "pull", summary: "restore an app's SOURCE from the serve plane into an editable content package \u2014 the other half of `himi push`, which archives the content package on every publish. Owner or editor only: a viewer may download the RUNNING app (`/v1/owner/package`), not the codebase it was built from. A PAST release is restorable, not only the live one \u2014 the archive is content-addressed per release, so it has none of the live-single-slot problem that makes `himi pack` current-release-only. Two limits: pruning keeps the current release plus the newest ~20 ledger entries, and a release id identifies OTA content rather than source, so a source-only change republishes under the same id and replaces that id's archive. A release published before source archiving shipped, or pushed with `--no-source`, answers `app_source_not_found` and says to push again. `--name` re-substitutes the app identity through the same machinery `himi init --template` uses, so the restored tree is a NEW app rather than a second copy of the same one, and a name that also appears inside a screen id (`feed` in `feed_home`) is left alone. A NON-EMPTY destination is refused unless you say which you mean: `--force` merges and reports \u2014 it writes the archive over what is there, keeps files the release does not carry, and NAMES every one of them as `left: [...]` so a tree that matches no release is never silent (#2437); `--replace` restores exactly what was archived, removing those files first (`removed: [...]`) and implying `--force`. `--replace` refuses a directory holding no `himalaya.content.json`, so a mistyped `--out` cannot clear an unrelated tree, and the only paths it can remove are the ones a push would have archived \u2014 `.git/`, `node_modules/`, `dist/`, `.env*` and key material are out of its reach by construction.", required: "<app> [--release <id>] [--out <dir>] [--name <new>] [--force|--replace] [--target <t>]" },
   { name: "share", summary: "publish or revoke a content-addressed `.himi` share link. The package must be a validated archive for an already-published release; the resulting https URL is safe to QR, copy, or open in Himi Player.", required: "--file <package.himi> [--expires-at <ISO>] | revoke --app <app> <shareId>" },
   { name: "run", summary: "serve a .himi package on localhost and open it in a browser \u2014 no serve plane, no dev-server, no setup. Given no argument it builds the current content package first, so `himi run` is the inner loop: edit, run, look at it. The SPA and /v1 are served from ONE origin because Tier-5 bundle fetches on web are same-origin-only. --chrome preview frames the app in a device chassis; --chrome app serves it as a plain web app. Blocks until Ctrl-C, like any dev server. --browser runs the whole plane INSIDE the tab (service worker + in-memory store) so no app code executes in this process or on any pod.", required: "[<package.himi|dir|url>] [--browser] [--content <dir>] [--port <n>] [--chrome preview|app] [--screen <id>] [--surface <id>] [--no-open] [--spa <url>]" },
   { name: "preview", summary: "print the shareable web URL + himi:// deep link + agent /v1/preview JSON URLs for an app+release; --surface frames the web preview as any catalog surface (?surface=)", required: "--app --release [--screen] [--surface]" },
@@ -47010,11 +47132,11 @@ function packageVersion(path) {
   }
 }
 function resolvedSdkVersion(fromDir = process.cwd(), bundledManifest = new URL("./authoring-runtime/node_modules/@wix/himalaya/package.json", import.meta.url)) {
-  let dir = resolve39(fromDir);
+  let dir = resolve40(fromDir);
   for (; ; ) {
     const version = packageVersion(join49(dir, "node_modules", "@wix", "himalaya", "package.json"));
     if (version) return { version, source: "local" };
-    const parent = dirname29(dir);
+    const parent = dirname28(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -47383,7 +47505,7 @@ async function nativeConfigAdvisories(app, configSource) {
     const { iosProjectYml: iosProjectYml2 } = await Promise.resolve().then(() => (init_paths(), paths_exports));
     const { androidOptedIn: androidOptedIn3, LABEL_IOS_SPLASH: LABEL_IOS_SPLASH2 } = await Promise.resolve().then(() => (init_splash(), splash_exports));
     const iosYmlPath = iosProjectYml2(app);
-    const iosYml = existsSync50(iosYmlPath) ? readFileSync63(iosYmlPath, "utf8") : "";
+    const iosYml = existsSync51(iosYmlPath) ? readFileSync63(iosYmlPath, "utf8") : "";
     let optedIn = iosYml.includes(LABEL_IOS_SPLASH2);
     if (!optedIn) {
       const { androidManifestPath: androidManifestPath3 } = await Promise.resolve().then(() => (init_gen_native_config(), gen_native_config_exports));
@@ -47403,13 +47525,13 @@ function readConfigSource(dir) {
   }
 }
 function writePngFile(path, base64) {
-  mkdirSync25(dirname29(path), { recursive: true });
+  mkdirSync25(dirname28(path), { recursive: true });
   writeFileSync23(path, Buffer.from(base64, "base64"));
   return path;
 }
 async function initFromRemoteTemplate(name, parentDir, template, c) {
-  const dir = resolve39(parentDir, name);
-  if (existsSync50(join49(dir, "himalaya.content.json"))) {
+  const dir = resolve40(parentDir, name);
+  if (existsSync51(join49(dir, "himalaya.content.json"))) {
     throw new Error(`content package already exists at ${dir}`);
   }
   const r = await c.fetchTemplateSource(TEMPLATE_APP_PREFIX + template);
@@ -47421,13 +47543,13 @@ async function initFromRemoteTemplate(name, parentDir, template, c) {
   return finishScaffold(materializeSource(archive.files, name, dir), template);
 }
 function contentDir(flags) {
-  return resolve39(str5(flags.content) ?? process.cwd());
+  return resolve40(str5(flags.content) ?? process.cwd());
 }
 function isHimalayaMonorepoCheckout(start) {
-  let dir = resolve39(start);
+  let dir = resolve40(start);
   for (; ; ) {
-    if (existsSync50(join49(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync50(join49(dir, "core", "serve", "src", "server.ts"))) return true;
-    const parent = dirname29(dir);
+    if (existsSync51(join49(dir, "tools", "himi-cli", "src", "cli.ts")) && existsSync51(join49(dir, "core", "serve", "src", "server.ts"))) return true;
+    const parent = dirname28(dir);
     if (parent === dir) return false;
     dir = parent;
   }
@@ -47456,9 +47578,9 @@ function materializeForPreview(appDir2, slug, displayName) {
   const forBuild = Object.fromEntries(
     Object.entries(files).map(([rel, body]) => [rel, rel === "himalaya.content.json" ? substituteIdentity(body, slug) : body])
   );
-  const repoRoot2 = resolve39(fileURLToPath21(new URL("../../..", import.meta.url)));
+  const repoRoot2 = resolve40(fileURLToPath21(new URL("../../..", import.meta.url)));
   const dest = join49(repoRoot2, "node_modules", ".cache", "himi-template-preview", slug);
-  rmSync8(dest, { recursive: true, force: true });
+  rmSync9(dest, { recursive: true, force: true });
   mkdirSync25(dest, { recursive: true });
   materializeSource(forBuild, displayName, dest, slug);
   return dest;
@@ -47676,7 +47798,7 @@ Seed your coding agent with \`himi agent-init\`. Portal: ${idx.portalUrl}`);
       return 0;
     }
     case "agent-init": {
-      const dir = resolve39(str5(flags.dir) ?? process.cwd());
+      const dir = resolve40(str5(flags.dir) ?? process.cwd());
       const res = writeAgentContext(dir);
       print({ ok: true, dir: res.dir, files: res.files, portalUrl: idx.portalUrl });
       return 0;
@@ -47782,7 +47904,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 2;
         }
         const template = str5(flags.template);
-        const parentDir = resolve39(str5(flags.dir) ?? process.cwd());
+        const parentDir = resolve40(str5(flags.dir) ?? process.cwd());
         if (template && flags.remote === true) {
           try {
             const res2 = await initFromRemoteTemplate(name, parentDir, template, client3());
@@ -47873,8 +47995,8 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
           return 0;
         }
         if (sub === "publish") {
-          const appDir2 = resolve39(str5(flags.dir) ?? process.cwd());
-          const sourceDir = resolve39(str5(flags["source-dir"]) ?? appDir2);
+          const appDir2 = resolve40(str5(flags.dir) ?? process.cwd());
+          const sourceDir = resolve40(str5(flags["source-dir"]) ?? appDir2);
           let meta;
           try {
             meta = JSON.parse(readFileSync63(join49(sourceDir, TEMPLATE_META_FILE), "utf8"));
@@ -47928,7 +48050,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
             }));
             return 1;
           }
-          const iconPath = str5(flags.icon) ? resolve39(str5(flags.icon)) : templateIconPath(name);
+          const iconPath = str5(flags.icon) ? resolve40(str5(flags.icon)) : templateIconPath(name);
           let iconHash;
           if (iconPath) {
             try {
@@ -48246,7 +48368,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
       case "test": {
         const dir = contentDir(flags);
         const structuredOutput = flags.json === true || io.isTTY !== true;
-        if (existsSync50(join49(dir, "functions"))) {
+        if (existsSync51(join49(dir, "functions"))) {
           const { invokeLocalFunction: invokeLocalFunction2, loadFunctionsApp: loadFunctionsApp2 } = await Promise.resolve().then(() => (init_functions(), functions_exports));
           const loaded = await loadFunctionsApp2(dir);
           const results = [];
@@ -48545,7 +48667,7 @@ himi v${cliVersion()} \u2014 run \`himi --version\`. If authoring commands fail
                 renderDescriptorWeb: renderDescriptorWeb2,
                 renderPngBatch: renderPngBatch2,
                 writePng: (path, base64) => writePngFile(path, base64),
-                clearDir: (d) => rmSync8(d, { recursive: true, force: true })
+                clearDir: (d) => rmSync9(d, { recursive: true, force: true })
               }
             });
             writtenShots = sp.written;
@@ -49034,8 +49156,10 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           return 2;
         }
         const renamed = str5(flags.name);
-        const dest = resolve39(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
-        if (existsSync50(dest)) {
+        const dest = resolve40(str5(flags.out) ?? process.cwd(), renamed ?? wanted);
+        const replace = flags.replace === true;
+        const force = replace || flags.force === true;
+        if (existsSync51(dest)) {
           if (!statSync13(dest).isDirectory()) {
             io.error(JSON.stringify({
               error: `${dest} exists and is not a directory`,
@@ -49043,8 +49167,16 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             }));
             return 1;
           }
-          if (readdirSync23(dest).length > 0 && flags.force !== true) {
-            io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway, or --out/--name to land somewhere else" }));
+          const occupied = readdirSync23(dest).length > 0;
+          if (occupied && !force) {
+            io.error(JSON.stringify({ error: `${dest} already exists and is not empty`, hint: "pass --force to write into it anyway (merging, and naming what it keeps), --replace to restore exactly what was archived, or --out/--name to land somewhere else" }));
+            return 1;
+          }
+          if (replace && occupied && !existsSync51(join49(dest, "himalaya.content.json"))) {
+            io.error(JSON.stringify({
+              error: `${dest} is not a content package \u2014 refusing to --replace it`,
+              hint: "--replace only clears a directory that holds himalaya.content.json. Check --out/--name, or pass --force to merge into it instead."
+            }));
             return 1;
           }
         }
@@ -49053,7 +49185,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ ok: false, app: wanted, status: pulled.status, ...pulled.json ?? {} }));
           return 1;
         }
-        const { readAppSource: readAppSource2, writeAppSource: writeAppSource2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
+        const { readAppSource: readAppSource2, writeAppSource: writeAppSource2, staleSourcePaths: staleSourcePaths2, removeStaleSource: removeStaleSource2, deniedArchivePaths: deniedArchivePaths2, writeConflicts: writeConflicts2 } = await Promise.resolve().then(() => (init_app_source(), app_source_exports));
         let restored;
         try {
           restored = readAppSource2(pulled.bytes);
@@ -49080,6 +49212,31 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             if (body !== void 0) entry.bytes = Buffer.from(substituteIdentity(body, renamed), "utf8");
           }
         }
+        if (restored.length === 0) {
+          io.error(JSON.stringify({
+            ok: false,
+            app: wanted,
+            error: "app_source_empty",
+            hint: "the plane returned an archive with no entries \u2014 nothing was changed. Re-push the app, then pull again"
+          }));
+          return 1;
+        }
+        const conflicts = writeConflicts2(restored, dest);
+        if (conflicts.length) {
+          io.error(JSON.stringify({
+            ok: false,
+            app: wanted,
+            error: "destination_shape_conflicts",
+            conflicts,
+            hint: "nothing was changed \u2014 remove or rename those paths, or pass --out/--name to land somewhere else"
+          }));
+          return 1;
+        }
+        let left = [];
+        let removed = [];
+        if (replace) removed = removeStaleSource2(restored, dest);
+        else left = staleSourcePaths2(restored, dest);
+        const refused = deniedArchivePaths2(restored);
         const written = writeAppSource2(restored, dest);
         print({
           ok: true,
@@ -49087,6 +49244,18 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           dir: dest,
           files: written.length,
           ...renamed ? { renamedTo: renamed } : {},
+          ...removed.length ? { removed } : {},
+          ...refused.length ? {
+            refused,
+            refusedNote: "this archive carries paths a restore will not write (the deny-list has grown since it was published) \u2014 they were skipped, not written over"
+          } : {},
+          // EVERY path, not a count and not a sample: the whole failure was that a hybrid tree
+          // looked like a restore, and a list you have to go and generate yourself is the same
+          // silence with extra steps.
+          ...left.length ? {
+            left,
+            warning: `${left.length} file(s) already in ${dest} are not in this release and were KEPT \u2014 this tree is a merge of both, and matches no release. Remove them, or re-run with --replace.`
+          } : {},
           next: `cd ${dest} && himi validate`
         });
         return 0;
@@ -49376,7 +49545,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
             return 2;
           }
           try {
-            const res = writePack(resolve39(releaseDir), only, resolve39(str5(flags.out) ?? process.cwd()));
+            const res = writePack(resolve40(releaseDir), only, resolve40(str5(flags.out) ?? process.cwd()));
             print({
               ok: true,
               app: res.app,
@@ -49414,12 +49583,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           ...fontIssues(dir, strict)
         ]);
         if (hasErrors && !force) {
-          rmSync8(built, { recursive: true, force: true });
+          rmSync9(built, { recursive: true, force: true });
           print({ ...report, packed: false, hint: "lint found errors \u2014 fix them, or re-run `himi pack --force` to pack anyway" });
           return 1;
         }
         try {
-          const res = writePack(built, app, resolve39(str5(flags.out) ?? dir));
+          const res = writePack(built, app, resolve40(str5(flags.out) ?? dir));
           print({
             ok: true,
             app: res.app,
@@ -49444,7 +49613,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          rmSync8(built, { recursive: true, force: true });
+          rmSync9(built, { recursive: true, force: true });
         }
       }
       // ---- himi share — publish/revoke a content-addressed package link ----
@@ -49472,12 +49641,12 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         }
         try {
           const { openPackageFile: openPackageFile2 } = await Promise.resolve().then(() => (init_pack(), pack_exports));
-          const opened = openPackageFile2(resolve39(file));
+          const opened = openPackageFile2(resolve40(file));
           if (!opened.validation.ok || !opened.header) {
             io.error(JSON.stringify({ error: "refusing to share an invalid package", issues: opened.validation.errors }));
             return 1;
           }
-          const archive = readFileSync63(resolve39(file));
+          const archive = readFileSync63(resolve40(file));
           const result = await client3().createPackageShare({
             app: opened.header.app,
             releaseId: opened.header.releaseId,
@@ -49542,9 +49711,9 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               open: flags["no-open"] !== true
             });
             print({ ok: true, app: run2.app, url: run2.url, port: run2.port, plane: "browser" });
-            await new Promise((resolve40) => {
+            await new Promise((resolve41) => {
               const stop = () => {
-                void run2.close().finally(() => resolve40());
+                void run2.close().finally(() => resolve41());
               };
               process.once("SIGINT", stop);
               process.once("SIGTERM", stop);
@@ -49580,7 +49749,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
-          if (temp) rmSync8(temp, { recursive: true, force: true });
+          if (temp) rmSync9(temp, { recursive: true, force: true });
         }
       }
       case "preview": {
@@ -50315,7 +50484,7 @@ ${label2}`);
         const platform = str5(flags.platform)?.split(",").map((p) => p.trim()).filter(Boolean);
         {
           const distDir = contentDir(flags);
-          if (existsSync50(join49(distDir, "himalaya.content.json"))) {
+          if (existsSync51(join49(distDir, "himalaya.content.json"))) {
             const issues = await iconIssues(distDir, flags.strict === true, { requireDeclared: true, requireVerified: true });
             const errors = issues.filter((i) => i.severity === "error");
             for (const i of issues.filter((i2) => i2.severity === "warning")) {